Change use of xfree to krb5_xfree to prevent namespace pollution

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@2670 dc483132-0cff-0310-8789-dd5450dbe970

156 files changed, 411 insertions, 411 deletions

diff --git a/src/lib/crypto/des/fin_rndkey.c b/src/lib/crypto/des/fin_rndkey.c
index 11d37751a3..14758851eb 100644
--- a/src/lib/crypto/des/fin_rndkey.c
+++ b/src/lib/crypto/des/fin_rndkey.c
@@ -41,7 +41,7 @@ krb5_error_code mit_des_finish_random_key (DECLARG(krb5_pointer *, seed))
 OLDDECLARG(krb5_pointer *, seed)
 {
     memset((char *)*seed, 0, sizeof(mit_des_random_key_seed) );
-    xfree(*seed);
+    krb5_xfree(*seed);
     *seed = 0;
     return 0;
 }
diff --git a/src/lib/crypto/des/new_rn_key.c b/src/lib/crypto/des/new_rn_key.c
index 681a799d6b..2d34df19d9 100644
--- a/src/lib/crypto/des/new_rn_key.c
+++ b/src/lib/crypto/des/new_rn_key.c
@@ -111,10 +111,10 @@ void mit_des_init_random_number_generator(key,p_seed)
 	   libraries */
 	register krb5_address **addr2;
 	for (addr2 = addrs; *addr2; addr2++) {
-	    xfree((*addr2)->contents);
-	    xfree(*addr2);
+	    krb5_xfree((*addr2)->contents);
+	    krb5_xfree(*addr2);
 	}
-	xfree(addrs);
+	krb5_xfree(addrs);
     }
     /*
      * Generate a tempory value that depends on the key and host_id
diff --git a/src/lib/crypto/des/random_key.c b/src/lib/crypto/des/random_key.c
index 8c835dbb42..2c2f277451 100644
--- a/src/lib/crypto/des/random_key.c
+++ b/src/lib/crypto/des/random_key.c
@@ -48,7 +48,7 @@ OLDDECLARG(krb5_keyblock **, keyblock)
     if (!(randkey = (krb5_keyblock *)malloc(sizeof(*randkey))))
 	return ENOMEM;
     if (!(randkey->contents = (krb5_octet *)malloc(sizeof(mit_des_cblock)))) {
-	xfree(randkey);
+	krb5_xfree(randkey);
 	return ENOMEM;
     }
     randkey->length = sizeof(mit_des_cblock);
diff --git a/src/lib/crypto/des/string2key.c b/src/lib/crypto/des/string2key.c
index e19b1f5ae8..ce3bdba232 100644
--- a/src/lib/crypto/des/string2key.c
+++ b/src/lib/crypto/des/string2key.c
@@ -162,7 +162,7 @@ OLDDECLARG(const krb5_data *, salt)
 
     /* clean & free the input string */
     memset(copystr, 0, length);
-    xfree(copystr);
+    krb5_xfree(copystr);
 
     /* now fix up key parity again */
     mit_des_fixup_key_parity(key);
diff --git a/src/lib/des425/string2key.c b/src/lib/des425/string2key.c
index 048e0f9322..9698e7f5b3 100644
--- a/src/lib/des425/string2key.c
+++ b/src/lib/des425/string2key.c
@@ -88,7 +88,7 @@ OLDDECLARG(krb5_const_principal, princ)
 	return(ENOMEM);
 
 #define cleanup() {memset(keyblock->contents, 0, sizeof(mit_des_cblock));\
-		       xfree(keyblock->contents);}
+		       krb5_xfree(keyblock->contents);}
 
     keyblock->keytype = KEYTYPE_DES;
     keyblock->length = sizeof(mit_des_cblock);
diff --git a/src/lib/gssapi/acc_sec.c b/src/lib/gssapi/acc_sec.c
index 135d17e2df..d0cc43c196 100644
--- a/src/lib/gssapi/acc_sec.c
+++ b/src/lib/gssapi/acc_sec.c
@@ -149,7 +149,7 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 		context->my_address.length = channel->initiator_address.length;
 		if (!(context->my_address.contents = (krb5_octet *)
 		      malloc(context->my_address.length))) {
-			xfree(context);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		memcpy((char *) context->my_address.contents,
@@ -159,8 +159,8 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 		context->his_address.length = channel->acceptor_address.length;
 		if (!(context->his_address.contents = (krb5_octet *)
 		      malloc(context->my_address.length))) {
-			xfree(context->my_address.contents);
-			xfree(context);
+			krb5_xfree(context->my_address.contents);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		memcpy((char *) context->his_address.contents,
@@ -179,9 +179,9 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 			if (*minor_status =
 			    krb5_generate_seq_number(authdat->ticket->enc_part2->session,
 						     &context->my_seq_num)) {
-				xfree(context->his_address.contents);
-				xfree(context->my_address.contents);
-				xfree(context);
+				krb5_xfree(context->his_address.contents);
+				krb5_xfree(context->my_address.contents);
+				krb5_xfree(context);
 				krb5_free_tkt_authent(authdat);
 				return(GSS_S_FAILURE);
 			}
@@ -195,9 +195,9 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 			    krb5_mk_rep(&repl,
 					authdat->ticket->enc_part2->session,
 					&outbuf)) {
-				xfree(context->his_address.contents);
-				xfree(context->my_address.contents);
-				xfree(context);
+				krb5_xfree(context->his_address.contents);
+				krb5_xfree(context->my_address.contents);
+				krb5_xfree(context);
 				krb5_free_tkt_authent(authdat);
 				return(GSS_S_FAILURE);
 			}
@@ -207,10 +207,10 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 							   outbuf.length,
 							   outbuf.data,
 							   output_token)) {
-				xfree(context->his_address.contents);
-				xfree(context->my_address.contents);
-				xfree(context);
-				xfree(outbuf.data);
+				krb5_xfree(context->his_address.contents);
+				krb5_xfree(context->my_address.contents);
+				krb5_xfree(context);
+				krb5_xfree(outbuf.data);
 				krb5_free_tkt_authent(authdat);
 				return(GSS_S_FAILURE);
 			}
@@ -222,18 +222,18 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 		if (*minor_status =
 		    krb5_copy_principal(verifier_cred_handle.principal,
 					&context->me)) {
-			xfree(context->his_address.contents);
-			xfree(context->my_address.contents);
-			xfree(context);
+			krb5_xfree(context->his_address.contents);
+			krb5_xfree(context->my_address.contents);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		if (*minor_status =
 		    krb5_copy_principal(authdat->authenticator->client,
 					&context->him)) {
 			krb5_free_principal(context->me);
-			xfree(context->his_address.contents);
-			xfree(context->my_address.contents);
-			xfree(context);
+			krb5_xfree(context->his_address.contents);
+			krb5_xfree(context->my_address.contents);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		if (*minor_status =
@@ -241,9 +241,9 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 				       &context->session_key)) {
 			krb5_free_principal(context->me);
 			krb5_free_principal(context->him);
-			xfree(context->his_address.contents);
-			xfree(context->my_address.contents);
-			xfree(context);
+			krb5_xfree(context->his_address.contents);
+			krb5_xfree(context->my_address.contents);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		context->his_seq_num = authdat->authenticator->seq_number;
@@ -260,12 +260,12 @@ OM_uint32 gss_accept_sec_context(minor_status, context_handle,
 		if (src_name) {
 			if (*minor_status = krb5_copy_principal(context->him,
 								src_name)) {
-				xfree(context->session_key->contents);
+				krb5_xfree(context->session_key->contents);
 				krb5_free_principal(context->me);
 				krb5_free_principal(context->him);
-				xfree(context->his_address.contents);
-				xfree(context->my_address.contents);
-				xfree(context);
+				krb5_xfree(context->his_address.contents);
+				krb5_xfree(context->my_address.contents);
+				krb5_xfree(context);
 				return(GSS_S_FAILURE);
 			}
 		}
diff --git a/src/lib/gssapi/init_sec.c b/src/lib/gssapi/init_sec.c
index 8078ae1d3b..87f48d8325 100644
--- a/src/lib/gssapi/init_sec.c
+++ b/src/lib/gssapi/init_sec.c
@@ -149,7 +149,7 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 		context->my_address.length = channel->initiator_address.length;
 		if (!(context->my_address.contents = (krb5_octet *)
 		      malloc(context->my_address.length))) {
-			xfree(context);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		memcpy((char *) context->my_address.contents,
@@ -159,8 +159,8 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 		context->his_address.length = channel->acceptor_address.length;
 		if (!(context->his_address.contents = (krb5_octet *)
 		      malloc(context->my_address.length))) {
-			xfree(context->my_address.contents);
-			xfree(context);
+			krb5_xfree(context->my_address.contents);
+			krb5_xfree(context);
 			return(GSS_S_FAILURE);
 		}
 		memcpy((char *) context->his_address.contents,
@@ -172,8 +172,8 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 		if (*minor_status =
 		    krb5_generate_seq_number(&creds.keyblock,
 					     &context->my_seq_num)) {
-			xfree(context->his_address.contents);
-			xfree(context->my_address.contents);
+			krb5_xfree(context->his_address.contents);
+			krb5_xfree(context->my_address.contents);
 			free((char *)context);
 			return(GSS_S_FAILURE);
 		}
@@ -222,7 +222,7 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 		if (*minor_status =
 		    krb5_copy_keyblock(&creds.keyblock,
 				       &context->session_key)) {
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			krb5_free_cred_contents(&creds);
 			free((char *)context);
 			return(GSS_S_FAILURE);
@@ -234,7 +234,7 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 						   outbuf.length,
 						   outbuf.data,
 						   output_token)) {
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			krb5_free_cred_contents(&creds);
 			free((char *) context);
 			return(GSS_S_FAILURE);
@@ -243,7 +243,7 @@ OM_uint32 gss_init_sec_context(minor_status, claimant_cred_handle,
 		 * Send over the requested flags information
 		 */
 		((char *) output_token->value)[4] = context->flags;
-		xfree(outbuf.data);
+		krb5_xfree(outbuf.data);
 		*context_handle = context;
  		context->state = GSS_KRB_STATE_DOWN;
 		*ret_flags = context->flags;
diff --git a/src/lib/gssapi/rel_cred.c b/src/lib/gssapi/rel_cred.c
index 54a3761ee4..af9a758e41 100644
--- a/src/lib/gssapi/rel_cred.c
+++ b/src/lib/gssapi/rel_cred.c
@@ -36,7 +36,7 @@ OM_uint32 gss_release_cred(minor_status, cred_handle)
 	krb5_free_principal(cred_handle->principal);
 	if (*minor_status = krb5_cc_close(cred_handle->ccache))
 		return(GSS_S_FAILURE);
-	xfree(cred_handle->srvtab.contents);
+	krb5_xfree(cred_handle->srvtab.contents);
 	return(GSS_S_COMPLETE);
 }
 	
diff --git a/src/lib/gssapi/seal.c b/src/lib/gssapi/seal.c
index 24fd65c4f3..4d90656715 100644
--- a/src/lib/gssapi/seal.c
+++ b/src/lib/gssapi/seal.c
@@ -78,7 +78,7 @@ OM_uint32 gss_seal(minor_status, context, conf_req_flag, qop_req,
 						   outbuf.length,
 						   outbuf.data,
 						   output_message_buffer)) {
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			return(GSS_S_FAILURE);
 		}
 		if (conf_state)
@@ -107,7 +107,7 @@ OM_uint32 gss_seal(minor_status, context, conf_req_flag, qop_req,
 						   outbuf.length,
 						   outbuf.data,
 						   output_message_buffer)) {
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			return(GSS_S_FAILURE);
 		}
 		if (conf_state)
diff --git a/src/lib/gssapi/sign.c b/src/lib/gssapi/sign.c
index 39bd193886..62c264276e 100644
--- a/src/lib/gssapi/sign.c
+++ b/src/lib/gssapi/sign.c
@@ -63,7 +63,7 @@ OM_uint32 gss_sign(minor_status, context, qop_req,
 	if (*minor_status = decode_krb5_safe(&outbuf, &message))
 		return(GSS_S_FAILURE);
 	message->user_data.length = 1;
-	xfree(outbuf.data);
+	krb5_xfree(outbuf.data);
 	if (*minor_status = encode_krb5_safe(&message, &scratch)) {
 		krb5_free_safe(message);
 		return(GSS_S_FAILURE);
diff --git a/src/lib/gssapi/verify.c b/src/lib/gssapi/verify.c
index b93b2b0be4..25cc14f5b2 100644
--- a/src/lib/gssapi/verify.c
+++ b/src/lib/gssapi/verify.c
@@ -53,7 +53,7 @@ OM_uint32 gss_verify(minor_status, context, message_buffer,
 	if (*minor_status = decode_krb5_safe(&inbuf, &message))
 		return(GSS_S_FAILURE);
 	if (message->user_data.data)
-		xfree(message->user_data.data);
+		krb5_xfree(message->user_data.data);
 	message->user_data.length = message_buffer->length;
 	message->user_data.data = message_buffer->value;
 	if (*minor_status = encode_krb5_safe(&message,  &scratch)) {
diff --git a/src/lib/kdb/decrypt_key.c b/src/lib/kdb/decrypt_key.c
index a16630f793..89a79ab2eb 100644
--- a/src/lib/kdb/decrypt_key.c
+++ b/src/lib/kdb/decrypt_key.c
@@ -73,13 +73,13 @@ krb5_keyblock *out;
     if (retval = krb5_decrypt((krb5_pointer) ((char *) in->contents + 4),
 			      (krb5_pointer) out->contents,
 			      in->length-sizeof(in->length), eblock, 0)) {
-	xfree(out->contents);
+	krb5_xfree(out->contents);
 	out->contents = 0;
 	out->length = 0;
 	return retval;
     }
     if (out->length < 0) {
-	xfree(out->contents);
+	krb5_xfree(out->contents);
 	out->contents = 0;
 	out->length = 0;
 	return KRB5_KDB_INVALIDKEYSIZE;
diff --git a/src/lib/kdb/encrypt_key.c b/src/lib/kdb/encrypt_key.c
index 05feeb1c99..1c3606de23 100644
--- a/src/lib/kdb/encrypt_key.c
+++ b/src/lib/kdb/encrypt_key.c
@@ -70,7 +70,7 @@ register krb5_encrypted_keyblock *out;
     out->length += sizeof(out->length);
     out->contents = (krb5_octet *)malloc(out->length);
     if (!out->contents) {
-	xfree(tmpin.contents);
+	krb5_xfree(tmpin.contents);
 	out->contents = 0;
 	out->length = 0;
 	return ENOMEM;
@@ -85,9 +85,9 @@ register krb5_encrypted_keyblock *out;
     retval = krb5_encrypt((krb5_pointer) tmpin.contents,
 			  (krb5_pointer) ((char *) out->contents + 4),
 			  tmpin.length, eblock, 0);
-    xfree(tmpin.contents);
+    krb5_xfree(tmpin.contents);
     if (retval) {
-	xfree(out->contents);
+	krb5_xfree(out->contents);
 	out->contents = 0;
 	out->length = 0;
     }
diff --git a/src/lib/kdb/fetch_mkey.c b/src/lib/kdb/fetch_mkey.c
index 38f79f9e1e..98dcac7a41 100644
--- a/src/lib/kdb/fetch_mkey.c
+++ b/src/lib/kdb/fetch_mkey.c
@@ -101,7 +101,7 @@ OLDDECLARG(krb5_keyblock *,key)
 	retval = krb5_string_to_key(eblock, key->keytype, key, &pwd,
 				    salt ? salt : &scratch);
 	if (!salt)
-		xfree(scratch.data);
+		krb5_xfree(scratch.data);
 	memset(password, 0, sizeof(password)); /* erase it */
 	return retval;
 
diff --git a/src/lib/kdb/kdb_dbm.c b/src/lib/kdb/kdb_dbm.c
index 145ed1d75e..43aa3e4d79 100644
--- a/src/lib/kdb/kdb_dbm.c
+++ b/src/lib/kdb/kdb_dbm.c
@@ -752,17 +752,17 @@ krb5_db_entry *entry;
     /* erase the key */
     if (entry->key.contents) {
 	memset((char *)entry->key.contents, 0, entry->key.length);
-	xfree(entry->key.contents);
+	krb5_xfree(entry->key.contents);
     }
     if (entry->salt)
-	xfree(entry->salt);
+	krb5_xfree(entry->salt);
     
     if (entry->alt_key.contents) {
 	memset((char *)entry->alt_key.contents, 0, entry->alt_key.length);
-	xfree(entry->alt_key.contents);
+	krb5_xfree(entry->alt_key.contents);
     }
     if (entry->alt_salt)
-	xfree(entry->alt_salt);
+	krb5_xfree(entry->alt_salt);
     
     if (entry->principal)
 	krb5_free_principal(entry->principal);
diff --git a/src/lib/kdb/verify_mky.c b/src/lib/kdb/verify_mky.c
index 503abdae2e..a5617fe7ab 100644
--- a/src/lib/kdb/verify_mky.c
+++ b/src/lib/kdb/verify_mky.c
@@ -84,7 +84,7 @@ krb5_encrypt_block *eblock;
 	retval = krb5_finish_key(eblock);
 
     memset((char *)tempkey.contents, 0, tempkey.length);
-    xfree(tempkey.contents);
+    krb5_xfree(tempkey.contents);
     krb5_db_free_principal(&master_entry, nprinc);
     
     return retval;
diff --git a/src/lib/krb425/mk_priv.c b/src/lib/krb425/mk_priv.c
index eeb6742d9b..c572220144 100644
--- a/src/lib/krb425/mk_priv.c
+++ b/src/lib/krb425/mk_priv.c
@@ -101,7 +101,7 @@ struct sockaddr_in *receiver;
 			 0,		/* ignore ivec */
 			 &out5);
 	krb5_rc_close(rcache);
-	xfree(rcache);
+	krb5_xfree(rcache);
 	krb5_free_address(saddr2);
 
 	if (r) {
diff --git a/src/lib/krb425/mk_req.c b/src/lib/krb425/mk_req.c
index 9d1c91b402..85291eabb1 100644
--- a/src/lib/krb425/mk_req.c
+++ b/src/lib/krb425/mk_req.c
@@ -81,12 +81,12 @@ u_long checksum;
 			EPRINT "Return to long (%d > %d)\n",
 				outbuf.length, MAX_KTXT_LEN);
 #endif
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			return(KFAILURE);
 		}
 		authent->length = outbuf.length;
 		memcpy((char *)authent->dat, (char *)outbuf.data, outbuf.length);
-		xfree(outbuf.data);
+		krb5_xfree(outbuf.data);
 	}
 	return(krb425error(r));
 }
diff --git a/src/lib/krb425/mk_safe.c b/src/lib/krb425/mk_safe.c
index 8bde66a9bb..6f753216cd 100644
--- a/src/lib/krb425/mk_safe.c
+++ b/src/lib/krb425/mk_safe.c
@@ -98,7 +98,7 @@ struct sockaddr_in *receiver;
 			 rcache,
 			 &out5);
 	krb5_rc_close(rcache);
-	xfree(rcache);
+	krb5_xfree(rcache);
 	krb5_free_address(saddr2);
 
 	if (r) {
diff --git a/src/lib/krb425/rd_priv.c b/src/lib/krb425/rd_priv.c
index af4e689958..cef751bc77 100644
--- a/src/lib/krb425/rd_priv.c
+++ b/src/lib/krb425/rd_priv.c
@@ -106,7 +106,7 @@ MSG_DAT *msg;
 	r = krb5_rd_priv(&inbuf, &keyb, saddr2, &raddr,
 			 0, 0, 0, rcache, &out);
 	krb5_rc_close(rcache);
-	xfree(rcache);
+	krb5_xfree(rcache);
 
 	krb5_free_address(saddr2);
 
diff --git a/src/lib/krb425/rd_safe.c b/src/lib/krb425/rd_safe.c
index 5ae55e1f70..4f89e9b133 100644
--- a/src/lib/krb425/rd_safe.c
+++ b/src/lib/krb425/rd_safe.c
@@ -105,7 +105,7 @@ MSG_DAT *msg;
 	r = krb5_rd_safe(&inbuf, &keyb, saddr2, &raddr,
 			 0, 0, rcache, &out);
 	krb5_rc_close(rcache);
-	xfree(rcache);
+	krb5_xfree(rcache);
 
 	krb5_free_address(saddr2);
 
diff --git a/src/lib/krb425/set_key.c b/src/lib/krb425/set_key.c
index a40ec35c00..34871a2e3c 100644
--- a/src/lib/krb425/set_key.c
+++ b/src/lib/krb425/set_key.c
@@ -39,7 +39,7 @@ int cvt;
 {
 	if (cvt) {
 		if (_krb425_servkey.contents)
-			xfree(_krb425_servkey.contents);
+			krb5_xfree(_krb425_servkey.contents);
 		mit_des_string_to_key(KEYTYPE_DES, &_krb425_servkey, 0, 0);
 	} else {
 		if (!_krb425_servkey.contents &&
diff --git a/src/lib/krb5/asn.1/adat2kadat.c b/src/lib/krb5/asn.1/adat2kadat.c
index e9172126bf..c2669fd2de 100644
--- a/src/lib/krb5/asn.1/adat2kadat.c
+++ b/src/lib/krb5/asn.1/adat2kadat.c
@@ -63,7 +63,7 @@ register int *error;
     }
     for (i = 0; i < val->nelem; i++) {
 	if (qb_pullup(val->element_KRB5_2[i]->ad__data) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    goto nomem;
 	}
 	retval[i] = (krb5_authdata *) xmalloc(sizeof(*retval[i]));
@@ -73,7 +73,7 @@ register int *error;
 	}
 	retval[i]->contents = (unsigned char *)xmalloc(val->element_KRB5_2[i]->ad__data->qb_forw->qb_len);
 	if (!retval[i]->contents) {
-	    xfree(retval[i]);
+	    krb5_xfree(retval[i]);
 	    retval[i] = 0;
 	    krb5_free_authdata(retval);
 	    goto nomem;
@@ -103,7 +103,7 @@ register int *error;
     }
     for (i = 0, rv = val; rv; rv = rv->next, i++) {
 	if (qb_pullup(rv->element_KRB5_2->ad__data) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    goto nomem;
 	}
 	retval[i] = (krb5_authdata *) xmalloc(sizeof(*retval[i]));
@@ -113,7 +113,7 @@ register int *error;
 	}
 	retval[i]->contents = (unsigned char *)xmalloc(rv->element_KRB5_2->ad__data->qb_forw->qb_len);
 	if (!retval[i]->contents) {
-	    xfree(retval[i]);
+	    krb5_xfree(retval[i]);
 	    retval[i] = 0;
 	    krb5_free_authdata(retval);
 	    goto nomem;
diff --git a/src/lib/krb5/asn.1/addr2kaddr.c b/src/lib/krb5/asn.1/addr2kaddr.c
index f0677d5713..db93c80819 100644
--- a/src/lib/krb5/asn.1/addr2kaddr.c
+++ b/src/lib/krb5/asn.1/addr2kaddr.c
@@ -64,7 +64,7 @@ register int *error;
     }
     for (i = 0; i < val->nelem; i++) {
 	if (qb_pullup(val->element_KRB5_0[i]->address) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    goto nomem;
 	}
 	retval[i] = (krb5_address *) xmalloc(sizeof(*retval[i]));
@@ -74,7 +74,7 @@ register int *error;
 	}
 	retval[i]->contents = (unsigned char *)xmalloc(val->element_KRB5_0[i]->address->qb_forw->qb_len);
 	if (!retval[i]->contents) {
-	    xfree(retval[i]);
+	    krb5_xfree(retval[i]);
 	    retval[i] = 0;
 	    krb5_free_addresses(retval);
 	    goto nomem;
@@ -104,7 +104,7 @@ register int *error;
     }
     for (i = 0, rv = val; rv; rv = rv->next, i++) {
 	if (qb_pullup(rv->element_KRB5_0->address) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    goto nomem;
 	}
 	retval[i] = (krb5_address *) xmalloc(sizeof(*retval[i]));
@@ -114,7 +114,7 @@ register int *error;
 	}
 	retval[i]->contents = (unsigned char *)xmalloc(rv->element_KRB5_0->address->qb_forw->qb_len);
 	if (!retval[i]->contents) {
-	    xfree(retval[i]);
+	    krb5_xfree(retval[i]);
 	    retval[i] = 0;
 	    krb5_free_addresses(retval);
 	    goto nomem;
diff --git a/src/lib/krb5/asn.1/adr2kadr.c b/src/lib/krb5/asn.1/adr2kadr.c
index cbacea7313..16be811106 100644
--- a/src/lib/krb5/asn.1/adr2kadr.c
+++ b/src/lib/krb5/asn.1/adr2kadr.c
@@ -59,12 +59,12 @@ register int *error;
     xbzero(retval, sizeof(*retval));
 
     if (qb_pullup(val->address) != OK) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     retval->contents = (unsigned char *)xmalloc(val->address->qb_forw->qb_len);
     if (!retval->contents) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     retval->addrtype = val->addr__type;
diff --git a/src/lib/krb5/asn.1/aprp2kaprp.c b/src/lib/krb5/asn.1/aprp2kaprp.c
index b42615f379..49bc5b297f 100644
--- a/src/lib/krb5/asn.1/aprp2kaprp.c
+++ b/src/lib/krb5/asn.1/aprp2kaprp.c
@@ -59,9 +59,9 @@ register int *error;
     temp = KRB5_EncryptedData2krb5_enc_data(val->enc__part, error);
     if (temp) {
 	retval->enc_part = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/aprq2kaprq.c b/src/lib/krb5/asn.1/aprq2kaprq.c
index a671372e01..7c587723c0 100644
--- a/src/lib/krb5/asn.1/aprq2kaprq.c
+++ b/src/lib/krb5/asn.1/aprq2kaprq.c
@@ -66,7 +66,7 @@ register int *error;
     temp = KRB5_EncryptedData2krb5_enc_data(val->authenticator, error);
     if (temp) {
 	retval->authenticator = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
 	krb5_free_ap_req(retval);
 	return(0);
diff --git a/src/lib/krb5/asn.1/arep2karep.c b/src/lib/krb5/asn.1/arep2karep.c
index aacad21a90..25a4cfd87a 100644
--- a/src/lib/krb5/asn.1/arep2karep.c
+++ b/src/lib/krb5/asn.1/arep2karep.c
@@ -57,7 +57,7 @@ register int *error;
 
     retval->ctime = gentime2unix(val->ctime, error);
     if (*error) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }	
     retval->cusec = val->cusec;
diff --git a/src/lib/krb5/asn.1/auth2kauth.c b/src/lib/krb5/asn.1/auth2kauth.c
index 5b44441a60..91fa9a2a8b 100644
--- a/src/lib/krb5/asn.1/auth2kauth.c
+++ b/src/lib/krb5/asn.1/auth2kauth.c
@@ -60,7 +60,7 @@ register int *error;
 						       val->crealm,
 						       error);
     if (!retval->client) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     if (val->cksum) {
diff --git a/src/lib/krb5/asn.1/ck2kck.c b/src/lib/krb5/asn.1/ck2kck.c
index 0a21b784df..f68927e28f 100644
--- a/src/lib/krb5/asn.1/ck2kck.c
+++ b/src/lib/krb5/asn.1/ck2kck.c
@@ -65,7 +65,7 @@ register int *error;
     }
     retval->contents = (unsigned char *)xmalloc(val->checksum->qb_forw->qb_len);
     if (!retval->contents) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     retval->checksum_type = val->cksumtype;
diff --git a/src/lib/krb5/asn.1/cred2kcred.c b/src/lib/krb5/asn.1/cred2kcred.c
index 2e992c388e..2cd082a6d4 100644
--- a/src/lib/krb5/asn.1/cred2kcred.c
+++ b/src/lib/krb5/asn.1/cred2kcred.c
@@ -65,7 +65,7 @@ register int *error;
     retval->tickets = (krb5_ticket **) xcalloc(i + 1, sizeof(*retval->tickets));
     if (!retval->tickets) {
 	*error = ENOMEM;
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     
@@ -75,7 +75,7 @@ register int *error;
 	if (!retval->tickets[i]) {
 	    krb5_free_tickets(retval->tickets);
 	    *error = ENOMEM;
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    return(0);
 	}
 	xbzero((char *)retval->tickets[i], sizeof(*retval->tickets[i]));
@@ -83,7 +83,7 @@ register int *error;
 	retval->tickets[i] = KRB5_Ticket2krb5_ticket(rv->Ticket, error);
 	if (!retval->tickets[i]) {
 	    krb5_free_tickets(retval->tickets);
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    return(0);
 	}
     }
@@ -93,10 +93,10 @@ register int *error;
     temp = KRB5_EncryptedData2krb5_enc_data(val->enc__part, error);
     if (temp) {
 	retval->enc_part = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
 	krb5_free_tickets(retval->tickets);
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
diff --git a/src/lib/krb5/asn.1/edat2kedat.c b/src/lib/krb5/asn.1/edat2kedat.c
index 2d3bfa9bae..da0a4b955b 100644
--- a/src/lib/krb5/asn.1/edat2kedat.c
+++ b/src/lib/krb5/asn.1/edat2kedat.c
@@ -59,9 +59,9 @@ register int *error;
     temp = qbuf2krb5_data(val->cipher, error);
     if (temp) {
 	retval->ciphertext = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     if (val->optionals & opt_KRB5_EncryptedData_kvno)
diff --git a/src/lib/krb5/asn.1/ekrp2kekrp.c b/src/lib/krb5/asn.1/ekrp2kekrp.c
index 5d34c765ff..7a53badf70 100644
--- a/src/lib/krb5/asn.1/ekrp2kekrp.c
+++ b/src/lib/krb5/asn.1/ekrp2kekrp.c
@@ -57,7 +57,7 @@ register int *error;
 
     retval->session = KRB5_EncryptionKey2krb5_keyblock(val->key, error);
     if (!retval->session) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
diff --git a/src/lib/krb5/asn.1/enck2kkey.c b/src/lib/krb5/asn.1/enck2kkey.c
index 260bea2ca4..4db62735b9 100644
--- a/src/lib/krb5/asn.1/enck2kkey.c
+++ b/src/lib/krb5/asn.1/enck2kkey.c
@@ -66,7 +66,7 @@ register int *error;
     }
     retval->contents = (unsigned char *) xmalloc(val->keyvalue->qb_forw->qb_len);
     if (!retval->contents) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     retval->keytype = val->keytype;
diff --git a/src/lib/krb5/asn.1/encode.c b/src/lib/krb5/asn.1/encode.c
index afa5be9789..f6ebdab14a 100644
--- a/src/lib/krb5/asn.1/encode.c
+++ b/src/lib/krb5/asn.1/encode.c
@@ -86,7 +86,7 @@ void (*free_translation) PROTOTYPE((krb5_pointer ));
     alldatout:
 	free((*data_out)->data);
     datout:
-	xfree(*data_out);
+	krb5_xfree(*data_out);
 	*data_out = 0;
     peout:
 	pe_free(pe);
diff --git a/src/lib/krb5/asn.1/err2kerr.c b/src/lib/krb5/asn.1/err2kerr.c
index 69d38a73c6..4dd918cd8c 100644
--- a/src/lib/krb5/asn.1/err2kerr.c
+++ b/src/lib/krb5/asn.1/err2kerr.c
@@ -96,7 +96,7 @@ register int *error;
 	temp = qbuf2krb5_data(val->e__text, error);
 	if (temp) {
 	    retval->text = *temp;
-	    xfree(temp);
+	    krb5_xfree(temp);
 	} else {
 	    goto errout;
 	}
@@ -105,7 +105,7 @@ register int *error;
 	temp = qbuf2krb5_data(val->e__text, error);
 	if (temp) {
 	    retval->text = *temp;
-	    xfree(temp);
+	    krb5_xfree(temp);
 	} else {
 	    goto errout;
 	}
diff --git a/src/lib/krb5/asn.1/etpt2ketpt.c b/src/lib/krb5/asn.1/etpt2ketpt.c
index 8d4ccaba84..a78aef4e72 100644
--- a/src/lib/krb5/asn.1/etpt2ketpt.c
+++ b/src/lib/krb5/asn.1/etpt2ketpt.c
@@ -64,7 +64,7 @@ register int *error;
 
     retval->flags = KRB5_TicketFlags2krb5_flags(val->flags, error);
     if (*error) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
@@ -84,7 +84,7 @@ register int *error;
     temp = KRB5_TransitedEncoding2krb5_transited(val->transited, error);
     if (temp) {
 	retval->transited = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
 	goto errout;
     }
diff --git a/src/lib/krb5/asn.1/kadat2adat.c b/src/lib/krb5/asn.1/kadat2adat.c
index 03d9899c2a..ad712da5a1 100644
--- a/src/lib/krb5/asn.1/kadat2adat.c
+++ b/src/lib/krb5/asn.1/kadat2adat.c
@@ -81,7 +81,7 @@ register int *error;
 						       (val[i])->length, 1);
 	if (!retval->element_KRB5_2[i]->ad__data) {
 	    /* clean up */
-	    xfree(retval->element_KRB5_2[i]);
+	    krb5_xfree(retval->element_KRB5_2[i]);
 	    goto errout;
 	}
     }
diff --git a/src/lib/krb5/asn.1/kaddr2addr.c b/src/lib/krb5/asn.1/kaddr2addr.c
index 6efebe2be2..cdf4742b21 100644
--- a/src/lib/krb5/asn.1/kaddr2addr.c
+++ b/src/lib/krb5/asn.1/kaddr2addr.c
@@ -85,7 +85,7 @@ register int *error;
 						    (val[i])->length, 1);
 	if (!retval->element_KRB5_0[i]->address) {
 	    /* clean up */
-	    xfree(retval->element_KRB5_0[i]);
+	    krb5_xfree(retval->element_KRB5_0[i]);
 	    goto errout;
 	}
     }
@@ -129,7 +129,7 @@ register int *error;
 					      (val[i])->length, 1);
 	if (!rv2->element_KRB5_0->address) {
 	    /* clean up */
-	    xfree(rv2->element_KRB5_0);
+	    krb5_xfree(rv2->element_KRB5_0);
 	    goto errout;
 	}
     }
diff --git a/src/lib/krb5/asn.1/kadr2adr.c b/src/lib/krb5/asn.1/kadr2adr.c
index 1ce8bf943a..2079ea21f3 100644
--- a/src/lib/krb5/asn.1/kadr2adr.c
+++ b/src/lib/krb5/asn.1/kadr2adr.c
@@ -58,7 +58,7 @@ register int *error;
     retval->addr__type = val->addrtype;
     retval->address = str2qb((char *)val->contents, val->length, 1);
     if (!retval->address) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/kaprp2aprp.c b/src/lib/krb5/asn.1/kaprp2aprp.c
index 0c7ef8b7ba..b71cd93b55 100644
--- a/src/lib/krb5/asn.1/kaprp2aprp.c
+++ b/src/lib/krb5/asn.1/kaprp2aprp.c
@@ -60,7 +60,7 @@ register int *error;
     retval->enc__part = krb5_enc_data2KRB5_EncryptedData(&(val->enc_part),
 							 error);
     if (!retval->enc__part) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/kaprq2aprq.c b/src/lib/krb5/asn.1/kaprq2aprq.c
index 9a00b537db..86e0c6e271 100644
--- a/src/lib/krb5/asn.1/kaprq2aprq.c
+++ b/src/lib/krb5/asn.1/kaprq2aprq.c
@@ -61,7 +61,7 @@ register int *error;
     retval->ap__options = krb5_apoptions2KRB5_APOptions(val->ap_options,
 							error);
     if (!retval->ap__options) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     retval->ticket = krb5_ticket2KRB5_Ticket(val->ticket, error);
diff --git a/src/lib/krb5/asn.1/karep2arep.c b/src/lib/krb5/asn.1/karep2arep.c
index f21814aa1f..146346fed8 100644
--- a/src/lib/krb5/asn.1/karep2arep.c
+++ b/src/lib/krb5/asn.1/karep2arep.c
@@ -57,7 +57,7 @@ register int *error;
 
     retval->ctime = unix2gentime(val->ctime, error);
     if (!retval->ctime) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
diff --git a/src/lib/krb5/asn.1/kcred2cred.c b/src/lib/krb5/asn.1/kcred2cred.c
index 1642997213..2e6cf76397 100644
--- a/src/lib/krb5/asn.1/kcred2cred.c
+++ b/src/lib/krb5/asn.1/kcred2cred.c
@@ -90,20 +90,20 @@ register int *error;
 	
 	rv2->Ticket = krb5_ticket2KRB5_Ticket(val->tickets[i], error);
 	if (!rv2->Ticket) {
-	    xfree(retval->tickets);
+	    krb5_xfree(retval->tickets);
 	    return(0);
 	}
     }
 
     if (!retval->tickets) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
     retval->enc__part = krb5_enc_data2KRB5_EncryptedData(&(val->enc_part),
 							 error);
     if (!retval->enc__part) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/kdcr2kkdcr.c b/src/lib/krb5/asn.1/kdcr2kkdcr.c
index fd47944e17..a60ccfe31f 100644
--- a/src/lib/krb5/asn.1/kdcr2kkdcr.c
+++ b/src/lib/krb5/asn.1/kdcr2kkdcr.c
@@ -62,7 +62,7 @@ element_KRB5_112krb5_pa_data(val, error)
     }
     for (i = 0, rv = val; rv; rv = rv->next, i++) {
 	if (qb_pullup(rv->PA__DATA->pa__data) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    *error = ENOMEM;
 	    return(0);
 	}
@@ -77,7 +77,7 @@ element_KRB5_112krb5_pa_data(val, error)
 	if (retval[i]->length) {
 	    retval[i]->contents = (unsigned char *)xmalloc(rv->PA__DATA->pa__data->qb_forw->qb_len);
 	    if (!retval[i]->contents) {
-		xfree(retval[i]);
+		krb5_xfree(retval[i]);
 		retval[i] = 0;
 		krb5_free_pa_data(retval);
 		*error = ENOMEM;
@@ -113,7 +113,7 @@ register int *error;
     if (val->padata) {
 	retval->padata = element_KRB5_112krb5_pa_data(val->padata, error);
 	if (*error) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    return 0;
 
 	}
@@ -122,7 +122,7 @@ register int *error;
 						       val->crealm,
 						       error);
     if (!retval->client) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
@@ -134,7 +134,7 @@ register int *error;
     temp = KRB5_EncryptedData2krb5_enc_data(val->enc__part, error);
     if (temp) {
 	retval->enc_part = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
 	krb5_free_kdc_rep(retval);
 	return(0);
diff --git a/src/lib/krb5/asn.1/kedat2edat.c b/src/lib/krb5/asn.1/kedat2edat.c
index e86b2d85ec..f66918feb5 100644
--- a/src/lib/krb5/asn.1/kedat2edat.c
+++ b/src/lib/krb5/asn.1/kedat2edat.c
@@ -58,7 +58,7 @@ register int *error;
     retval->etype = val->etype;
     retval->cipher = krb5_data2qbuf(&(val->ciphertext));
     if (!retval->cipher) {
-	xfree(retval);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return(0);
     }
diff --git a/src/lib/krb5/asn.1/kekrp2ekrp.c b/src/lib/krb5/asn.1/kekrp2ekrp.c
index b70e76db41..ee53e34798 100644
--- a/src/lib/krb5/asn.1/kekrp2ekrp.c
+++ b/src/lib/krb5/asn.1/kekrp2ekrp.c
@@ -57,7 +57,7 @@ register int *error;
 
     retval->key = krb5_keyblock2KRB5_EncryptionKey(val->session, error);
     if (!retval->key) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     retval->last__req = krb5_last_req2KRB5_LastReq(val->last_req, error);
diff --git a/src/lib/krb5/asn.1/kerr2err.c b/src/lib/krb5/asn.1/kerr2err.c
index 31828c6b91..102f7e297f 100644
--- a/src/lib/krb5/asn.1/kerr2err.c
+++ b/src/lib/krb5/asn.1/kerr2err.c
@@ -61,7 +61,7 @@ register int *error;
     if (val->ctime) {
 	retval->ctime = unix2gentime(val->ctime, error);
 	if (!retval->ctime) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    return(0);
 	}
     }
diff --git a/src/lib/krb5/asn.1/ketpt2etpt.c b/src/lib/krb5/asn.1/ketpt2etpt.c
index d235087d2e..94dc4530d4 100644
--- a/src/lib/krb5/asn.1/ketpt2etpt.c
+++ b/src/lib/krb5/asn.1/ketpt2etpt.c
@@ -53,7 +53,7 @@ register int *error;
 
     retval->flags = krb5_flags2KRB5_TicketFlags(val->flags, error);
     if (*error) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     retval->key = krb5_keyblock2KRB5_EncryptionKey(val->session, error);
diff --git a/src/lib/krb5/asn.1/kprep2prep.c b/src/lib/krb5/asn.1/kprep2prep.c
index 5eded53eda..9c4ebc3454 100644
--- a/src/lib/krb5/asn.1/kprep2prep.c
+++ b/src/lib/krb5/asn.1/kprep2prep.c
@@ -57,7 +57,7 @@ register int *error;
 
     retval->user__data = krb5_data2qbuf(&(val->user_data));
     if (!retval->user__data) {
-	xfree(retval);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return(0);
     }
diff --git a/src/lib/krb5/asn.1/kpriv2priv.c b/src/lib/krb5/asn.1/kpriv2priv.c
index aeab624928..656849ecb7 100644
--- a/src/lib/krb5/asn.1/kpriv2priv.c
+++ b/src/lib/krb5/asn.1/kpriv2priv.c
@@ -61,7 +61,7 @@ register int *error;
     retval->enc__part = krb5_enc_data2KRB5_EncryptedData(&(val->enc_part),
 							 error);
     if (!retval->enc__part) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/kpwds2pwds.c b/src/lib/krb5/asn.1/kpwds2pwds.c
index 473c8eca56..4f2f9b245c 100644
--- a/src/lib/krb5/asn.1/kpwds2pwds.c
+++ b/src/lib/krb5/asn.1/kpwds2pwds.c
@@ -117,7 +117,7 @@ register int *error;
 			free_KRB5_PasswdSequence(rv1->PasswdSequence);
 
 		    rv2 = rv1->next;
-		    xfree(rv1);
+		    krb5_xfree(rv1);
 		}
 	    goto errout;
 	    }
diff --git a/src/lib/krb5/asn.1/ksafe2safe.c b/src/lib/krb5/asn.1/ksafe2safe.c
index 72b85b05b7..59763f45f7 100644
--- a/src/lib/krb5/asn.1/ksafe2safe.c
+++ b/src/lib/krb5/asn.1/ksafe2safe.c
@@ -58,7 +58,7 @@ register int *error;
 
     rv2 = (struct type_KRB5_KRB__SAFE__BODY *)xmalloc(sizeof(*rv2));
     if (!rv2) {
-	xfree(retval);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return(0);
     }
@@ -70,7 +70,7 @@ register int *error;
 
     rv2->user__data = krb5_data2qbuf(&(val->user_data));
     if (!rv2->user__data) {
-	xfree(retval);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return(0);
     }
diff --git a/src/lib/krb5/asn.1/ktgrq2tgrq.c b/src/lib/krb5/asn.1/ktgrq2tgrq.c
index b87bfbcf39..e560aa7b18 100644
--- a/src/lib/krb5/asn.1/ktgrq2tgrq.c
+++ b/src/lib/krb5/asn.1/ktgrq2tgrq.c
@@ -171,7 +171,7 @@ register int *error;
 		    free_KRB5_Ticket(adtk->Ticket[i]);
 		    i--;
 		}
-		xfree(adtk);
+		krb5_xfree(adtk);
 		goto errout;
 	    }
 	}
@@ -202,7 +202,7 @@ register int *error;
 		    if (rv1->Ticket)
 			free_KRB5_Ticket(rv1->Ticket);
 		    rv2 = rv1->next;
-		    xfree(rv1);
+		    krb5_xfree(rv1);
 		}
 		goto errout;
 	    }
@@ -299,7 +299,7 @@ register int *error;
     if (val->padata) {
 	retval->padata = krb5_pa_data2element_KRB5_7(val->padata, error);
 	if (*error) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    return 0;
 	}
     }
diff --git a/src/lib/krb5/asn.1/prep2kprep.c b/src/lib/krb5/asn.1/prep2kprep.c
index a2b5c80e4c..85195c3b96 100644
--- a/src/lib/krb5/asn.1/prep2kprep.c
+++ b/src/lib/krb5/asn.1/prep2kprep.c
@@ -59,9 +59,9 @@ register int *error;
     temp = qbuf2krb5_data(val->user__data, error);
     if (temp) {
 	retval->user_data = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     if (val->timestamp) {
diff --git a/src/lib/krb5/asn.1/prin2kprin.c b/src/lib/krb5/asn.1/prin2kprin.c
index 9c844f2d19..f642115922 100644
--- a/src/lib/krb5/asn.1/prin2kprin.c
+++ b/src/lib/krb5/asn.1/prin2kprin.c
@@ -80,7 +80,7 @@ register int *error;
     retval->length = i;
     retval->data = (krb5_data *)malloc(i * sizeof(krb5_data));
     if (retval->data == 0) {
-	xfree(retval);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return 0;
     }
@@ -88,8 +88,8 @@ register int *error;
     retval->type = val->name__type;
 
     if (qbuf_to_data(realm, krb5_princ_realm(retval))) {
-	xfree(retval->data);
-	xfree(retval);
+	krb5_xfree(retval->data);
+	krb5_xfree(retval);
 	*error = ENOMEM;
 	return 0;
     }
diff --git a/src/lib/krb5/asn.1/priv2kpriv.c b/src/lib/krb5/asn.1/priv2kpriv.c
index 57d6700de4..dbf447a727 100644
--- a/src/lib/krb5/asn.1/priv2kpriv.c
+++ b/src/lib/krb5/asn.1/priv2kpriv.c
@@ -59,9 +59,9 @@ register int *error;
     temp = KRB5_EncryptedData2krb5_enc_data(val->enc__part, error);
     if (temp) {
 	retval->enc_part = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/asn.1/pwd2kpwd.c b/src/lib/krb5/asn.1/pwd2kpwd.c
index a8ab2d8c67..5349c80064 100644
--- a/src/lib/krb5/asn.1/pwd2kpwd.c
+++ b/src/lib/krb5/asn.1/pwd2kpwd.c
@@ -56,13 +56,13 @@ register int *error;
 
     retval->passwd = qbuf2krb5_data(val->passwd, error);
     if (!retval->passwd) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
     retval->phrase = qbuf2krb5_data(val->phrase, error);
     if (!retval->phrase) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
diff --git a/src/lib/krb5/asn.1/pwds2kpwds.c b/src/lib/krb5/asn.1/pwds2kpwds.c
index 9d408a10d4..bffa2d5783 100644
--- a/src/lib/krb5/asn.1/pwds2kpwds.c
+++ b/src/lib/krb5/asn.1/pwds2kpwds.c
@@ -84,7 +84,7 @@ register int *error;
 		krb5_free_pwd_sequences(element[i]);
 		i--;
 	    }
-	    xfree(element);
+	    krb5_xfree(element);
 	    goto errout;
 	}
     }
diff --git a/src/lib/krb5/asn.1/qbuf2data.c b/src/lib/krb5/asn.1/qbuf2data.c
index 7c5c74b506..1e36ce53a7 100644
--- a/src/lib/krb5/asn.1/qbuf2data.c
+++ b/src/lib/krb5/asn.1/qbuf2data.c
@@ -65,7 +65,7 @@ register int *error;
     }
     retval->data = (char *)xmalloc(val->qb_forw->qb_len);
     if (!retval->data) {
-	xfree(retval);
+	krb5_xfree(retval);
 	goto nomem;
     }
     xbcopy(val->qb_forw->qb_data, retval->data,
diff --git a/src/lib/krb5/asn.1/safe2ksafe.c b/src/lib/krb5/asn.1/safe2ksafe.c
index a3c4a18a45..bd3121f6be 100644
--- a/src/lib/krb5/asn.1/safe2ksafe.c
+++ b/src/lib/krb5/asn.1/safe2ksafe.c
@@ -59,9 +59,9 @@ register int *error;
     temp = qbuf2krb5_data(val->safe__body->user__data, error);
     if (temp) {
 	retval->user_data = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     if (val->safe__body->timestamp) {
diff --git a/src/lib/krb5/asn.1/tgrq2ktgrq.c b/src/lib/krb5/asn.1/tgrq2ktgrq.c
index 3021f1da14..6775574640 100644
--- a/src/lib/krb5/asn.1/tgrq2ktgrq.c
+++ b/src/lib/krb5/asn.1/tgrq2ktgrq.c
@@ -137,7 +137,7 @@ register int *error;
 						error);
 	if (temp) {
 	    retval->authorization_data = *temp;
-	    xfree(temp);
+	    krb5_xfree(temp);
 	} else
 	    goto errout;
     }
@@ -164,7 +164,7 @@ register int *error;
 		    krb5_free_ticket(aticks[i]);
 		    i--;
 		}
-		xfree(aticks);
+		krb5_xfree(aticks);
 		goto errout;
 	    }
 	}
@@ -192,7 +192,7 @@ register int *error;
 		    krb5_free_ticket(aticks[i]);
 		    i--;
 		}
-		xfree(aticks);
+		krb5_xfree(aticks);
 		goto errout;
 	    }
 	}
@@ -222,7 +222,7 @@ element_KRB5_72krb5_pa_data(val, error)
     }
     for (i = 0, rv = val; rv; rv = rv->next, i++) {
 	if (qb_pullup(rv->PA__DATA->pa__data) != OK) {
-	    xfree(retval);
+	    krb5_xfree(retval);
 	    *error = ENOMEM;
 	    return(0);
 	}
@@ -237,7 +237,7 @@ element_KRB5_72krb5_pa_data(val, error)
 	if (retval[i]->length) {
 	    retval[i]->contents = (unsigned char *)xmalloc(rv->PA__DATA->pa__data->qb_forw->qb_len);
 	    if (!retval[i]->contents) {
-		xfree(retval[i]);
+		krb5_xfree(retval[i]);
 		retval[i] = 0;
 		krb5_free_pa_data(retval);
 		*error = ENOMEM;
diff --git a/src/lib/krb5/asn.1/tkt2ktkt.c b/src/lib/krb5/asn.1/tkt2ktkt.c
index 14d1fe7feb..e05873d346 100644
--- a/src/lib/krb5/asn.1/tkt2ktkt.c
+++ b/src/lib/krb5/asn.1/tkt2ktkt.c
@@ -61,14 +61,14 @@ register int *error;
 						       val->realm,
 						       error);
     if (!retval->server) {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
 
     temp = KRB5_EncryptedData2krb5_enc_data(val->enc__part, error);
     if (temp) {
 	retval->enc_part = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
 	krb5_free_ticket(retval);
 	return(0);
diff --git a/src/lib/krb5/asn.1/tran2ktran.c b/src/lib/krb5/asn.1/tran2ktran.c
index 3429f62488..6a9ff49961 100644
--- a/src/lib/krb5/asn.1/tran2ktran.c
+++ b/src/lib/krb5/asn.1/tran2ktran.c
@@ -60,9 +60,9 @@ register int *error;
     temp = qbuf2krb5_data(val->contents, error);
     if (temp) {
 	retval->tr_contents = *temp;
-	xfree(temp);
+	krb5_xfree(temp);
     } else {
-	xfree(retval);
+	krb5_xfree(retval);
 	return(0);
     }
     return(retval);
diff --git a/src/lib/krb5/ccache/file/fcc_close.c b/src/lib/krb5/ccache/file/fcc_close.c
index 303391a454..be154d3788 100644
--- a/src/lib/krb5/ccache/file/fcc_close.c
+++ b/src/lib/krb5/ccache/file/fcc_close.c
@@ -50,9 +50,9 @@ krb5_fcc_close(id)
      if (((krb5_fcc_data *) id->data)->fd >= 0)
 	     krb5_fcc_close_file(id);
 
-     xfree(((krb5_fcc_data *) id->data)->filename);
-     xfree(((krb5_fcc_data *) id->data));
-     xfree(id);
+     krb5_xfree(((krb5_fcc_data *) id->data)->filename);
+     krb5_xfree(((krb5_fcc_data *) id->data));
+     krb5_xfree(id);
 
      return closeval;
 }
diff --git a/src/lib/krb5/ccache/file/fcc_eseq.c b/src/lib/krb5/ccache/file/fcc_eseq.c
index ac21656925..dfd73a345c 100644
--- a/src/lib/krb5/ccache/file/fcc_eseq.c
+++ b/src/lib/krb5/ccache/file/fcc_eseq.c
@@ -56,7 +56,7 @@ krb5_fcc_end_seq_get(id, cursor)
 	and if not, fcc_start_seq_get and/or fcc_next_cred will do the
 	MAYBE_CLOSE.
      MAYBE_CLOSE(id, kret); */
-     xfree((krb5_fcc_cursor *) *cursor);
+     krb5_xfree((krb5_fcc_cursor *) *cursor);
 
      return kret;
 }
diff --git a/src/lib/krb5/ccache/file/fcc_gennew.c b/src/lib/krb5/ccache/file/fcc_gennew.c
index 53c1f3de05..2771e8bc2d 100644
--- a/src/lib/krb5/ccache/file/fcc_gennew.c
+++ b/src/lib/krb5/ccache/file/fcc_gennew.c
@@ -79,7 +79,7 @@ krb5_fcc_generate_new (id)
 
      lid->data = (krb5_pointer) malloc(sizeof(krb5_fcc_data));
      if (lid->data == NULL) {
-	  xfree(lid);
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
@@ -91,8 +91,8 @@ krb5_fcc_generate_new (id)
      ((krb5_fcc_data *) lid->data)->filename = (char *)
 	  malloc(strlen(scratch) + 1);
      if (((krb5_fcc_data *) lid->data)->filename == NULL) {
-	  xfree(((krb5_fcc_data *) lid->data));
-	  xfree(lid);
+	  krb5_xfree(((krb5_fcc_data *) lid->data));
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
@@ -137,8 +137,8 @@ krb5_fcc_generate_new (id)
      }
 
 err_out:
-     xfree(((krb5_fcc_data *) lid->data)->filename);
-     xfree(((krb5_fcc_data *) lid->data));
-     xfree(lid);
+     krb5_xfree(((krb5_fcc_data *) lid->data)->filename);
+     krb5_xfree(((krb5_fcc_data *) lid->data));
+     krb5_xfree(lid);
      return retcode;
 }
diff --git a/src/lib/krb5/ccache/file/fcc_read.c b/src/lib/krb5/ccache/file/fcc_read.c
index 5cea968870..bcfba6552b 100644
--- a/src/lib/krb5/ccache/file/fcc_read.c
+++ b/src/lib/krb5/ccache/file/fcc_read.c
@@ -208,18 +208,18 @@ krb5_fcc_read_keyblock(id, keyblock)
 		(keyblock->length)*sizeof(krb5_octet));
 
      if (ret < 0) {
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
 	 return krb5_fcc_interpret(errno);
      }
      if (ret != (keyblock->length)*sizeof(krb5_octet)) {
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
 	 return KRB5_CC_END;
      }
 
      return KRB5_OK;
  errout:
      if (keyblock->contents)
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
      return kret;
 }
 
@@ -248,18 +248,18 @@ krb5_fcc_read_data(id, data)
      ret = read(((krb5_fcc_data *) id->data)->fd, (char *)data->data,
 		data->length);
      if (ret == -1) {
-	 xfree(data->data);
+	 krb5_xfree(data->data);
 	 return krb5_fcc_interpret(errno);
      }
      if (ret != data->length) {
-	 xfree(data->data);
+	 krb5_xfree(data->data);
 	 return KRB5_CC_END;
      }
      data->data[data->length] = 0; /* Null terminate, just in case.... */
      return KRB5_OK;
  errout:
      if (data->data)
-	 xfree(data->data);
+	 krb5_xfree(data->data);
      return kret;
 }
 
@@ -289,17 +289,17 @@ krb5_fcc_read_addr(id, addr)
      ret = read(((krb5_fcc_data *) id->data)->fd, (char *)addr->contents,
 		(addr->length)*sizeof(krb5_octet));
      if (ret == -1) {
-	  xfree(addr->contents);
+	  krb5_xfree(addr->contents);
 	  return krb5_fcc_interpret(errno);
      }
      if (ret != (addr->length)*sizeof(krb5_octet)) {
-	  xfree(addr->contents);
+	  krb5_xfree(addr->contents);
 	  return KRB5_CC_END;
      }
      return KRB5_OK;
  errout:
      if (addr->contents)
-	 xfree(addr->contents);
+	 krb5_xfree(addr->contents);
      return kret;
 }
 
@@ -425,17 +425,17 @@ krb5_fcc_read_authdatum(id, a)
     ret = read(((krb5_fcc_data *) id->data)->fd, (char *)a->contents,
 		(a->length)*sizeof(krb5_octet));
      if (ret == -1) {
-	  xfree(a->contents);
+	  krb5_xfree(a->contents);
 	  return krb5_fcc_interpret(errno);
      }
      if (ret != (a->length)*sizeof(krb5_octet)) {
-	  xfree(a->contents);
+	  krb5_xfree(a->contents);
 	  return KRB5_CC_END;
      }
      return KRB5_OK;
  errout:
      if (a->contents)
-	 xfree(a->contents);
+	 krb5_xfree(a->contents);
      return kret;
     
 }
diff --git a/src/lib/krb5/ccache/file/fcc_reslv.c b/src/lib/krb5/ccache/file/fcc_reslv.c
index f674111c6d..c42f724b13 100644
--- a/src/lib/krb5/ccache/file/fcc_reslv.c
+++ b/src/lib/krb5/ccache/file/fcc_reslv.c
@@ -69,7 +69,7 @@ krb5_fcc_resolve (id, residual)
      
      lid->data = (krb5_pointer) malloc(sizeof(krb5_fcc_data));
      if (lid->data == NULL) {
-	  xfree(lid);
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
@@ -77,8 +77,8 @@ krb5_fcc_resolve (id, residual)
 	  malloc(strlen(residual) + 1);
 
      if (((krb5_fcc_data *) lid->data)->filename == NULL) {
-	  xfree(((krb5_fcc_data *) lid->data));
-	  xfree(lid);
+	  krb5_xfree(((krb5_fcc_data *) lid->data));
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
diff --git a/src/lib/krb5/ccache/file/fcc_sseq.c b/src/lib/krb5/ccache/file/fcc_sseq.c
index 8c57c81557..d2625ebaa1 100644
--- a/src/lib/krb5/ccache/file/fcc_sseq.c
+++ b/src/lib/krb5/ccache/file/fcc_sseq.c
@@ -59,7 +59,7 @@ krb5_fcc_start_seq_get(id, cursor)
      if (OPENCLOSE(id)) {
 	  ret = krb5_fcc_open_file(id, FCC_OPEN_RDONLY);
 	  if (ret) {
-	      xfree(fcursor);
+	      krb5_xfree(fcursor);
 	      return ret;
 	  }
      }
diff --git a/src/lib/krb5/ccache/stdio/scc_close.c b/src/lib/krb5/ccache/stdio/scc_close.c
index fd9027a222..256e5ab23d 100644
--- a/src/lib/krb5/ccache/stdio/scc_close.c
+++ b/src/lib/krb5/ccache/stdio/scc_close.c
@@ -57,9 +57,9 @@ krb5_scc_close(id)
 	     closeval = KRB5_OK;
 		 
      }
-     xfree (data->filename);
-     xfree (data);
-     xfree (id);
+     krb5_xfree (data->filename);
+     krb5_xfree (data);
+     krb5_xfree (id);
 
      return closeval;
 }
diff --git a/src/lib/krb5/ccache/stdio/scc_eseq.c b/src/lib/krb5/ccache/stdio/scc_eseq.c
index 01ee482fc5..0eb91180ef 100644
--- a/src/lib/krb5/ccache/stdio/scc_eseq.c
+++ b/src/lib/krb5/ccache/stdio/scc_eseq.c
@@ -53,7 +53,7 @@ krb5_scc_end_seq_get(id, cursor)
     int ret = KRB5_OK;
 /*    MAYBE_CLOSE (id, ret);*/
 
-    xfree((krb5_scc_cursor *) *cursor);
+    krb5_xfree((krb5_scc_cursor *) *cursor);
 
     return ret;
 }
diff --git a/src/lib/krb5/ccache/stdio/scc_gennew.c b/src/lib/krb5/ccache/stdio/scc_gennew.c
index b9b7ff44be..89c6a14bc2 100644
--- a/src/lib/krb5/ccache/stdio/scc_gennew.c
+++ b/src/lib/krb5/ccache/stdio/scc_gennew.c
@@ -79,15 +79,15 @@ krb5_scc_generate_new (id)
 
      lid->data = (krb5_pointer) malloc(sizeof(krb5_scc_data));
      if (lid->data == NULL) {
-	  xfree(lid);
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
      ((krb5_scc_data *) lid->data)->filename = (char *)
 	  malloc(strlen(scratch) + 1);
      if (((krb5_scc_data *) lid->data)->filename == NULL) {
-	  xfree(((krb5_scc_data *) lid->data));
-	  xfree(lid);
+	  krb5_xfree(((krb5_scc_data *) lid->data));
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
@@ -124,8 +124,8 @@ krb5_scc_generate_new (id)
 	 return KRB5_OK;
      }
 err_out:
-     xfree(((krb5_scc_data *) lid->data)->filename);
-     xfree(((krb5_scc_data *) lid->data));
-     xfree(lid);
+     krb5_xfree(((krb5_scc_data *) lid->data)->filename);
+     krb5_xfree(((krb5_scc_data *) lid->data));
+     krb5_xfree(lid);
      return retcode;
 }
diff --git a/src/lib/krb5/ccache/stdio/scc_read.c b/src/lib/krb5/ccache/stdio/scc_read.c
index a8eedc0500..998115f0c3 100644
--- a/src/lib/krb5/ccache/stdio/scc_read.c
+++ b/src/lib/krb5/ccache/stdio/scc_read.c
@@ -204,18 +204,18 @@ krb5_scc_read_keyblock(id, keyblock)
 		 ((krb5_scc_data *) id->data)->file);
 
      if ((ret == 0) && errno) {
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
 	 return krb5_scc_interpret(errno);
      }
      if (ret != (keyblock->length)*sizeof(krb5_octet)) {
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
 	 return KRB5_CC_END;
      }
 
      return KRB5_OK;
  errout:
      if (keyblock->contents)
-	 xfree(keyblock->contents);
+	 krb5_xfree(keyblock->contents);
      return kret;
 }
 
@@ -240,18 +240,18 @@ krb5_scc_read_data(id, data)
      ret = fread((char *)data->data, 1,
 		 data->length, ((krb5_scc_data *) id->data)->file);
      if ((ret == 0) && errno) {
-	 xfree(data->data);
+	 krb5_xfree(data->data);
 	 return krb5_scc_interpret(errno);
      }
      if (ret != data->length) {
-	 xfree(data->data);
+	 krb5_xfree(data->data);
 	 return KRB5_CC_END;
      }
      data->data[data->length] = 0; /* Null terminate just in case.... */
      return KRB5_OK;
  errout:
      if (data->data)
-	 xfree(data->data);
+	 krb5_xfree(data->data);
      return kret;
 }
 
@@ -279,17 +279,17 @@ krb5_scc_read_addr(id, addr)
      ret = fread((char *)addr->contents, 1, (addr->length)*sizeof(krb5_octet),
 		 ((krb5_scc_data *) id->data)->file);
      if ((ret == 0) && errno) {
-	  xfree(addr->contents);
+	  krb5_xfree(addr->contents);
 	  return krb5_scc_interpret(errno);
      }
      if (ret != (addr->length)*sizeof(krb5_octet)) {
-	  xfree(addr->contents);
+	  krb5_xfree(addr->contents);
 	  return KRB5_CC_END;
      }
      return KRB5_OK;
  errout:
      if (addr->contents)
-	 xfree(addr->contents);
+	 krb5_xfree(addr->contents);
      return kret;
 }
 
@@ -414,16 +414,16 @@ krb5_scc_read_authdatum(id, a)
 		 (a->length)*sizeof(krb5_octet),
 		 ((krb5_scc_data *) id->data)->file);
     if ((ret == 0) && errno) {
-	xfree(a->contents);
+	krb5_xfree(a->contents);
 	return krb5_scc_interpret(errno);
     }
     if (ret != (a->length)*sizeof(krb5_octet)) {
-	xfree(a->contents);
+	krb5_xfree(a->contents);
 	return KRB5_CC_END;
     }
     return KRB5_OK;
 errout:
     if (a->contents)
-	xfree(a->contents);
+	krb5_xfree(a->contents);
     return kret;
 }
diff --git a/src/lib/krb5/ccache/stdio/scc_reslv.c b/src/lib/krb5/ccache/stdio/scc_reslv.c
index 53780458f6..aebc738b28 100644
--- a/src/lib/krb5/ccache/stdio/scc_reslv.c
+++ b/src/lib/krb5/ccache/stdio/scc_reslv.c
@@ -69,7 +69,7 @@ krb5_scc_resolve (id, residual)
      
      lid->data = (krb5_pointer) malloc(sizeof(krb5_scc_data));
      if (lid->data == NULL) {
-	  xfree(lid);
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
@@ -77,8 +77,8 @@ krb5_scc_resolve (id, residual)
 	  malloc(strlen(residual) + 1);
 
      if (((krb5_scc_data *) lid->data)->filename == NULL) {
-	  xfree(((krb5_scc_data *) lid->data));
-	  xfree(lid);
+	  krb5_xfree(((krb5_scc_data *) lid->data));
+	  krb5_xfree(lid);
 	  return KRB5_CC_NOMEM;
      }
 
diff --git a/src/lib/krb5/free/f_addr.c b/src/lib/krb5/free/f_addr.c
index a10fc12098..38109751ac 100644
--- a/src/lib/krb5/free/f_addr.c
+++ b/src/lib/krb5/free/f_addr.c
@@ -38,7 +38,7 @@ krb5_free_address(val)
 krb5_address *val;
 {
     if (val->contents)
-	xfree(val->contents);
-    xfree(val);
+	krb5_xfree(val->contents);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_address.c b/src/lib/krb5/free/f_address.c
index 7017579859..3e40d92b9d 100644
--- a/src/lib/krb5/free/f_address.c
+++ b/src/lib/krb5/free/f_address.c
@@ -41,9 +41,9 @@ krb5_address **val;
 
     for (temp = val; *temp; temp++) {
 	if ((*temp)->contents)
-	    xfree((*temp)->contents);
-	xfree(*temp);
+	    krb5_xfree((*temp)->contents);
+	krb5_xfree(*temp);
     }
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_ap_rep.c b/src/lib/krb5/free/f_ap_rep.c
index 46d2e8d1f1..a88a2f6992 100644
--- a/src/lib/krb5/free/f_ap_rep.c
+++ b/src/lib/krb5/free/f_ap_rep.c
@@ -38,7 +38,7 @@ krb5_free_ap_rep(val)
 register krb5_ap_rep *val;
 {
     if (val->enc_part.ciphertext.data)
-	xfree(val->enc_part.ciphertext.data);
-    xfree(val);
+	krb5_xfree(val->enc_part.ciphertext.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_ap_req.c b/src/lib/krb5/free/f_ap_req.c
index f9c216b9ba..695bfd149a 100644
--- a/src/lib/krb5/free/f_ap_req.c
+++ b/src/lib/krb5/free/f_ap_req.c
@@ -40,7 +40,7 @@ register krb5_ap_req *val;
     if (val->ticket)
 	krb5_free_ticket(val->ticket);
     if (val->authenticator.ciphertext.data)
-	xfree(val->authenticator.ciphertext.data);
-    xfree(val);
+	krb5_xfree(val->authenticator.ciphertext.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_arep_enc.c b/src/lib/krb5/free/f_arep_enc.c
index b75c1198e2..bd951762d4 100644
--- a/src/lib/krb5/free/f_arep_enc.c
+++ b/src/lib/krb5/free/f_arep_enc.c
@@ -39,6 +39,6 @@ krb5_ap_rep_enc_part *val;
 {
     if (val->subkey)
 	krb5_free_keyblock(val->subkey);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_authdata.c b/src/lib/krb5/free/f_authdata.c
index 06cdfa276b..975ae2926a 100644
--- a/src/lib/krb5/free/f_authdata.c
+++ b/src/lib/krb5/free/f_authdata.c
@@ -41,9 +41,9 @@ krb5_authdata **val;
 
     for (temp = val; *temp; temp++) {
 	if ((*temp)->contents)
-	    xfree((*temp)->contents);
-	xfree(*temp);
+	    krb5_xfree((*temp)->contents);
+	krb5_xfree(*temp);
     }
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_authent.c b/src/lib/krb5/free/f_authent.c
index 4e399b567c..07e27facc3 100644
--- a/src/lib/krb5/free/f_authent.c
+++ b/src/lib/krb5/free/f_authent.c
@@ -46,6 +46,6 @@ krb5_authenticator *val;
 	krb5_free_keyblock(val->subkey);
     if (val->authorization_data)        
        krb5_free_authdata(val->authorization_data);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_cksum.c b/src/lib/krb5/free/f_cksum.c
index d293c96bd3..9cbd5ed8ad 100644
--- a/src/lib/krb5/free/f_cksum.c
+++ b/src/lib/krb5/free/f_cksum.c
@@ -38,7 +38,7 @@ krb5_free_checksum(val)
 register krb5_checksum *val;
 {
     if (val->contents)
-	xfree(val->contents);
-    xfree(val);
+	krb5_xfree(val->contents);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_cred.c b/src/lib/krb5/free/f_cred.c
index b640176517..3e32878643 100644
--- a/src/lib/krb5/free/f_cred.c
+++ b/src/lib/krb5/free/f_cred.c
@@ -40,7 +40,7 @@ register krb5_cred *val;
     if (val->tickets)
         krb5_free_tickets(val->tickets);
     if (val->enc_part.ciphertext.data)
-	xfree(val->enc_part.ciphertext.data);
-    xfree(val);
+	krb5_xfree(val->enc_part.ciphertext.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_cred_cnt.c b/src/lib/krb5/free/f_cred_cnt.c
index e5b73b95ad..4a3b506529 100644
--- a/src/lib/krb5/free/f_cred_cnt.c
+++ b/src/lib/krb5/free/f_cred_cnt.c
@@ -48,12 +48,12 @@ krb5_creds *val;
 	krb5_free_principal(val->server);
     if (val->keyblock.contents) {
 	memset((char *)val->keyblock.contents, 0, val->keyblock.length);
-	xfree(val->keyblock.contents);
+	krb5_xfree(val->keyblock.contents);
     }
     if (val->ticket.data)
-	xfree(val->ticket.data);
+	krb5_xfree(val->ticket.data);
     if (val->second_ticket.data)
-	xfree(val->second_ticket.data);
+	krb5_xfree(val->second_ticket.data);
     if (val->addresses)
 	krb5_free_addresses(val->addresses);
     if (val->authdata)
diff --git a/src/lib/krb5/free/f_cred_enc.c b/src/lib/krb5/free/f_cred_enc.c
index 46a3df1d95..5ca6102d03 100644
--- a/src/lib/krb5/free/f_cred_enc.c
+++ b/src/lib/krb5/free/f_cred_enc.c
@@ -53,8 +53,8 @@ register krb5_cred_enc_part *val;
 	  krb5_free_principal((*temp)->server);
 	if ((*temp)->caddrs)
 	  krb5_free_addresses((*temp)->caddrs);
-	xfree((*temp));
+	krb5_xfree((*temp));
     }
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_creds.c b/src/lib/krb5/free/f_creds.c
index 9b5a5e5c56..5fcbc91832 100644
--- a/src/lib/krb5/free/f_creds.c
+++ b/src/lib/krb5/free/f_creds.c
@@ -38,6 +38,6 @@ krb5_free_creds(val)
 krb5_creds *val;
 {
     krb5_free_cred_contents(val);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_enc_kdc.c b/src/lib/krb5/free/f_enc_kdc.c
index 28fda6c454..a5ed6234fa 100644
--- a/src/lib/krb5/free/f_enc_kdc.c
+++ b/src/lib/krb5/free/f_enc_kdc.c
@@ -45,6 +45,6 @@ register krb5_enc_kdc_rep_part *val;
 	krb5_free_principal(val->server);
     if (val->caddrs)
 	krb5_free_addresses(val->caddrs);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_enc_tkt.c b/src/lib/krb5/free/f_enc_tkt.c
index 9a38270413..c0fdcd90fd 100644
--- a/src/lib/krb5/free/f_enc_tkt.c
+++ b/src/lib/krb5/free/f_enc_tkt.c
@@ -42,11 +42,11 @@ krb5_enc_tkt_part *val;
     if (val->client)
 	krb5_free_principal(val->client);
     if (val->transited.tr_contents.data)
-	xfree(val->transited.tr_contents.data);
+	krb5_xfree(val->transited.tr_contents.data);
     if (val->caddrs)
 	krb5_free_addresses(val->caddrs);
     if (val->authorization_data)
 	krb5_free_authdata(val->authorization_data);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_error.c b/src/lib/krb5/free/f_error.c
index 219412e750..4cb7d85ab4 100644
--- a/src/lib/krb5/free/f_error.c
+++ b/src/lib/krb5/free/f_error.c
@@ -42,9 +42,9 @@ register krb5_error *val;
     if (val->server)
 	krb5_free_principal(val->server);
     if (val->text.data)
-	xfree(val->text.data);
+	krb5_xfree(val->text.data);
     if (val->e_data.data)
-	xfree(val->e_data.data);
-    xfree(val);
+	krb5_xfree(val->e_data.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_kdc_rep.c b/src/lib/krb5/free/f_kdc_rep.c
index b4a8bf8737..19791c9bcd 100644
--- a/src/lib/krb5/free/f_kdc_rep.c
+++ b/src/lib/krb5/free/f_kdc_rep.c
@@ -44,9 +44,9 @@ krb5_kdc_rep *val;
     if (val->ticket)
 	krb5_free_ticket(val->ticket);
     if (val->enc_part.ciphertext.data)
-	xfree(val->enc_part.ciphertext.data);
+	krb5_xfree(val->enc_part.ciphertext.data);
     if (val->enc_part2)
 	krb5_free_enc_kdc_rep_part(val->enc_part2);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_kdc_req.c b/src/lib/krb5/free/f_kdc_req.c
index 489fe85597..177ef087e9 100644
--- a/src/lib/krb5/free/f_kdc_req.c
+++ b/src/lib/krb5/free/f_kdc_req.c
@@ -44,15 +44,15 @@ krb5_kdc_req *val;
     if (val->server)
 	krb5_free_principal(val->server);
     if (val->etype)
-	xfree(val->etype);
+	krb5_xfree(val->etype);
     if (val->addresses)
 	krb5_free_addresses(val->addresses);
     if (val->authorization_data.ciphertext.data)
-	xfree(val->authorization_data.ciphertext.data);
+	krb5_xfree(val->authorization_data.ciphertext.data);
     if (val->unenc_authdata)
 	krb5_free_authdata(val->unenc_authdata);
     if (val->second_ticket)
 	krb5_free_tickets(val->second_ticket);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_keyblock.c b/src/lib/krb5/free/f_keyblock.c
index 14d395331a..18dbcc289a 100644
--- a/src/lib/krb5/free/f_keyblock.c
+++ b/src/lib/krb5/free/f_keyblock.c
@@ -39,8 +39,8 @@ register krb5_keyblock *val;
 {
     if (val->contents) {
 	memset((char *)val->contents, 0, val->length);
-	xfree(val->contents);
+	krb5_xfree(val->contents);
     }
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_last_req.c b/src/lib/krb5/free/f_last_req.c
index 240cde482c..e731d1d93b 100644
--- a/src/lib/krb5/free/f_last_req.c
+++ b/src/lib/krb5/free/f_last_req.c
@@ -40,7 +40,7 @@ krb5_last_req_entry **val;
     register krb5_last_req_entry **temp;
 
     for (temp = val; *temp; temp++)
-	xfree(*temp);
-    xfree(val);
+	krb5_xfree(*temp);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_padata.c b/src/lib/krb5/free/f_padata.c
index 86523ac2de..384fbfb4e6 100644
--- a/src/lib/krb5/free/f_padata.c
+++ b/src/lib/krb5/free/f_padata.c
@@ -41,9 +41,9 @@ krb5_pa_data **val;
 
     for (temp = val; *temp; temp++) {
 	if ((*temp)->contents)
-	    xfree((*temp)->contents);
-	xfree(*temp);
+	    krb5_xfree((*temp)->contents);
+	krb5_xfree(*temp);
     }
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_princ.c b/src/lib/krb5/free/f_princ.c
index 802707efc1..cf8a933974 100644
--- a/src/lib/krb5/free/f_princ.c
+++ b/src/lib/krb5/free/f_princ.c
@@ -42,10 +42,10 @@ krb5_principal val;
     if (val->data) {
 	while(--i >= 0)
 	    free(krb5_princ_component(val, i)->data);
-	xfree(val->data);
+	krb5_xfree(val->data);
     }
     if (val->realm.data)
-	xfree(val->realm.data);
-    xfree(val);
+	krb5_xfree(val->realm.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_priv.c b/src/lib/krb5/free/f_priv.c
index 28f7e1d508..6ad616a8f9 100644
--- a/src/lib/krb5/free/f_priv.c
+++ b/src/lib/krb5/free/f_priv.c
@@ -38,7 +38,7 @@ krb5_free_priv(val)
 register krb5_priv *val;
 {
     if (val->enc_part.ciphertext.data)
-	xfree(val->enc_part.ciphertext.data);
-    xfree(val);
+	krb5_xfree(val->enc_part.ciphertext.data);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_priv_enc.c b/src/lib/krb5/free/f_priv_enc.c
index 0d65970253..a645344cab 100644
--- a/src/lib/krb5/free/f_priv_enc.c
+++ b/src/lib/krb5/free/f_priv_enc.c
@@ -38,11 +38,11 @@ krb5_free_priv_enc_part(val)
 register krb5_priv_enc_part *val;
 {
     if (val->user_data.data)
-	xfree(val->user_data.data);
+	krb5_xfree(val->user_data.data);
     if (val->r_address)
 	krb5_free_address(val->r_address);
     if (val->s_address)
 	krb5_free_address(val->s_address);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_pwd_data.c b/src/lib/krb5/free/f_pwd_data.c
index 95d1a3125f..9688101d2a 100644
--- a/src/lib/krb5/free/f_pwd_data.c
+++ b/src/lib/krb5/free/f_pwd_data.c
@@ -39,6 +39,6 @@ krb5_pwd_data *val;
 {
     if (val->element)
 	krb5_free_pwd_sequences(val->element);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_pwd_seq.c b/src/lib/krb5/free/f_pwd_seq.c
index 65b072c34f..4f51a7d257 100644
--- a/src/lib/krb5/free/f_pwd_seq.c
+++ b/src/lib/krb5/free/f_pwd_seq.c
@@ -38,8 +38,8 @@ krb5_free_pwd_sequences(val)
 passwd_phrase_element **val;
 {
     if ((*val)->passwd)
-	xfree((*val)->passwd);
+	krb5_xfree((*val)->passwd);
     if ((*val)->phrase)
-	xfree((*val)->phrase);
+	krb5_xfree((*val)->phrase);
     return;
 }
diff --git a/src/lib/krb5/free/f_safe.c b/src/lib/krb5/free/f_safe.c
index b884236455..b07b789cf7 100644
--- a/src/lib/krb5/free/f_safe.c
+++ b/src/lib/krb5/free/f_safe.c
@@ -38,13 +38,13 @@ krb5_free_safe(val)
 register krb5_safe *val;
 {
     if (val->user_data.data)
-	xfree(val->user_data.data);
+	krb5_xfree(val->user_data.data);
     if (val->r_address)
 	krb5_free_address(val->r_address);
     if (val->s_address)
 	krb5_free_address(val->s_address);
     if (val->checksum)
 	krb5_free_checksum(val->checksum);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_tgt_cred.c b/src/lib/krb5/free/f_tgt_cred.c
index 3cf91f69b5..ac363ccafd 100644
--- a/src/lib/krb5/free/f_tgt_cred.c
+++ b/src/lib/krb5/free/f_tgt_cred.c
@@ -41,5 +41,5 @@ krb5_creds **tgts;
     register krb5_creds **tgtpp;
     for (tgtpp = tgts; *tgtpp; tgtpp++)
 	krb5_free_creds(*tgtpp);
-    xfree(tgts);
+    krb5_xfree(tgts);
 }
diff --git a/src/lib/krb5/free/f_ticket.c b/src/lib/krb5/free/f_ticket.c
index 839dfb289b..8cf3e98c95 100644
--- a/src/lib/krb5/free/f_ticket.c
+++ b/src/lib/krb5/free/f_ticket.c
@@ -40,9 +40,9 @@ krb5_ticket *val;
     if (val->server)
 	krb5_free_principal(val->server);
     if (val->enc_part.ciphertext.data)
-	xfree(val->enc_part.ciphertext.data);
+	krb5_xfree(val->enc_part.ciphertext.data);
     if (val->enc_part2)
 	krb5_free_enc_tkt_part(val->enc_part2);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_tickets.c b/src/lib/krb5/free/f_tickets.c
index 6a61d697e9..f4b768ace4 100644
--- a/src/lib/krb5/free/f_tickets.c
+++ b/src/lib/krb5/free/f_tickets.c
@@ -41,6 +41,6 @@ krb5_ticket **val;
 
     for (temp = val; *temp; temp++)
         krb5_free_ticket(*temp);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/free/f_tkt_auth.c b/src/lib/krb5/free/f_tkt_auth.c
index 3152eeb3ee..732892e7af 100644
--- a/src/lib/krb5/free/f_tkt_auth.c
+++ b/src/lib/krb5/free/f_tkt_auth.c
@@ -41,6 +41,6 @@ krb5_tkt_authent *val;
 	    krb5_free_ticket(val->ticket);
     if (val->authenticator)
 	    krb5_free_authenticator(val->authenticator);
-    xfree(val);
+    krb5_xfree(val);
     return;
 }
diff --git a/src/lib/krb5/keytab/file/ktf_close.c b/src/lib/krb5/keytab/file/ktf_close.c
index 27910f52de..21c7e87701 100644
--- a/src/lib/krb5/keytab/file/ktf_close.c
+++ b/src/lib/krb5/keytab/file/ktf_close.c
@@ -47,9 +47,9 @@ krb5_ktfile_close(id)
    * This routine should undo anything done by krb5_ktfile_resolve().
    */
 {
-    xfree(KTFILENAME(id));
-    xfree(id->data);
+    krb5_xfree(KTFILENAME(id));
+    krb5_xfree(id->data);
     id->ops = 0;
-    xfree(id);
+    krb5_xfree(id);
     return (0);
 }
diff --git a/src/lib/krb5/keytab/file/ktf_endget.c b/src/lib/krb5/keytab/file/ktf_endget.c
index c4f1d62db8..e0ac73b98b 100644
--- a/src/lib/krb5/keytab/file/ktf_endget.c
+++ b/src/lib/krb5/keytab/file/ktf_endget.c
@@ -40,6 +40,6 @@ krb5_ktfile_end_get(id, cursor)
 krb5_keytab id;
 krb5_kt_cursor *cursor;
 {
-    xfree(*cursor);
+    krb5_xfree(*cursor);
     return krb5_ktfileint_close(id);
 }
diff --git a/src/lib/krb5/keytab/file/ktf_get_en.c b/src/lib/krb5/keytab/file/ktf_get_en.c
index 35bd810b0f..f46b9a8261 100644
--- a/src/lib/krb5/keytab/file/ktf_get_en.c
+++ b/src/lib/krb5/keytab/file/ktf_get_en.c
@@ -77,7 +77,7 @@ OLDDECLARG(krb5_keytab_entry *, entry)
     if (!(kerror = krb5_ktfileint_close(id))) {
 	if (cur_entry) {
 	    *entry = *cur_entry;
-	    xfree(cur_entry);
+	    krb5_xfree(cur_entry);
 	} else
 	    kerror = KRB5_KT_NOTFOUND;
     } else
diff --git a/src/lib/krb5/keytab/file/ktf_next.c b/src/lib/krb5/keytab/file/ktf_next.c
index 7482f935f2..80edf09a40 100644
--- a/src/lib/krb5/keytab/file/ktf_next.c
+++ b/src/lib/krb5/keytab/file/ktf_next.c
@@ -51,6 +51,6 @@ krb5_kt_cursor *cursor;
 	return kerror;
     *fileoff = ftell(KTFILEP(id));
     *entry = *cur_entry;
-    xfree(cur_entry);
+    krb5_xfree(cur_entry);
     return 0;
 }
diff --git a/src/lib/krb5/keytab/file/ktf_resolv.c b/src/lib/krb5/keytab/file/ktf_resolv.c
index bf6ea489f9..10364fd869 100644
--- a/src/lib/krb5/keytab/file/ktf_resolv.c
+++ b/src/lib/krb5/keytab/file/ktf_resolv.c
@@ -48,13 +48,13 @@ krb5_ktfile_resolve(name, id)
     
     (*id)->ops = &krb5_ktf_ops;
     if ((data = (krb5_ktfile_data *)malloc(sizeof(krb5_ktfile_data))) == NULL) {
-	xfree(*id);
+	krb5_xfree(*id);
 	return(ENOMEM);
     }
 
     if ((data->name = (char *)calloc(strlen(name) + 1, sizeof(char))) == NULL) {
-	xfree(data);
-	xfree(*id);
+	krb5_xfree(data);
+	krb5_xfree(*id);
 	return(ENOMEM);
     }
 
diff --git a/src/lib/krb5/keytab/file/ktf_wreslv.c b/src/lib/krb5/keytab/file/ktf_wreslv.c
index 0127070a2a..aa875c4107 100644
--- a/src/lib/krb5/keytab/file/ktf_wreslv.c
+++ b/src/lib/krb5/keytab/file/ktf_wreslv.c
@@ -48,13 +48,13 @@ krb5_ktfile_wresolve(name, id)
     
     (*id)->ops = &krb5_ktf_writable_ops;
     if ((data = (krb5_ktfile_data *)malloc(sizeof(krb5_ktfile_data))) == NULL) {
-	xfree(*id);
+	krb5_xfree(*id);
 	return(ENOMEM);
     }
 
     if ((data->name = (char *)calloc(strlen(name) + 1, sizeof(char))) == NULL) {
-	xfree(data);
-	xfree(*id);
+	krb5_xfree(data);
+	krb5_xfree(*id);
 	return(ENOMEM);
     }
 
diff --git a/src/lib/krb5/keytab/ktfr_entry.c b/src/lib/krb5/keytab/ktfr_entry.c
index e07d1515ed..28dcae6997 100644
--- a/src/lib/krb5/keytab/ktfr_entry.c
+++ b/src/lib/krb5/keytab/ktfr_entry.c
@@ -39,6 +39,6 @@ krb5_keytab_entry *entry;
 {
     krb5_free_principal(entry->principal);
     memset((char *)entry->key.contents, 0, entry->key.length);
-    xfree(entry->key.contents);
+    krb5_xfree(entry->key.contents);
     return 0;
 }
diff --git a/src/lib/krb5/krb/bld_pr_ext.c b/src/lib/krb5/krb/bld_pr_ext.c
index 4e7837435a..5df39f5b3b 100644
--- a/src/lib/krb5/krb/bld_pr_ext.c
+++ b/src/lib/krb5/krb/bld_pr_ext.c
@@ -78,15 +78,15 @@ va_dcl
 	return ENOMEM;
     princ_ret = (krb5_principal) malloc(sizeof(krb5_principal_data));
     if (!princ_ret) {
-	xfree(princ_data);
+	krb5_xfree(princ_data);
 	return ENOMEM;
     }
     princ_ret->data = princ_data;
     princ_ret->length = count;
     tmpdata = malloc(rlen+1);
     if (!tmpdata) {
-	xfree(princ_data);
-	xfree(princ_ret);
+	krb5_xfree(princ_data);
+	krb5_xfree(princ_ret);
 	return ENOMEM;
     }	
     krb5_princ_set_realm_length(princ_ret, rlen);
@@ -117,9 +117,9 @@ va_dcl
 
 free_out:
     while (i-- >= 0)
-	xfree(princ_data[i].data);
-    xfree(princ_data);
-    xfree(princ_ret);
+	krb5_xfree(princ_data[i].data);
+    krb5_xfree(princ_data);
+    krb5_xfree(princ_ret);
     va_end(ap);
     return ENOMEM;
 }
diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c
index f56fefb0e6..62aa8d8367 100644
--- a/src/lib/krb5/krb/bld_princ.c
+++ b/src/lib/krb5/krb/bld_princ.c
@@ -82,9 +82,9 @@ va_list ap;
 	    if (!p_tmp) {
 	    free_out:
 		    while (--i >= 0)
-			xfree(data[i].data);
-		    xfree(data);
-		    xfree(tmpdata);
+			krb5_xfree(data[i].data);
+		    krb5_xfree(data);
+		    krb5_xfree(tmpdata);
 		    return (ENOMEM);
 	    }
 	    count *= 2;
diff --git a/src/lib/krb5/krb/copy_addrs.c b/src/lib/krb5/krb/copy_addrs.c
index 623b9e3a53..b1551395a7 100644
--- a/src/lib/krb5/krb/copy_addrs.c
+++ b/src/lib/krb5/krb/copy_addrs.c
@@ -45,7 +45,7 @@ krb5_address **outad;
 	return ENOMEM;
     *tmpad = *inad;
     if (!(tmpad->contents = (krb5_octet *)malloc(inad->length))) {
-	xfree(tmpad);
+	krb5_xfree(tmpad);
 	return ENOMEM;
     }
     memcpy((char *)tmpad->contents, (char *)inad->contents, inad->length);
diff --git a/src/lib/krb5/krb/copy_athctr.c b/src/lib/krb5/krb/copy_athctr.c
index 28a5138739..6fc5684adf 100644
--- a/src/lib/krb5/krb/copy_athctr.c
+++ b/src/lib/krb5/krb/copy_athctr.c
@@ -48,24 +48,24 @@ krb5_authenticator **authto;
 
     retval = krb5_copy_principal(authfrom->client, &tempto->client);
     if (retval) {
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }
     
     if (authfrom->checksum &&
 	(retval = krb5_copy_checksum(authfrom->checksum, &tempto->checksum))) {
 	    krb5_free_principal(tempto->client);    
-	    xfree(tempto);
+	    krb5_xfree(tempto);
 	    return retval;
     }
     
     if (authfrom->subkey) {
 	    retval = krb5_copy_keyblock(authfrom->subkey, &tempto->subkey);
 	    if (retval) {
-		    xfree(tempto->subkey);
+		    krb5_xfree(tempto->subkey);
 		    krb5_free_checksum(tempto->checksum);
 		    krb5_free_principal(tempto->client);    
-		    xfree(tempto);
+		    krb5_xfree(tempto);
 		    return retval;
 	    }
     }
@@ -74,11 +74,11 @@ krb5_authenticator **authto;
 		retval = krb5_copy_authdata(authfrom->authorization_data,
 				    &tempto->authorization_data);
 		if (retval) {
-		    xfree(tempto->subkey);
+		    krb5_xfree(tempto->subkey);
 		    krb5_free_checksum(tempto->checksum);
 		    krb5_free_principal(tempto->client);    
 		    krb5_free_authdata(tempto->authorization_data);
-		    xfree(tempto);
+		    krb5_xfree(tempto);
 		    return retval;
 		}
     }
diff --git a/src/lib/krb5/krb/copy_auth.c b/src/lib/krb5/krb/copy_auth.c
index a36aad4744..8c6e737185 100644
--- a/src/lib/krb5/krb/copy_auth.c
+++ b/src/lib/krb5/krb/copy_auth.c
@@ -45,7 +45,7 @@ krb5_authdata **outad;
 	return ENOMEM;
     *tmpad = *inad;
     if (!(tmpad->contents = (krb5_octet *)malloc(inad->length))) {
-	xfree(tmpad);
+	krb5_xfree(tmpad);
 	return ENOMEM;
     }
     memcpy((char *)tmpad->contents, (char *)inad->contents, inad->length);
diff --git a/src/lib/krb5/krb/copy_cksum.c b/src/lib/krb5/krb/copy_cksum.c
index 8b7a0d903e..a6f42ae622 100644
--- a/src/lib/krb5/krb/copy_cksum.c
+++ b/src/lib/krb5/krb/copy_cksum.c
@@ -47,7 +47,7 @@ krb5_checksum **ckto;
 
     if (!(tempto->contents =
 	  (krb5_octet *)malloc(tempto->length))) {
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return ENOMEM;
     }
     memcpy((char *) tempto->contents, (char *) ckfrom->contents,
diff --git a/src/lib/krb5/krb/copy_creds.c b/src/lib/krb5/krb/copy_creds.c
index 3871d64cdb..45837087f8 100644
--- a/src/lib/krb5/krb/copy_creds.c
+++ b/src/lib/krb5/krb/copy_creds.c
@@ -68,13 +68,13 @@ krb5_creds **outcred;
     if (retval)
 	goto cleanaddrs;
     tempcred->ticket = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
     retval = krb5_copy_data(&incred->second_ticket, &scratch);
     if (retval)
 	goto cleanticket;
 
     tempcred->second_ticket = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
 
     retval = krb5_copy_authdata(incred->authdata,&tempcred->authdata);
     if (retval)
@@ -90,12 +90,12 @@ krb5_creds **outcred;
  cleanaddrs:
     krb5_free_addresses(tempcred->addresses);
  cleanblock:
-    xfree(tempcred->keyblock.contents);
+    krb5_xfree(tempcred->keyblock.contents);
  cleanserver:
     krb5_free_principal(tempcred->server);
  cleanclient:
     krb5_free_principal(tempcred->client);
  cleanlast:
-    xfree(tempcred);
+    krb5_xfree(tempcred);
     return retval;
 }
diff --git a/src/lib/krb5/krb/copy_data.c b/src/lib/krb5/krb/copy_data.c
index f86d04c491..d192ec2538 100644
--- a/src/lib/krb5/krb/copy_data.c
+++ b/src/lib/krb5/krb/copy_data.c
@@ -54,7 +54,7 @@ krb5_data **outdata;
     tempdata->length = indata->length;
     if (tempdata->length) {
 	if (!(tempdata->data = malloc(tempdata->length))) {
-	    xfree(tempdata);
+	    krb5_xfree(tempdata);
 	    return ENOMEM;
 	}
 	memcpy((char *)tempdata->data, (char *)indata->data, tempdata->length);
diff --git a/src/lib/krb5/krb/copy_key.c b/src/lib/krb5/krb/copy_key.c
index b20206fe27..444729d5a8 100644
--- a/src/lib/krb5/krb/copy_key.c
+++ b/src/lib/krb5/krb/copy_key.c
@@ -47,7 +47,7 @@ krb5_keyblock **to;
 		return ENOMEM;
 	*new_key = *from;
 	if (!(new_key->contents = (krb5_octet *)malloc(new_key->length))) {
-		xfree(new_key);
+		krb5_xfree(new_key);
 		return(ENOMEM);
 	}
 	memcpy((char *)new_key->contents, (char *)from->contents,
diff --git a/src/lib/krb5/krb/copy_tick.c b/src/lib/krb5/krb/copy_tick.c
index 660f1945d8..8871d1b088 100644
--- a/src/lib/krb5/krb/copy_tick.c
+++ b/src/lib/krb5/krb/copy_tick.c
@@ -48,13 +48,13 @@ krb5_enc_tkt_part **partto;
     retval = krb5_copy_keyblock(partfrom->session,
 				&tempto->session);
     if (retval) {
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }
     retval = krb5_copy_principal(partfrom->client, &tempto->client);
     if (retval) {
 	krb5_free_keyblock(tempto->session);
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }
     tempto->transited = partfrom->transited;
@@ -66,7 +66,7 @@ krb5_enc_tkt_part **partto;
 	if (!tempto->transited.tr_contents.data) {
 	    krb5_free_principal(tempto->client);
 	    krb5_free_keyblock(tempto->session);
-	    xfree(tempto);
+	    krb5_xfree(tempto);
 	    return retval;
 	}
 	memcpy((char *)tempto->transited.tr_contents.data,
@@ -76,10 +76,10 @@ krb5_enc_tkt_part **partto;
 
     retval = krb5_copy_addresses(partfrom->caddrs, &tempto->caddrs);
     if (retval) {
-	xfree(tempto->transited.tr_contents.data);
+	krb5_xfree(tempto->transited.tr_contents.data);
 	krb5_free_principal(tempto->client);
 	krb5_free_keyblock(tempto->session);
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }
     if (partfrom->authorization_data) {
@@ -87,10 +87,10 @@ krb5_enc_tkt_part **partto;
 				    &tempto->authorization_data);
 	if (retval) {
 	    krb5_free_addresses(tempto->caddrs);
-	    xfree(tempto->transited.tr_contents.data);
+	    krb5_xfree(tempto->transited.tr_contents.data);
 	    krb5_free_principal(tempto->client);
 	    krb5_free_keyblock(tempto->session);
-	    xfree(tempto);
+	    krb5_xfree(tempto);
 	    return retval;
 	}
     }
@@ -116,16 +116,16 @@ krb5_ticket **pto;
     retval = krb5_copy_data(&from->enc_part.ciphertext, &scratch);
     if (retval) {
 	krb5_free_principal(tempto->server);
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }
     tempto->enc_part.ciphertext = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
     retval = krb5_copy_enc_tkt_part(from->enc_part2, &tempto->enc_part2);
     if (retval) {
-	xfree(tempto->enc_part.ciphertext.data);
+	krb5_xfree(tempto->enc_part.ciphertext.data);
 	krb5_free_principal(tempto->server);
-	xfree(tempto);
+	krb5_xfree(tempto);
 	return retval;
     }	
     *pto = tempto;
diff --git a/src/lib/krb5/krb/encode_kdc.c b/src/lib/krb5/krb/encode_kdc.c
index 3d11b63b8b..84aa4493b2 100644
--- a/src/lib/krb5/krb/encode_kdc.c
+++ b/src/lib/krb5/krb/encode_kdc.c
@@ -93,7 +93,7 @@ krb5_free_data(scratch); }
     if (!(scratch->data = realloc(scratch->data,
 				  dec_rep->enc_part.ciphertext.length))) {
 	/* may destroy scratch->data */
-	xfree(scratch);
+	krb5_xfree(scratch);
 	return ENOMEM;
     }
     memset(scratch->data + scratch->length, 0,
diff --git a/src/lib/krb5/krb/encrypt_tk.c b/src/lib/krb5/krb/encrypt_tk.c
index 636146ef6d..80d4fc278e 100644
--- a/src/lib/krb5/krb/encrypt_tk.c
+++ b/src/lib/krb5/krb/encrypt_tk.c
@@ -81,7 +81,7 @@ krb5_free_data(scratch); }
     if (!(scratch->data = realloc(scratch->data,
 				  dec_ticket->enc_part.ciphertext.length))) {
 	/* may destroy scratch->data */
-	xfree(scratch);
+	krb5_xfree(scratch);
 	return ENOMEM;
     }
     memset(scratch->data + scratch->length, 0,
diff --git a/src/lib/krb5/krb/free_rtree.c b/src/lib/krb5/krb/free_rtree.c
index 82a5ee8a66..65bf747d34 100644
--- a/src/lib/krb5/krb/free_rtree.c
+++ b/src/lib/krb5/krb/free_rtree.c
@@ -42,5 +42,5 @@ krb5_principal *realms;
 	krb5_free_principal(*nrealms);
 	nrealms++;
     }
-    xfree(realms);
+    krb5_xfree(realms);
 }
diff --git a/src/lib/krb5/krb/gc_2tgt.c b/src/lib/krb5/krb/gc_2tgt.c
index d917be4ff7..2aca318bcf 100644
--- a/src/lib/krb5/krb/gc_2tgt.c
+++ b/src/lib/krb5/krb/gc_2tgt.c
@@ -181,7 +181,7 @@ register krb5_creds * cred;
     }
 
     cred->ticket = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
 
     krb5_free_kdc_rep(dec_rep);
     return 0;
diff --git a/src/lib/krb5/krb/gc_via_tgt.c b/src/lib/krb5/krb/gc_via_tgt.c
index 0614e6859e..64d38d9b7d 100644
--- a/src/lib/krb5/krb/gc_via_tgt.c
+++ b/src/lib/krb5/krb/gc_via_tgt.c
@@ -215,7 +215,7 @@ OLDDECLARG(krb5_creds *, cred)
     }
 
     cred->ticket = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
 
     krb5_free_kdc_rep(dec_rep);
     return retval;
diff --git a/src/lib/krb5/krb/gen_seqnum.c b/src/lib/krb5/krb/gen_seqnum.c
index 1aa0b62a2b..d4ee4b826e 100644
--- a/src/lib/krb5/krb/gen_seqnum.c
+++ b/src/lib/krb5/krb/gen_seqnum.c
@@ -83,7 +83,7 @@ krb5_int32 *seqno;
     }
     outtmp = (krb5_octet *)malloc(esize);
     if (!outtmp) {
-	xfree(intmp);
+	krb5_xfree(intmp);
 	krb5_free_keyblock(subkey);
 	return ENOMEM;
     }
@@ -118,8 +118,8 @@ krb5_int32 *seqno;
     (void) krb5_finish_key(&eblock);
  cleanup:
     krb5_free_keyblock(subkey);
-    xfree(intmp);
-    xfree(outtmp);
+    krb5_xfree(intmp);
+    krb5_xfree(outtmp);
     return retval;
 }
 
diff --git a/src/lib/krb5/krb/gen_subkey.c b/src/lib/krb5/krb/gen_subkey.c
index b992e1daee..e1124e0d4f 100644
--- a/src/lib/krb5/krb/gen_subkey.c
+++ b/src/lib/krb5/krb/gen_subkey.c
@@ -57,7 +57,7 @@ krb5_keyblock **subkey;
 	
     if (retval = krb5_random_key(&eblock, random_state, subkey)) {
 	(void) krb5_finish_random_key(&eblock, &random_state);
-	xfree(*subkey);
+	krb5_xfree(*subkey);
 	return retval;
     }	
     /* ignore the error if any, since we've already gotten the key out */
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 2b8b9f776b..320a3b2080 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -208,7 +208,7 @@ OLDDECLARG(krb5_kdc_rep **, ret_as_reply)
 	if (retval = decode_krb5_error(&reply, &err_reply)) {
 	    if (decrypt_key)
 		krb5_free_keyblock(decrypt_key);
-	    xfree(reply.data);
+	    krb5_xfree(reply.data);
             return retval;              /* some other reply--??? */
 	}
 	/* it was an error */
@@ -225,23 +225,23 @@ OLDDECLARG(krb5_kdc_rep **, ret_as_reply)
 	krb5_free_error(err_reply);
 	if (decrypt_key)
 	    krb5_free_keyblock(decrypt_key);
-	xfree(reply.data);
+	krb5_xfree(reply.data);
 	return retval;
     }
 
     if (!krb5_is_as_rep(&reply)) {
 	if (decrypt_key)
 	    krb5_free_keyblock(decrypt_key);
-	xfree(reply.data);
+	krb5_xfree(reply.data);
 	return KRB5KRB_AP_ERR_MSG_TYPE;
     }
     if (retval = decode_krb5_as_rep(&reply, &as_reply)) {
 	if (decrypt_key)
 	    krb5_free_keyblock(decrypt_key);
-	xfree(reply.data);
+	krb5_xfree(reply.data);
 	return retval;		/* some other reply--??? */
     }
-    xfree(reply.data);
+    krb5_xfree(reply.data);
     if (as_reply->msg_type != KRB5_AS_REP) {
 	if (decrypt_key)
 	    krb5_free_keyblock(decrypt_key);
@@ -309,7 +309,7 @@ OLDDECLARG(krb5_kdc_rep **, ret_as_reply)
     }
 #define cleanup_key() {memset((char *)creds->keyblock.contents, 0,\
 			     creds->keyblock.length); \
-		       xfree(creds->keyblock.contents); \
+		       krb5_xfree(creds->keyblock.contents); \
 		       creds->keyblock.contents = 0; \
 		       creds->keyblock.length = 0;}
 
@@ -333,13 +333,13 @@ OLDDECLARG(krb5_kdc_rep **, ret_as_reply)
 	return retval;
     }	
     creds->ticket = *packet;
-    xfree(packet);
+    krb5_xfree(packet);
 
     /* store it in the ccache! */
     if (retval = krb5_cc_store_cred(ccache, creds)) {
 	krb5_free_kdc_rep(as_reply);
 	/* clean up the pieces */
-	xfree(creds->ticket.data);
+	krb5_xfree(creds->ticket.data);
 	krb5_free_addresses(creds->addresses);
 	cleanup_key();
 	return retval;
diff --git a/src/lib/krb5/krb/in_tkt_pwd.c b/src/lib/krb5/krb/in_tkt_pwd.c
index aa84038680..712f271199 100644
--- a/src/lib/krb5/krb/in_tkt_pwd.c
+++ b/src/lib/krb5/krb/in_tkt_pwd.c
@@ -93,7 +93,7 @@ OLDDECLARG(krb5_pa_data **,padata)
 	if (retval = krb5_read_password(krb5_default_pwd_prompt1,
 					0,
 					pwdbuf, &pwsize)) {
-	    if (f_salt) xfree(salt.data);
+	    if (f_salt) krb5_xfree(salt.data);
 	    return retval;
 	}
 	arg2 = *arg;
@@ -103,7 +103,7 @@ OLDDECLARG(krb5_pa_data **,padata)
     }
     *key = (krb5_keyblock *)malloc(sizeof(**key));
     if (!*key) {
-	if (f_salt) xfree(salt.data);
+	if (f_salt) krb5_xfree(salt.data);
 	return ENOMEM;
     }    
     if (retval = (*krb5_keytype_array[type]->system->
@@ -111,11 +111,11 @@ OLDDECLARG(krb5_pa_data **,padata)
 				 *key,
 				 &arg->password,
                                  &salt)) {
-	xfree(*key);
-	if (f_salt) xfree(salt.data);
+	krb5_xfree(*key);
+	if (f_salt) krb5_xfree(salt.data);
 	return(retval);
     }
-    if (f_salt) xfree(salt.data);
+    if (f_salt) krb5_xfree(salt.data);
     return 0;
 }
 
diff --git a/src/lib/krb5/krb/in_tkt_sky.c b/src/lib/krb5/krb/in_tkt_sky.c
index 517f468f04..0c8db227e5 100644
--- a/src/lib/krb5/krb/in_tkt_sky.c
+++ b/src/lib/krb5/krb/in_tkt_sky.c
@@ -83,7 +83,7 @@ OLDDECLARG(krb5_pa_data **,padata)
     else
 	retval = krb5_copy_keyblock(&kt_ent.key, &realkey);
     if (retval) {
-	xfree(realkey);
+	krb5_xfree(realkey);
 	cleanup();
 	return retval;
     }
diff --git a/src/lib/krb5/krb/mk_error.c b/src/lib/krb5/krb/mk_error.c
index 857a558d1a..160c375520 100644
--- a/src/lib/krb5/krb/mk_error.c
+++ b/src/lib/krb5/krb/mk_error.c
@@ -54,6 +54,6 @@ krb5_data *enc_err;
     if (retval = encode_krb5_error(dec_err, &new_enc_err))
 	return(retval);
     *enc_err = *new_enc_err;
-    xfree(new_enc_err);
+    krb5_xfree(new_enc_err);
     return 0;
 }
diff --git a/src/lib/krb5/krb/mk_priv.c b/src/lib/krb5/krb/mk_priv.c
index defbd5ea35..0e9eca8164 100644
--- a/src/lib/krb5/krb/mk_priv.c
+++ b/src/lib/krb5/krb/mk_priv.c
@@ -122,7 +122,7 @@ OLDDECLARG(krb5_data *, outbuf)
     if (!(scratch->data = realloc(scratch->data,
 				  privmsg.enc_part.ciphertext.length))) {
 	/* may destroy scratch->data */
-	xfree(scratch);
+	krb5_xfree(scratch);
 	return ENOMEM;
     }
     memset(scratch->data + scratch->length, 0,
@@ -193,13 +193,13 @@ OLDDECLARG(krb5_data *, outbuf)
 	if (retval = krb5_rc_store(rcache, &replay)) {
 	    /* should we really error out here? XXX */
 	    cleanup_scratch();
-	    xfree(replay.client);
+	    krb5_xfree(replay.client);
 	    return retval;
 	}
-	xfree(replay.client);
+	krb5_xfree(replay.client);
     }
     *outbuf = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
     return 0;
 
  clean_prockey:
diff --git a/src/lib/krb5/krb/mk_rep.c b/src/lib/krb5/krb/mk_rep.c
index 82d0fa3478..c84e39a79d 100644
--- a/src/lib/krb5/krb/mk_rep.c
+++ b/src/lib/krb5/krb/mk_rep.c
@@ -91,7 +91,7 @@ krb5_free_data(scratch); }
     if (!(scratch->data = realloc(scratch->data,
 				  reply.enc_part.ciphertext.length))) {
 	/* may destroy scratch->data */
-	xfree(scratch);
+	krb5_xfree(scratch);
 	return ENOMEM;
     }
     memset(scratch->data + scratch->length, 0,
@@ -132,7 +132,7 @@ reply.enc_part.ciphertext.length = 0; reply.enc_part.ciphertext.data = 0;}
 
     if (!(retval = encode_krb5_ap_rep(&reply, &toutbuf))) {
 	*outbuf = *toutbuf;
-	xfree(toutbuf);
+	krb5_xfree(toutbuf);
     }
     cleanup_encpart();
     return retval;
diff --git a/src/lib/krb5/krb/mk_safe.c b/src/lib/krb5/krb/mk_safe.c
index 061479a936..476216cda4 100644
--- a/src/lib/krb5/krb/mk_safe.c
+++ b/src/lib/krb5/krb/mk_safe.c
@@ -128,17 +128,17 @@ OLDDECLARG(krb5_data *, outbuf)
 					 scratch->length,
 					 (krb5_pointer) key->contents,
 					 key->length, &safe_checksum)) {
-	xfree(safe_checksum.contents);
+	krb5_xfree(safe_checksum.contents);
 	clean_scratch();
 	return retval;
     }
     safemsg.checksum = &safe_checksum;
     clean_scratch();
     if (retval = encode_krb5_safe(&safemsg, &scratch)) {
-	xfree(safe_checksum.contents);
+	krb5_xfree(safe_checksum.contents);
 	return retval;
     }
-    xfree(safe_checksum.contents);
+    krb5_xfree(safe_checksum.contents);
     if (!(safe_flags & KRB5_SAFE_NOTIME)) {
 	krb5_donot_replay replay;
 
@@ -154,13 +154,13 @@ OLDDECLARG(krb5_data *, outbuf)
 	if (retval = krb5_rc_store(rcache, &replay)) {
 	    /* should we really error out here? XXX */
 	    clean_scratch();
-	    xfree(replay.client);
+	    krb5_xfree(replay.client);
 	    return retval;
 	}
-	xfree(replay.client);
+	krb5_xfree(replay.client);
     }
     *outbuf = *scratch;
-    xfree(scratch);
+    krb5_xfree(scratch);
 
     return 0;
 }
diff --git a/src/lib/krb5/krb/parse.c b/src/lib/krb5/krb/parse.c
index b59a8c364b..8fb8bf15ca 100644
--- a/src/lib/krb5/krb/parse.c
+++ b/src/lib/krb5/krb/parse.c
@@ -205,8 +205,8 @@ krb5_parse_name(name, nprincipal)
 	 */
 	tmpdata = malloc(realmsize+1);
 	if (tmpdata == 0) {
-		xfree(principal->data);
-		xfree(principal);
+		krb5_xfree(principal->data);
+		krb5_xfree(principal);
 		return ENOMEM;
 	}
 	krb5_princ_set_realm_data(principal, tmpdata);
@@ -215,10 +215,10 @@ krb5_parse_name(name, nprincipal)
 		  malloc(krb5_princ_component(principal, i)->length + 1);
 		if (!tmpdata) {
 			for (i--; i >= 0; i--)
-				xfree(krb5_princ_component(principal, i)->data);
-			xfree(krb5_princ_realm(principal)->data);
-			xfree(principal->data);
-			xfree(principal);
+				krb5_xfree(krb5_princ_component(principal, i)->data);
+			krb5_xfree(krb5_princ_realm(principal)->data);
+			krb5_xfree(principal->data);
+			krb5_xfree(principal);
 			return(ENOMEM);
 		}
 		krb5_princ_component(principal, i)->data = tmpdata;
diff --git a/src/lib/krb5/krb/rd_priv.c b/src/lib/krb5/krb/rd_priv.c
index a1c6c3c649..1e51f937b1 100644
--- a/src/lib/krb5/krb/rd_priv.c
+++ b/src/lib/krb5/krb/rd_priv.c
@@ -94,7 +94,7 @@ OLDDECLARG(krb5_data *, outbuf)
 	return retval;
     }
     
-#define cleanup_privmsg() {(void)xfree(privmsg->enc_part.ciphertext.data); (void)xfree(privmsg);}
+#define cleanup_privmsg() {(void)krb5_xfree(privmsg->enc_part.ciphertext.data); (void)krb5_xfree(privmsg);}
     if (!valid_etype(privmsg->enc_part.etype)) {
 	cleanup_privmsg();
 	return KRB5_PROG_ETYPE_NOSUPP;
@@ -110,7 +110,7 @@ OLDDECLARG(krb5_data *, outbuf)
         return ENOMEM;
     }
 
-#define cleanup_scratch() {(void)memset(scratch.data, 0, scratch.length); (void)xfree(scratch.data);}
+#define cleanup_scratch() {(void)memset(scratch.data, 0, scratch.length); (void)krb5_xfree(scratch.data);}
 
     /* do any necessary key pre-processing */
     if (retval = krb5_process_key(&eblock, key)) {
@@ -158,8 +158,8 @@ OLDDECLARG(krb5_data *, outbuf)
     }
     cleanup_scratch();
 
-#define cleanup_data() {(void)memset(privmsg_enc_part->user_data.data,0,privmsg_enc_part->user_data.length); (void)xfree(privmsg_enc_part->user_data.data);}
-#define cleanup_mesg() {(void)xfree(privmsg_enc_part);}
+#define cleanup_data() {(void)memset(privmsg_enc_part->user_data.data,0,privmsg_enc_part->user_data.length); (void)krb5_xfree(privmsg_enc_part->user_data.data);}
+#define cleanup_mesg() {(void)krb5_xfree(privmsg_enc_part);}
 
     if (!(priv_flags & KRB5_PRIV_NOTIME)) {
 	krb5_donot_replay replay;
@@ -201,12 +201,12 @@ OLDDECLARG(krb5_data *, outbuf)
 	replay.cusec = privmsg_enc_part->usec;
 	replay.ctime = privmsg_enc_part->timestamp;
 	if (retval = krb5_rc_store(rcache, &replay)) {
-	    xfree(replay.client);
+	    krb5_xfree(replay.client);
 	    cleanup_data();
 	    cleanup_mesg();  
 	    return retval;
 	}
-	xfree(replay.client);
+	krb5_xfree(replay.client);
     }
 
     if (priv_flags & KRB5_PRIV_DOSEQUENCE)
diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 8c327f7490..bf573ebd71 100644
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -182,8 +182,8 @@ krb5_tkt_authent **authdat;
 	if (retval)
 	    goto cleanup;
 	retval = krb5_rc_store(rcache, &rep);
-	xfree(rep.server);
-	xfree(rep.client);
+	krb5_xfree(rep.server);
+	krb5_xfree(rep.client);
 	if (retval)
 	    goto cleanup;
     }
diff --git a/src/lib/krb5/krb/rd_req_sim.c b/src/lib/krb5/krb/rd_req_sim.c
index 2cf92989ff..ad29c51f2f 100644
--- a/src/lib/krb5/krb/rd_req_sim.c
+++ b/src/lib/krb5/krb/rd_req_sim.c
@@ -80,7 +80,7 @@ krb5_tkt_authent **authdat;
 				     sender_addr, 0,
 				     0, 0, rcache, authdat);
 	krb5_rc_close(rcache);
-	xfree(rcache);
+	krb5_xfree(rcache);
     }
     krb5_free_ap_req(request);
 
diff --git a/src/lib/krb5/krb/rd_safe.c b/src/lib/krb5/krb/rd_safe.c
index 7068aa4f8a..8e6cd992db 100644
--- a/src/lib/krb5/krb/rd_safe.c
+++ b/src/lib/krb5/krb/rd_safe.c
@@ -119,11 +119,11 @@ krb5_data *outbuf;
 	replay.cusec = message->usec;
 	replay.ctime = message->timestamp;
 	if (retval = krb5_rc_store(rcache, &replay)) {
-	    xfree(replay.client);
+	    krb5_xfree(replay.client);
 	    cleanup();
 	    return retval;
 	}
-	xfree(replay.client);
+	krb5_xfree(replay.client);
     }
 
     if (safe_flags & KRB5_SAFE_DOSEQUENCE)
@@ -173,7 +173,7 @@ krb5_data *outbuf;
     }
 
 #undef cleanup
-#define cleanup() {krb5_free_safe(message); xfree(our_cksum.contents);}
+#define cleanup() {krb5_free_safe(message); krb5_xfree(our_cksum.contents);}
 
     retval = krb5_calculate_checksum(his_cksum->checksum_type,
 				     scratch->data, scratch->length,
@@ -196,13 +196,13 @@ krb5_data *outbuf;
 
     *outbuf = message->user_data;
 
-    xfree(our_cksum.contents);
+    krb5_xfree(our_cksum.contents);
     if (message->s_address)
 	krb5_free_address(message->s_address);
     if (message->r_address)
 	krb5_free_address(message->r_address);
     krb5_free_checksum(his_cksum);
-    xfree(message);
+    krb5_xfree(message);
 
     return 0;
 }
diff --git a/src/lib/krb5/krb/recvauth.c b/src/lib/krb5/krb/recvauth.c
index 1b51459158..3e8775a846 100644
--- a/src/lib/krb5/krb/recvauth.c
+++ b/src/lib/krb5/krb/recvauth.c
@@ -92,21 +92,21 @@ krb5_recvauth(/* IN */
 	if (retval = krb5_read_message(fd, &inbuf))
 		return(retval);
 	if (strcmp(inbuf.data, sendauth_version)) {
-		xfree(inbuf.data);
+		krb5_xfree(inbuf.data);
 		problem = KRB5_SENDAUTH_BADAUTHVERS;
 	}
-	xfree(inbuf.data);
+	krb5_xfree(inbuf.data);
 	/*
 	 * Do the same thing for the application version string.
 	 */
 	if (retval = krb5_read_message(fd, &inbuf))
 		return(retval);
 	if (strcmp(inbuf.data, appl_version)) {
-		xfree(inbuf.data);
+		krb5_xfree(inbuf.data);
 		if (!problem)
 			problem = KRB5_SENDAUTH_BADAPPLVERS;
 	}
-	xfree(inbuf.data);
+	krb5_xfree(inbuf.data);
 	/*
 	 * OK, now check the problem variable.  If it's zero, we're
 	 * fine and we can continue.  Otherwise, we have to signal an
@@ -199,7 +199,7 @@ krb5_recvauth(/* IN */
 	if (!problem)
 		problem = krb5_rd_req(&inbuf, server, sender_addr, fetch_from,
 				      keyproc, keyprocarg, rcache, &authdat);
-	xfree(inbuf.data);
+	krb5_xfree(inbuf.data);
 #ifdef WORKING_RCACHE
 	if (rcache)
 	    retval = krb5_rc_close(rcache);
@@ -242,7 +242,7 @@ krb5_recvauth(/* IN */
 	}
 	if (retval = krb5_write_message(fd, &outbuf)) {
 		if (outbuf.data)
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 		if (!problem)
 			krb5_free_tkt_authent(authdat);
 		return(retval);
@@ -287,11 +287,11 @@ krb5_recvauth(/* IN */
 			return(retval);
 		}
 		if (retval = krb5_write_message(fd, &outbuf)) {
-			xfree(outbuf.data);
+			krb5_xfree(outbuf.data);
 			krb5_free_tkt_authent(authdat);
 			return(retval);
 		}
-		xfree(outbuf.data);
+		krb5_xfree(outbuf.data);
 	}
 	/*
 	 * At this point, we've won.  We just need to copy whatever
@@ -321,7 +321,7 @@ krb5_recvauth(/* IN */
 		*authent = authdat->authenticator;
 	else
 		krb5_free_authenticator(authdat->authenticator);
-	xfree(authdat);
+	krb5_xfree(authdat);
 	return 0;
 }
 
diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c
index ef2a13d7a7..62093f33ff 100644
--- a/src/lib/krb5/krb/send_tgs.c
+++ b/src/lib/krb5/krb/send_tgs.c
@@ -128,7 +128,7 @@ OLDDECLARG(krb5_response *,rep)
 	if (!(scratch->data = realloc(scratch->data,
 				      tgsreq.authorization_data.ciphertext.length))) {
 	    /* may destroy scratch->data */
-	    xfree(scratch);
+	    krb5_xfree(scratch);
 	    return ENOMEM;
 	}
 	memset(scratch->data + scratch->length, 0,
@@ -147,20 +147,20 @@ OLDDECLARG(krb5_response *,rep)
 				  (krb5_pointer) tgsreq.authorization_data.ciphertext.data,
 				  scratch->length, &eblock, 0)) {
 	    (void) krb5_finish_key(&eblock);
-	    xfree(tgsreq.authorization_data.ciphertext.data);
+	    krb5_xfree(tgsreq.authorization_data.ciphertext.data);
 	    krb5_free_data(scratch);
 	    return retval;
 	}	    
 	krb5_free_data(scratch);
 	if (retval = krb5_finish_key(&eblock)) {
-	    xfree(tgsreq.authorization_data.ciphertext.data);
+	    krb5_xfree(tgsreq.authorization_data.ciphertext.data);
 	    return retval;
 	}
     }
 #define cleanup_authdata() { if (tgsreq.authorization_data.ciphertext.data) {\
 	(void) memset(tgsreq.authorization_data.ciphertext.data, 0,\
              tgsreq.authorization_data.ciphertext.length); \
-	    xfree(tgsreq.authorization_data.ciphertext.data);}}
+	    krb5_xfree(tgsreq.authorization_data.ciphertext.data);}}
 
 
 
@@ -203,7 +203,7 @@ OLDDECLARG(krb5_response *,rep)
 					 &ap_checksum)) {
 	if (sec_ticket)
 	    krb5_free_ticket(sec_ticket);
-	xfree(ap_checksum.contents);
+	krb5_xfree(ap_checksum.contents);
 	krb5_free_data(scratch);
 	cleanup_authdata();
 	return retval;
@@ -211,7 +211,7 @@ OLDDECLARG(krb5_response *,rep)
     /* done with body */
     krb5_free_data(scratch);
 
-#define cleanup() {xfree(ap_checksum.contents);\
+#define cleanup() {krb5_xfree(ap_checksum.contents);\
 		   if (sec_ticket) krb5_free_ticket(sec_ticket);}
     /* attach ap_req to the tgsreq */
 
@@ -245,7 +245,7 @@ OLDDECLARG(krb5_response *,rep)
 	if (!combined_padata) {
 	    cleanup();
 	    cleanup_authdata();
-	    xfree(ap_req_padata.contents);
+	    krb5_xfree(ap_req_padata.contents);
 	    return ENOMEM;
 	}
 	combined_padata[0] = &ap_req_padata;
@@ -257,7 +257,7 @@ OLDDECLARG(krb5_response *,rep)
 	if (!combined_padata) {
 	    cleanup();
 	    cleanup_authdata();
-	    xfree(ap_req_padata.contents);
+	    krb5_xfree(ap_req_padata.contents);
 	    return ENOMEM;
 	}
 	combined_padata[0] = &ap_req_padata;
@@ -269,18 +269,18 @@ OLDDECLARG(krb5_response *,rep)
     if (retval = encode_krb5_tgs_req(&tgsreq, &scratch)) {
 	cleanup();
 	cleanup_authdata();
-	xfree(combined_padata);
-	xfree(ap_req_padata.contents);
+	krb5_xfree(combined_padata);
+	krb5_xfree(ap_req_padata.contents);
 	return(retval);
     }
     if (sec_ticket)
 	krb5_free_ticket(sec_ticket);
     cleanup_authdata();
-    xfree(combined_padata);
-    xfree(ap_req_padata.contents);
+    krb5_xfree(combined_padata);
+    krb5_xfree(ap_req_padata.contents);
 #undef cleanup_authdata
 #undef cleanup
-#define cleanup() {xfree(ap_checksum.contents);}
+#define cleanup() {krb5_xfree(ap_checksum.contents);}
 
     /* now send request & get response from KDC */
     retval = krb5_sendto_kdc(scratch, krb5_princ_realm(sname),
diff --git a/src/lib/krb5/krb/sendauth.c b/src/lib/krb5/krb/sendauth.c
index f79e343222..4270c368cd 100644
--- a/src/lib/krb5/krb/sendauth.c
+++ b/src/lib/krb5/krb/sendauth.c
@@ -187,11 +187,11 @@ krb5_sendauth(/* IN */
 	if (inbuf.length) {
 		if (error) {
 			if (retval = krb5_rd_error(&inbuf, error)) {
-				xfree(inbuf.data);
+				krb5_xfree(inbuf.data);
 				return(retval);
 			}
 		}
-		xfree(inbuf.data);
+		krb5_xfree(inbuf.data);
 		krb5_free_cred_contents(&creds);
 		memset((char *)&authent, 0, sizeof(authent));
 		return(KRB5_SENDAUTH_REJECTED);
@@ -217,7 +217,7 @@ krb5_sendauth(/* IN */
 			problem = KRB5_SENDAUTH_MUTUAL_FAILED;
 		memset((char *)&authent, 0, sizeof(authent));
 		krb5_free_cred_contents(&creds);
-		xfree(inbuf.data);
+		krb5_xfree(inbuf.data);
 		if (problem) {
 			krb5_free_ap_rep_enc_part(repl);
 			return(problem);
diff --git a/src/lib/krb5/krb/srv_rcache.c b/src/lib/krb5/krb/srv_rcache.c
index f11f83d89e..96778755b8 100644
--- a/src/lib/krb5/krb/srv_rcache.c
+++ b/src/lib/krb5/krb/srv_rcache.c
@@ -63,7 +63,7 @@ krb5_rcache *rcptr;
 	    } else
 		retval = ENOMEM;
 	}
-	xfree(rcache);
+	krb5_xfree(rcache);
     } else
 	retval = ENOMEM;
     return retval;
diff --git a/src/lib/krb5/krb/walk_rtree.c b/src/lib/krb5/krb/walk_rtree.c
index c3afad1de2..89bb722249 100644
--- a/src/lib/krb5/krb/walk_rtree.c
+++ b/src/lib/krb5/krb/walk_rtree.c
@@ -140,7 +140,7 @@ char realm_branch_char;
     i = 1;
     if (retval = krb5_tgtname(client,
 			      client, &rettree[0])) {
-	xfree(rettree);
+	krb5_xfree(rettree);
 	return retval;
     }
     for (prevccp = ccp = client->data;
@@ -160,7 +160,7 @@ char realm_branch_char;
 		krb5_free_principal(rettree[i-1]);
 		i--;
 	    }
-	    xfree(rettree);
+	    krb5_xfree(rettree);
 	    return retval;
 	}
 	prevccp = ccp;
@@ -178,7 +178,7 @@ char realm_branch_char;
 		krb5_free_principal(rettree[i-1]);
 		i--;
 	    }
-	    xfree(rettree);
+	    krb5_xfree(rettree);
 	    return retval;
 	}
 	i++;
@@ -202,7 +202,7 @@ char realm_branch_char;
 		krb5_free_principal(rettree[i-1]);
 		i--;
 	    }
-	    xfree(rettree);
+	    krb5_xfree(rettree);
 	    return retval;
 	}
 	prevscp = scp + 1;
@@ -222,7 +222,7 @@ char realm_branch_char;
 		krb5_free_principal(rettree[i-1]);
 		i--;
 	    }
-	    xfree(rettree);
+	    krb5_xfree(rettree);
 	    return retval;
 	}
     }
diff --git a/src/lib/krb5/os/an_to_ln.c b/src/lib/krb5/os/an_to_ln.c
index 6efc506bdd..f36f167cd5 100644
--- a/src/lib/krb5/os/an_to_ln.c
+++ b/src/lib/krb5/os/an_to_ln.c
@@ -102,13 +102,13 @@ char *lname;
 
     db = dbm_open(krb5_lname_file, O_RDONLY, 0600);
     if (!db) {
-	xfree(princ_name);
+	krb5_xfree(princ_name);
 	return KRB5_LNAME_CANTOPEN;
     }
 
     contents = dbm_fetch(db, key);
 
-    xfree(princ_name);
+    krb5_xfree(princ_name);
 
     if (contents.dptr == NULL) {
 	retval = KRB5_LNAME_NOTRANS;
diff --git a/src/lib/krb5/os/free_krbhs.c b/src/lib/krb5/os/free_krbhs.c
index c68efce8eb..ff8fd8cfb5 100644
--- a/src/lib/krb5/os/free_krbhs.c
+++ b/src/lib/krb5/os/free_krbhs.c
@@ -46,6 +46,6 @@ char * const *hostlist;
 
     for (cp = hostlist; *cp; cp++)
 	free(*cp);
-    xfree(hostlist);
+    krb5_xfree(hostlist);
     return 0;
 }
diff --git a/src/lib/krb5/os/full_ipadr.c b/src/lib/krb5/os/full_ipadr.c
index e41add029b..ffd39e1743 100644
--- a/src/lib/krb5/os/full_ipadr.c
+++ b/src/lib/krb5/os/full_ipadr.c
@@ -63,7 +63,7 @@ OLDDECLARG(krb5_address **,outaddr)
 	2*sizeof(temptype) + 2*sizeof(templength);
 
     if (!(retaddr->contents = (krb5_octet *)malloc(retaddr->length))) {
-	xfree(retaddr);
+	krb5_xfree(retaddr);
 	return ENOMEM;
     }
     marshal = retaddr->contents;
diff --git a/src/lib/krb5/os/get_krbhst.c b/src/lib/krb5/os/get_krbhst.c
index 66ef9961e5..6bdd766112 100644
--- a/src/lib/krb5/os/get_krbhst.c
+++ b/src/lib/krb5/os/get_krbhst.c
@@ -123,7 +123,7 @@ char ***hostlist;
 	    if (!rethlist[hlindex]) {
 		for (--hlindex; hlindex >= 0; hlindex--)
 		    free(rethlist[hlindex]);
-		xfree(rethlist);
+		krb5_xfree(rethlist);
 		rethlist = 0;
 		retval = ENOMEM;
 		break;
@@ -147,7 +147,7 @@ char ***hostlist;
     (void) fclose(config_file);
 
     if (hlindex == 0) {
-	xfree(rethlist);
+	krb5_xfree(rethlist);
 	rethlist = 0;
 	retval = KRB5_REALM_UNKNOWN;
     }
diff --git a/src/lib/krb5/os/hst_realm.c b/src/lib/krb5/os/hst_realm.c
index 644a4dd5d0..bb506c7cc9 100644
--- a/src/lib/krb5/os/hst_realm.c
+++ b/src/lib/krb5/os/hst_realm.c
@@ -116,7 +116,7 @@ char ***realmsp;
 	char *cp;
 
 	if (!(retrealms[0] = malloc(strlen(&domain[1])+1))) {
-	    xfree(retrealms);
+	    krb5_xfree(retrealms);
 	    return ENOMEM;
 	}
 	strcpy(retrealms[0], &domain[1]);
@@ -126,14 +126,14 @@ char ***realmsp;
 		*cp = toupper(*cp);
     } else {
 	if (retval = krb5_get_default_realm(&retrealms[0])) {
-	    xfree(retrealms);
+	    krb5_xfree(retrealms);
 	    return retval;
 	}
     }
 
     if ((trans_file = fopen(krb5_trans_file, "r")) == (FILE *) 0) {
-	xfree(retrealms[0]);
-	xfree(retrealms);
+	krb5_xfree(retrealms[0]);
+	krb5_xfree(retrealms);
 	return KRB5_TRANS_CANTOPEN;
     }
     (void) sprintf(scanstring, "%%%ds %%%ds",
@@ -153,7 +153,7 @@ char ***realmsp;
 	    /* exact match of hostname, so return the realm */
 	    if (!(retrealms[0] = realloc(retrealms[0],
 					 strlen(trans_realm)+1))) {
-		xfree(retrealms);
+		krb5_xfree(retrealms);
 		return ENOMEM;
 	    }
 	    (void) strcpy(retrealms[0], trans_realm);
@@ -166,7 +166,7 @@ char ***realmsp;
 		/* domain match, save for later */
 		if (!(retrealms[0] = realloc(retrealms[0],
 					     strlen(trans_realm)+1))) {
-		    xfree(retrealms);
+		    krb5_xfree(retrealms);
 		    return ENOMEM;
 		}
 		(void) strcpy(retrealms[0], trans_realm);
diff --git a/src/lib/krb5/os/localaddr.c b/src/lib/krb5/os/localaddr.c
index 55af537d72..d0531626a2 100644
--- a/src/lib/krb5/os/localaddr.c
+++ b/src/lib/krb5/os/localaddr.c
@@ -152,7 +152,7 @@ krb5_error_code krb5_os_localaddr(addr)
 		    address->length = sizeof(struct in_addr);
 		    address->contents = (unsigned char *)malloc(address->length);
 		    if (!address->contents) {
-			xfree(address);
+			krb5_xfree(address);
 			address = 0;
 			mem_err++;
 		    } else {
@@ -179,7 +179,7 @@ krb5_error_code krb5_os_localaddr(addr)
 		    address->length = sizeof(struct ns_addr);
 		    address->contents = (unsigned char *)malloc(address->length);
 		    if (!address->contents) {
-			xfree(address);
+			krb5_xfree(address);
 			address = 0;
 			mem_err++;
 		    } else {
@@ -210,7 +210,7 @@ krb5_error_code krb5_os_localaddr(addr)
     
     if (mem_err) {
 	for (i=0; i<n_found; i++) {
-	    xfree(addr_temp[i]);
+	    krb5_xfree(addr_temp[i]);
 	    addr_temp[i] = 0;
 	}
 	return ENOMEM;
diff --git a/src/lib/krb5/os/read_msg.c b/src/lib/krb5/os/read_msg.c
index 9b1da0ffea..d9df8bc900 100644
--- a/src/lib/krb5/os/read_msg.c
+++ b/src/lib/krb5/os/read_msg.c
@@ -60,7 +60,7 @@ krb5_read_message(fdp, inbuf)
 			return(ENOMEM);
 		}
 		if ((len2 = krb5_net_read(fd, buf, len)) != len) {
-			xfree(buf);
+			krb5_xfree(buf);
 			return((len2 < 0) ? errno : ECONNABORTED);
 		}
 	}
diff --git a/src/lib/krb5/os/read_pwd.c b/src/lib/krb5/os/read_pwd.c
index 7977321a31..bfa7ed5602 100644
--- a/src/lib/krb5/os/read_pwd.c
+++ b/src/lib/krb5/os/read_pwd.c
@@ -158,7 +158,7 @@ int *size_return;
 	/* interrupted */
 	if (readin_string) {
 	    (void) memset((char *)readin_string, 0, *size_return);
-	    xfree(readin_string);
+	    krb5_xfree(readin_string);
 	}
 	(void) memset(return_pwd, 0, *size_return);
 	cleanup(KRB5_LIBOS_PWDINTR);
@@ -203,7 +203,7 @@ int *size_return;
 	    (void) putchar('\n');
 	    (void) memset((char *)readin_string, 0, *size_return);
 	    (void) memset(return_pwd, 0, *size_return);
-	    xfree(readin_string);
+	    krb5_xfree(readin_string);
 	    cleanup(KRB5_LIBOS_CANTREADPWD);
 	}
 	(void) putchar('\n');
@@ -219,11 +219,11 @@ int *size_return;
 	if (strncmp(return_pwd, (char *)readin_string, *size_return)) {
 	    (void) memset((char *)readin_string, 0, *size_return);
 	    (void) memset(return_pwd, 0, *size_return);
-	    xfree(readin_string);
+	    krb5_xfree(readin_string);
 	    cleanup(KRB5_LIBOS_BADPWDMATCH);
 	}
 	(void) memset((char *)readin_string, 0, *size_return);
-	xfree(readin_string);
+	krb5_xfree(readin_string);
     }
     
     /* reset intrfunc */
diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
index 64a94f5cb4..f8dc24cab7 100644
--- a/src/lib/krb5/os/sendto_kdc.c
+++ b/src/lib/krb5/os/sendto_kdc.c
@@ -94,7 +94,7 @@ OLDDECLARG(krb5_data *, reply)
 	socklist[i] = -1;
 
     if (!(reply->data = malloc(krb5_max_dgram_size))) {
-	xfree(addr);
+	krb5_xfree(addr);
 	return ENOMEM;
     }
     reply->length = krb5_max_dgram_size;
@@ -195,7 +195,7 @@ OLDDECLARG(krb5_data *, reply)
     for (i = 0; i < AF_MAX; i++)
 	if (socklist[i] != -1)
 	    (void) close(socklist[i]);
-    xfree(addr);
+    krb5_xfree(addr);
     if (retval) {
 	free(reply->data);
 	reply->data = 0;
diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c
index 4e19cb2409..9edede3b91 100644
--- a/src/lib/krb5/os/sn2princ.c
+++ b/src/lib/krb5/os/sn2princ.c
@@ -94,7 +94,7 @@ OLDDECLARG(krb5_principal *,ret_princ)
 	}
 	if (!hrealms[0]) {
 	    free(remote_host);
-	    xfree(hrealms);
+	    krb5_xfree(hrealms);
 	    return KRB5_ERR_HOST_REALM_UNKNOWN;
 	}