This one is mostly strcpy/strcat checking, checking for null strings before strlen, removing some dead code, other odds and ends.

39 files changed, 179 insertions, 1136 deletions

diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 4e21c31d..23f41240 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -1712,11 +1712,7 @@ acl_modified (Slapi_PBlock *pb, int optype, char *n_dn, void *change)
 		if (parent_DN == NULL) {
 			new_DN = new_RDN;
 		} else {
-			new_DN = (char*) slapi_ch_malloc (strlen (new_RDN) + 3 
-						    + strlen (parent_DN));
-			strcpy (new_DN, new_RDN);
-			strcat (new_DN, ",");
-			strcat (new_DN, parent_DN);
+			new_DN = slapi_ch_smprintf("%s,%s", new_RDN, parent_DN);
 			slapi_dn_normalize (new_DN);
 		}
 
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index 8971c4f2..0705c419 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -539,8 +539,10 @@ aclutil_expand_paramString ( char *str, Slapi_Entry *e )
 	}
 	rc = 0;		/* everything is okay*/
 	/* remove the last comma */
-	len = strlen ( buf);
-	buf[len-1] = '\0';
+	if (buf) {
+		len = strlen ( buf);
+		buf[len-1] = '\0';
+	}
 
 cleanup:
 
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index c5dfdf89..1345f0bd 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -103,9 +103,9 @@ collation_config (size_t cargc, char** cargv,
  
                 if(cargc > 7) {
                     strcpy(nameOrder,"-");
-                    PL_strcatn(nameOrder,256,cargv[7]);
+                    PL_strcatn(nameOrder,sizeof(nameOrder),cargv[7]);
                     strcpy(nameSubstring,"-");
-                    PL_strcatn(nameSubstring,256,cargv[7]);
+                    PL_strcatn(nameSubstring,sizeof(nameSubstring),cargv[7]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
@@ -117,19 +117,19 @@ collation_config (size_t cargc, char** cargv,
 						nameOrder[0] = 0;
 						nameSubstring[0] = 0;
 					}
-                    PL_strcatn(nameOrder,256,cargv[1]);
-                    PL_strcatn(nameSubstring,256,cargv[1]);
+                    PL_strcatn(nameOrder,sizeof(nameOrder),cargv[1]);
+                    PL_strcatn(nameSubstring,sizeof(nameSubstring),cargv[1]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
-                PL_strncpyz(oidString,cargv[6], 256);
+                PL_strncpyz(oidString,cargv[6], sizeof(oidString));
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_OID,
                                        (void *)slapi_ch_strdup(oidString));
                 if(0 != cargv[2][0]) {
-                    PR_snprintf(descStr, 256, "%s-%s",cargv[1],cargv[2]);
+                    PR_snprintf(descStr, sizeof(descStr), "%s-%s",cargv[1],cargv[2]);
                 }
                 else {
-                    PL_strncpyz(descStr,cargv[1], 256);
+                    PL_strncpyz(descStr,cargv[1], sizeof(descStr));
                 }
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_DESC,
 						   (void *)slapi_ch_strdup(descStr));
@@ -144,7 +144,7 @@ collation_config (size_t cargc, char** cargv,
                 slapi_ch_free((void **)&tmpStr);
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                        (void *)slapi_ch_strdup(nameSubstring));
-                strcat(oidString,".6");
+                PL_strcatn(oidString,sizeof(oidString),".6");
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_OID,
                                        (void *)slapi_ch_strdup(oidString));
                 slapi_matchingrule_register(mrentry);
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 303458e5..672bb827 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -1970,7 +1970,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
 			{
 				char tmpGrade[BUFSIZ];
 
-				if (strlen(pCosSpecifier->val) < (BUFSIZ - 9)) {  /* 9 for "-default" */
+				if (strlen(pCosSpecifier->val) < (sizeof(tmpGrade) - 9)) {  /* 9 for "-default" */
 					strcpy(tmpGrade, pCosSpecifier->val);
 					strcat(tmpGrade, "-default");
 					if(!slapi_utf8casecmp((unsigned char*)grade, (unsigned char*)tmpGrade))
diff --git a/ldap/servers/plugins/http/http_impl.c b/ldap/servers/plugins/http/http_impl.c
index e6d4a664..8c216775 100644
--- a/ldap/servers/plugins/http/http_impl.c
+++ b/ldap/servers/plugins/http/http_impl.c
@@ -226,11 +226,6 @@ static int doRequest(const char *url, httpheader **httpheaderArray, char *body,
 	PRInt32 errcode = 0;
 	PRInt32 http_connection_time_out = 0;
 	PRInt32 sslOn;
-	PRInt32 nssStatus;
-	PRUint32 nssFlags = 0;
-	char certDir[1024];
-	char certPref[1024];
-	char keyPref[1024];
 	
 	LDAPDebug( LDAP_DEBUG_PLUGIN, "--> doRequest -- BEGIN\n",0,0,0);
 
@@ -290,10 +285,16 @@ static int doRequest(const char *url, httpheader **httpheaderArray, char *body,
 			if (!httpConfig->nssInitialized) {
 				if (nssReinitializationRequired())
 				{
+					PRInt32 nssStatus;
+					PRUint32 nssFlags = 0;
+					char certDir[1024];
+					char certPref[1024];
+					char keyPref[1024];
+
 					NSS_Shutdown();
 					nssFlags &= (~NSS_INIT_READONLY);
        				val = config_get_instancedir();
-       				strcpy(certDir, val);
+       				PL_strncpyz(certDir, val, sizeof(certDir));
 					defaultprefix = strrchr(certDir, '/');
 					if (!defaultprefix)
     						defaultprefix = strrchr(certDir, '\\');
@@ -301,7 +302,7 @@ static int doRequest(const char *url, httpheader **httpheaderArray, char *body,
     						goto bail; /* . . . can't do anything */
 					defaultprefix++;
 					PR_snprintf(certPref, 1024, "%s-",defaultprefix);
-					strcpy(keyPref, certPref);
+					PL_strncpyz(keyPref, certPref, sizeof(keyPref));
 					*defaultprefix= '\0';
 					PR_snprintf(certDir, 1024, "%salias", certDir);
        				nssStatus = NSS_Initialize(certDir, certPref, keyPref, "secmod.db", nssFlags);
@@ -719,7 +720,11 @@ static PRStatus sendPostReq(PRFileDesc *fd, const char *path, httpheader **httph
 	int i = 0;
 	int body_len, buflen = 0; 
 
-	body_len = strlen(body);
+	if (body) {
+		body_len = strlen(body);
+	} else {
+		body_len = 0;
+	}
 	PR_snprintf(body_len_str, sizeof(body_len_str), "%d", body_len);
 
     buflen = (HTTP_POST_STD_LEN + strlen(path) + body_len + strlen(body_len_str));
@@ -762,7 +767,9 @@ static PRStatus sendPostReq(PRFileDesc *fd, const char *path, httpheader **httph
 	}
 
     strcat(reqBUF, "\r\n");
-    strcat(reqBUF, body);
+	if (body) {
+		strcat(reqBUF, body);
+	}
     strcat(reqBUF, "\0");
 
 	LDAPDebug( LDAP_DEBUG_PLUGIN, "---------->reqBUF is %s \n",reqBUF,0,0);
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
index 8711513f..5103875c 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
@@ -19,7 +19,8 @@ typedef struct my_str_buf {
 static char *
 init_my_str_buf(MyStrBuf *buf, const char *s)
 {
-	if (s && (strlen(s) < MY_STATIC_BUF_SIZE)) {
+	PR_ASSERT(buf);
+	if (s && (strlen(s) < sizeof(buf->fixbuf))) {
 		strcpy(buf->fixbuf, s);
 		buf->str = buf->fixbuf;
 	} else {
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 4ff55802..cdf371cb 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -2387,7 +2387,7 @@ static int _cl5Entry2DBData (const CL5Entry *entry, char **data, PRUint32 *len)
 	char *rawDN = NULL;
 	char s[CSN_STRSIZE];		
 
-	PR_ASSERT (entry && entry->op && data && len);
+	PR_ASSERT (entry && entry->op && data && len && op->target_address.uniqueid);
 
 	op = entry->op;
 
diff --git a/ldap/servers/plugins/replication/repl_monitor.c b/ldap/servers/plugins/replication/repl_monitor.c
index 9e44a93e..1cb10d7f 100644
--- a/ldap/servers/plugins/replication/repl_monitor.c
+++ b/ldap/servers/plugins/replication/repl_monitor.c
@@ -46,6 +46,7 @@ repl_monitor_search(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter, i
     	{
     	    port= config_get_secureport();
     	}
+		buf[0] = (char)0;
         /* ONREPL - how do we publish changenumbers now with multiple changelogs?
 		sprintf( buf, "%s:%lu %s% lu", get_localhost_DNS(), port, sdv, ldapi_get_last_changenumber());
         */
diff --git a/ldap/servers/plugins/replication/repl_opext.c b/ldap/servers/plugins/replication/repl_opext.c
index b8d117ee..361ecbc8 100644
--- a/ldap/servers/plugins/replication/repl_opext.c
+++ b/ldap/servers/plugins/replication/repl_opext.c
@@ -12,9 +12,6 @@
 
 /* ***** Supplier side ***** */
 
-/* JCMREPL -> PINAKIxxx  The interface to the referral stuff is not correct */
-void ref_array_dup_free(void *the_copy); /* JCMREPL - should be #included */
-
 /* supplier operation extension constructor */
 void* supplier_operation_extension_constructor (void *object, void *parent)
 {
@@ -89,7 +86,8 @@ void consumer_operation_extension_destructor (void *ext,void *object, void *pare
 		consumer_operation_extension *opext = (consumer_operation_extension *)ext;
 		if (NULL != opext->search_referrals)
 		{
-			ref_array_dup_free(opext->search_referrals); /* JCMREPL - undefined */
+			/* free them - search_referrals is currently unused, but 
+			   free them using the obverse of the allocation method */
 			opext->search_referrals = NULL;
 		}
 		slapi_ch_free((void **)&ext);	
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index e8698a68..312196e1 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -19,6 +19,7 @@
 #include <string.h>
 #include "dirver.h"
 #include "plugin-utils.h"
+#include "nspr.h"
 
 #if defined( LDAP_DEBUG ) && !defined( DEBUG )
 #define DEBUG
@@ -114,6 +115,8 @@ create_filter(const char *attribute, const struct berval *value)
   int valueLen;
   int filterLen;
 
+  PR_ASSERT(attribute);
+
   /* Compute the length of the required buffer */
   attrLen = strlen(attribute);
 
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
index 63826abb..9c7d4b54 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
@@ -72,9 +72,9 @@ static char *attrinfo2ConfMatchingRules (struct attrinfo *pai)
     if (pai->ai_index_rules) {
 	strcat (buffer, "\t");
 	for (i = 0; pai->ai_index_rules[i]; i++) {
-            strcat (buffer, pai->ai_index_rules[i]);
+            PL_strcatn (buffer, sizeof(buffer), pai->ai_index_rules[i]);
             if (pai->ai_index_rules[i+1]) {
-		strcat (buffer, ",");
+		PL_strcatn (buffer, sizeof(buffer), ",");
             }
 	}
     }
@@ -500,13 +500,13 @@ int ldbm_instance_config_add_index_entry(
         return(-1);
     }
 
-    PL_strncpyz(tmpAttrsStr,argv[0], 256);
+    PL_strncpyz(tmpAttrsStr,argv[0], sizeof(tmpAttrsStr));
     attrs = str2charray( tmpAttrsStr, "," );
-    PL_strncpyz(tmpIndexesStr,argv[1], 256);
+    PL_strncpyz(tmpIndexesStr,argv[1], sizeof(tmpIndexesStr));
     indexes = str2charray( tmpIndexesStr, ",");
 
     if(argc > 2) {
-        PL_strncpyz(tmpMatchingRulesStr,argv[2], 1024);
+        PL_strncpyz(tmpMatchingRulesStr,argv[2], sizeof(tmpMatchingRulesStr));
         matchingRules = str2charray( tmpMatchingRulesStr, ",");
     }
 
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index 65f1a6f0..f800f7c5 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -757,18 +757,6 @@ onelevel_candidates(
     return( candidates );
 }
 
-
-#define GRABSIZE2    50
-#define BUF_ALLOC_CAT( cpyfunc, s ) { \
-    int    len = 2 * strlen( s ); \
-    while ( bmax - bcur < len + 1 ) { \
-        bmax += GRABSIZE2; \
-        buf = slapi_ch_realloc( buf, bmax ); \
-    } \
-    cpyfunc( buf + bcur, s ); \
-    bcur += strlen( buf + bcur ); \
-}
-
 /*
  * We need to modify the filter to be something like this:
  *
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 2e3d1d8d..4ec954d4 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -85,14 +85,14 @@ int ldbm_back_fetch_incl_excl(Slapi_PBlock *pb, char ***include,
     /* normalize */
     if (pb_excl) {
 	for (i = 0; pb_excl[i]; i++) {
-	    PL_strncpyz(subtreeDn, pb_excl[i], BUFSIZ);
+	    PL_strncpyz(subtreeDn, pb_excl[i], sizeof(subtreeDn));
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(exclude, slapi_ch_strdup(normSubtreeDn));
 	}
     }
     if (pb_incl) {
 	for (i = 0; pb_incl[i]; i++) {
-	    PL_strncpyz(subtreeDn, pb_incl[i], BUFSIZ);
+	    PL_strncpyz(subtreeDn, pb_incl[i], sizeof(subtreeDn));
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(include, slapi_ch_strdup(normSubtreeDn));
 	}
diff --git a/ldap/servers/slapd/back-ldbm/uniqueid2entry.c b/ldap/servers/slapd/back-ldbm/uniqueid2entry.c
index c743de54..5319d706 100644
--- a/ldap/servers/slapd/back-ldbm/uniqueid2entry.c
+++ b/ldap/servers/slapd/back-ldbm/uniqueid2entry.c
@@ -34,6 +34,7 @@ uniqueid2entry(
 #endif
 	if (e == NULL)	{
 		/* convert dn to entry id */
+		PR_ASSERT(uniqueid);
 		*err = 0;
 		idv.bv_val = (void*)uniqueid; 
 		idv.bv_len = strlen( idv.bv_val );
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index 42012af1..e7d7d608 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -57,12 +57,14 @@ vlvSearch_new()
 static void
 trimspaces(char *s)
 {
-    PRUint32 i= strlen(s) - 1;
-    while(i > 0 && isascii(s[i]) && isspace(s[i]))
-    {
-        s[i]= '\0';
-        i--;
-    }
+	if (s) {
+		PRUint32 i= strlen(s) - 1;
+		while(i > 0 && isascii(s[i]) && isspace(s[i]))
+			{
+				s[i]= '\0';
+				i--;
+			}
+	}
 }
 
 /*
diff --git a/ldap/servers/slapd/backend_manager.c b/ldap/servers/slapd/backend_manager.c
index 842d2a55..e7a085d9 100644
--- a/ldap/servers/slapd/backend_manager.c
+++ b/ldap/servers/slapd/backend_manager.c
@@ -379,259 +379,6 @@ be_nbackends_public()
 #define	SUFFIX_ATTR			"nsslapd-suffix"
 #define CACHE_ATTR			"nsslapd-cachememsize"
 
-/* add nsslapd-instance attribute to cn=config,cn=ldbm database,cn=plugins,cn=config
-   entry. This causes empty backend instance creation */
-/* JCM - Should be adding an instance entry, not an attr value */
-static int 
-be_add_instance (const char *name, void *plugin_identity)
-{
-	Slapi_PBlock pb;
-	Slapi_Mods smods;
-	int rc;
-
-	PR_ASSERT (name && plugin_identity);
-
-	slapi_mods_init (&smods, 1);
-	slapi_mods_add(&smods, LDAP_MOD_ADD, INSTANCE_ATTR, strlen (name), name);
-
-	pblock_init (&pb);	
-	slapi_modify_internal_set_pb (&pb, LDBM_CONFIG_ENTRY, 
-								  slapi_mods_get_ldapmods_byref(&smods), NULL,
-								  NULL, plugin_identity, 0);
-	slapi_modify_internal_pb (&pb);
-	slapi_mods_done (&smods);
-
-	slapi_pblock_get (&pb, SLAPI_PLUGIN_INTOP_RESULT,&rc);
-	if (rc != LDAP_SUCCESS)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: "
-						"failed to modify ldbm configuration entry; LDAP error - %d\n", rc);
-		pblock_done(&pb);
-		return -1;
-	}	
-
-	pblock_done(&pb);
-	return 0;
-}
-
-static char* 
-be_get_instance_dn (const char *index_name, const char *name)
-{
-	char *dn;
-
-	PR_ASSERT (name);
-
-	if (index_name) {
-		dn = slapi_ch_smprintf("cn=%s,cn=index,cn=config,cn=%s,%s", index_name, name, 
-							   LDBM_CLASS_PREFIX);				
-	} else {
-		dn = slapi_ch_smprintf("cn=config,cn=%s,%s", name, LDBM_CLASS_PREFIX);	
-	}
-
-	return dn;
-}
-
-
-/* configure newly added backend by modifying instance's configuration entry:
-   cn=config,cn=<instance name>,cn=ldbm database,cn=plugins,cn=config.
-   Can configure backend root and cache size */
-static int 
-be_configure_instance (const char *name, const char *root, int cache_size,
-								  void *plugin_identity)
-{
-	Slapi_PBlock pb;
-	Slapi_Mods smods;
-	char value [128];
-	char *dn;
-	int rc;
-
-	PR_ASSERT (name && root && plugin_identity);
-
-	dn = be_get_instance_dn (NULL, name);
-
-	slapi_mods_init (&smods, 2);
-	slapi_mods_add(&smods, LDAP_MOD_ADD, SUFFIX_ATTR, strlen (root), root);
-	if (cache_size > 0)
-	{
-		sprintf (value, "%d", cache_size);
-		slapi_mods_add(&smods, LDAP_MOD_REPLACE, CACHE_ATTR, strlen (value), value);	
-	}		
-
-	pblock_init (&pb);
-	slapi_modify_internal_set_pb (&pb, dn, slapi_mods_get_ldapmods_byref(&smods),
-								  NULL, NULL, plugin_identity, 0);
-	slapi_modify_internal_pb (&pb);
-
-	slapi_mods_done (&smods);
-	slapi_ch_free ((void**)&dn);
-
-	slapi_pblock_get (&pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
-	if (rc != LDAP_SUCCESS)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: "
-						"failed to update instance entry; LDAP error - %d\n", rc);
-		pblock_done(&pb);
-		return -1;
-	}	
-
-	pblock_done(&pb);
-	return 0;
-}
-
-/* configure instance indexes by adding an index entry:
-   "cn=<attr name>,cn=index,cn=config,cn=<instance name>,
-    cn=ldbm database,cn=plugins,cn=config".*/
-static int 
-be_configure_instance_indexes (const char *name, IndexConfig *indexes, 
-										  int index_count, void *plugin_identity)
-{
-	int rc;
-	Slapi_PBlock pb;
-	Slapi_Entry *e;
-	char *dn;
-	int i; 
-	char *start, *end;
-	char index_type [16];
-
-	PR_ASSERT (name && indexes && index_count > 0 && plugin_identity);
-
-	for (i = 0; i < index_count; i++)
-	{
-		dn = be_get_instance_dn (indexes[i].attr_name, name);
-		e = slapi_entry_alloc ();
-		slapi_entry_init (e, dn, NULL);
-
-		/* add objectclases */
-		slapi_entry_add_string (e, "objectclass", "top");
-		slapi_entry_add_string (e, "objectclass", "nsIndex");
-		slapi_entry_add_string (e, "cn", indexes[i].attr_name);		
-		slapi_entry_add_string (e, "nssystemindex", indexes[i].system ? "true" : "false");				
-		
-		start = indexes[i].index_type;
-		while ((end = strchr (start, ' ')) != NULL)
-		{
-			if ((end - start) >= 16)
-				continue;
-
-			strncpy (index_type, start, end - start); 
-			slapi_entry_add_string (e, "nsindextype", index_type);
-			start = end + 1;
-		}
-	
-		slapi_entry_add_string (e, "nsindextype", start);		
-	
-		pblock_init (&pb);
-		slapi_add_entry_internal_set_pb (&pb, e, NULL /* controls */, plugin_identity,
-										 0/* operation flags */);
-		slapi_add_internal_pb (&pb);
-
-		slapi_pblock_get (&pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
-		if (rc != LDAP_SUCCESS)
-		{
-			slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: "
-						"failed to update instance entry; LDAP error - %d\n", rc);
-			pblock_done(&pb);
-			return -1;
-		}
-	}	
-
-	pblock_done(&pb);
-	return 0;
-}
-
-int 
-be_create_instance (const char *type, const char *name, const char *root, 
-						int cache_size, IndexConfig *indexes, int index_count, 
-						void *plugin_identity)
-{
-	int rc;	
-	
-	if (type == NULL || strcasecmp (type, "ldbm") != 0)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: "
-						"invalid backend type: %s.\n", type ? type : "null");
-		return -1;
-	}
-
-	if (name == NULL)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: null instance name.\n");
-		return -1;
-	}
-
-	if (root == NULL)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: null root dn.\n");
-		return -1;
-	}
-
-	if (plugin_identity == NULL)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: null plugin identity.\n");
-		return -1;
-	}	
-
-	rc = be_add_instance (name, plugin_identity);
-	if (rc != 0)
-		return rc;
-
-	rc = be_configure_instance (name, root, cache_size, plugin_identity);
-	if (rc != 0)
-		return rc;
-
-	if (index_count > 0)
-		rc = be_configure_instance_indexes (name, indexes, index_count, plugin_identity);
-
-	return rc;
-}
-
-int 
-be_remove_instance (const char *type, const char *name, void *plugin_identity)
-{
-	int rc;
-	char *dn;
-	Slapi_PBlock pb;
-
-	if (type == NULL || strcasecmp (type, "ldbm") != 0)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_remove_instance: "
-						"invalid backend type: %s.\n", type ? type : "null");
-		return -1;
-	}
-
-	if (name == NULL)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_remove_instance: null instance name.\n");
-		return -1;
-	}
-
-	if (plugin_identity == NULL)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_remove_instance: null plugin identity.\n");
-		return -1;
-	}
-
-	dn = be_get_instance_dn (NULL, name);	
-
-	pblock_init (&pb);
-	slapi_delete_internal_set_pb (&pb, dn, NULL, NULL, plugin_identity, 0);
-	slapi_delete_internal_pb (&pb);
-	
-	slapi_ch_free ((void**)&dn);
-
-	slapi_pblock_get (&pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
-	if (rc != LDAP_SUCCESS)
-	{
-		slapi_log_error(SLAPI_LOG_FATAL, NULL, "be_create_instance: "
-					"failed to update instance entry; LDAP error - %d\n", rc);
-		pblock_done(&pb);
-		return -1;
-	}
-
-	pblock_done(&pb);
-	return 0;
-}
-
 void 
 slapi_be_Rlock(Slapi_Backend * be)
 {
@@ -680,6 +427,8 @@ slapi_lookup_instance_name_by_suffix(char *suffix,
 	if (instances == NULL)
 		return rval;
 
+	PR_ASSERT(suffix);
+
 	rval = 0;
 	suffixlen = strlen(suffix);
     cookie = NULL;
diff --git a/ldap/servers/slapd/ch_malloc.c b/ldap/servers/slapd/ch_malloc.c
index e64bdb3d..d673159d 100644
--- a/ldap/servers/slapd/ch_malloc.c
+++ b/ldap/servers/slapd/ch_malloc.c
@@ -383,9 +383,14 @@ slapi_ch_smprintf(const char *fmt, ...)
 	char *p = NULL;
 	va_list ap;
 
+	if (NULL == fmt) {
+		return NULL;
+	}
+
 	va_start(ap, fmt);
 	p = PR_vsmprintf(fmt, ap);
 	va_end(ap);
+
 	return p;
 }
 
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index d1166054..15c10213 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -817,10 +817,7 @@ char *
 slapi_dn_plus_rdn(const char *dn, const char *rdn)
 {
 	/* rdn + separator + dn + null */
-	char *newdn = (char *) slapi_ch_malloc( strlen( dn ) + strlen( rdn ) + 2 );
-	strcpy( newdn, rdn );
-	strcat( newdn, "," );
-	strcat( newdn, dn );
+	char *newdn = slapi_ch_smprintf("%s,%s", rdn, dn);
 	return newdn;
 }
 
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 0989b37f..51feb61e 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -2215,11 +2215,16 @@ slapi_entry_attr_set_charptr( Slapi_Entry* e, const char *type, const char *valu
 {
 	struct berval bv;
 	struct berval *bvals[2];
-	bvals[0] = &bv;
-	bvals[1] = NULL;
-	bv.bv_val = (char*)value;
-	bv.bv_len = strlen( value );
-    slapi_entry_attr_replace( e, type, bvals );
+
+	if (value) {
+		bvals[0] = &bv;
+		bvals[1] = NULL;
+		bv.bv_val = (char*)value;
+		bv.bv_len = strlen( value );
+		slapi_entry_attr_replace( e, type, bvals );
+	} else {
+		slapi_entry_attr_delete( e, type );
+	}
 }
 
 void
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 2b30760f..f636a530 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1841,8 +1841,7 @@ int fedse_create_startOK(char *filename,  char *startokfilename, const char *con
 	int rc = -1;
 
     if (configdir!=NULL) {
-        realconfigdir = slapi_ch_malloc(strlen(configdir)+1);
-        strcpy(realconfigdir, configdir);
+        realconfigdir = slapi_ch_strdup(configdir);
     } else if (id!=NULL) {
         realconfigdir = slapi_ch_smprintf("%s/%s", id, config_sub_dir);
     }
diff --git a/ldap/servers/slapd/localhost.c b/ldap/servers/slapd/localhost.c
index 0a367ad7..be04e2b0 100644
--- a/ldap/servers/slapd/localhost.c
+++ b/ldap/servers/slapd/localhost.c
@@ -130,11 +130,11 @@ find_localhost_DNS()
     if (domain == NULL) {
 	return NULL;
     }
-    strcpy (hostname, hp->h_name);
+    PL_strncpyz (hostname, hp->h_name, sizeof(hostname));
     if (domain[0] == '.') ++domain;
     if (domain[0]) {
-	strcat (hostname, ".");
-	strcat (hostname, domain);
+	PL_strcatn (hostname, sizeof(hostname), ".");
+	PL_strcatn (hostname, sizeof(hostname), domain);
     }
     LDAPDebug (LDAP_DEBUG_CONFIG, "hostname == %s\n", hostname, 0, 0);
     return slapi_ch_strdup (hostname);
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index a25f0ab3..eb1ffa78 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -3410,7 +3410,7 @@ static void dump_mapping_tree(mapping_tree_node *parent, int depth)
     }
     dump_indent[0] = '\0';
     for (i = 0; i < depth; i++)
-        strcat(dump_indent, "  ");
+        PL_strcatn(dump_indent, sizeof(dump_indent), "  ");
     for (current = parent->mtn_children; current;
          current = current->mtn_brother)
     {
diff --git a/ldap/servers/slapd/modutil.c b/ldap/servers/slapd/modutil.c
index 94f4b30e..52b2a818 100644
--- a/ldap/servers/slapd/modutil.c
+++ b/ldap/servers/slapd/modutil.c
@@ -288,6 +288,7 @@ slapi_mods_add( Slapi_Mods *smods, int modtype, const char *type, unsigned long
 void
 slapi_mods_add_string( Slapi_Mods *smods, int modtype, const char *type, const char *val)
 {
+	PR_ASSERT(val);
 	slapi_mods_add( smods, modtype, type, strlen(val), val);
 }
 
diff --git a/ldap/servers/slapd/ntuserpin.c b/ldap/servers/slapd/ntuserpin.c
index 2d3a9081..251e4bfd 100644
--- a/ldap/servers/slapd/ntuserpin.c
+++ b/ldap/servers/slapd/ntuserpin.c
@@ -121,8 +121,7 @@ static char *getPin(SVRCOREPinObj *obj, const char *tokenName, PRBool retry)
 				buf[i].TokenLength)==0) 
 			{
 			    memset(pin, '\0', MAX_PASSWORD);
-		    	    strncpy (pin, buf[i].Password,
-					buf[i].PasswordLength);
+		    	    PL_strncpyz (pin, buf[i].Password, sizeof(pin));
 	    		    slapi_ch_free ((void **) &buf);
 			    return slapi_ch_strdup(pin);
 		        }
@@ -142,10 +141,10 @@ static char *getPin(SVRCOREPinObj *obj, const char *tokenName, PRBool retry)
     {
 	slapi_ch_free ((void **) &buf);
 	buf = (PK11_PIN *)slapi_ch_malloc(sizeof(PK11_PIN));
-	strcpy (buf[0].TokenName, tokenName);
-	buf[0].TokenLength=strlen(tokenName);
-	strcpy (buf[0].Password, password);
-	buf[0].PasswordLength=strlen(password);
+	PL_strncpyz (buf[0].TokenName, tokenName, sizeof(buf[0].TokenName));
+	buf[0].TokenLength=strlen(buf[0].TokenName);
+	PL_strncpyz (buf[0].Password, password, sizeof(buf[0].Password));
+	buf[0].PasswordLength=strlen(buf[0].Password);
 	if (i== cbRemotePassword)
     	{
 	    /* Add a new token and password to the end of the table.*/
diff --git a/ldap/servers/slapd/ntwdog/ntwatchdog.c b/ldap/servers/slapd/ntwdog/ntwatchdog.c
index 0c516827..5914f4e1 100644
--- a/ldap/servers/slapd/ntwdog/ntwatchdog.c
+++ b/ldap/servers/slapd/ntwdog/ntwatchdog.c
@@ -109,8 +109,9 @@ BOOL WD_GetServerConfig(char *szServerId, char *szServerRoot, LPDWORD cbServerRo
 		return(bReturn);
 
 	// query registry key to figure out config directory
-    sprintf(szSlapdKey, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
+    snprintf(szSlapdKey, sizeof(szSlapdKey), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
         szServerId);
+	szSlapdKey[sizeof(szSlapdKey)-1] = (char)0;
 
 	dwResult = RegOpenKey(HKEY_LOCAL_MACHINE, szSlapdKey, &hSlapdKey);
 	if(dwResult == ERROR_SUCCESS) 
@@ -139,7 +140,8 @@ BOOL WD_GetServerId(IN DWORD dwSubKey, OUT char *szServerId, IN OUT LPDWORD cbSe
 	char szSlapdKey[MAX_LINE];
 
 	if(dwSubKey == 0) {
-    	sprintf(szSlapdKey, "%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT);
+    	snprintf(szSlapdKey, sizeof(szSlapdKey), "%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT);
+		szSlapdKey[sizeof(szSlapdKey)-1] = (char)0;
 		dwResult = RegOpenKey(HKEY_LOCAL_MACHINE, szSlapdKey, 
 			&hSlapdKey);
 	}
@@ -236,8 +238,9 @@ DWORD WD_GetDefaultKeyValue(char *szServerName, char *szKeyName, DWORD dwDefault
 	DWORD cbValue = sizeof(dwValue);
 
 	// query registry key to figure out config directory
-    sprintf(szSlapdKey, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
+    snprintf(szSlapdKey, sizeof(szSlapdKey), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
         szServerName);
+	szSlapdKey[sizeof(szSlapdKey)-1] = (char)0;
 	if(RegOpenKey(HKEY_LOCAL_MACHINE, szSlapdKey, &hSlapdKey) == ERROR_SUCCESS)
 	{
 	 	RegQueryValueEx(hSlapdKey, szKeyName, NULL, &dwValueType, 
@@ -360,7 +363,8 @@ BOOL WD_GetServerRoot(char *szServerRoot, char *szServerConfig)
 	BOOL bReturn = FALSE;
 	char *szChar = NULL;
 
-	strcpy(szTemp, szServerConfig);
+	strncpy(szTemp, szServerConfig, sizeof(szTemp));
+	szTemp[sizeof(szTemp)-1] = (char)0;
 	// szTemp should be something like c:\navgold\server\slapd-kennedy\config
 	if(szChar = strrchr(szTemp,'\\'))
 	{
@@ -370,7 +374,8 @@ BOOL WD_GetServerRoot(char *szServerRoot, char *szServerConfig)
 		{
 			*szChar = 0;
 		   // szTemp should be c:\navgold\server
-			strcpy( szServerRoot, szTemp );
+			strncpy( szServerRoot, szTemp, sizeof(gszServerRoot) );
+			szServerRoot[sizeof(gszServerRoot)-1] = (char)0;
 			wsprintf(szServerRootEnvVar, "%s=%s", SLAPD_ROOT, szTemp);
 			putenv(szServerRootEnvVar);
 			bReturn = TRUE;
@@ -395,8 +400,9 @@ BOOL WD_GetConfigFromRegistry(char *szServerConfig, char *szServerName)
 	DWORD dwResult = 0;
 
 	// query registry key to figure out config directory
-    sprintf(szSlapdKey, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
+    snprintf(szSlapdKey, sizeof(szSlapdKey), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT,
         szServerName);
+	szSlapdKey[sizeof(szSlapdKey)-1] = (char)0;
 
 	dwResult = RegOpenKey(HKEY_LOCAL_MACHINE, szSlapdKey, &hSlapdKey);
 	if(dwResult != ERROR_SUCCESS) 
@@ -413,7 +419,8 @@ BOOL WD_GetConfigFromRegistry(char *szServerConfig, char *szServerName)
 	} 
 	else
 	{
-		strcpy(szServerConfig, szValueString);
+		strncpy(szServerConfig, szValueString, sizeof(gszServerConfig));
+		szServerConfig[sizeof(gszServerConfig)-1] = (char)0;
 		WD_UnixToDosPath(szServerConfig);
 		WD_GetServerRoot(gszServerRoot, szServerConfig);
 		bReturn = TRUE;
@@ -437,7 +444,8 @@ BOOL WD_GetConfigFromCmdline(char *szServerConfig, char *szServerName, char *szC
 		return(bReturn);
 	}
 
-	strcpy(szServerConfig, szCmdLine);
+	strncpy(szServerConfig, szCmdLine, sizeof(gszServerConfig));
+	szServerConfig[sizeof(gszServerConfig)-1] = (char)0;
 	WD_UnixToDosPath(szCmdLine);
 	WD_GetServerRoot(gszServerRoot, szCmdLine);
 
@@ -450,7 +458,8 @@ BOOL WD_GetConfigFromCmdline(char *szServerConfig, char *szServerName, char *szC
 		{
 			szChar++;
 		   // szChar should point to slapd-kennedy
-			strcpy(szServerName, szChar);
+			strncpy(szServerName, szChar, sizeof(gszServerName));
+			szServerName[sizeof(gszServerName)-1] = (char)0;
 			WD_GetConfigFromRegistry(szServerConfig, szServerName);
 			bReturn = TRUE;
 
@@ -459,7 +468,8 @@ BOOL WD_GetConfigFromCmdline(char *szServerConfig, char *szServerName, char *szC
 	else
 	{
 		// szCmdLine should be something like slapd-kennedy
-		strcpy(szServerName, szCmdLine);
+		strncpy(szServerName, szCmdLine, sizeof(gszServerName));
+		szServerName[sizeof(gszServerName)-1] = (char)0;
 		bReturn = WD_GetConfigFromRegistry(szServerConfig, szServerName);
 	}
 
@@ -486,7 +496,8 @@ BOOL WD_IsServerSecure(void)
 	char *szTemp;
 	FILE *fh = NULL;
 	
-	sprintf(szFileName, "%s\\%s", gszServerConfig, SLAPD_CONF);
+	snprintf(szFileName, sizeof(szFileName), "%s\\%s", gszServerConfig, SLAPD_CONF);
+	szFileName[sizeof(szFileName)-1] = (char)0;
 	if(fh = fopen(szFileName, "r"))
 	{
 		while(!feof(fh))
@@ -542,7 +553,8 @@ LONG APIENTRY WD_MainWndProc(HWND hWnd, UINT message, UINT wParam, LONG lParam)
 					char szShutdownEvent[MAX_LINE];
 
 					// shutdown web server, it should exit with 0, WatchDog won't restart it
-					sprintf(szShutdownEvent, "NS_%s", gszServerName);
+					snprintf(szShutdownEvent, sizeof(szShutdownEvent), "NS_%s", gszServerName);
+					szShutdownEvent[sizeof(szShutdownEvent)-1] = (char)0;
 					hevShutdown = OpenEvent(EVENT_MODIFY_STATE, FALSE, szShutdownEvent);
 					if(hevShutdown)
 					{
@@ -709,7 +721,8 @@ BOOL WD_StartServer(PROCESS_INFORMATION *pi)
        return(FALSE);
     }
 
-	strcpy(szServerPath, gszServerConfig);
+	strncpy(szServerPath, gszServerConfig, sizeof(szServerPath));
+	szServerPath[sizeof(szServerPath)-1] = (char)0;
 	WD_UnixToDosPath(szServerPath);
 
 	// szServerPath should now be something similar to
@@ -717,7 +730,8 @@ BOOL WD_StartServer(PROCESS_INFORMATION *pi)
 	if(szChar = strrchr(szServerPath, '\\'))
 	{
 		*szChar = 0;
-		strcpy (szInstancePath, szServerPath);
+		strncpy (szInstancePath, szServerPath, sizeof(szInstancePath));
+		szInstancePath[sizeof(szInstancePath)-1] = (char)0;
 		if(szChar = strrchr(szServerPath, '\\'))
 		{
 			*szChar = 0;
@@ -726,8 +740,9 @@ BOOL WD_StartServer(PROCESS_INFORMATION *pi)
 
 	// For Directory Server, service-name is defined as slapd.exe, 
 	// in ldapserver/include/nt/regpargms.h
-	sprintf( szCmdLine, "%s\\bin\\%s\\server\\%s -D \"%s\"", szServerPath, 
+	snprintf( szCmdLine, sizeof(szCmdLine), "%s\\bin\\%s\\server\\%s -D \"%s\"", szServerPath, 
 			 PRODUCT_NAME, SERVICE_EXE, szInstancePath );
+	szCmdLine[sizeof(szCmdLine)-1] = (char)0;
 	// szCmdLine ex: c:\navgold\server\bin\slapd\slapd.exe 
 	//		-f c:\navgold\server\slapd-kennedy\config
 
@@ -877,29 +892,6 @@ BOOL WD_CreateCronThread(HANDLE hevWatchDogExit)
 
 
 //--------------------------------------------------------------------------//
-// signals event create by SNMP agent for notification of server shutdown   //
-//--------------------------------------------------------------------------//
-#if 0
-BOOL WS_SendSNMPTrapSignal(void)
-{
-	BOOL bReturn = FALSE;
-	HANDLE hevShutdown = NULL;
-	char szShutdownEvent[MAX_LINE];
-
-	sprintf(szShutdownEvent, NSEV_SNMPTRAP_HTTP);
-	hevShutdown = OpenEvent(EVENT_MODIFY_STATE, FALSE, szShutdownEvent);
-	if(hevShutdown)
-	{
-		SetEvent(hevShutdown);
-		CLOSEHANDLE(hevShutdown);
-		bReturn = TRUE;
-	}
-	return(bReturn);
-}
-#endif
-
-
-//--------------------------------------------------------------------------//
 //                                                                          //
 //--------------------------------------------------------------------------//
 BOOL WD_MonitorServer(void)
@@ -932,7 +924,8 @@ BOOL WD_MonitorServer(void)
 			// shutdown web server
 			//CLOSEHANDLE(pi.hProcess);  // XXXahakim close them after TerminateProcess()
 			//CLOSEHANDLE(pi.hThread);
-			sprintf(szServerDoneEvent, "NS_%s", gszServerName);
+			snprintf(szServerDoneEvent, sizeof(szServerDoneEvent), "NS_%s", gszServerName);
+			szServerDoneEvent[sizeof(szServerDoneEvent)-1] = (char)0;
 			hevServerDone = OpenEvent(EVENT_MODIFY_STATE, FALSE, szServerDoneEvent);
 			if(hevServerDone)
 			{
@@ -1079,7 +1072,8 @@ VOID WD_ServiceMain(DWORD dwArgc, LPTSTR  *lpszArgv)
 		bOkToProceed = (gsshServiceStatus != (SERVICE_STATUS_HANDLE)NULL);
 		if(bOkToProceed)
 		{
-			strcpy(gszServerName, lpszArgv[0]);
+			strncpy(gszServerName, lpszArgv[0], sizeof(gszServerName));
+			gszServerName[sizeof(gszServerName)-1] = (char)0;
 			bOkToProceed = WD_GetConfigFromRegistry(gszServerConfig, 
 								gszServerName);
 		}
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 7ff8ff06..99010e8c 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -196,6 +196,7 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
 #define SLAPD_SEARCH_FMTSTR_BASE_INT "conn=%s op=%d SRCH base=\"%s\" scope=%d "
 #define SLAPD_SEARCH_FMTSTR_REMAINDER " attrs=%s%s\n"
 
+	  PR_ASSERT(fstr);
       if ( strlen(fstr) > 1024 )
       {
           /*
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index 38dc7f44..42ded667 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -1775,27 +1775,6 @@ set_plugin_config_from_entry(
 	return status;
 }
 
-#if 0
-static PRBool 
-plugin_matches_key (char *arg, char *key)
-{
-	PRBool haveVal = strlen (arg) > strlen (key);
-	return (haveVal && strncasecmp (arg, key, strlen (key)) == 0);
-}
-
-static char*
-plugin_get_str_val (char *arg, char *key)
-{
-	return &(arg[strlen (key)]);
-}
-
-static PRBool
-plugin_get_bool_val (char*arg, char *key, char *true_val)
-{
-	return (strcasecmp (&(arg[strlen (key)]), true_val) == 0);
-}
-#endif
-
 /* This function is called after the plugin init function has been called
    which fills in the desc part of the plugin
 */
diff --git a/ldap/servers/slapd/protect_db.c b/ldap/servers/slapd/protect_db.c
index 4efe729a..4d7183ad 100644
--- a/ldap/servers/slapd/protect_db.c
+++ b/ldap/servers/slapd/protect_db.c
@@ -55,7 +55,8 @@ grab_lockfile()
        gets called by an atexit function, and NSPR is long gone by then. */
 
     /* Get the name of the lockfile */
-    sprintf(lockfile, "%s/%s", slapdFrontendConfig->instancedir, LOCK_FILE);
+    snprintf(lockfile, sizeof(lockfile), "%s/%s", slapdFrontendConfig->instancedir, LOCK_FILE);
+	lockfile[sizeof(lockfile)-1] = (char)0;
     /* Get our pid */
     pid = getpid();
 
@@ -125,7 +126,8 @@ release_lockfile()
 
     /* This function assumes that the caller owns the lock, it doesn't check to make sure! */
 
-    sprintf(lockfile, "%s/%s", slapdFrontendConfig->instancedir, LOCK_FILE);
+    snprintf(lockfile, sizeof(lockfile), "%s/%s", slapdFrontendConfig->instancedir, LOCK_FILE);
+	lockfile[sizeof(lockfile)-1] = (char)0;
     unlink(lockfile);
 }
 
@@ -191,7 +193,8 @@ add_this_process_to(char *dir_name)
     PRFileDesc* prfd;
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
-    sprintf(file_name, "%s/%d", dir_name, getpid());
+    snprintf(file_name, sizeof(file_name), "%s/%d", dir_name, getpid());
+	file_name[sizeof(file_name)-1] = (char)0;
     
     if ((prfd = PR_Open(file_name, PR_RDWR | PR_CREATE_FILE, 0666)) == NULL) {
 	LDAPDebug(LDAP_DEBUG_ANY, FILE_CREATE_WARNING, file_name, 0, 0);
@@ -317,10 +320,14 @@ remove_slapd_process()
 
     /* Create the name of the directories that hold the pids of the currently running 
      * ns-slapd processes */
-    sprintf(lock_dir, "%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR);
-    sprintf(import_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, IMPORT_DIR);
-    sprintf(export_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, EXPORT_DIR);
-    sprintf(server_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, SERVER_DIR);
+    snprintf(lock_dir, sizeof(lock_dir), "%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR);
+	lock_dir[sizeof(lock_dir)-1] = (char)0;
+    snprintf(import_dir, sizeof(import_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, IMPORT_DIR);
+	import_dir[sizeof(import_dir)-1] = (char)0;
+    snprintf(export_dir, sizeof(export_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, EXPORT_DIR);
+	export_dir[sizeof(export_dir)-1] = (char)0;
+    snprintf(server_dir, sizeof(server_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, SERVER_DIR);
+	server_dir[sizeof(server_dir)-1] = (char)0;
 
     /* Grab the lockfile */
     if (grab_lockfile() != 0) {
@@ -353,10 +360,14 @@ add_new_slapd_process(int exec_mode, int r_flag, int skip_flag)
 
     /* Create the name of the directories that hold the pids of the currently running 
      * ns-slapd processes */
-    sprintf(lock_dir, "%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR);
-    sprintf(import_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, IMPORT_DIR);
-    sprintf(export_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, EXPORT_DIR);
-    sprintf(server_dir, "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, SERVER_DIR);
+    snprintf(lock_dir, sizeof(lock_dir), "%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR);
+	lock_dir[sizeof(lock_dir)-1] = (char)0;
+    snprintf(import_dir, sizeof(import_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, IMPORT_DIR);
+	import_dir[sizeof(import_dir)-1] = (char)0;
+    snprintf(export_dir, sizeof(export_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, EXPORT_DIR);
+	export_dir[sizeof(export_dir)-1] = (char)0;
+    snprintf(server_dir, sizeof(server_dir), "%s/%s/%s", slapdFrontendConfig->instancedir, LOCK_DIR, SERVER_DIR);
+	server_dir[sizeof(server_dir)-1] = (char)0;
 
     /* Grab the lockfile */
     if (grab_lockfile() != 0) {
@@ -491,8 +502,10 @@ is_slapd_running() {
   slapdFrontendConfig_t *cfg = getFrontendConfig();
   int running = 0;
   
-  sprintf(lock_dir, "%s/%s", cfg->instancedir, LOCK_DIR);
-  sprintf( server_dir, "%s/%s/%s", cfg->instancedir, LOCK_DIR, SERVER_DIR);
+  snprintf(lock_dir, sizeof(lock_dir), "%s/%s", cfg->instancedir, LOCK_DIR);
+  lock_dir[sizeof(lock_dir)-1] = (char)0;
+  snprintf( server_dir, sizeof(server_dir), "%s/%s/%s", cfg->instancedir, LOCK_DIR, SERVER_DIR);
+  server_dir[sizeof(server_dir)-1] = (char)0;
   
   /* Grab the lockfile */
   if (grab_lockfile() != 0) {
@@ -620,14 +633,14 @@ add_new_slapd_process(int exec_mode, int r_flag, int skip_flag)
 	}
 
 	/* Create the names for the mutexes */
-	strcpy(mutexName, slapdFrontendConfig->instancedir);
+	PL_strncpyz(mutexName, slapdFrontendConfig->instancedir, sizeof(mutexName));
 
 	/* Make sure the name of the mutex is legal. */
 	fix_mutex_name(mutexName);
 
-	sprintf(serverMutexName, "%s/server", mutexName);
-	sprintf(importMutexName, "%s/import", mutexName);
-	sprintf(exportMutexName, "%s/export", mutexName);
+	PR_snprintf(serverMutexName, sizeof(serverMutexName), "%s/server", mutexName);
+	PR_snprintf(importMutexName, sizeof(importMutexName), "%s/import", mutexName);
+	PR_snprintf(exportMutexName, sizeof(exportMutexName), "%s/export", mutexName);
 	
 	/* Fill in the security crap for the mutex */
 	pSD = (PSECURITY_DESCRIPTOR)slapi_ch_malloc( sizeof( SECURITY_DESCRIPTOR ) );
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 7ad6ee4d..687aa727 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -676,9 +676,6 @@ struct slapi_componentid * pw_get_componentID();
  * referral.c
  */
 void referrals_free ();
-Ref_Array * ref_array_dup();
-void ref_array_dup_free(Ref_Array *the_copy);
-void update_global_referrals( Slapi_PBlock *pb );
 struct berval **ref_adjust( Slapi_PBlock *pb, struct berval **urls, const Slapi_DN *refcontainerdn, int is_reference );
 /* GGOODREPL temporarily in slapi-plugin.h struct berval **get_data_source( char *dn, int orc, Ref_Array * ); */
 
diff --git a/ldap/servers/slapd/referral.c b/ldap/servers/slapd/referral.c
index cede05d6..429f6ef4 100644
--- a/ldap/servers/slapd/referral.c
+++ b/ldap/servers/slapd/referral.c
@@ -12,36 +12,12 @@
 #include "slap.h"
 
 /* Forward Decls */
-static int ref_array_del(Ref **target, int write, int read);
-static int ref_array_add(const char *dn, struct berval *referral, int write, int read);
-static Ref **ref_array_find(const char *dn);
-static int ref_array_mod(Ref **target, struct berval *referral, int write, int read);
-static void strcat_escaped( char *s1, char *s2 );
 static void adjust_referral_basedn( char **urlp, const Slapi_DN *refcontainerdn, char *opdn_norm, int isreference );
 static int dn_is_below( const char *dn_norm, const char *ancestor_norm );
 static Ref_Array *g_get_global_referrals(void);
 static void ref_free (Ref **goner);
 static Ref_Array global_referrals;
 
-struct refCb {
-    int type;
-    char *cbName;
-    void (*cb)(Slapi_PBlock *, void *);
-    void *cbData;
-    struct refCb *next;
-};
-
-struct refCb *refCbList=NULL;
-
-int
-ref_register_callback(int type, char *description, 
-		      void (*cb)(Slapi_PBlock *, void *), void *cbData);
-int
-ref_remove_callback(char *description);
-static
-int ref_call_cbs(int type, Slapi_PBlock *pb);
-
-
 #define SLAPD_DEFAULT_REFARRAY_SIZE 10
 
 /*
@@ -76,438 +52,6 @@ g_get_global_referrals(void)
     return( &global_referrals );
 }
 
-/*
- *  Function: ref_array_del
- *
- *  Returns: 0 good, -1 bad.
- *
- *  Description: finds "dn" in the list and unsets the read or write
- *               flag(s). If both are then zero, then it frees up that entry.
- *               target should point to the referral that is to be deleted.
- *               Note: This does NOT lock global_referrals.ra_rwlock.
- *               
- * Author: RJP
- */
-static int
-ref_array_del(Ref **target, int write, int read)
-{
-  Ref           **lastref = NULL;
-  Ref_Array      *grefs = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (target == NULL) {
-    return(-1); 
-  }
-
-  /*Unset either or both flags*/
-  if (write) {
-    (*target)->ref_writes = 0;
-  }
-  if (read) {
-    (*target)->ref_reads = 0;
-    grefs->ra_readcount--;
-  }
-  
-  /*If there is a flag set, then don't delete the referral*/
-  if (((*target)->ref_writes == 1) || (*target)->ref_reads == 1){
-    return(0);
-  }
-  
-  /* Free up target */
-  ref_free(target);
-
-
-  /*
-   * Okay, we want to maintain our array's compactedness, 
-   * so we take the referral that's in the last position, and 
-   * put that in target's place. If they are one and the 
-   * same, then no problem. This shouldn't ever seg fault.
-   * (famous last words).
-   */
-  lastref = &grefs->ra_refs[grefs->ra_nextindex - 1];
-
-  *target = *lastref;
-
-  grefs->ra_refs[grefs->ra_nextindex - 1] = NULL;
-
-  /*reset the next_index*/
-  grefs->ra_nextindex--;
-
-  return(0);
-
-}
-
-
-/*
- *  Function: ref_array_replace
- *
- *  Returns: 0 good, -1 bad.
- *
- *  Description: Locks the mutex associated with global_referrals,
- *               adds that referral and "dn" to the global_referrals if it
- *               doesn't exist already. If it does exist, and the new
- *               referral is different, then the old one gets clobbered.
- *               If referral is NULL, then it deletes the referral 
- *               associated with dn.
- *               Note: This locks global_referrals.ra_rwlock.
- *               
- * Author: RJP
- */
-int
-ref_array_replace(const char *dn, struct berval *referral, int write, int read)
-{
-  Ref           **target = NULL;
-  int            err;
-  Ref_Array      *grefs = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (dn == NULL) {
-    return(0);
-  }
-
-  GR_LOCK_WRITE();
-  
-  /* Find the referral, if any. */
-  target = ref_array_find(dn);
-
-  /* If datasource is NULL, then delete target. */
-  if ( referral == NULL ){
-
-    /* If target is null, then there is nothing to do. */
-    if (target == NULL) {
-      GR_UNLOCK_WRITE();
-      return(0);
-    }
-    err = ref_array_del(target, write, read);
-        
-    GR_UNLOCK_WRITE();
-
-    return(err);
-  }
-
-  /* If target is NULL, then add target to the end. */
-  if ( target == NULL) {
-    err = ref_array_add(dn, referral, write, read);
-    GR_UNLOCK_WRITE();
-    return(err);
-  }
-
-  /* Else, the referral already exists and we should modify it. */
-  err = ref_array_mod(target, referral, write, read);
-  GR_UNLOCK_WRITE();
-  return(err);
-}
-
-
-/*
- *  Function: ref_array_mod
- *
- *  Returns: 0 good, -1 bad.
- *
- *  Description: modifies the existing referral.
- *               First it checks the host:port in datasource 
- *               against the host:port in the existing referral.
- *               If they don't match, then it replaces the referral
- *
- *               Note: This does NOT lock global_referrals.ra_rwlock.
- *               
- * Author: RJP
- */
-static int
-ref_array_mod(Ref **target, struct berval *referral, int write, int read)
-{
-  Ref_Array     *grefs  = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (referral == NULL || target == NULL) {
-    return(0);
-  }
-
-  /* Actually, instead of comparing them, we might as well just swap */
-  ber_bvfree( (*target)->ref_referral );
-
-  (*target)->ref_referral = referral ;
-
-  /* 
-   * We have to update the read/write flags which
-   * refer reads and writes, respectively
-   */
-  if (write) {
-    (*target)->ref_writes = 1;
-  }
-  if (read) {
-    /*Don't update the readcount unnecessarily*/
-    if ((*target)->ref_reads == 0) {
-      grefs->ra_readcount++;
-    }
-    
-    (*target)->ref_reads = 1;
-  }
-
-  return(0);
-  
-}
-
-
-
-/*
- *  Function: ref_array_add
- *
- *  Returns: 0 good, -1 bad.
- *
- *  Description: adds that referral and "dn" to the global_referrals 
- *               Note: This does NOT lock global_referrals.ra_rwlock.
- *               
- * Author: RJP
- */
-static int
-ref_array_add(const char *dn, struct berval *referral, int write, int read)
-{
-  Ref           **target = NULL;
-  Ref_Array     *grefs = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (dn == NULL || referral == NULL) {
-    return(0);
-  }
-
-
-  /* We may have to realloc if we are about to index an out-of-range slot */
-  if (grefs->ra_nextindex >= grefs->ra_size){
-    /* reset the size */
-    grefs->ra_size += 10;
-    
-    /* reallocate */
-    grefs->ra_refs = (Ref **) slapi_ch_realloc((char *) grefs->ra_refs, 
-						  grefs->ra_size * (sizeof(Ref *)));
-  }
-
-  /* Tack the new referral to the end. */
-  target = &(grefs->ra_refs[grefs->ra_nextindex]);
-  
-  /* Malloc and fill the fields of the new referral */
-  (*target) = (Ref *) slapi_ch_malloc( sizeof(Ref));
-  (*target)->ref_dn = slapi_dn_normalize_case(slapi_ch_strdup(dn));
-  (*target)->ref_referral = referral;
-  
-  /* Update the next available index */
-  grefs->ra_nextindex++;
-
-  (*target)->ref_writes = 0;
-  (*target)->ref_reads = 0;
-
-  /* 
-   * We have to update the read/write flags which
-   * refer reads and writes, respectively
-   */
-  if (write) {
-    (*target)->ref_writes = 1;
-  }
-  if (read) {
-    (*target)->ref_reads = 1;
-    grefs->ra_readcount++;
-  }
-
-  return(0);
-}
-
-/*
- * Function: ref_array_find
- *
- * Returns: a pointer to a pointer to a Ref, or NULL
- *
- * Description: Traverses the array of referrals, until
- *              it either finds a match or gets to the end.
- *              Note: This DOES NOT lock global_referrals.ra_rwlock.
- *
- * Author: RJP
- *
- */
-static Ref **
-ref_array_find(const char *dn)
-{
-  int walker;
-  Ref_Array  *grefs = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (dn == NULL) {
-    return(NULL);
-  }
-
-  /* Walk down the array, testing for a match */
-  for (walker = 0; walker < grefs->ra_nextindex; walker++){
-
-    if (strcasecmp (grefs->ra_refs[walker]->ref_dn, dn) == 0) {
-      return(&grefs->ra_refs[walker]);
-    }
-  }
-  return(NULL);
-}
-
-/*
- * Function: send_read_referrals
- *
- * Returns: A copy of global_referrals
- *
- * Description: Given a dn, this function sends all the copyingfrom
- *              referrals beneath "dn" that are within "scope."
- *              returns a copy of the global_referrals array
- *              that it makes for use later. This is to avoid
- *              any race conditions of ORC ending in the middle
- *              of the search and scewing things up. NULL is returned
- *              if there are no copyingfrom referrals in there.
- *
- *              If "dn" does not exactly match a referral's dn, we append
- *              "/referralDN" to the referral itself, i.e, we send a
- *              referral like this:
- *                   ldap://host:port/dn
- *              instead of one like this:
- *                   ldap://host:port
- *              We do not append the referral DN to the referrals present
- *              in the copy of the global_referrals array that we return.
- *
- * Author: RJP
- *
- */
-Ref_Array * 
-send_read_referrals(Slapi_PBlock *pb, int scope, char *dn,
-	struct berval ***urls)
-{
-  int             walker, urllen, dnlen;
-  struct berval  *refs[2], refcopy;
-  char           *urlcopy;
-  Ref_Array      *grefs     = NULL;
-  Ref_Array      *the_copy  = NULL;
-  int             found_one = 0;
-
-  /* Get a pointer to global_referrals */
-  grefs = g_get_global_referrals();
-  
-  GR_LOCK_READ();
-
-  /*If no copyingfroms, just return*/
-  if (grefs->ra_readcount <= 0) {
-    GR_UNLOCK_READ();
-    return(NULL);
-  }
-  
-  refs[1] = NULL;
-
-  /*
-   * Walk through the refs in the_copy and send any referrals
-   * that are below "dn".  Take "scope" into account as well.
-   */
-  for (walker = 0; walker < grefs->ra_nextindex; walker++) {
-    if ( grefs->ra_refs[walker]->ref_reads && 
-	 (( scope == LDAP_SCOPE_BASE &&
-	     strcasecmp(grefs->ra_refs[walker]->ref_dn, dn) == 0 ) ||
-	 ( scope == LDAP_SCOPE_ONELEVEL &&
-	     slapi_dn_isparent(dn, grefs->ra_refs[walker]->ref_dn)) ||
-	 ( scope == LDAP_SCOPE_SUBTREE &&
-	     slapi_dn_issuffix(grefs->ra_refs[walker]->ref_dn, dn)))) {
-      found_one = 1;
-      
-      /*
-       * Make an array of 1 referral.  If the referral DN is below "dn",
-       * i.e, it is not the same as "dn", we make a copy and append a
-       * URL-escaped version of the referral DN to the original referral.
-       */
-      if ( scope == LDAP_SCOPE_BASE ||
-	    strcasecmp( grefs->ra_refs[walker]->ref_dn, dn ) == 0 ) {
-	refs[0] = grefs->ra_refs[walker]->ref_referral;
-	urlcopy = NULL;
-      } else {
-	urllen = strlen( grefs->ra_refs[walker]->ref_referral->bv_val );
-	dnlen = strlen( grefs->ra_refs[walker]->ref_dn );
-	/* space for worst-case expansion due to escape plus room for '/' */
-	urlcopy = slapi_ch_malloc( urllen + 3 * dnlen + 2 );
-
-	strcpy( urlcopy, grefs->ra_refs[walker]->ref_referral->bv_val );
-	urlcopy[urllen] = '/';
-	++urllen;
-	urlcopy[urllen] = '\0';
-	strcat_escaped( urlcopy + urllen, grefs->ra_refs[walker]->ref_dn );
-
-	refcopy.bv_val = urlcopy;
-	refcopy.bv_len = strlen( urlcopy );
-	refs[0] = &refcopy;
-      }
-
-      send_ldap_referral( pb, NULL, refs, urls ); 
-      slapi_pblock_set( pb, SLAPI_SEARCH_REFERRALS, *urls );
-
-      if ( urlcopy != NULL ) {
-        slapi_ch_free( (void **)&urlcopy );
-      }
-    }
-  }
-  
-  /* Make a copy of global_referrals to avoid any race conditions */
-  if (found_one) {
-    the_copy = ref_array_dup();
-  }
-  
-  GR_UNLOCK_READ();
-
-  /*
-   * After we sent all the referrals, return the copy of
-   * global_referrals for use later. If there were none found, return
-   * NULL 
-   */
-  return(the_copy);
-}
-
-/*
- * Function: ref_array_dup
- *
- * Returns: a copy of global_referrals 
- *
- * Description: Makes a copy of global_referrals and returns that puppy
- *              Note: Does not lock global_referrals.
- *
- * Author: RJP
- *
- */
-Ref_Array *
-ref_array_dup(void)
-{
-  Ref_Array *grefs    = NULL;
-  Ref_Array *the_copy = NULL;
-  int        walker;
-
-  /*Allocate the first structure*/
-  the_copy = (Ref_Array *) slapi_ch_calloc(1, sizeof(Ref_Array));
-
-  /* Don't bother with the lock, it's only a local copy. */
-  the_copy->ra_rwlock = NULL;
-
-  /*Grab a reference to the global_referrals*/
-  grefs = g_get_global_referrals();
-
-  /* Initialize all the fields of the copy. */
-  the_copy->ra_size      = grefs->ra_size;
-  the_copy->ra_nextindex = grefs->ra_nextindex;
-  the_copy->ra_readcount = grefs->ra_readcount;
-  the_copy->ra_refs = (Ref **) slapi_ch_calloc(the_copy->ra_size, sizeof( Ref * ));
-
-  /*Walk down grefs, copying each Ref struct */
-  for (walker = 0; walker < grefs->ra_nextindex; walker++) {
-    the_copy->ra_refs[walker] = (Ref *)slapi_ch_calloc(1, sizeof(Ref));						       
-    the_copy->ra_refs[walker]->ref_dn = slapi_ch_strdup(grefs->ra_refs[walker]->ref_dn);
-    the_copy->ra_refs[walker]->ref_referral = slapi_ch_bvdup(grefs->ra_refs[walker]->ref_referral);
-    the_copy->ra_refs[walker]->ref_reads = grefs->ra_refs[walker]->ref_reads;
-    the_copy->ra_refs[walker]->ref_writes = grefs->ra_refs[walker]->ref_writes;
-  }
-
-  return(the_copy);
-
-}
-
 
 /*
  * Function: ref_free
@@ -527,39 +71,6 @@ ref_free (Ref **goner)
   slapi_ch_free((void**) goner);
 }
 
-/*
- * Function: ref_array_dup_free
- *
- * Returns: nothingness
- *
- * Description: takes a Ref_Array dup and frees that puppy
- *
- * Author: RJP
- *
- */
-void
-ref_array_dup_free(Ref_Array *the_copy)
-{
-	int walker;
-
-	if (the_copy == NULL) {
-		return;
-	}
-
-	/* Walk down the array, deleting each referral */
-	for (walker = 0; walker < the_copy->ra_nextindex; walker++)
-	{
-		ref_free (&the_copy->ra_refs[walker]);
-	} 
-
-	/* free the array of pointers */
-	slapi_ch_free((void **) &the_copy->ra_refs);
-	slapi_ch_free((void **) &the_copy);
-
-	return;
-}
-
-
 
 /*
  * Function: referrals_free
@@ -595,125 +106,6 @@ referrals_free (void)
 }
 
 /*
- *  Function: ref_array_moddn
- *
- *  Returns: 0 good, -1 bad.
- *
- *  Description: modifies the existing referral's dn.
- *               First it locks global_referrals.ra_rwlock.
- *               Then it clobbers the existing dn.
- *               Then it replaces it with a new dn constructed 
- *               from newrdn.
- *               Note: This locks global_referrals.ra_rwlock.
- *               
- * Author: RJP
- */
-void
-ref_array_moddn(const char *dn, char *newrdn, Slapi_PBlock *pb)
-{
-  char  *pdn = NULL;
-  char  *newdn = NULL;
-  Ref  **target = NULL;
-  Ref_Array      *grefs = NULL;
-
-  grefs = g_get_global_referrals();
-
-  if (dn == NULL) {
-    return;
-  }
-  
-  GR_LOCK_WRITE();
-  
-  /* Find the referral. */
-  target = ref_array_find(dn);
-  
-  /* 
-   * If we can't find it, then we're done. This is okay, because this
-   * is the only check that is made to see if the entry has a
-   * copiedfrom in it.
-   */
-  if (target == NULL) {
-    GR_UNLOCK_WRITE();
-    return;
-  }
-  /* construct the new dn */
-  if ( (pdn = slapi_dn_beparent( pb, dn )) != NULL ) {
-    /* parent + rdn + separator(s) + null */
-    newdn = (char *) slapi_ch_malloc( strlen( pdn ) + strlen( newrdn ) + 3 );
-    strcpy( newdn, newrdn );
-    strcat( newdn, ", " );
-    strcat( newdn, pdn );
-  } else {
-    newdn = (char *) slapi_ch_strdup( newrdn );
-  }
-  slapi_ch_free((void **) &pdn );
-  (void) slapi_dn_normalize_case( newdn );
-
-
-  /* We have found the referral. blow away the dn*/
-  slapi_ch_free((void**) &((*target)->ref_dn));
-
-  /* stick in the new one. */
-  (*target)->ref_dn = newdn;
-
-  GR_UNLOCK_WRITE();
-
-  return;
-}
-
-
-/*
- * HREF_CHAR_ACCEPTABLE was copied from libldap/tmplout.c
- */
-/* Note: an identical function is in ../plugins/replication/replutil.c */
-#define HREF_CHAR_ACCEPTABLE( c )	(( c >= '-' && c <= '9' ) ||	\
-					 ( c >= '@' && c <= 'Z' ) ||	\
-					 ( c == '_' ) ||		\
-					 ( c >= 'a' && c <= 'z' ))
-
-/*
- *  Function: strcat_escaped
- *
- *  Returns: nothing
- *
- *  Description: Appends string s2 to s1, URL-escaping (%HH) unsafe
- *               characters in s2 as appropriate.  This function was
- *               copied from libldap/tmplout.c.
- *               
- * Author: MCS
- */
-/*
- * append s2 to s1, URL-escaping (%HH) unsafe characters
- */
-/* Note: an identical function is in ../plugins/replication/replutil.c */
-static void
-strcat_escaped( char *s1, char *s2 )
-{
-    char	*p, *q;
-    char	*hexdig = "0123456789ABCDEF";
-
-    p = s1 + strlen( s1 );
-    for ( q = s2; *q != '\0'; ++q ) {
-	if ( HREF_CHAR_ACCEPTABLE( *q )) {
-	    *p++ = *q;
-	} else {
-	    *p++ = '%';
-	    *p++ = hexdig[ 0x0F & ((*(unsigned char*)q) >> 4) ];
-	    *p++ = hexdig[ 0x0F & *q ];
-	}
-    }
-
-    *p = '\0';
-}
-
-void
-update_global_referrals(Slapi_PBlock *pb)
-{
-    ref_call_cbs(0,pb);
-    return;
-}
-
-/*
  * ref_adjust() -- adjust referrals based on operation-specific data.
  * The general idea is for us (the server) to be smart so LDAP clients
  * can be as dumb as possible.
@@ -1124,80 +516,3 @@ get_data_source(Slapi_PBlock *pb, const Slapi_DN *sdn, int orc, void *cfrp)
   return(bvp);
 
 }
-
-
-int
-ref_register_callback(int type, char *description, 
-		      void (*cb)(Slapi_PBlock *, void *), void *cbData)
-{
-    struct refCb *cbPtr;
-    struct refCb *newCb;
-
-    if(NULL == (newCb = 
-		(struct refCb *)slapi_ch_calloc(1,sizeof(struct refCb)))) {
-	/* out of memory? */
-	return(-1);
-    }
-    newCb->type = type;
-    newCb->next = NULL;
-    newCb->cb = cb;
-    newCb->cbData = cbData;
-    newCb->cbName = slapi_ch_strdup(description);
-
-    if(NULL == refCbList) {
-	refCbList = newCb;
-	return(0);
-    }
-    cbPtr = refCbList;
-    while(NULL != cbPtr->next) cbPtr = cbPtr->next;
-    cbPtr->next=newCb;
-    
-    return(0);
-}
-
-int
-ref_remove_callback(char *description)
-{
-    struct refCb *cbPtr = refCbList;
-    struct refCb *cbPrev = refCbList;
-
-    if((NULL == description) || (NULL == cbPtr)) 
-	return(-1);
-
-    while(cbPtr) {
-	if(!strcmp(description,cbPtr->cbName)) {
-	    if(cbPrev == refCbList) {
-		refCbList = cbPtr->next;
-	    } else {
-		cbPrev->next = cbPtr->next;
-	    }
-	    slapi_ch_free((void **)&cbPtr->cbName);
-	    /* we don't know how the cbData was allocated...we won't attempt
-	       to free it */
-	    slapi_ch_free((void **)&cbPtr);
-	    break;
-	}
-	cbPrev = cbPtr;
-	cbPtr = cbPtr->next;
-    }
-    
-    return(0);
-}
-
-static
-int ref_call_cbs(int type, Slapi_PBlock *pb)
-{
-  struct refCb *cbPtr = refCbList;
-
-  if(NULL == cbPtr) {
-    return(0);
-  }
-
-  while(cbPtr) {
-   (*cbPtr->cb)(pb, cbPtr->cbData);
-   cbPtr = cbPtr->next;
-  }
-     
-  return(0);
-}
-
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 9a406e85..003274b7 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -98,7 +98,7 @@ g_set_default_referral( struct berval **ldap_url ) {
 
   /* check to see if we want to delete all referrals */
   if ( ldap_url && ldap_url[0] &&
-	   strcasecmp ( (char *)ldap_url[0]->bv_val, REFERRAL_REMOVE_CMD) == 0 ) {
+	   PL_strncasecmp ( (char *)ldap_url[0]->bv_val, REFERRAL_REMOVE_CMD, ldap_url[0]->bv_len ) == 0 ) {
 	delete_default_referral(slapdFrontendConfig->defaultreferral);
 	slapdFrontendConfig->defaultreferral = NULL;
 	return;
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 1a6c2f14..c68b61a4 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -422,7 +422,7 @@ static int ids_sasl_canon_user(
     }
 
     /* TODO: canonicalize */
-    strcpy(out_user, dn);
+    PL_strncpyz(out_user, dn, out_umax);
 #ifdef CYRUS_SASL
     /* the length of out_user needs to be set for Cyrus SASL */
     *out_ulen = strlen(out_user);
@@ -433,7 +433,7 @@ static int ids_sasl_canon_user(
         /* The authid can start with dn:. In such case remove it */    
         if (strncasecmp(authid,"dn:",3) == 0 )
             offset = 3;
-        strcpy(out_authid, authid+offset);
+        PL_strncpyz(out_authid, authid+offset, out_amax);
     }
     *out_ulen = -1;
     *out_alen = -1;
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 7162a968..632120c6 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -3183,6 +3183,11 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
 		attr_names = parse_qdescrs(psbAttrName->buffer, &num_names);
 		if ( NULL != attr_names ) {
 			first_attr_name = attr_names[0];
+		} else { /* NAME followed by nothing violates syntax */
+			schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
+									input, "Missing or invalid attribute name" );
+			status = invalid_syntax_error;
+			goto done;
 		}
 	}
 
@@ -3192,7 +3197,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
 	 * if the attribute ldif doesn't have an OID, we'll make the oid 
 	 * attrname-oid 
 	 */ 
-	if ( strcasecmp ( pOid, "NAME" ) == 0 ) { 
+	if ( (strcasecmp ( pOid, "NAME" ) == 0) && (first_attr_name)) { 
 		slapi_ch_free_string( &pOid ); 
 		pOid = slapi_ch_smprintf("%s-oid", first_attr_name ); 
 	} 
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index fc956615..05862cd6 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -585,19 +585,6 @@ typedef struct index_config
 	int	 system;	  /* marks this index as system */
 }IndexConfig;
 
-int be_create_instance (const char *type,		/* for now, must be "ldbm"			  */
-						const char *name,		/* gloably unique instance name       */
-						const char *root,		/* backend root, i.e. o=mcom.com	  */
-						int cache_size,			/* cache size in bytes; 0 for default */
-						IndexConfig *indexes,	/* indexes in addition to standard	  */
-						int index_count,		/* number of elements in indexes 	  */
-						void *plugin_identity	/* identity of the calling plugin	  */
-					   );
-int be_remove_instance (const char *type,		/* for now, must be "ldbm"			  */
-						const char *name,		/* gloably unique instance name       */
-						void *plugin_identity	/* identity of the calling plugin	  */
-					   );
-
 void be_set_sizelimit(Slapi_Backend * be, int sizelimit);
 void be_set_timelimit(Slapi_Backend * be, int timelimit);
 
@@ -1123,14 +1110,8 @@ int config_get_secureport( void );
 char* get_localhost_DN( void );
 char* get_localhost_DNS( void );
 
-int ref_array_replace(const char *dn, struct berval *referral, int write, int read);
-void ref_array_moddn(const char *dn, char *newrdn, Slapi_PBlock *pb);
-int ref_register_callback(int type, char *description,
-	void (*cb)(Slapi_PBlock *, void *), void *cbData);
-int ref_remove_callback(char *description);
 /* GGOODREPL get_data_source definition should move into repl DLL */
 struct berval **get_data_source(Slapi_PBlock *pb, const Slapi_DN *sdn, int orc, void *cf_refs);
-/* Ref_Array *send_read_referrals(Slapi_PBlock *pb, int scope, char *dn, struct berval ***urls); */
 
 /* JCMREPL - IFP and CFP should be defined centrally */
 #ifndef _IFP
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 70ca82da..93a7ae94 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -379,7 +379,7 @@ slapd_nss_init(int init_ssl, int config_available)
 	}
 
 	instancedir = config_get_instancedir();
-	strcpy(path, instancedir);
+	PL_strncpyz(path, instancedir, sizeof(path));
 	slapi_ch_free_string(&instancedir);
 
 	/* make sure path does not end in the path separator character */
@@ -398,7 +398,7 @@ slapd_nss_init(int init_ssl, int config_available)
 	if(keyfn && certfn) {
 		if (is_abspath(certfn)) {
 			/* first, initialize path from the certfn */
-			strcpy(path, certfn);
+			PL_strncpyz(path, certfn, sizeof(path));
 			/* extract path from cert db filename */
 			val = strrchr(path, '/');
 			if (!val) {
@@ -407,15 +407,15 @@ slapd_nss_init(int init_ssl, int config_available)
 			*val = 0; /* path is initialized */
 			/* next, init the cert db prefix */
 			val++;
-			strcpy(certPref, val);
+			PL_strncpyz(certPref, val, sizeof(certPref));
 		} else {
-			strcpy(val, certfn);
+			PL_strncpyz(val, certfn, sizeof(path)-(val-path));
 			val = strrchr(path, '/');
 			if (!val) {
 				val = strrchr(path, '\\');
 			}
 			val++;
-			strcpy(certPref, val);
+			PL_strncpyz(certPref, val, sizeof(certPref));
 			*val = '\0'; 
 		}
 		/* path represents now the base directory where cert, key, pin, and module db live */
@@ -437,7 +437,7 @@ slapd_nss_init(int init_ssl, int config_available)
 		} else {
 			val = keyfn;
 		}
-		strcpy(keyPref, val);
+		PL_strncpyz(keyPref, val, sizeof(keyPref));
 		/* richm - use strrstr to get the last occurance of -key in the string, in case
 		   the instance is named slapd-key - the keydb name will be slapd-key-key3.db
 		*/
@@ -458,8 +458,8 @@ slapd_nss_init(int init_ssl, int config_available)
 						   (certfn ? "found" : "not found"));
 		}
 		PR_snprintf(certPref, sizeof(certPref), "%s-", val);
-		strcpy(keyPref, certPref);
-		strcpy(val, "alias/");
+		PL_strncpyz(keyPref, certPref, sizeof(keyPref));
+		PL_strncpyz(val, "alias/", sizeof(path)-(val-path));
 	}
 
 	slapi_ch_free((void **) &certfn);
@@ -661,7 +661,7 @@ slapd_ssl_init() {
     /* Step Three.5: Set SSL cipher preferences */
     *cipher_string = 0;
     if(ciphers && (*ciphers) && strcmp(ciphers, "blank"))
-         strcpy(cipher_string, ciphers);
+         PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
     slapi_ch_free((void **) &ciphers);
 
     if( NULL != (val = _conf_setciphers(cipher_string)) ) {
@@ -796,7 +796,7 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
             if( token && personality ) {
                 if( !strcasecmp(token, "internal") ||
                     !strcasecmp(token, "internal (software)") )
-                    strcpy(cert_name, personality);
+                    PL_strncpyz(cert_name, personality, sizeof(cert_name));
                 else
                     /* external PKCS #11 token - attach token name */
                     PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
@@ -1128,7 +1128,7 @@ slapd_SSL_client_auth (LDAP* ld)
 			 			 * the personality for internal tokens.
 			 			 */
 						token = slapi_ch_strdup(internalTokenName);
-						strcpy(cert_name, personality);
+						PL_strncpyz(cert_name, personality, sizeof(cert_name));
 						slapi_ch_free((void **) &ssltoken);
 			  } else {
 						/* external PKCS #11 token - attach token name */
@@ -1371,8 +1371,10 @@ char* slapd_get_tmp_dir()
 			 "config_get_instancedir returns NULL Setting tmp dir to default\n");
 
 #if defined( XP_WIN32 )
+			ilen = sizeof(tmp);
+			GetTempPath( ilen, tmp );
+			tmp[ilen-1] = (char)0;
 			ilen = strlen(tmp);
-			GetTempPath( ilen+1, tmp );
 			/* Remove trailing slash. */
 			pch = tmp[ilen-1];
 			if( pch == '\\' || pch == '/' )
diff --git a/ldap/servers/slapd/str2filter.c b/ldap/servers/slapd/str2filter.c
index 0be70725..cb65cc97 100644
--- a/ldap/servers/slapd/str2filter.c
+++ b/ldap/servers/slapd/str2filter.c
@@ -215,6 +215,8 @@ str2simple( char *str , int unescape_filter)
 
 	LDAPDebug( LDAP_DEBUG_FILTER, "str2simple \"%s\"\n", str, 0, 0 );
 
+	PR_ASSERT(str);
+
 	if ( (s = strchr( str, '=' )) == NULL ) {
 		return( NULL );
 	}
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index 20e42b95..4bc452fd 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -245,7 +245,7 @@ void slapi_task_log_notice(Slapi_Task *task, char *format, ...)
     va_end(ap);
 
     len = 2 + strlen(buffer) + (task->task_log ? strlen(task->task_log) : 0);
-    if (len > MAX_SCROLLBACK_BUFFER) {
+    if ((len > MAX_SCROLLBACK_BUFFER) && task->task_log) {
 		size_t i;
 		char *newbuf;
 
diff --git a/ldap/servers/slapd/tools/mmldif.c b/ldap/servers/slapd/tools/mmldif.c
index 68ec793f..63f0ff96 100644
--- a/ldap/servers/slapd/tools/mmldif.c
+++ b/ldap/servers/slapd/tools/mmldif.c
@@ -655,8 +655,8 @@ int mm_init(int argc, char * argv[])
         edfin[ndirectories].end = FALSE;
 
         if (emitchanges) {
-            strcpy(deltaname, *argv);
-            strcat(deltaname, ".delta");
+            PL_strncpyz(deltaname, *argv, sizeof(deltaname));
+            PL_strcatn(deltaname, sizeof(deltaname), ".delta");
             edfout[ndirectories] = fopen(deltaname, "w");
             if (edfout[ndirectories] == NULL) {
                 perror(deltaname);
diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index 7d8fa0b4..bb1b569c 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -411,9 +411,9 @@ rel2abspath( char *relpath )
 #else
 	if ( abspath[ 0 ] != '\0' && abspath[ strlen( abspath ) - 1 ] != '/' ) {
 #endif
-	    strcat( abspath, "/" );
+	    PL_strcatn( abspath, sizeof(abspath), "/" );
 	}
-	strcat( abspath, relpath );
+	PL_strcatn( abspath, sizeof(abspath), relpath );
     }
     return( slapi_ch_strdup( abspath ));
 }