clean up sprintf usage and many other flawfinder issues; clean up compiler warnings on Linux; remove pam_passthru from DS 7.1

152 files changed, 756 insertions, 1296 deletions

diff --git a/ldap/servers/plugins/Makefile b/ldap/servers/plugins/Makefile
index 5abb48f0..2f4b84de 100644
--- a/ldap/servers/plugins/Makefile
+++ b/ldap/servers/plugins/Makefile
@@ -20,7 +20,9 @@ include $(BUILD_ROOT)/nsconfig.mk
 include $(LDAP_SRC)/nsldap.mk
 
 ifneq ($(ARCH), WINNT)
-all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views _pam_passthru
+all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views
+# richm 20050303 - do not build pam pass thru for DS 7.1
+#all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views _pam_passthru
 else
 all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views
 endif
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 24848efa..4e21c31d 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -35,7 +35,7 @@ static char *ds_map_generic[2] = { NULL, NULL };
 /****************************************************************************/
 static	int	acl__resource_match_aci(struct acl_pblock *aclpb, aci_t	*aci ,
 								int skip_attrEval, int *a_matched);
-static	acl__TestRights(Acl_PBlock *aclpb,int access, char **right,
+static	int acl__TestRights(Acl_PBlock *aclpb,int access, char **right,
 						char ** map_generic, aclResultReason_t *result_reason);
 static int 	acl__scan_for_acis(struct acl_pblock *aclpb, int *err);
 static void	acl__reset_cached_result (struct acl_pblock *aclpb );
@@ -43,7 +43,6 @@ static int 	acl__scan_match_handles ( struct acl_pblock *aclpb, int type);
 static int 	acl__attr_cached_result (struct acl_pblock *aclpb, char *attr, int access );
 static int 	acl__match_handlesFromCache (struct acl_pblock *aclpb, char *attr, int access);
 static int	acl__get_attrEval ( struct acl_pblock *aclpb, char *attr );
-static int	acl__config_get_readonly ();
 static int	acl__recompute_acl (Acl_PBlock *aclpb, AclAttrEval *a_eval,
 									int	access,	int	aciIndex);
 static void	__acl_set_aclIndex_inResult ( Acl_PBlock *aclpb,
@@ -991,8 +990,7 @@ acl_read_access_allowed_on_entry (
 				slapi_ch_free ( (void **) &aclpb->aclpb_Evalattr);
 				aclpb->aclpb_Evalattr = slapi_ch_malloc(len);
 			}
-			strncpy (aclpb->aclpb_Evalattr, attr_type, len);
-			aclpb->aclpb_Evalattr[len] = '\0';
+			PL_strncpyz (aclpb->aclpb_Evalattr, attr_type, len);
 			if ( attr_index >= 0 ) {
 				/*
 				 * access was granted to one of the user specified attributes
@@ -3872,34 +3870,6 @@ acl_regen_aclsignature ()
 }
 	
 
-
-static int
-acl__handle_config_entry (Slapi_Entry *e,  void *callback_data )
-{
-
-    int             *value = (int *) callback_data;
-
-	*value = slapi_entry_attr_get_int( e, "nsslapd-readonly");
-       
-    return 0;
-}
-
-static int
-acl__config_get_readonly ()
-{
-
-	int readonly = 0;
-
-	slapi_search_internal_callback( "cn=config", LDAP_SCOPE_BASE, "(objectclass=*)",
-   	                        NULL, 0 /* attrsonly */,
-                            &readonly/* callback_data */,
-                            NULL /* controls */,
-                            NULL /* result_callback */,
-                            acl__handle_config_entry,
-                            NULL /* referral_callback */);
-
-	return readonly;
-}
 /*
 *
 * Assumptions:
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index 129c7f54..511862b9 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -730,7 +730,6 @@ acl__done_aclpb ( struct acl_pblock *aclpb )
 
 	int		i;
 	int		dump_aclpb_info = 0;
-	char    *ds_attr_userdn=NULL;	/* for finding userdn for freeing */
 	int 	rc=-1;
 	char 	*tmp_ptr=NULL;
 
diff --git a/ldap/servers/plugins/acl/aclanom.c b/ldap/servers/plugins/acl/aclanom.c
index 1161a4bd..ba03552a 100644
--- a/ldap/servers/plugins/acl/aclanom.c
+++ b/ldap/servers/plugins/acl/aclanom.c
@@ -352,7 +352,6 @@ aclanom_get_suffix_info(Slapi_Entry *e,
 	char     *ndn = NULL;
 	Slapi_DN    *e_sdn;
 	const char    *aci_ndn;
-	int populate = 0;
 	struct scoped_entry_anominfo *s_e_anominfo =
 			&aclpb->aclpb_scoped_entry_anominfo;
 
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c
index 98d08ee9..2a1c61ae 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -5,6 +5,53 @@
 
 #include "acl.h"
 
+/* safer than doing strcat unprotected */
+/* news2 is optional, provided as a convenience */
+/* capacity is the capacity of the gerstr, size is the current length */
+static void
+_append_gerstr(char **gerstr, size_t *capacity, size_t *size, const char *news, const char *news2)
+{
+	size_t len;
+	size_t increment = 128;
+	size_t fornull;
+
+	if (!news) {
+		return;
+	}
+
+	/* find out how much space we need */
+	len = strlen(news);
+	fornull = 1;
+	if (news2) {
+		len += strlen(news2);
+		fornull++;
+	}
+
+	/* increase space if needed */
+	while ((*size + len + fornull) > *capacity) {
+		if ((len + fornull) > increment) {
+			*capacity += len + fornull; /* just go ahead and grow the string enough */
+		} else {
+			*capacity += increment; /* rather than having lots of small increments */
+		}
+	}
+
+	if (!*gerstr) {
+		*gerstr = slapi_ch_malloc(*capacity);
+		**gerstr = 0;
+	} else {
+		*gerstr = slapi_ch_realloc(*gerstr, *capacity);
+	}
+	strcat(*gerstr, news);
+	if (news2) {
+		strcat(*gerstr, news2);
+	}
+
+	*size += len;
+
+	return;
+}
+
 static int
 _ger_g_permission_granted ( Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf )
 {
@@ -203,8 +250,8 @@ _ger_new_gerpb (
 {
 	Connection *conn;
 	struct acl_cblock *geraclcb;
-	Acl_PBlock *aclpb, *geraclpb;
-	Operation *op, *gerop;
+	Acl_PBlock *geraclpb;
+	Operation *gerop;
 	int rc = LDAP_SUCCESS;
 
 	*aclcb = NULL;
@@ -282,17 +329,18 @@ _ger_get_entry_rights (
 	Slapi_PBlock *gerpb,
 	Slapi_Entry *e,
 	const char *subjectndn,
-	char *gerstr,
+	char **gerstr,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	char **errbuf
 	)
 {
 	unsigned long entryrights = 0;
 	Slapi_RDN *rdn = NULL;
-	const char *rdnstr = NULL;
-	char *equalsign = NULL;
 	char *rdntype = NULL;
+	char *rdnvalue = NULL;
 
-	strcpy ( gerstr, "entryLevelRights: " );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "entryLevelRights: ", NULL);
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_READ\n" );
@@ -300,7 +348,7 @@ _ger_get_entry_rights (
 	{
 		/* v - view e */
 		entryrights |= SLAPI_ACL_READ;
-		strcat (gerstr, "v");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "v", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_ADD\n" );
@@ -308,7 +356,7 @@ _ger_get_entry_rights (
 	{
 		/* a - add child entry below e */
 		entryrights |= SLAPI_ACL_ADD;
-		strcat (gerstr, "a");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "a", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_DELETE\n" );
@@ -316,7 +364,7 @@ _ger_get_entry_rights (
 	{
 		/* d - delete e */
 		entryrights |= SLAPI_ACL_DELETE;
-		strcat (gerstr, "d");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "d", NULL);
 	}
 	/*
 	 * Some limitation/simplification applied here:
@@ -327,12 +375,8 @@ _ger_get_entry_rights (
 	 *   the first rdn type only for now.
 	 */
 	rdn = slapi_rdn_new_dn ( slapi_entry_get_ndn (e) );
-	rdnstr = slapi_rdn_get_rdn ( rdn );
-	if ( NULL != (equalsign = strchr ( rdnstr, '=' )) )
-	{
-		rdntype = slapi_ch_malloc ( equalsign-rdnstr+1 );
-		strncpy ( rdntype, rdnstr, equalsign-rdnstr );
-		rdntype [ equalsign-rdnstr ] = '\0';
+	slapi_rdn_get_first(rdn, &rdntype, &rdnvalue);
+	if ( NULL != rdntype ) {
 		slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 			"_ger_get_entry_rights: SLAPI_ACL_WRITE_DEL & _ADD %s\n", rdntype );
 		if (acl_access_allowed(gerpb, e, rdntype, NULL,
@@ -342,19 +386,17 @@ _ger_get_entry_rights (
 		{
 			/* n - rename e */
 			entryrights |= SLAPI_ACL_WRITE;
-			strcat (gerstr, "n");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
 		}
-		slapi_ch_free ( (void**) &rdntype );
 	}
 	slapi_rdn_free ( &rdn );
 
-done:
 	if ( entryrights == 0 )
 	{
-		strcat (gerstr, "none");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "none", NULL);
 	}
 
-	strcat (gerstr, "\n");
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "\n", NULL);
 
 	return entryrights;
 }
@@ -370,25 +412,19 @@ _ger_get_attr_rights (
 	const char *subjectndn,
 	char *type,
 	char **gerstr,
-	int *gerstrsize,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	int isfirstattr,
 	char **errbuf
 	)
 {
 	unsigned long attrrights = 0;
 
-	/* Enough space for " $type:rwoscxx" ? */
-	if ( (*gerstrsize - strlen(*gerstr)) < (strlen(type) + 16) )
-	{
-		/* slapi_ch_realloc() exits if realloc() failed */
-		*gerstrsize += 256;
-		*gerstr = slapi_ch_realloc ( *gerstr, *gerstrsize );
-	}
 	if (!isfirstattr)
 	{
-		strcat ( *gerstr, ", " );
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, ", ", NULL);
 	}
-	sprintf ( *gerstr + strlen(*gerstr), "%s:", type );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, type, ":");
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_READ %s\n", type );
@@ -396,7 +432,7 @@ _ger_get_attr_rights (
 	{
 		/* r - read the values of type */
 		attrrights |= SLAPI_ACL_READ;
-		strcat (*gerstr, "r");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "r", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_SEARCH %s\n", type );
@@ -404,7 +440,7 @@ _ger_get_attr_rights (
 	{
 		/* s - search the values of type */
 		attrrights |= SLAPI_ACL_SEARCH;
-		strcat (*gerstr, "s");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "s", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_COMPARE %s\n", type );
@@ -412,7 +448,7 @@ _ger_get_attr_rights (
 	{
 		/* c - compare the values of type */
 		attrrights |= SLAPI_ACL_COMPARE;
-		strcat (*gerstr, "c");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "c", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_WRITE_ADD %s\n", type );
@@ -420,7 +456,7 @@ _ger_get_attr_rights (
 	{
 		/* w - add the values of type */
 		attrrights |= ACLPB_SLAPI_ACL_WRITE_ADD;
-		strcat (*gerstr, "w");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "w", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_WRITE_DEL %s\n", type );
@@ -428,7 +464,7 @@ _ger_get_attr_rights (
 	{
 		/* o - delete the values of type */
 		attrrights |= ACLPB_SLAPI_ACL_WRITE_DEL;
-		strcat (*gerstr, "o");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "o", NULL);
 	}
 	/* If subjectdn has no general write right, check for self write */
 	if ( 0 == (attrrights & (ACLPB_SLAPI_ACL_WRITE_DEL | ACLPB_SLAPI_ACL_WRITE_ADD)) )
@@ -442,19 +478,19 @@ _ger_get_attr_rights (
 		{
 			/* W - add self to the attribute */
 			attrrights |= ACLPB_SLAPI_ACL_WRITE_ADD;
-			strcat (*gerstr, "W");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "W", NULL);
 		}
 		if (acl_access_allowed(gerpb, e, type, &val, ACLPB_SLAPI_ACL_WRITE_DEL) == LDAP_SUCCESS)
 		{
 			/* O - delete self from the attribute */
 			attrrights |= ACLPB_SLAPI_ACL_WRITE_DEL;
-			strcat (*gerstr, "O");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "O", NULL);
 		}
 	}
 
 	if ( attrrights == 0 )
 	{
-		strcat (*gerstr, "none");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "none", NULL);
 	}
 
 	return attrrights;
@@ -467,21 +503,22 @@ _ger_get_attrs_rights (
 	const char *subjectndn,
 	char **attrs,
 	char **gerstr,
-	int *gerstrsize,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	char **errbuf
 	)
 {
 	int isfirstattr = 1;
 
 	/* gerstr was initially allocated with enough space for one more line */
-	strcat ( *gerstr, "attributeLevelRights: " );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "attributeLevelRights: ", NULL);
 
 	if (attrs && *attrs)
 	{
 		int i;
 		for ( i = 0; attrs[i]; i++ )
 		{
-			_ger_get_attr_rights ( gerpb, e, subjectndn, attrs[i], gerstr, gerstrsize, isfirstattr, errbuf );
+			_ger_get_attr_rights ( gerpb, e, subjectndn, attrs[i], gerstr, gerstrsize, gerstrcap, isfirstattr, errbuf );
 			isfirstattr = 0;
 		}
 	}
@@ -495,7 +532,7 @@ _ger_get_attrs_rights (
 			if ( ! slapi_attr_flag_is_set (attr, SLAPI_ATTR_FLAG_OPATTR) )
 			{
 				slapi_attr_get_type ( attr, &type );
-				_ger_get_attr_rights ( gerpb, e, subjectndn, type, gerstr, gerstrsize, isfirstattr, errbuf );
+				_ger_get_attr_rights ( gerpb, e, subjectndn, type, gerstr, gerstrsize, gerstrcap, isfirstattr, errbuf );
 				isfirstattr = 0;
 			}
 			prevattr = attr;
@@ -505,7 +542,7 @@ _ger_get_attrs_rights (
 	if ( isfirstattr )
 	{
 		/* not a single attribute was retrived or specified */
-		strcat ( *gerstr, "*:none" );
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "*:none", NULL);
 	}
 	return;
 }
@@ -587,13 +624,13 @@ acl_get_effective_rights (
 	void *aclcb = NULL;
 	char *subjectndn = NULL;
 	char *gerstr = NULL;
-	int gerstrsize = 1024;
+	size_t gerstrsize = 0;
+	size_t gerstrcap = 0;
 	unsigned long entryrights;
 	int iscritical = 1;
 	int rc;
 
 	*errbuf = '\0';
-	gerstr = slapi_ch_malloc ( gerstrsize );
 
 	/*
 	 * Get the subject
@@ -624,13 +661,13 @@ acl_get_effective_rights (
 	}
 
 	/* Get entry level effective rights */
-	entryrights = _ger_get_entry_rights ( gerpb, e, subjectndn, gerstr, errbuf );
+	entryrights = _ger_get_entry_rights ( gerpb, e, subjectndn, &gerstr, &gerstrsize, &gerstrcap, errbuf );
 
 	/*
 	 * Attribute level effective rights may not be NULL
 	 * even if entry level's is.
 	 */
-	_ger_get_attrs_rights ( gerpb, e, subjectndn, attrs, &gerstr, &gerstrsize, errbuf );
+	_ger_get_attrs_rights ( gerpb, e, subjectndn, attrs, &gerstr, &gerstrsize, &gerstrcap, errbuf );
 
 bailout:
 	/*
@@ -640,7 +677,7 @@ bailout:
 
 	if ( rc != LDAP_SUCCESS )
 	{
-		sprintf ( gerstr, "entryLevelRights: %d\nattributeLevelRights: *:%d", rc, rc );
+		gerstr = slapi_ch_smprintf("entryLevelRights: %d\nattributeLevelRights: *:%d", rc, rc );
 	}
 
 	slapi_log_error (SLAPI_LOG_ACLSUMMARY, plugin_name,
diff --git a/ldap/servers/plugins/acl/aclinit.c b/ldap/servers/plugins/acl/aclinit.c
index a2e8c6ae..53cd975b 100644
--- a/ldap/servers/plugins/acl/aclinit.c
+++ b/ldap/servers/plugins/acl/aclinit.c
@@ -36,7 +36,6 @@ static int acl_initialized = 0;
 int
 aclinit_main()
 {
-	char				*cookie = NULL;
 	Slapi_PBlock		*pb;
 	int					rv;
 	Slapi_DN			*sdn;
@@ -194,7 +193,6 @@ aclinit_search_and_update_aci ( int thisbeonly, const Slapi_DN *base,
 {
 	char				*attrs[2] = { "aci", NULL };
 	 /* Tell __aclinit_handler whether it's an add or a delete */
-	int				any_error = op;
 	Slapi_PBlock 	*aPb;
 	LDAPControl		**ctrls=NULL;
 	int				retval;
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 88913ae6..e6437866 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -1487,7 +1487,6 @@ acllas__user_ismember_of_group( struct acl_pblock *aclpb,
 	int			max_nestlevel;
 	int			max_memberlimit;
 	aclUserGroup		*u_group;
-	char			ebuf [ BUFSIZ ];
 	struct member_info	*groupMember = NULL;
 	struct member_info 	*parentGroup = NULL;
 
@@ -3180,13 +3179,10 @@ DS_LASRoleDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
 		PList_t global_auth)
 {
 
-	char			*s_attrName = NULL;
 	char			*attrName;
 	int				matched;
 	int				rc;
 	Slapi_Attr 		*attr;
-	int				numOflevels = 0;
-	char			*n_currEntryDn = NULL;
 	lasInfo			lasinfo;
 	Slapi_Value     *sval=NULL;
 	const struct berval	*attrVal;
@@ -3477,16 +3473,10 @@ static char **
 acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
 	
 	char **a = NULL;
-	char *str = NULL;
 	char *patched_rule = NULL;
 	char *rule_to_use = NULL;
 	char *new_patched_rule = NULL;	
-	char *rule_prefix = NULL;
-	char *rule_suffix = NULL;
-	int  rule_suffix_len = 0;
-	char *comp = NULL;
 	int	matched_val_len = 0;
-	int macro_len = 0;
 	int j = 0;
 	int has_macro_dn = 0;
 	int has_macro_levels = 0;
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index f3c333fa..d6df5111 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -1576,7 +1576,6 @@ __acl_trim_filterstr( char * str ) {
 
 static int __acl__init_targetattrfilters( aci_t *aci, char *input_str) {
 
-	int		numattr=0;
 	char	*s, *str;
 	int		len;	
 	char 	*addlistptr = NULL;
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index d1eb9a67..8971c4f2 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -16,9 +16,6 @@ static  void	aclutil__typestr (int type , char str[]);
 static  void	aclutil__Ruletypestr (int type , char str[]);
 static char* 	__aclutil_extract_dn_component ( char **e_dns,  int position, 
 											char *attrName );
-static char*	acl_get_final_component(char *macro_prefix) ;
-static char*	acl_match_component( char *start, char *component);
-static int		aclutil_compare_components( char * comp1, char *comp2);
 static int		acl_find_comp_start(char * s, int pos );
 static PRIntn	acl_ht_free_entry_and_value(PLHashEntry *he, PRIntn i,
 																void *arg);
@@ -130,7 +127,7 @@ aclutil_print_err (int rv , const Slapi_DN *sdn, const struct berval* val,
 		return;
 
 	if (val->bv_len > 0 && val->bv_val != NULL) {
-	    sprintf (str, "%.1023s", val->bv_val);
+	    PR_snprintf (str, sizeof(str), "%.1023s", val->bv_val);
 	} else {
 	    str[0] = '\0';
 	}
@@ -629,7 +626,6 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
 	char *tmp_ptr = NULL;
 	char *matched_val = NULL;
 	char *ndn_suffix_start = NULL;
-	char *macro_prefix_final_component = NULL;
 	char *ret_val = NULL;
 	int ndn_len = 0;
 	int macro_suffix_len = 0;
@@ -890,12 +886,7 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
 int
 acl_match_prefix( char *macro_prefix, const char *ndn, int *exact_match) {
 
-	int macro_index = 0;
-	int ndn_index = 0;
 	int ret_code = -1;
-	char *curr_macro_component = NULL;
-	char *curr_ndn_component = NULL;
-	int matched = 0;
 	int macro_prefix_len = 0;
 	int ndn_len = 0;
 	int i = 0;
@@ -1289,97 +1280,6 @@ get_this_component(char *dn, int *index) {
 	
 } 
 
-/*
- * return 1 if comp1==comp2,
- * return 0 otherwise.
- *
- * the components might have *'s.
- *
- * eg: comp1: cn=*
- * 		comp2: cn=fred
- *
- *
-*/
-
-static int
-aclutil_compare_components( char * comp1, char *comp2) {
-		
-	char *tmp_str = NULL;
-	
-	tmp_str = strstr( comp1, "=*");
-	if (  tmp_str == NULL) {
-	
-		/* Just a straight cmp */
-
-		if (slapi_utf8casecmp((ACLUCHP)comp1, (ACLUCHP)comp2) == 0) {
-			return(1);
-		} else {
-			return(0);
-		}
-	} else {
-
-		char *tmp_comp1= NULL;
-		char *tmp_comp2 = NULL;
-		int ret_code = 0;
-
-		/* Here, just compare the bit before the = */
-	
-		tmp_comp1 = slapi_ch_strdup(comp1);
-		tmp_comp2 = slapi_ch_strdup(comp2);
-
-		/*
-		 * Probably need to verify it's not escaped--see code for looking for
-		 * unescaped commas.
-		*/
-
-		tmp_str = strstr(tmp_comp1, "=");
-		*tmp_str = '\0';
-	
-		tmp_str = strstr(tmp_comp2, "=");
-		if ( tmp_str == NULL) {
-			ret_code = 0;
-		} else{
-
-			*tmp_str = '\0';
-
-			if (slapi_utf8casecmp((ACLUCHP)comp1, (ACLUCHP)comp2) == 0) {
-				ret_code = 1;
-			} else {
-				ret_code = 0;
-			}
-						
-		slapi_ch_free((void **)&tmp_comp1);
-		slapi_ch_free((void **)&tmp_comp2);
-		
-		return(ret_code);
-
-		}
-								
-	}
-}
-
-/*
- * return a pointer to the final component of macro_prefix.
-*/
-
-static char *
-acl_get_final_component(char *macro_prefix) {
-
-	return(NULL);
-}
-
-/*
- * 
- * 
-*/
-
-static char *
-acl_match_component( char *start, char *component) {
-
-
-	return(NULL);
-}
-
 /* acl hash table funcs */
 
 /*
diff --git a/ldap/servers/plugins/chainingdb/cb_add.c b/ldap/servers/plugins/chainingdb/cb_add.c
index 4a0fcad0..b68ec720 100644
--- a/ldap/servers/plugins/chainingdb/cb_add.c
+++ b/ldap/servers/plugins/chainingdb/cb_add.c
@@ -76,7 +76,9 @@ chaining_back_add ( Slapi_PBlock *pb )
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR,NULL,cnxerrbuf, 0, NULL);
 		ldap_mods_free(mods,1);
-		slapi_ch_free((void **)&cnxerrbuf);
+		if (cnxerrbuf) {
+		  PR_smprintf_free(cnxerrbuf);
+		}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
 
diff --git a/ldap/servers/plugins/chainingdb/cb_bind.c b/ldap/servers/plugins/chainingdb/cb_bind.c
index 7f80507a..404fdcb4 100644
--- a/ldap/servers/plugins/chainingdb/cb_bind.c
+++ b/ldap/servers/plugins/chainingdb/cb_bind.c
@@ -245,7 +245,7 @@ chainingdb_bind( Slapi_PBlock *pb ) {
 	if ( LDAP_USER_CANCELLED != rc ) {
    		errmsg = ldap_err2string( rc );
 		if (rc == LDAP_TIMEOUT) {
-		  cb_ping_farm(cb,NULL,NULL);
+		  cb_ping_farm(cb,NULL,0);
 		}
             	rc = LDAP_OPERATIONS_ERROR;
 	}
diff --git a/ldap/servers/plugins/chainingdb/cb_compare.c b/ldap/servers/plugins/chainingdb/cb_compare.c
index 0163c946..9fb2b0ab 100644
--- a/ldap/servers/plugins/chainingdb/cb_compare.c
+++ b/ldap/servers/plugins/chainingdb/cb_compare.c
@@ -77,7 +77,9 @@ chaining_back_compare ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-	       	slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return 1;
diff --git a/ldap/servers/plugins/chainingdb/cb_config.c b/ldap/servers/plugins/chainingdb/cb_config.c
index 3f12cccd..e7e13348 100644
--- a/ldap/servers/plugins/chainingdb/cb_config.c
+++ b/ldap/servers/plugins/chainingdb/cb_config.c
@@ -29,7 +29,7 @@ int cb_config_add_dse_entries(cb_backend *cb, char **entries, char *string1, cha
 
         for(x = 0; strlen(entries[x]) > 0; x++) {
                 util_pb = slapi_pblock_new();
-                sprintf(entry_string, entries[x], string1, string2, string3);
+                PR_snprintf(entry_string, sizeof(entry_string), entries[x], string1, string2, string3);
                 e = slapi_str2entry(entry_string, 0);
                 slapi_add_entry_internal_set_pb(util_pb, e, NULL, cb->identity, 0);
 		slapi_add_internal_pb(util_pb);
@@ -125,7 +125,7 @@ int cb_config_load_dse_info(Slapi_PBlock * pb) {
 	/* Get the default instance value entry if it exists */
 	/* else create it 				     */
 
-	sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+	PR_snprintf(defaultDn,sizeof(defaultDn),"cn=default instance config,%s",cb->pluginDN);
 
         default_pb = slapi_pblock_new();
         slapi_search_internal_set_pb(default_pb, defaultDn, LDAP_SCOPE_BASE,
diff --git a/ldap/servers/plugins/chainingdb/cb_conn_stateless.c b/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
index dd017d02..b988da87 100644
--- a/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
+++ b/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
@@ -174,8 +174,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                 slapi_log_error( SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM,
                 	"<== cb_get_connection error (no connection available)\n");
 		if ( errmsg ) {
-			*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-			sprintf(*errmsg,error1,"no connection available");
+			*errmsg = PR_smprintf(error1, "no connection available");
 		}
 		return LDAP_CONNECT_ERROR;
         }
@@ -227,8 +226,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
   				slapi_log_error( SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM,
         				"cb_get_connection server %s expired.\n", hostname );
 				if ( errmsg ) {
-					*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-					sprintf(*errmsg,error1,"timelimit exceeded");
+					*errmsg = PR_smprintf(error1,"timelimit exceeded");
 				}
 				rc=LDAP_TIMELIMIT_EXCEEDED;
 				conn=NULL;
@@ -299,8 +297,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                		"Can't contact server <%s> port <%d>.\n", hostname, port);
 				}
 				if ( errmsg ) {
-					*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-					sprintf(*errmsg,error1,"unknown reason");
+					*errmsg = PR_smprintf(error1,"unknown reason");
 				}
 				rc = LDAP_CONNECT_ERROR;
 				goto unlock_and_return;
@@ -365,8 +362,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
 								prerr, slapd_pr_strerror(prerr));
 					}
 					if ( errmsg ) {
-						*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-						sprintf(*errmsg,error2, ldap_err2string(rc));
+						*errmsg = PR_smprintf(error2, ldap_err2string(rc));
 					}
 					rc = LDAP_CONNECT_ERROR;
 					goto unlock_and_return;
@@ -386,8 +382,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
 							prerr, slapd_pr_strerror(prerr));
 					}
 					if ( errmsg ) {
-						*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-						sprintf(*errmsg,error2,ldap_err2string(rc));
+						*errmsg = PR_smprintf(error2,ldap_err2string(rc));
 					}
 					rc = LDAP_CONNECT_ERROR;
 					goto unlock_and_return;
@@ -411,8 +406,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                         		hostname, port, ldap_err2string(parse_rc));
 						}
 						if ( errmsg ) {
-	                                                *errmsg = slapi_ch_malloc(CB_BUFSIZE);
-							sprintf(*errmsg,error2,ldap_err2string(parse_rc));
+							*errmsg = PR_smprintf(error2,ldap_err2string(parse_rc));
 						}
 						rc = parse_rc;
 						goto unlock_and_return;
@@ -425,8 +419,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                         		hostname, port, ldap_err2string(rc));
 						}
 						if ( errmsg ) {
-	                                                *errmsg = slapi_ch_malloc(CB_BUFSIZE);
-							sprintf(*errmsg,error2, ldap_err2string(rc));
+							*errmsg = PR_smprintf(error2, ldap_err2string(rc));
 						}
 						goto unlock_and_return;
 					}
diff --git a/ldap/servers/plugins/chainingdb/cb_delete.c b/ldap/servers/plugins/chainingdb/cb_delete.c
index fe0e72a4..1ddf1ac4 100644
--- a/ldap/servers/plugins/chainingdb/cb_delete.c
+++ b/ldap/servers/plugins/chainingdb/cb_delete.c
@@ -71,7 +71,9 @@ chaining_back_delete ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_init.c b/ldap/servers/plugins/chainingdb/cb_init.c
index 3b0c20ea..8ceb61ac 100644
--- a/ldap/servers/plugins/chainingdb/cb_init.c
+++ b/ldap/servers/plugins/chainingdb/cb_init.c
@@ -46,11 +46,9 @@ chaining_back_init( Slapi_PBlock *pb )
 	/* Initialize misc. fields */
 	cb->config.rwl_config_lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, "chaining_db");
         rc = slapi_pblock_set( pb, SLAPI_PLUGIN_PRIVATE, (void *) cb );
-	cb->pluginDN=slapi_ch_calloc( 1,strlen(PLUGIN_BASE_DN)+strlen(CB_PLUGIN_NAME)+5);
-	sprintf(cb->pluginDN,"cn=%s,%s",CB_PLUGIN_NAME,PLUGIN_BASE_DN);
+	cb->pluginDN=slapi_ch_smprintf("cn=%s,%s",CB_PLUGIN_NAME,PLUGIN_BASE_DN);
 
-	cb->configDN=slapi_ch_calloc( 1,strlen(cb->pluginDN)+11);
-        sprintf(cb->configDN,"cn=config,%s",cb->pluginDN);
+	cb->configDN=slapi_ch_smprintf("cn=config,%s",cb->pluginDN);
 
 	/* Set backend callback functions */
 	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03 );
diff --git a/ldap/servers/plugins/chainingdb/cb_instance.c b/ldap/servers/plugins/chainingdb/cb_instance.c
index 2b6f6368..f835d877 100644
--- a/ldap/servers/plugins/chainingdb/cb_instance.c
+++ b/ldap/servers/plugins/chainingdb/cb_instance.c
@@ -4,6 +4,7 @@
  * All rights reserved.
  * END COPYRIGHT BLOCK **/
 #include "cb.h"
+#include "plstr.h"
 
 /*
 ** 1 set/get function for each parameter of a backend instance
@@ -124,7 +125,7 @@ static char *cb_skeleton_entries[] =
 static void cb_instance_config_set_default(cb_backend_instance *inst)
 {
         cb_instance_config_info *config;
-        char err_buf[CB_BUFSIZE];
+        char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
 
         for (config = cb_the_instance_config; config->config_name != NULL; config++) {
                 cb_instance_config_set((void *)inst, 
@@ -188,8 +189,7 @@ static cb_backend_instance * cb_instance_alloc(cb_backend * cb, char * name, cha
 	/* Config is now merged with the backend entry */
 	inst->configDn=slapi_ch_strdup(basedn);
 
-	inst->monitorDn=(char *) slapi_ch_calloc(1,strlen(basedn)+15);
-	sprintf(inst->monitorDn,"cn=monitor,%s",basedn); 
+	inst->monitorDn=slapi_ch_smprintf("cn=monitor,%s",basedn); 
 
 	inst->eq_ctx = NULL;
 
@@ -260,7 +260,7 @@ int cb_instance_modify_config_check_callback(Slapi_PBlock *pb, Slapi_Entry* entr
 
 		/* specific processing for multi-valued attributes */
 		if ( !strcasecmp ( attr_name, CB_CONFIG_SUFFIX )) {
-                        sprintf(returntext, "suffix modification not allowed\n");
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "suffix modification not allowed\n");
                         rc = LDAP_UNWILLING_TO_PERFORM;
 			continue;
 		} else
@@ -293,7 +293,7 @@ int cb_instance_modify_config_check_callback(Slapi_PBlock *pb, Slapi_Entry* entr
                 if ((mods[i]->mod_op & LDAP_MOD_DELETE) ||
                         ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD)) {
                         rc= LDAP_UNWILLING_TO_PERFORM;
-                        sprintf(returntext, "%s attributes is not allowed",
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
                                 (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
                 } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                         /* This assumes there is only one bval for this mod. */
@@ -428,7 +428,7 @@ int cb_instance_modify_config_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 			}
 			
                         rc= LDAP_UNWILLING_TO_PERFORM;
-                        sprintf(returntext, "%s attributes is not allowed",
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
                               (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
                 } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                         /* This assumes there is only one bval for this mod. */
@@ -467,7 +467,6 @@ cb_parse_instance_config_entry(cb_backend * cb, Slapi_Entry * e) {
     	const struct berval 	*attrValue;
 	cb_backend_instance 	*inst=NULL;
 	char			*instname;
-	Slapi_PBlock 		*search_pb=NULL;
 	char 			retmsg[CB_BUFSIZE];
 
 	CB_ASSERT(e!=NULL);
@@ -512,7 +511,7 @@ cb_instance_config_initialize(cb_backend_instance * inst, Slapi_Entry * e , int
         Slapi_Value             *sval;
 	struct berval * 	 bval;
 	int 			using_def_connlifetime,i;
-        char 			err_buf[CB_BUFSIZE];
+        char 			err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
 	int 			urlfound=0;
 	char 			*rootdn;
 
@@ -672,7 +671,7 @@ static int cb_instance_hosturl_set(void *arg, void *value, char *errorbuf, int p
 	int 			rc=LDAP_SUCCESS;
 
  	if (( rc = ldap_url_parse( url, &ludp )) != 0 ) {
-		strcpy(errorbuf,cb_urlparse_err2string( rc ));
+		PL_strncpyz(errorbuf,cb_urlparse_err2string( rc ), SLAPI_DSE_RETURNTEXT_SIZE);
 		if (CB_CONFIG_PHASE_INITIALIZATION == phase)
 			inst->pool->url=slapi_ch_strdup("");
 		return(LDAP_INVALID_SYNTAX);
@@ -727,22 +726,23 @@ static int cb_instance_hosturl_set(void *arg, void *value, char *errorbuf, int p
 
 		{ char * aBufCopy, * aHostName;
 			char * iter = NULL;
-			aBufCopy= aBufCopy=slapi_ch_strdup(inst->pool->hostname);
+			aBufCopy=slapi_ch_strdup(inst->pool->hostname);
 
 			aHostName=ldap_utf8strtok_r(aBufCopy," ", &iter);
 			charray_free(inst->url_array);
 			inst->url_array=NULL;
 			while (aHostName) {
 			
-				char * aHostPort = slapi_ch_calloc(1,strlen(aHostName)+30);
-       	        		if ( NULL == ( ptr=strstr(aHostName,":")))
-       	                		sprintf(aHostPort,"%s://%s:%d/",
-						inst->pool->secure ? "ldaps" : "ldap", 
-						aHostName,inst->pool->port);
-				else
-       	                		sprintf(aHostPort,"%s://%s/", 
-						inst->pool->secure ? "ldaps" : "ldap",
-						aHostName);
+				char * aHostPort;
+				if ( NULL == ( ptr=strstr(aHostName,":"))) {
+					aHostPort = slapi_ch_smprintf("%s://%s:%d/",
+												  inst->pool->secure ? "ldaps" : "ldap", 
+												  aHostName,inst->pool->port);
+				} else {
+					aHostPort = slapi_ch_smprintf("%s://%s/", 
+												  inst->pool->secure ? "ldaps" : "ldap",
+												  aHostName);
+				}
 
 				charray_add(&inst->url_array,aHostPort);
 				aHostName=ldap_utf8strtok_r(NULL," ", &iter);
@@ -818,7 +818,7 @@ static int cb_instance_binduser_set(void *arg, void *value, char *errorbuf, int
                         !strcmp(theValueCopy,rootdn)) {	/* UTF8-aware. See cb_get_dn() */
                         rc=LDAP_UNWILLING_TO_PERFORM; 
 			if (errorbuf) {
-				sprintf(errorbuf,"value %s not allowed",rootdn);
+				PR_snprintf(errorbuf,SLAPI_DSE_RETURNTEXT_SIZE, "value %s not allowed",rootdn);
 			}
                 }
                 PR_RWLock_Unlock(inst->rwl_config_lock);
@@ -1129,7 +1129,7 @@ static int cb_instance_imperson_set(void *arg, void *value, char *errorbuf, int
 	                !strcmp(inst->pool->binddn,rootdn)) {	/* UTF-8 aware */
 		  	rc=LDAP_UNWILLING_TO_PERFORM;
 			if (errorbuf)
-				sprintf(errorbuf,"Proxy mode incompatible with %s value (%s not allowed)",
+				PR_snprintf(errorbuf,SLAPI_DSE_RETURNTEXT_SIZE, "Proxy mode incompatible with %s value (%s not allowed)",
 					CB_CONFIG_BINDUSER,rootdn);
 		}
                 PR_RWLock_Unlock(inst->rwl_config_lock); 
@@ -1309,8 +1309,8 @@ static cb_instance_config_info *cb_get_config_info(cb_instance_config_info *conf
 ** For now, unknown attributes are ignored
 ** Return a LDAP error code OR CB_REOPEN_CONN when the
 ** update requires to close open connections.
+** err_buf is size SLAPI_DSE_RETURNTEXT_SIZE
 */
-
 static int 
 cb_instance_config_set(void *arg, char *attr_name, cb_instance_config_info *config_array, 
 struct berval *bval, char *err_buf, int phase, int apply_mod)
@@ -1386,6 +1386,7 @@ struct berval *bval, char *err_buf, int phase, int apply_mod)
 /* Utility function used in creating config entries.  Using the
  * config_info, this function gets info and formats in the correct
  * way.
+ * buf is CB_BUFSIZE size
  */
 void cb_instance_config_get(void *arg, cb_instance_config_info *config, char *buf)
 {
@@ -1409,7 +1410,7 @@ void cb_instance_config_get(void *arg, cb_instance_config_info *config, char *bu
                 /* Remember the get function for strings returns memory
                  * that must be freed. */
                 tmp_string = (char *) config->config_get_fn(arg);
-                sprintf(buf, "%s", (char *) tmp_string);
+                PR_snprintf(buf, CB_BUFSIZE, "%s", (char *) tmp_string);
                 slapi_ch_free((void **)&tmp_string);
                 break;
         case CB_CONFIG_TYPE_ONOFF:
@@ -1759,7 +1760,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 	int 			rc;
 	cb_backend_instance 	*dummy;
 	Slapi_Entry 		*e=slapi_entry_alloc();
-        char            	defaultDn[CB_BUFSIZE];
+	char            	*defaultDn;
 	char 			*olddn;
         struct berval           val;
         struct berval           *vals[2];
@@ -1772,7 +1773,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 
 	/* set right dn	 and objectclass */
 
-        sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+	defaultDn = PR_smprintf("cn=default instance config,%s",cb->pluginDN);
 	olddn = slapi_entry_get_dn(e);
 	slapi_ch_free((void **) &olddn);
 	
@@ -1805,6 +1806,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 	/* cleanup */
         cb_instance_free(dummy);
 	/* BEWARE: entry is consummed */
+		PR_smprintf_free(defaultDn);
 	return rc;
 }
 
@@ -1817,7 +1819,7 @@ int cb_build_backend_instance_config(cb_backend_instance *inst, Slapi_Entry * co
 	Slapi_Entry     **default_entries = NULL;
 	Slapi_Entry 	*default_conf=NULL;
 	int 		default_res, rc;
-	char 		defaultDn[CB_BUFSIZE];
+	char 		*defaultDn;
 	cb_backend_instance * current_inst;
 
 	rc=LDAP_SUCCESS;
@@ -1832,12 +1834,13 @@ int cb_build_backend_instance_config(cb_backend_instance *inst, Slapi_Entry * co
 
         /* 2: Overwrite values present in the default instance config */
  
-        sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+        defaultDn = PR_smprintf("cn=default instance config,%s",cb->pluginDN);
  
         default_pb = slapi_pblock_new();
         slapi_search_internal_set_pb(default_pb, defaultDn, LDAP_SCOPE_BASE,
                 "objectclass=*", NULL, 0, NULL, NULL, cb->identity, 0);
         slapi_search_internal_pb (default_pb);
+		PR_smprintf_free(defaultDn);
         slapi_pblock_get(default_pb, SLAPI_PLUGIN_INTOP_RESULT, &default_res);
         if ( LDAP_SUCCESS == default_res ) {
                 slapi_pblock_get(default_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &default_entries);
diff --git a/ldap/servers/plugins/chainingdb/cb_modify.c b/ldap/servers/plugins/chainingdb/cb_modify.c
index 91b3b9ae..6b586592 100644
--- a/ldap/servers/plugins/chainingdb/cb_modify.c
+++ b/ldap/servers/plugins/chainingdb/cb_modify.c
@@ -79,7 +79,9 @@ chaining_back_modify ( Slapi_PBlock *pb )
 	/* Grab a connection handle */
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_modrdn.c b/ldap/servers/plugins/chainingdb/cb_modrdn.c
index 8e1b0747..67b66179 100644
--- a/ldap/servers/plugins/chainingdb/cb_modrdn.c
+++ b/ldap/servers/plugins/chainingdb/cb_modrdn.c
@@ -105,7 +105,9 @@ chaining_back_modrdn ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_search.c b/ldap/servers/plugins/chainingdb/cb_search.c
index dcb80798..48f64a31 100644
--- a/ldap/servers/plugins/chainingdb/cb_search.c
+++ b/ldap/servers/plugins/chainingdb/cb_search.c
@@ -113,8 +113,7 @@ chainingdb_build_candidate_list ( Slapi_PBlock *pb )
 
         	PR_RWLock_Rlock(cb->rwl_config_lock);
 		for (i=0; cb->url_array && cb->url_array[i]; i++) {
-			char * anUrl= slapi_ch_calloc(1,strlen(cb->url_array[i])+strlen(target)+1);
-			sprintf(anUrl,"%s%s",cb->url_array[i],target);
+			char * anUrl = slapi_ch_smprintf("%s%s",cb->url_array[i],target);
                 	bv.bv_val=anUrl;
 			bv.bv_len=strlen(bv.bv_val);
                 	slapi_entry_attr_merge( anEntry, "ref", bvals);
@@ -185,7 +184,9 @@ chainingdb_build_candidate_list ( Slapi_PBlock *pb )
 		else
 			cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL,cnxerrbuf, 0, NULL);
 
-		slapi_ch_free((void **)&cnxerrbuf);
+		if (cnxerrbuf) {
+			PR_smprintf_free(cnxerrbuf);
+		}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
 		return 1;
diff --git a/ldap/servers/plugins/chainingdb/cb_test.c b/ldap/servers/plugins/chainingdb/cb_test.c
index 7f561a80..8ad3510d 100644
--- a/ldap/servers/plugins/chainingdb/cb_test.c
+++ b/ldap/servers/plugins/chainingdb/cb_test.c
@@ -37,8 +37,7 @@ int cb_back_test( Slapi_PBlock *pb )
         aSuffixString=slapi_sdn_get_dn(aSuffix);
         /* Remove leading white spaces */
         for (aSuffixString; *aSuffixString==' ';aSuffixString++) {}
-	theTarget=slapi_ch_calloc(1,strlen(aSuffixString)+20);
-	sprintf(theTarget,"cn=test,%s",aSuffixString);
+	theTarget=slapi_ch_smprintf("cn=test,%s",aSuffixString);
 
 	/* XXXSD make sure chaining allowed for this plugin... */
         slapi_search_internal_set_pb (apb, theTarget, LDAP_SCOPE_BASE, "objectclass=*", NULL, 0, NULL, NULL,
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index 90dad328..c5dfdf89 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -102,31 +102,34 @@ collation_config (size_t cargc, char** cargv,
                 }
  
                 if(cargc > 7) {
-                    strcat(nameOrder,"-");
-                    strcat(nameOrder,cargv[7]);
-                    strcat(nameSubstring,"-");
-                    strcat(nameSubstring,cargv[7]);
+                    strcpy(nameOrder,"-");
+                    PL_strcatn(nameOrder,256,cargv[7]);
+                    strcpy(nameSubstring,"-");
+                    PL_strcatn(nameSubstring,256,cargv[7]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
                 else {
                     if(0 != cargv[1][0]) {
-                        strcat(nameOrder,"-");
-                        strcat(nameSubstring,"-");
-                    }
-                    strcat(nameOrder,cargv[1]);
-                    strcat(nameSubstring,cargv[1]);
+                        strcpy(nameOrder,"-");
+                        strcpy(nameSubstring,"-");
+                    } else {
+						nameOrder[0] = 0;
+						nameSubstring[0] = 0;
+					}
+                    PL_strcatn(nameOrder,256,cargv[1]);
+                    PL_strcatn(nameSubstring,256,cargv[1]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
-                strcpy(oidString,cargv[6]);
+                PL_strncpyz(oidString,cargv[6], 256);
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_OID,
                                        (void *)slapi_ch_strdup(oidString));
                 if(0 != cargv[2][0]) {
-                    sprintf(descStr,"%s-%s",cargv[1],cargv[2]);
+                    PR_snprintf(descStr, 256, "%s-%s",cargv[1],cargv[2]);
                 }
                 else {
-                    strcpy(descStr,cargv[1]);
+                    PL_strncpyz(descStr,cargv[1], 256);
                 }
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_DESC,
 						   (void *)slapi_ch_strdup(descStr));
@@ -191,7 +194,6 @@ SetUnicodeStringFromUTF_8 (UChar** U, int32_t* Ulen, int *isAlloced, const struc
 {
     size_t n;
     int32_t len = 0; /* length of non-space string */
-    int32_t needLen = 0; /* number of bytes needed for string */
     UErrorCode err = U_ZERO_ERROR;
     const char* s = bv->bv_val;
     const char* begin = NULL; /* will point to beginning of non-space in val */
diff --git a/ldap/servers/plugins/cos/Makefile b/ldap/servers/plugins/cos/Makefile
index 8d437b66..d53ef420 100644
--- a/ldap/servers/plugins/cos/Makefile
+++ b/ldap/servers/plugins/cos/Makefile
@@ -74,6 +74,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index e88156d3..303458e5 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -143,7 +143,7 @@ extern "C" {
 /* the global plugin handle */
 static volatile vattr_sp_handle *vattr_handle = NULL;
 
-static cos_cache_notify_flag = 0;
+static int cos_cache_notify_flag = 0;
 
 /* service definition cache structs */
 
@@ -1985,13 +1985,10 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
 					 * only 2 lines of code -> no need to set an indirect char *
 					 * duplicate the lines of code for clearness instead
 					 */
-					char * newTmpGrade = (char*) slapi_ch_malloc(
-						strlen((pCosSpecifier->val) + 9));
-					strcpy(newTmpGrade, pCosSpecifier->val);
-					strcat(newTmpGrade, "-default");
+					char * newTmpGrade = PR_smprintf("%s-default", pCosSpecifier->val);
 					if(!slapi_utf8casecmp((unsigned char*)grade, (unsigned char*)newTmpGrade))
 						template_default = 1;
-					slapi_ch_free((void**)&newTmpGrade);
+					PR_smprintf_free(newTmpGrade);
 				}
 			}
 
@@ -2204,7 +2201,6 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context *context, Sl
 	int attr_matched_index = 0; /* for identifying the matched attribute */
 	int hit = 0;
 	cosAttributes *pDefAttr = 0;
-	Slapi_ValueSet* results = 0;
 	Slapi_Value *val;
 /*	int type_name_disposition;
 	char *actual_type_name; 
@@ -2354,7 +2350,6 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context *context, Sl
 				/* Does this entry have a correct cosSpecifier? */
 				do
 				{
-					Slapi_ValueSet *results = 0;
 					int type_name_disposition = 0;
 					char *actual_type_name = 0;
 					int free_flags = 0;
@@ -3158,7 +3153,7 @@ static int cos_cache_cos_2_slapi_valueset(cosAttributes *pAttr, Slapi_ValueSet *
 	cosAttrValue *pAttrVal = pAttr->pAttrValue;
 	int add_mode = 0;
 	static Slapi_Attr *attr = 0; /* allocated once, never freed */
-	static done_once = 0;
+	static int done_once = 0;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_cos_2_slapi_attr\n",0,0,0);
 	
@@ -3240,8 +3235,6 @@ bail:
 void cos_cache_change_notify(Slapi_PBlock *pb)
 {
 	char *dn;
-	Slapi_Attr *pObjclasses = 0;
-	int index = 0;
 	int do_update = 0;
 	struct slapi_entry *e;
         Slapi_Backend *be=NULL;
@@ -3417,7 +3410,6 @@ static int cos_cache_follow_pointer( vattr_context *c, const char *dn, char *typ
 	Slapi_PBlock *pDnSearch = 0;
 	Slapi_Entry **pEntryList = 0;
 	char *attrs[2];
-	int entryIndex = 0;
 	int op = 0;
 	int type_test = 0;
 	int type_name_disposition = 0;
diff --git a/ldap/servers/plugins/http/Makefile b/ldap/servers/plugins/http/Makefile
index 7ddbb543..ba10ab35 100644
--- a/ldap/servers/plugins/http/Makefile
+++ b/ldap/servers/plugins/http/Makefile
@@ -75,6 +75,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/http/http_client.c b/ldap/servers/plugins/http/http_client.c
index 2fbbdd52..3ed24f9b 100644
--- a/ldap/servers/plugins/http/http_client.c
+++ b/ldap/servers/plugins/http/http_client.c
@@ -133,7 +133,6 @@ int http_client_version()
 int http_client_init(Slapi_PBlock *pb)
 {
 	int status = HTTP_SUCCESS;
-	PRUint32 nssFlags = 0;
 	LDAPDebug( LDAP_DEBUG_PLUGIN, "--> http_client_init -- BEGIN\n",0,0,0);
 
 	if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
diff --git a/ldap/servers/plugins/http/http_impl.c b/ldap/servers/plugins/http/http_impl.c
index bad8315c..e6d4a664 100644
--- a/ldap/servers/plugins/http/http_impl.c
+++ b/ldap/servers/plugins/http/http_impl.c
@@ -300,10 +300,10 @@ static int doRequest(const char *url, httpheader **httpheaderArray, char *body,
 					if (!defaultprefix) /* still could not find it . . . */
     						goto bail; /* . . . can't do anything */
 					defaultprefix++;
-					sprintf(certPref, "%s-",defaultprefix);
+					PR_snprintf(certPref, 1024, "%s-",defaultprefix);
 					strcpy(keyPref, certPref);
 					*defaultprefix= '\0';
-					sprintf(certDir, "%salias", certDir);
+					PR_snprintf(certDir, 1024, "%salias", certDir);
        				nssStatus = NSS_Initialize(certDir, certPref, keyPref, "secmod.db", nssFlags);
 					slapi_ch_free((void **)&val);
 		
@@ -610,12 +610,10 @@ static int nssReinitializationRequired()
 {
 	int nssReinitializationRequired = 0;
 	int err = 0;
-	int str_len = 0;
 	float version = 0;
 	const float DSVERSION = 6.1;
 	char *str = NULL;
 	char *value   = NULL;
-	char *ver_value   = NULL;
 	Slapi_Entry  **entry = NULL;
 	Slapi_PBlock *resultpb= NULL;
 
@@ -679,7 +677,6 @@ static PRStatus sendGetReq(PRFileDesc *fd, const char *path)
 	http_connection_time_out = httpConfig->connectionTimeOut;
 	status = sendFullData( fd, reqBUF, http_connection_time_out);
 
-bail:
 	if (reqBUF) {
 		PR_Free(reqBUF);
 		reqBUF = 0;
@@ -773,7 +770,6 @@ static PRStatus sendPostReq(PRFileDesc *fd, const char *path, httpheader **httph
 
 	status = sendFullData( fd, reqBUF, http_connection_time_out);
 
-bail:
     if (reqBUF) {
             PR_Free(reqBUF);
             reqBUF = 0;
@@ -1360,7 +1356,6 @@ int http_impl_post(char *url, httpheader **httpheaderArray, char *body, char **d
 
 void http_impl_shutdown()
 {
-	int status = HTTP_IMPL_SUCCESS;
 	/**
 	 * Put cleanup code here
 	 */
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
index 50aafef8..21879c36 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
@@ -12,9 +12,6 @@
 #include "pam_passthru.h"
 
 #define PAM_PT_CONFIG_FILTER "(objectclass=*)"
-#ifndef SLAPI_DSE_RETURNTEXT_SIZE
-#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
-#endif /* SLAPI_DSE_RETURNTEXT_SIZE */
 
 /*
  * The configuration attributes are contained in the plugin entry e.g.
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
index c6b35a48..8711513f 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
@@ -24,6 +24,7 @@ init_my_str_buf(MyStrBuf *buf, const char *s)
 		buf->str = buf->fixbuf;
 	} else {
 		buf->str = slapi_ch_strdup(s);
+		buf->fixbuf[0] = 0;
 	}
 
 	return buf->str;
diff --git a/ldap/servers/plugins/passthru/ptconfig.c b/ldap/servers/plugins/passthru/ptconfig.c
index 74a5ed4b..843f1da5 100644
--- a/ldap/servers/plugins/passthru/ptconfig.c
+++ b/ldap/servers/plugins/passthru/ptconfig.c
@@ -45,8 +45,6 @@
 /*
  * function prototypes
  */ 
-static char **get_backend_suffixes( void );
-static int is_underneath_backend_suffix( char *normdn, char **besuffixes );
 
 /*
  * static variables
diff --git a/ldap/servers/plugins/pwdstorage/crypt_pwd.c b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
index 4c0f1221..28aab7a4 100644
--- a/ldap/servers/plugins/pwdstorage/crypt_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
@@ -79,11 +79,7 @@ crypt_pw_enc( char *pwd )
     cry = crypt( pwd, salt );
     if ( cry != NULL )
     {
-        enc = slapi_ch_malloc( 3 + CRYPT_NAME_LEN + strlen( cry ));
-        if ( enc != NULL )
-        {
-            sprintf( enc, "%c%s%c%s", PWD_HASH_PREFIX_START, CRYPT_SCHEME_NAME, PWD_HASH_PREFIX_END, cry );
-        }
+        enc = slapi_ch_smprintf("%c%s%c%s", PWD_HASH_PREFIX_START, CRYPT_SCHEME_NAME, PWD_HASH_PREFIX_END, cry );
     }    
     PR_Unlock(cryptlock);
     return( enc );
diff --git a/ldap/servers/plugins/pwdstorage/ssha_pwd.c b/ldap/servers/plugins/pwdstorage/ssha_pwd.c
index 194ee817..a65bd797 100644
--- a/ldap/servers/plugins/pwdstorage/ssha_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/ssha_pwd.c
@@ -97,7 +97,7 @@ salted_sha1_pw_enc( char *pwd )
         return( NULL );
     }
 
-    if (( enc = PR_Malloc( 3 + SALTED_SHA1_NAME_LEN +
+    if (( enc = slapi_ch_malloc( 3 + SALTED_SHA1_NAME_LEN +
         LDIF_BASE64_LEN(sizeof(hash)))) == NULL ) {
         return( NULL );
     }
diff --git a/ldap/servers/plugins/referint/referint.c b/ldap/servers/plugins/referint/referint.c
index 5bd11214..6fac705e 100644
--- a/ldap/servers/plugins/referint/referint.c
+++ b/ldap/servers/plugins/referint/referint.c
@@ -295,7 +295,6 @@ int update_integrity(char **argv, char *origDN, char *newrDN, int logChanges){
   int dnsize;
   int x;
   int rc;
-  int valcount = 0;
  
   if ( argv == NULL ) { 
       slapi_log_error( SLAPI_LOG_FATAL, REFERINT_PLUGIN_SUBSYSTEM,
@@ -783,9 +782,9 @@ void writeintegritylog(char *logfilename, char *dn, char *newrdn){
                          " to update references to this entry.\n");
     }else{
        PRInt32 rv;
-       sprintf(buffer, "%s\t%s\t\n", 
-                dn,
-                (newrdn != NULL) ? newrdn : "NULL");
+       PR_snprintf(buffer, MAX_LINE, "%s\t%s\t\n", 
+				   dn,
+				   (newrdn != NULL) ? newrdn : "NULL");
         if ((rv = PR_Write(prfd,buffer,strlen(buffer))) < 0){
            slapi_log_error(SLAPI_LOG_FATAL,REFERINT_PLUGIN_SUBSYSTEM,
 	       " writeintegritylog: PR_Write failed : The disk"
diff --git a/ldap/servers/plugins/replication/cl4_api.c b/ldap/servers/plugins/replication/cl4_api.c
index f60eb91e..83f479f5 100644
--- a/ldap/servers/plugins/replication/cl4_api.c
+++ b/ldap/servers/plugins/replication/cl4_api.c
@@ -401,10 +401,7 @@ static char* _cl4MakeCSNDN (const CSN* csn)
 		return NULL;
 
 	/* Construct the dn of this change record */
-    pat = "%s=%s,%s";
-    edn = slapi_ch_malloc(strlen(pat) + strlen(attr_csn) + strlen(suffix) + CSN_STRSIZE + 1);
-	if (edn)
-		sprintf(edn, pat, attr_csn, csn_as_string(csn,PR_FALSE,s), suffix);
+    edn = slapi_ch_smprintf("%s=%s,%s", attr_csn, csn_as_string(csn,PR_FALSE,s), suffix);
 	slapi_ch_free ((void **)&suffix);
 
 	return edn;
@@ -561,7 +558,7 @@ static int _cl4GetTargetEntry (Slapi_DN *sdn, const char *uniqueid, Slapi_Entry
 	Slapi_Entry **entries = NULL;
 
 	/* read corresponding database entry based on its uniqueid */
-	sprintf (filter, "uniqueid=%s", uniqueid);	
+	PR_snprintf (filter, sizeof(filter), "uniqueid=%s", uniqueid);	
 	pb = slapi_pblock_new ();
 	slapi_search_internal_set_pb (pb, (char*)slapi_sdn_get_ndn(sdn), LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
 								  repl_get_plugin_identity (PLUGIN_LEGACY_REPLICATION), 0);
@@ -633,7 +630,7 @@ static int _cl4FindTargetDN (const CSN *csn, const char *uniqueid,
 	/* Look for all modifications to the target entry with csn larger than 
 	   this csn. We are only interested in rename operations, but change type
        is currently not indexed */
-	sprintf (filter, "&(uniqueid=%s)(csn>%s)", uniqueid, csn_as_string(csn,PR_FALSE,s));
+	PR_snprintf (filter, 128, "&(uniqueid=%s)(csn>%s)", uniqueid, csn_as_string(csn,PR_FALSE,s));
 	pb = slapi_pblock_new ();
 	slapi_search_internal_set_pb (pb, suffix, LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
 								  repl_get_plugin_identity (PLUGIN_LEGACY_REPLICATION), 0);
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index e8c01157..024335f5 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -303,7 +303,6 @@ static int _cl5ReadBervals (struct berval ***bv, char** buff, unsigned int size)
 static int _cl5WriteBervals (struct berval **bv, char** buff, unsigned int *size);
 
 /* replay iteration */
-static PRBool _cl5ValidReplayIterator (const CL5ReplayIterator *iterator);
 static int _cl5PositionCursorForReplay (ReplicaId consumerRID, const RUV *consumerRuv,
 			Object *replica, Object *fileObject, CL5ReplayIterator **iterator);
 static int _cl5CheckMissingCSN (const CSN *minCsn, const RUV *supplierRUV, CL5DBFile *file);
@@ -4734,8 +4733,8 @@ _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op, char **repl
 		if (rc != 0)
 		{
 			if ( errmsg != NULL ) {
-			        slapi_log_error(SLAPI_LOG_PARSE, repl_plugin_name_cl, "%s", errmsg); 
-				slapi_ch_free( (void**)&errmsg );
+				slapi_log_error(SLAPI_LOG_PARSE, repl_plugin_name_cl, "%s", errmsg); 
+				PR_smprintf_free(errmsg );
 			}
 			slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, 
 							"_cl5LDIF2Operation: warning - failed to parse ldif line\n");
@@ -5291,17 +5290,6 @@ PRBool cl5HelperEntry (const char *csnstr, CSN *csnp)
 	return retval;
 }
 
-/* Replay iteration helper functions */
-static PRBool _cl5ValidReplayIterator (const CL5ReplayIterator *iterator)
-{
-	if (iterator == NULL || 
-		iterator->consumerRuv == NULL || iterator->supplierRuvObj == NULL || 
-        iterator->fileObj == NULL)
-		return PR_FALSE;
-
-	return PR_TRUE;
-}
-
 /* Algorithm: ONREPL!!!
  */
 struct replica_hash_entry
@@ -5811,10 +5799,7 @@ static char* _cl5Replica2FileName (Object *replica)
 
 static char* _cl5MakeFileName (const char *replName, const char *replGen)
 {
-    char *fileName;
-    fileName = slapi_ch_malloc (strlen (replName) + strlen (replGen) + 
-                                 strlen (DB_EXTENSION) + 3/* '_' + '.' + '\0' */);
-    sprintf (fileName, "%s%s%s.%s", replName, FILE_SEP, replGen, DB_EXTENSION);
+    char *fileName = slapi_ch_smprintf("%s%s%s.%s", replName, FILE_SEP, replGen, DB_EXTENSION);
 
     return fileName;
 }
@@ -6069,8 +6054,7 @@ out:
 
 	if ( semadir != NULL )
 	{
-		(*dbFile)->semaName = slapi_ch_malloc (strlen(semadir) + strlen(replName) + strlen(".sema") + 10);
-		sprintf ((*dbFile)->semaName, "%s/%s.sema", semadir, replName);
+		(*dbFile)->semaName = slapi_ch_smprintf("%s/%s.sema", semadir, replName);
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
 			"_cl5NewDBFile: semaphore %s\n", (*dbFile)->semaName);
 		(*dbFile)->sema = PR_OpenSemaphore((*dbFile)->semaName, PR_SEM_CREATE, 0666, s_cl5Desc.dbConfig.maxConcurrentWrites );
diff --git a/ldap/servers/plugins/replication/cl5_clcache.c b/ldap/servers/plugins/replication/cl5_clcache.c
index 17eb8e59..c60b0421 100644
--- a/ldap/servers/plugins/replication/cl5_clcache.c
+++ b/ldap/servers/plugins/replication/cl5_clcache.c
@@ -23,7 +23,7 @@
 #define DEFAULT_CLC_BUFFER_PAGE_COUNT		32
 #define DEFAULT_CLC_BUFFER_PAGE_SIZE		1024
 
-static enum {
+enum {
 	CLC_STATE_READY = 0,		/* ready to iterate */
 	CLC_STATE_UP_TO_DATE,		/* remote RUV already covers the CSN */
 	CLC_STATE_CSN_GT_RUV,		/* local RUV doesn't conver the CSN */
@@ -527,7 +527,6 @@ clcache_adjust_anchorcsn ( CLC_Buffer *buf )
 {
 	PRBool hasChange = PR_FALSE;
 	struct csn_seq_ctrl_block *cscb;
-	int rc = 0;
 	int i;
 
 	if ( buf->buf_state == CLC_STATE_READY ) {
@@ -706,9 +705,7 @@ static CLC_Buffer *
 clcache_new_buffer ( ReplicaId consumer_rid )
 {
 	CLC_Buffer *buf = NULL;
-	int page_count = 0;
 	int welldone = 0;
-	int rc = 0;
 
 	do {
 
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index 846f39fe..3d78c35c 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -15,6 +15,8 @@
 #ifdef TEST_CL5
 #include "cl5_test.h"    
 #endif
+#include "nspr.h"
+#include "plstr.h"
 
 #define CONFIG_BASE		"cn=changelog5,cn=config" /*"cn=changelog,cn=supplier,cn=replication5.0,cn=replication,cn=config"*/
 #define CONFIG_FILTER	"(objectclass=*)"
@@ -158,7 +160,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "NULL changelog directory");
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "NULL changelog directory");
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -173,7 +175,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to start changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to start changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -188,7 +190,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf  (returntext, "failed to configure changelog trimming; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to configure changelog trimming; error - %d", rc);
 		}
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
 						"changelog5_config_add: failed to configure changelog trimming\n");
@@ -366,7 +368,8 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 					*returncode = LDAP_UNWILLING_TO_PERFORM;
 					if (returntext)
 					{
-						sprintf (returntext, "Unwilling to apply %s mods while the server is running", config_attr);
+						PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+									 "Unwilling to apply %s mods while the server is running", config_attr);
 					}
 					goto done;
 				}
@@ -415,7 +418,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					strcpy (returntext, "invalid changelog directory or insufficient access");
+					PL_strncpyz (returntext, "invalid changelog directory or insufficient access", SLAPI_DSE_RETURNTEXT_SIZE);
 				}
 				
 				goto done;
@@ -437,7 +440,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to close changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to close changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -451,7 +454,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to remove changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to remove changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -465,7 +468,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to restart changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to restart changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -490,7 +493,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 			*returncode = 1;
 			if (returntext)
 			{
-				sprintf (returntext, "failed to configure changelog trimming; error - %d", rc);
+				PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to configure changelog trimming; error - %d", rc);
 			}
 
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -539,7 +542,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "changelog is not configured");
+			PL_strncpyz(returntext, "changelog is not configured", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -555,7 +558,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "changelog is not configured");
+			PL_strncpyz(returntext, "changelog is not configured", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -571,7 +574,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "internal failure");
+			PL_strncpyz (returntext, "internal failure", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -587,7 +590,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to close changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to close changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -601,7 +604,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to remove changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to remove changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
diff --git a/ldap/servers/plugins/replication/cl5_test.c b/ldap/servers/plugins/replication/cl5_test.c
index e8605fab..cfe3d53f 100644
--- a/ldap/servers/plugins/replication/cl5_test.c
+++ b/ldap/servers/plugins/replication/cl5_test.c
@@ -94,7 +94,7 @@ static void testBackupRestore ()
 	char *dir;
 	int rc = -1;
 	char *baseDir;
-	char bkDir [MAXPATHLEN + 1];
+	char bkDir [MAXPATHLEN];
 
 	slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, "Starting backup and recovery test ...\n");	
 	
@@ -103,7 +103,7 @@ static void testBackupRestore ()
 	if (dir)
 	{
 		baseDir = getBaseDir (dir);
-		sprintf (bkDir, "%s/clbackup", baseDir);
+		PR_snprintf (bkDir, sizeof(bkDir), "%s/clbackup", baseDir);
 		slapi_ch_free ((void**)&baseDir);
 		rc = cl5Backup (bkDir, NULL);
 
@@ -394,12 +394,12 @@ static void testLDIF ()
 	char *clDir = cl5GetDir ();
 	int rc;
 	char *baseDir;
-	char ldifFile [MAXPATHLEN + 1];
+	char ldifFile [MAXPATHLEN];
 
 	slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, "Starting LDIF test ...\n");	
 
 	baseDir = getBaseDir (clDir);
-	sprintf (ldifFile, "%s/cl5.ldif", baseDir);
+	PR_snprintf (ldifFile, sizeof(ldifFile), "%s/cl5.ldif", baseDir);
 	slapi_ch_free ((void**)&baseDir);
 	rc = populateChangelog (ENTRY_COUNT, NULL);
 
@@ -660,7 +660,7 @@ static int  configureChangelog ()
 
     slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
 	str = slapi_entry_attr_get_charptr(entries[0], INSTANCE_ATTR);
-    sprintf (cl_dir, "%s/%s", str, "cl5db");
+    PR_snprintf (cl_dir, sizeof(cl_dir), "%s/%s", str, "cl5db");
 	slapi_ch_free((void **)&str);
 	slapi_entry_add_string (e, CONFIG_CHANGELOG_DIR_ATTRIBUTE, cl_dir);
 
@@ -689,6 +689,8 @@ done:
     return rc;
 }
 
+#define DN_SIZE 1024
+
 /* Format:
     dn: cn=replica,cn="o=NetscapeRoot",cn= mapping tree,cn=config
     objectclass: top
@@ -704,10 +706,10 @@ static int  configureReplica ()
     Slapi_PBlock *pb = slapi_pblock_new ();
     Slapi_Entry  *e = slapi_entry_alloc ();
     int rc;
-    char dn [128];
+    char dn [DN_SIZE];
 
     /* set changelog dn */
-    sprintf (dn, "%s,cn=\"%s\",%s", REPLICA_RDN, REPLICA_ROOT, 
+    PR_snprintf (dn, sizeof(dn), "%s,cn=\"%s\",%s", REPLICA_RDN, REPLICA_ROOT, 
              slapi_get_mapping_tree_config_root ());
     slapi_entry_set_dn (e, slapi_ch_strdup (dn));
     
@@ -746,7 +748,7 @@ static int  populateChangelogOp ()
     Slapi_PBlock *pb = slapi_pblock_new ();
     Slapi_Entry  *e = slapi_entry_alloc ();
     int rc;
-    char dn [128], newrdn [64];
+    char dn [DN_SIZE], newrdn [64];
     LDAPMod *mods[2];
     Slapi_Mod smod;
     struct berval bv;
@@ -754,7 +756,7 @@ static int  populateChangelogOp ()
 
     /* add entry */
     cur_time = time(NULL);
-    sprintf (dn, "cn=%s,%s", ctime(&cur_time), REPLICA_ROOT);
+    PR_snprintf (dn, sizeof(dn), "cn=%s,%s", ctime(&cur_time), REPLICA_ROOT);
     slapi_entry_set_dn (e, slapi_ch_strdup (dn));
     slapi_entry_add_string(e, "objectclass", "top");
     slapi_entry_add_string(e, "objectclass", "extensibleObject");
@@ -798,7 +800,7 @@ static int  populateChangelogOp ()
     /* rename entry */
     pb = slapi_pblock_new ();
     cur_time = time (NULL);
-    sprintf (newrdn, "cn=renamed%s", ctime(&cur_time));
+    PR_snprintf (newrdn, sizeof(newrdn), "cn=renamed%s", ctime(&cur_time));
     slapi_rename_internal_set_pb (pb, dn, newrdn, NULL, 1, NULL, NULL,
 	 					          repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0);
     slapi_modrdn_internal_pb (pb);
@@ -813,7 +815,7 @@ static int  populateChangelogOp ()
 
     /* delete the entry */
     pb = slapi_pblock_new ();
-    sprintf (dn, "%s,%s", newrdn, REPLICA_ROOT);
+    PR_snprintf (dn, sizeof(dn), "%s,%s", newrdn, REPLICA_ROOT);
     slapi_delete_internal_set_pb (pb, dn, NULL,  NULL, 
 								  repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0);
     slapi_delete_internal_pb (pb);
diff --git a/ldap/servers/plugins/replication/legacy_consumer.c b/ldap/servers/plugins/replication/legacy_consumer.c
index f04d8ed2..2369f423 100644
--- a/ldap/servers/plugins/replication/legacy_consumer.c
+++ b/ldap/servers/plugins/replication/legacy_consumer.c
@@ -498,19 +498,6 @@ legacy_consumer_is_replicationpw(struct berval *pwval)
     return return_value;
 }
 
-static void 
-legacy_consumer_free_config ()
-{
-	if (NULL != legacy_consumer_replicationdn) {
-		slapi_sdn_free(&legacy_consumer_replicationdn);
-	}
-	if (NULL != legacy_consumer_replicationpw) {
-		slapi_ch_free((void **) &legacy_consumer_replicationpw);
-	}
-}
-
-
-
 static void
 legacy_consumer_encode_pw (Slapi_Entry *e)
 {
@@ -599,9 +586,7 @@ get_legacy_referral (Slapi_Entry *e, char **referral, char **state)
         }
         else
         {
-            *referral = slapi_ch_malloc (strlen (pat) + strlen (hostport));
-        
-            sprintf (*referral, pat, hostport);
+            *referral = slapi_ch_smprintf (pat, hostport);
 
             slapi_ch_free ((void**)&hostport);
         }
diff --git a/ldap/servers/plugins/replication/profile.c b/ldap/servers/plugins/replication/profile.c
index af233355..f95a3f3e 100644
--- a/ldap/servers/plugins/replication/profile.c
+++ b/ldap/servers/plugins/replication/profile.c
@@ -28,15 +28,14 @@ void profile_log(char *file,int line)
 void profile_open()
 {
 	char filename[MAX_FILENAME];
-	strncpy(filename,CFG_rootpath,MAX_FILENAME);
-	strcat(filename,CFG_profilefile);
+	PR_snprintf(filename, MAX_FILENAME, "%s%s", CFG_rootpath, CFG_profilefile);
 	profile_fd= textfile_open(filename,"a");
 }
 
 void profile_close()
 {
 	if (profile_fd==NULL)
-		slapi_log_error(,"profile_close: profile file not open.");
+		slapi_log_error(SLAPI_LOG_ERROR, "repl_profile" ,"profile_close: profile file not open.");
 	else
 		textfile_close(profile_fd);
 }
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c
index b8bd09a3..dae8da60 100644
--- a/ldap/servers/plugins/replication/repl5_agmt.c
+++ b/ldap/servers/plugins/replication/repl5_agmt.c
@@ -310,9 +310,7 @@ agmt_new_from_entry(Slapi_Entry *e)
 		if (dot) {
 			*dot = '\0';
 		}
-		ra->long_name = slapi_ch_malloc(strlen(agmtname) + 
-			strlen(hostname) + 25);
-		sprintf(ra->long_name, "agmt=\"%s\" (%s:%d)", agmtname, hostname, ra->port);
+		ra->long_name = slapi_ch_smprintf("agmt=\"%s\" (%s:%d)", agmtname, hostname, ra->port);
 	}
 
 	/* Initialize status information */
@@ -868,7 +866,6 @@ agmt_set_bind_method_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
 int
 agmt_set_bind_method_from_entry(Repl_Agmt *ra, const Slapi_Entry *e)
 {
-	char *tmpstr = NULL;
 	int return_value = 0;
 
 	PR_ASSERT(NULL != ra);
diff --git a/ldap/servers/plugins/replication/repl5_agmtlist.c b/ldap/servers/plugins/replication/repl5_agmtlist.c
index e821ae2b..1c93e14f 100644
--- a/ldap/servers/plugins/replication/repl5_agmtlist.c
+++ b/ldap/servers/plugins/replication/repl5_agmtlist.c
@@ -164,7 +164,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
     int update_the_schedule = 0;	/* do we need to update the repl sched? */
 	Repl_Agmt *agmt = NULL;
 	LDAPMod **mods;
-    char buff [BUFSIZ];
+    char buff [SLAPI_DSE_RETURNTEXT_SIZE];
     char *errortext = returntext ? returntext : buff;
     int rc = SLAPI_DSE_CALLBACK_OK;
     Slapi_Operation *op;
@@ -225,7 +225,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
 			    /* Start replica initialization */
                 if (val == NULL)
                 {
-                    sprintf (errortext, "No value supplied for attr (%s)", mods[i]->mod_type);
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "No value supplied for attr (%s)", mods[i]->mod_type);
                     slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "agmtlist_modify_callback: %s\n",
                                     errortext);	  
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
@@ -247,7 +247,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
                 }
                 else
                 {
-                    sprintf (errortext, "Invalid value (%s) value supplied for attr (%s)", 
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "Invalid value (%s) value supplied for attr (%s)", 
                              val, mods[i]->mod_type);
                     slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "agmtlist_modify_callback: %s\n",
                                     errortext);	
diff --git a/ldap/servers/plugins/replication/repl5_connection.c b/ldap/servers/plugins/replication/repl5_connection.c
index cd6c45ae..eed22750 100644
--- a/ldap/servers/plugins/replication/repl5_connection.c
+++ b/ldap/servers/plugins/replication/repl5_connection.c
@@ -61,9 +61,6 @@ static int s_debug_level = 0;
 static Slapi_Eq_Context repl5_start_debug_timeout(int *setlevel);
 static void repl5_stop_debug_timeout(Slapi_Eq_Context eqctx, int *setlevel);
 static void repl5_debug_timeout_callback(time_t when, void *arg);
-#ifndef DSE_RETURNTEXT_SIZE
-#define SLAPI_DSE_RETURNTEXT_SIZE 512
-#endif
 
 #define STATE_CONNECTED 600
 #define STATE_DISCONNECTED 601
@@ -1050,9 +1047,6 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
 	char *nsschemacsn = "nsschemacsn";
 	Slapi_Entry **entries = NULL;
 	Slapi_Entry *schema_entry = NULL;
-	int push_schema = 1; /* Assume we need to push for now */
-	int local_error = 0; /* No local error encountered yet */
-	int remote_error = 0; /* No remote error encountered yet */
 	CSN *localcsn = NULL;
 	Slapi_PBlock *spb = NULL;
 	char localcsnstr[CSN_STRSIZE + 1] = {0};
@@ -1193,6 +1187,8 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
 					case CONN_OPERATION_SUCCESS:
 						return_value = CONN_SCHEMA_UPDATED;
 						break;
+					default:
+						break;
 					}
 				}
 			}
@@ -1434,18 +1430,6 @@ repl5_set_debug_timeout(const char *val)
 	}
 }
 
-static time_t 
-PRTime2time_t (PRTime tm)
-{
-    PRInt64 rt;
-
-    PR_ASSERT (tm);
-    
-    LL_DIV(rt, tm, PR_USEC_PER_SEC);
-
-    return (time_t)rt;
-}
-
 static Slapi_Eq_Context
 repl5_start_debug_timeout(int *setlevel)
 {
@@ -1465,7 +1449,7 @@ repl5_stop_debug_timeout(Slapi_Eq_Context eqctx, int *setlevel)
 	char msg[SLAPI_DSE_RETURNTEXT_SIZE];
 
 	if (eqctx && !*setlevel) {
-		int found = slapi_eq_cancel(eqctx);
+		(void)slapi_eq_cancel(eqctx);
 	}
 
 	if (s_debug_timeout && s_debug_level && *setlevel) {
diff --git a/ldap/servers/plugins/replication/repl5_init.c b/ldap/servers/plugins/replication/repl5_init.c
index 8aead52d..d2207501 100644
--- a/ldap/servers/plugins/replication/repl5_init.c
+++ b/ldap/servers/plugins/replication/repl5_init.c
@@ -36,6 +36,8 @@ nsslapd-plugindescription: Multi-Master Replication Plugin
 #include "dirver.h"
 #include <dirlite_strings.h> /* PLUGIN_MAGIC_VENDOR_STR */
 
+#include "plstr.h"
+
 /* #ifdef _WIN32
 int *module_ldap_debug = 0;
 
@@ -152,15 +154,15 @@ get_repl_session_id (Slapi_PBlock *pb, char *idstr, CSN **csn)
 		/* Avoid "Connection is NULL and hence cannot access SLAPI_CONN_ID" */
 		if (opid) {
 			slapi_pblock_get (pb, SLAPI_CONN_ID, &connid);
-			sprintf (idstr, "conn=%d op=%d", connid, opid);
+			PR_snprintf (idstr, REPL_SESSION_ID_SIZE, "conn=%d op=%d", connid, opid);
 		}
 
 		slapi_pblock_get ( pb, SLAPI_OPERATION, &op );
 		opcsn = operation_get_csn (op);
 		if (opcsn) {
 			csn_as_string (opcsn, PR_FALSE, opcsnstr);
-			strcat (idstr, " csn=");
-			strcat (idstr, opcsnstr);
+			PL_strcatn (idstr, REPL_SESSION_ID_SIZE, " csn=");
+			PL_strcatn (idstr, REPL_SESSION_ID_SIZE, opcsnstr);
 		}
 	}
 	if (csn) {
diff --git a/ldap/servers/plugins/replication/repl5_plugins.c b/ldap/servers/plugins/replication/repl5_plugins.c
index c929fafd..c81dbc3f 100644
--- a/ldap/servers/plugins/replication/repl5_plugins.c
+++ b/ldap/servers/plugins/replication/repl5_plugins.c
@@ -50,8 +50,6 @@ static PRBool process_operation (Slapi_PBlock *pb, const CSN *csn);
 static PRBool is_mmr_replica (Slapi_PBlock *pb);
 static const char *replica_get_purl_for_op (const Replica *r, Slapi_PBlock *pb, const CSN *opcsn);
 static void strip_legacy_info (slapi_operation_parameters *op_params);
-static void close_changelog_for_replica (Object *r_obj);
-static void process_new_ruv_for_replica (Replica *r);
 
 /*
  * XXXggood - what to do if both ssl and non-ssl ports available? How
@@ -98,14 +96,7 @@ multimaster_set_local_purl()
 			}
 			else
 			{
-				int len = 0;
-				char *patt = "ldap://%s:%s";
-				len += strlen(host);
-				len += strlen(port);
-				len += strlen(patt);
-				len++; /* for \0 */
-				local_purl = slapi_ch_malloc(len);
-				sprintf(local_purl, patt, host, port);
+				local_purl = slapi_ch_smprintf("ldap://%s:%s", host, port);
 			}
 
 			/* slapi_ch_free acceptS NULL pointer */
@@ -1407,10 +1398,3 @@ multimaster_be_state_change (void *handle, char *be_name, int old_be_state, int
 
     object_release (r_obj);
 }
-
-static void 
-close_changelog_for_replica (Object *r_obj)
-{
-    if (cl5GetState () == CL5_STATE_OPEN)
-        cl5CloseDB (r_obj);
-}
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index 525fe10d..36bae420 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -95,7 +95,7 @@ replica_new(const Slapi_DN *root)
 {
 	Replica *r = NULL;
 	Slapi_Entry *e = NULL;
-	char errorbuf[BUFSIZ];
+	char errorbuf[SLAPI_DSE_RETURNTEXT_SIZE];
 	char ebuf[BUFSIZ];
 	
 	PR_ASSERT (root);
@@ -135,7 +135,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
     {
         if (NULL != errortext)
 		{
-            sprintf (errortext, "NULL entry");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "NULL entry");
 		}
         return NULL;        
     }
@@ -146,7 +146,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
 	{
 		if (NULL != errortext)
 		{
-            sprintf (errortext, "failed to create replica lock");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to create replica lock");
 		}
 		rc = -1;
 		goto done;
@@ -156,7 +156,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
 	{
 		if (NULL != errortext)
 		{
-            sprintf (errortext, "failed to create replica lock");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to create replica lock");
 		}
 		rc = -1;
 		goto done;
@@ -969,7 +969,6 @@ replica_set_referrals(Replica *r,const Slapi_ValueSet *vs)
 	{
 		Slapi_ValueSet *newvs = slapi_valueset_new();
 		const char *repl_root = slapi_sdn_get_dn(r->repl_root);
-		int rootlen = strlen(repl_root);
 		ii = slapi_valueset_first_value(r->repl_referral, &vv);
 		while (vv)
 		{
@@ -984,12 +983,9 @@ replica_set_referrals(Replica *r,const Slapi_ValueSet *vs)
 				char *tmpref = NULL;
 				int need_slash = 0;
 				if (ref[len-1] != '/') {
-					len++; /* add another one for the slash */
 					need_slash = 1;
 				}
-				len += rootlen + 2;
-				tmpref = slapi_ch_malloc(len);
-				sprintf(tmpref, "%s%s%s", ref, (need_slash ? "/" : ""),
+				tmpref = slapi_ch_smprintf("%s%s%s", ref, (need_slash ? "/" : ""),
 						repl_root);
 				newval = slapi_value_new_string(tmpref);
 				slapi_ch_free_string(&tmpref); /* sv_new_string makes a copy */
@@ -1545,7 +1541,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	Slapi_Attr *attr;
 	char *val;
 	CSNGen *gen; 
-    char buf [BUFSIZ];
+    char buf [SLAPI_DSE_RETURNTEXT_SIZE];
     char *errormsg = errortext? errortext : buf;
 	Slapi_Attr *a = NULL;
 	char dnescape[BUFSIZ]; /* for escape_string */
@@ -1556,7 +1552,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	val = slapi_entry_attr_get_charptr (e, attr_replicaRoot);
     if (val == NULL)
     {
-        sprintf (errormsg, "failed to retrieve %s attribute from (%s)\n", 
+        PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, "failed to retrieve %s attribute from (%s)\n", 
                  attr_replicaRoot,
 				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n",
@@ -1621,7 +1617,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 			slapi_ch_free ((void**)&val);
 			if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID)
 			{
-				sprintf (errormsg,
+				PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
 						 "attribute %s must have a value greater than 0 "
 						 "and less than %d: entry %s",
 						 attr_replicaId, READ_ONLY_REPLICA_ID,
@@ -1639,7 +1635,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 		}
 		else
 		{
-			sprintf (errormsg, "failed to retrieve required %s attribute from %s",
+			PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+						 "failed to retrieve required %s attribute from %s",
 					 attr_replicaId,
 					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
 								   dnescape));
@@ -1655,7 +1652,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	gen = csngen_new (r->repl_rid, attr);
 	if (gen == NULL)
 	{
-        sprintf (errormsg, "failed to create csn generator for replica (%s)",
+        PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+					 "failed to create csn generator for replica (%s)",
 				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
 							   dnescape));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
@@ -1681,7 +1679,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
         rc = slapi_uniqueIDGenerateString (&r->repl_name);
         if (rc != UID_SUCCESS)
 	    {
-            sprintf (errormsg, "failed to assign replica name for replica (%s); "
+            PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+						 "failed to assign replica name for replica (%s); "
                      "uuid generator error - %d ",
 					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape),
 					 rc);
@@ -1748,7 +1747,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
     rc = csngen_get_state ((CSNGen*)object_get_data (r->repl_csngen), &smod);
 	if (rc != CSN_SUCCESS)
     {
-        sprintf (errortext, "failed to get csn generator's state; csn error - %d", rc);
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to get csn generator's state; csn error - %d", rc);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1763,7 +1762,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
 
     if (rc != 0)
     {
-        sprintf (errortext, "failed to update replica entry");
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to update replica entry");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1773,7 +1772,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
     rc = slapi_entry_add_string (e, attr_replicaName, r->repl_name);
     if (rc != 0)
     {
-        sprintf (errortext, "failed to update replica entry");
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to update replica entry");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1790,15 +1789,10 @@ _replica_get_config_dn (const Slapi_DN *root)
 {
     char *dn;
     const char *mp_base = slapi_get_mapping_tree_config_root ();
-    int len; 
 
     PR_ASSERT (root);
 
-    len = strlen (REPLICA_RDN) + strlen (slapi_sdn_get_dn (root)) +
-          strlen (mp_base) + 8; /* 8 = , + cn= + \" + \" + , + \0 */
-
-    dn = (char*)slapi_ch_malloc (len);
-    sprintf (dn, "%s,cn=\"%s\",%s", REPLICA_RDN, slapi_sdn_get_dn (root), mp_base);
+    dn = slapi_ch_smprintf("%s,cn=\"%s\",%s", REPLICA_RDN, slapi_sdn_get_dn (root), mp_base);
 
     return dn;
 }
@@ -2622,10 +2616,7 @@ replica_create_ruv_tombstone(Replica *r)
 	char ebuf[BUFSIZ];
 	
 	PR_ASSERT(NULL != r && NULL != r->repl_root);
-	root_entry_str = slapi_ch_malloc(strlen(root_glue) +
-		slapi_sdn_get_ndn_len(r->repl_root) +
-		strlen(RUV_STORAGE_ENTRY_UNIQUEID) + 1);
-	sprintf(root_entry_str, root_glue, slapi_sdn_get_ndn(r->repl_root),
+	root_entry_str = slapi_ch_smprintf(root_glue, slapi_sdn_get_ndn(r->repl_root),
 		RUV_STORAGE_ENTRY_UNIQUEID);
 
 	e = slapi_str2entry(root_entry_str, SLAPI_STR2ENTRY_TOMBSTONE_CHECK);
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index e93ec640..b113b3c9 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -98,7 +98,7 @@ replica_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
 	Replica *r = NULL;
     multimaster_mtnode_extension *mtnode_ext;	
     char *replica_root = (char*)slapi_entry_attr_get_charptr (e, attr_replicaRoot);
-	char buf [BUFSIZ];
+	char buf [SLAPI_DSE_RETURNTEXT_SIZE];
 	char *errortext = errorbuf ? errorbuf : buf;
     
 	if (errorbuf)
@@ -118,7 +118,7 @@ replica_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
 
     if (mtnode_ext->replica)
     {
-        sprintf (errortext, "replica already configured for %s", replica_root);
+        PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "replica already configured for %s", replica_root);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_add: %s\n", errortext);
         *returncode = LDAP_UNWILLING_TO_PERFORM;    
         goto done;   
@@ -173,7 +173,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
     multimaster_mtnode_extension *mtnode_ext;	
 	Replica *r = NULL;
     char *replica_root = NULL; 
-	char buf [BUFSIZ];
+	char buf [SLAPI_DSE_RETURNTEXT_SIZE];
 	char *errortext = returntext ? returntext : buf;
     char *config_attr, *config_attr_value;
     Slapi_Operation *op;
@@ -208,7 +208,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
 
     if (mtnode_ext->replica == NULL)
     {
-        sprintf (errortext, "replica does not exist for %s", replica_root);
+        PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "replica does not exist for %s", replica_root);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n",
                         errortext);
         *returncode = LDAP_OPERATIONS_ERROR;    
@@ -248,7 +248,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 strcasecmp (config_attr, attr_state) == 0)
             {
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
-                sprintf (errortext, "modification of %s attribute is not allowed", 
+                PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "modification of %s attribute is not allowed", 
                          config_attr);                         
                 slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                 errortext);
@@ -280,7 +280,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 else
                 {
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
-                    sprintf (errortext, "deletion of %s attribute is not allowed", config_attr);                         
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "deletion of %s attribute is not allowed", config_attr);                         
                     slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                     errortext);
                 }                
@@ -372,7 +372,8 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 else
                 {
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
-                    sprintf (errortext, "modification of attribute %s is not allowed in replica entry", config_attr);
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE,
+								 "modification of attribute %s is not allowed in replica entry", config_attr);
                     slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                     errortext);
                 } 
@@ -497,7 +498,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
         type = atoi (new_type);
         if (type <= REPLICA_TYPE_UNKNOWN || type >= REPLICA_TYPE_END)
         {
-            sprintf (returntext, "invalid replica type %d", type);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "invalid replica type %d", type);
             return LDAP_OPERATIONS_ERROR;
         }
     }
@@ -505,7 +506,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	/* disallow changing type to itself just to permit a replica ID change */
 	if (oldtype == type)
 	{
-            sprintf (returntext, "replica type is already %d - not changing", type);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "replica type is already %d - not changing", type);
             return LDAP_OPERATIONS_ERROR;
 	}
 
@@ -515,7 +516,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	}
 	else if (!new_id)
 	{
-		sprintf(returntext, "a replica ID is required when changing replica type to read-write");
+		PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "a replica ID is required when changing replica type to read-write");
 		return LDAP_UNWILLING_TO_PERFORM;
 	}
 	else
@@ -523,7 +524,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 		int temprid = atoi (new_id);
 		if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID)
 		{
-			sprintf(returntext,
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,
 					"attribute %s must have a value greater than 0 "
 					"and less than %d",
 					attr_replicaId, READ_ONLY_REPLICA_ID);
@@ -538,7 +539,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	/* error if old rid == new rid */
 	if (oldrid == rid)
 	{
-            sprintf (returntext, "replica ID is already %d - not changing", rid);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "replica ID is already %d - not changing", rid);
             return LDAP_OPERATIONS_ERROR;
 	}
 
@@ -610,7 +611,8 @@ static int replica_execute_task (Object *r, const char *task_name, char *returnt
 	{
 		int temprid = atoi(&(task_name[CLEANRUVLEN]));
 		if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID){
-			sprintf(returntext, "Invalid replica id for task - %s", task_name);
+			PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+						"Invalid replica id for task - %s", task_name);
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"replica_execute_task: %s\n", returntext);
 			return LDAP_OPERATIONS_ERROR;
@@ -624,7 +626,7 @@ static int replica_execute_task (Object *r, const char *task_name, char *returnt
 	}
 	else
 	{
-        sprintf (returntext, "unsupported replica task - %s", task_name);
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "unsupported replica task - %s", task_name);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_task: %s\n", returntext);        
         return LDAP_OPERATIONS_ERROR;
@@ -642,7 +644,7 @@ static int replica_execute_cl2ldif_task (Object *r, char *returntext)
 
     if (cl5GetState () != CL5_STATE_OPEN)
     {
-        sprintf (returntext, "changelog is not open");
+        PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "changelog is not open");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_cl2ldif_task: %s\n", returntext);        
         return LDAP_OPERATIONS_ERROR;
@@ -659,13 +661,13 @@ static int replica_execute_cl2ldif_task (Object *r, char *returntext)
     replica = (Replica*)object_get_data (r);
     PR_ASSERT (replica);
 
-    sprintf (fName, "%s/%s.ldif", clDir, replica_get_name (replica));
+    PR_snprintf (fName, MAXPATHLEN, "%s/%s.ldif", clDir, replica_get_name (replica));
     slapi_ch_free ((void**)&clDir);
 
     rc = cl5ExportLDIF (fName, rlist);
     if (rc != CL5_SUCCESS)
     {
-        sprintf (returntext, "failed to export changelog data to file %s; "
+        PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to export changelog data to file %s; "
                  "changelog error - %d", fName, rc);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_cl2ldif_task: %s\n", returntext);        
diff --git a/ldap/servers/plugins/replication/repl5_ruv.c b/ldap/servers/plugins/replication/repl5_ruv.c
index 306c20a2..dfc11227 100644
--- a/ldap/servers/plugins/replication/repl5_ruv.c
+++ b/ldap/servers/plugins/replication/repl5_ruv.c
@@ -978,19 +978,14 @@ ruv_to_bervals(const RUV *ruv, struct berval ***bvals)
 		returned_bervals = (struct berval **)slapi_ch_malloc(sizeof(struct berval *) * count);
 		returned_bervals[count - 1] = NULL;
 		returned_bervals[0] = (struct berval *)slapi_ch_malloc(sizeof(struct berval));
-		returned_bervals[0]->bv_val = slapi_ch_malloc(strlen(prefix_replicageneration) + strlen(ruv->replGen) + 2);
-		sprintf(returned_bervals[0]->bv_val, "%s %s",
+		returned_bervals[0]->bv_val = slapi_ch_smprintf("%s %s",
 			prefix_replicageneration, ruv->replGen);
 		returned_bervals[0]->bv_len = strlen(returned_bervals[0]->bv_val);
 		for (i = 1, replica = dl_get_first (ruv->elements, &cookie); replica;
 			 i++, replica = dl_get_next (ruv->elements, &cookie))
 		{
 			returned_bervals[i] = (struct berval *)slapi_ch_malloc(sizeof(struct berval));
-			returned_bervals[i]->bv_val = slapi_ch_malloc(strlen(prefix_ruvcsn) + RIDSTR_SIZE +
-				((replica->replica_purl == NULL) ? 0 : strlen(replica->replica_purl)) +
-				((replica->min_csn == NULL) ? 0 : CSN_STRSIZE) +
-				((replica->csn == NULL) ? 0 : CSN_STRSIZE) + 5);
-			sprintf(returned_bervals[i]->bv_val, "%s%d%s%s}%s%s%s%s",
+			returned_bervals[i]->bv_val = slapi_ch_smprintf("%s%d%s%s}%s%s%s%s",
 				prefix_ruvcsn, replica->rid,
 				replica->replica_purl == NULL ? "" : " ",
 				replica->replica_purl == NULL ? "" : replica->replica_purl,
diff --git a/ldap/servers/plugins/replication/repl5_schedule.c b/ldap/servers/plugins/replication/repl5_schedule.c
index c07a2339..90a7c13e 100644
--- a/ldap/servers/plugins/replication/repl5_schedule.c
+++ b/ldap/servers/plugins/replication/repl5_schedule.c
@@ -83,7 +83,6 @@ static void schedule_window_state_change_event (Schedule *sch);
 static void unschedule_window_state_change_event (Schedule *sch);
 static void window_state_changed (time_t when, void *arg);
 static int schedule_in_window_now_nolock(Schedule *sch);
-static schedule_item* get_current_schedule_item (Schedule *sch);
 static time_t PRTime2time_t (PRTime tm);
 static PRTime schedule_next_nolock (Schedule *sch, PRBool start);
 static void free_schedule_list(schedule_item **schedule_list);
@@ -426,7 +425,6 @@ schedule_next_nolock (Schedule *sch, PRBool start)
 	{
 		schedule_item *si = sch->schedule_list;
 		PRTime now = PR_Now();
-        unsigned char dow = 1 << day_of_week(now);
 
 		while (NULL != si)
 		{
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index cbbfccf0..b7bb38bd 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -60,7 +60,6 @@ repl5_tot_run(Private_Repl_Protocol *prp)
     callback_data cb_data;
     Slapi_PBlock *pb;
     LDAPControl **ctrls;
-	PRBool replica_acquired = PR_FALSE;
 	char *hostname = NULL;
 	int portnum = 0;
 	Slapi_DN *area_sdn = NULL;
diff --git a/ldap/servers/plugins/replication/repl_bind.c b/ldap/servers/plugins/replication/repl_bind.c
index 8671c7bb..6b91915d 100644
--- a/ldap/servers/plugins/replication/repl_bind.c
+++ b/ldap/servers/plugins/replication/repl_bind.c
@@ -17,7 +17,6 @@ legacy_preop_bind( Slapi_PBlock *pb )
 	char *dn = NULL;
 	struct berval *cred = NULL;
 	int method;
-	int one = 1;
     
 	slapi_pblock_get(pb, SLAPI_BIND_METHOD, &method);
 	slapi_pblock_get(pb, SLAPI_BIND_TARGET, &dn);
diff --git a/ldap/servers/plugins/replication/repl_controls.c b/ldap/servers/plugins/replication/repl_controls.c
index d569afc9..d6f25e9a 100644
--- a/ldap/servers/plugins/replication/repl_controls.c
+++ b/ldap/servers/plugins/replication/repl_controls.c
@@ -36,7 +36,6 @@ create_NSDS50ReplUpdateInfoControl(const char *uuid,
 {
 	int retval;
 	BerElement *tmp_bere = NULL;
-	struct berval tmpval = {0};
 	char csn_str[CSN_STRSIZE];	
 
 	if (NULL == ctrlp)
diff --git a/ldap/servers/plugins/replication/repl_extop.c b/ldap/servers/plugins/replication/repl_extop.c
index cb491a39..5f518b81 100644
--- a/ldap/servers/plugins/replication/repl_extop.c
+++ b/ldap/servers/plugins/replication/repl_extop.c
@@ -724,7 +724,7 @@ multimaster_extop_StartNSDS50ReplicationRequest(Slapi_PBlock *pb)
 	 * the session's conn id and op id to identify the the supplier.
 	 */
 	/* junkrc = ruv_get_first_id_and_purl(supplier_ruv, &junkrid, &locking_purl); */
-	sprintf(locking_session, "conn=%d id=%d", connid, opid);
+	PR_snprintf(locking_session, sizeof(locking_session), "conn=%d id=%d", connid, opid);
 	locking_purl = &locking_session[0];
 	if (replica_get_exclusive_access(replica, &isInc, connid, opid,
 									 locking_purl,
@@ -826,7 +826,7 @@ send_response:
 		int resp_log_level = SLAPI_LOG_FATAL;
 		char purlstr[1024] = {0};
 		if (current_purl)
-			sprintf(purlstr, " locked by %s for %s update", current_purl,
+			PR_snprintf(purlstr, sizeof(purlstr), " locked by %s for %s update", current_purl,
 					isInc ? "incremental" : "total");
 
 		/* Don't log replica busy as errors - these are almost always not
diff --git a/ldap/servers/plugins/replication/repl_init.c b/ldap/servers/plugins/replication/repl_init.c
index 35d8bbf4..14475900 100644
--- a/ldap/servers/plugins/replication/repl_init.c
+++ b/ldap/servers/plugins/replication/repl_init.c
@@ -52,7 +52,6 @@ static Slapi_PluginDesc legacypreopdesc = { "replication-legacy-preop", PLUGIN_M
 static Slapi_PluginDesc legacypostopdesc = { "replication-legacy-postop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication post-operation plugin" };
 static Slapi_PluginDesc legacyinternalpreopdesc = { "replication-legacy-internalpreop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication internal pre-operation plugin" };
 static Slapi_PluginDesc legacyinternalpostopdesc = { "replication-legacy-internalpostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication internal post-operation plugin" };
-static Slapi_PluginDesc legacybepostopdesc = { "replication-legacy-bepostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication bepost-operation plugin" };
 static Slapi_PluginDesc legacyentrydesc = { "replication-legacy-entry", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication entry plugin" };
 
 static int legacy_stopped; /* A flag which is set when all the plugin threads are to stop */        
@@ -173,7 +172,6 @@ legacy_entry_init( Slapi_PBlock *pb )
 static int
 create_config_top()
 {
-	const char *dn = REPL_CONFIG_TOP;
 	char *entry_string = slapi_ch_strdup("dn: cn=replication,cn=config\nobjectclass: top\nobjectclass: extensibleobject\ncn: replication\n");
 	Slapi_PBlock *pb = slapi_pblock_new();
 	Slapi_Entry *e = slapi_str2entry(entry_string, 0);
diff --git a/ldap/servers/plugins/replication/repl_ops.c b/ldap/servers/plugins/replication/repl_ops.c
index aaffe507..28e9f4af 100644
--- a/ldap/servers/plugins/replication/repl_ops.c
+++ b/ldap/servers/plugins/replication/repl_ops.c
@@ -55,13 +55,6 @@ legacy_postop( Slapi_PBlock *pb, const char *caller, int operation_type)
 	return 0;
 }
 
-
-
-static char *not_replicationdn_errmsg =
-	"An operation was submitted that contained copiedFrom or "
-	"copyingFrom attributes, but the connection was not bound "
-	"as the replicationdn.";
-
 int
 legacy_preop(Slapi_PBlock *pb, const char *caller, int operation_type)
 {
diff --git a/ldap/servers/plugins/replication/replutil.c b/ldap/servers/plugins/replication/replutil.c
index bb6b13e4..e1aab69d 100644
--- a/ldap/servers/plugins/replication/replutil.c
+++ b/ldap/servers/plugins/replication/replutil.c
@@ -413,9 +413,9 @@ parse_changes_string(char *str)
 			if (rc != 0)
 			{
 				/* ONREPL - log warning */
-			        if ( errmsg != NULL ) {
-				        slapi_log_error( SLAPI_LOG_PARSE, repl_plugin_name, "%s", errmsg ); 
-					slapi_ch_free( (void**)&errmsg );
+				if ( errmsg != NULL ) {
+					slapi_log_error( SLAPI_LOG_PARSE, repl_plugin_name, "%s", errmsg ); 
+					PR_smprintf_free(errmsg );
 				}
 				slapi_log_error( SLAPI_LOG_REPL, repl_plugin_name, 
 						 "Failed to parse the ldif line.\n");
@@ -907,7 +907,6 @@ repl_enable_chain_on_update(Slapi_DN *suffix)
     /* Submit a Modify operation to add the distribution function to the mapping tree
 	   node for the given suffix */
     slapi_mods smods;
-	Slapi_Operation *op = NULL;
 	int operation_result;
 	Slapi_PBlock *pb= slapi_pblock_new();
 	char *mtnnodedn;
@@ -952,7 +951,6 @@ repl_disable_chain_on_update(Slapi_DN *suffix)
     /* Submit a Modify operation to remove the distribution function from the mapping tree
 	   node for the given suffix */
     slapi_mods smods;
-	Slapi_Operation *op = NULL;
 	int operation_result;
 	Slapi_PBlock *pb= slapi_pblock_new();
 	char *mtnnodedn;
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index 70f449b5..db111c21 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -149,7 +149,7 @@ urp_add_operation( Slapi_PBlock *pb )
 			Slapi_RDN *rdn;
 			char buf[BUFSIZ];
 
-			sprintf(buf, "%s %s", REASON_ANNOTATE_DN, basedn);
+			PR_snprintf(buf, BUFSIZ, "%s %s", REASON_ANNOTATE_DN, basedn);
 			if (slapi_entry_attr_find (addentry, ATTR_NSDS5_REPLCONFLICT, &attr) == 0)
 			{
 				/* ATTR_NSDS5_REPLCONFLICT exists */
@@ -998,8 +998,7 @@ urp_get_min_naming_conflict_entry ( Slapi_PBlock *pb, char *sessionid, CSN *opcs
 	slapi_log_error ( SLAPI_LOG_REPL, sessionid,
 		"Enter urp_get_min_naming_conflict_entry for %s\n", basedn);
 
-	filter = slapi_ch_malloc(50 + strlen(basedn));
-	sprintf(filter, "(%s=%s %s)", ATTR_NSDS5_REPLCONFLICT, REASON_ANNOTATE_DN, basedn);
+	filter = PR_smprintf("(%s=%s %s)", ATTR_NSDS5_REPLCONFLICT, REASON_ANNOTATE_DN, basedn);
 
 	/* server_ctrls will be freed when newpb is destroyed */
 	server_ctrls = (LDAPControl **)slapi_ch_calloc (2, sizeof (LDAPControl *));
@@ -1058,7 +1057,9 @@ urp_get_min_naming_conflict_entry ( Slapi_PBlock *pb, char *sessionid, CSN *opcs
 
 done:
 	slapi_ch_free((void **)&parent_dn);
-	slapi_ch_free((void **)&filter);
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	slapi_free_search_results_internal(newpb);
 	slapi_pblock_destroy(newpb);
 	newpb = NULL;
@@ -1239,7 +1240,7 @@ mod_namingconflict_attr (const char *uniqueid, const char *entrydn, const char *
 	char buf[BUFSIZ];
 	int op_result;
 
-	sprintf (buf, "%s %s", REASON_ANNOTATE_DN, conflictdn);
+	PR_snprintf (buf, sizeof(buf), "%s %s", REASON_ANNOTATE_DN, conflictdn);
 	slapi_mods_init (&smods, 2);
 	if ( strncmp (entrydn, SLAPI_ATTR_UNIQUEID, strlen(SLAPI_ATTR_UNIQUEID)) != 0 )
 	{
diff --git a/ldap/servers/plugins/replication/urp_glue.c b/ldap/servers/plugins/replication/urp_glue.c
index 86213393..42be4f27 100644
--- a/ldap/servers/plugins/replication/urp_glue.c
+++ b/ldap/servers/plugins/replication/urp_glue.c
@@ -153,10 +153,7 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
 				rdnval, rdnval_len, LDIF_OPT_NOWRAP);
 		*rdnpair = '\0';
 	}	  
-	estr= slapi_ch_malloc(strlen(glue_entry) + slapi_sdn_get_ndn_len(sdn) +
-						  strlen(rdnstr) + strlen(uniqueid) +
-						  strlen(ATTR_NSDS5_REPLCONFLICT) + strlen(reason) + 1);
-	sprintf(estr, glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid, 
+	estr= slapi_ch_smprintf(glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid, 
 			ATTR_NSDS5_REPLCONFLICT, reason);
 	slapi_ch_free((void**)&rdnstr);
 	slapi_rdn_done(newrdn);
@@ -167,8 +164,8 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
 	{
 		slapi_entry_set_uniqueid (e, slapi_ch_strdup(uniqueid));
 		op_result = urp_fixup_add_entry (e, NULL, NULL, opcsn, 0);
-		slapi_ch_free ( (void **) &estr ); /* XXXggood - this leaks if e == NULL */
 	}
+	slapi_ch_free_string(&estr);
 	slapi_sdn_free(&sdn);
 	return op_result;
 }
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
index d6b7a12d..cf615609 100644
--- a/ldap/servers/plugins/retrocl/retrocl.c
+++ b/ldap/servers/plugins/retrocl/retrocl.c
@@ -45,7 +45,6 @@ Slapi_Backend *retrocl_be_changelog = NULL;
 static Slapi_PluginDesc retrocldesc = {"retrocl", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Retrocl Plugin"};
 static Slapi_PluginDesc retroclpostopdesc = {"retrocl-postop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "retrocl post-operation plugin"};
 static Slapi_PluginDesc retroclinternalpostopdesc = {"retrocl-internalpostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "retrocl internal post-operation plugin"};
-static Slapi_PluginDesc retroclbepostopdesc = {"retrocl-bepostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Retrocl bepost-operation plugin"};
 
 
 /*
@@ -165,7 +164,7 @@ static int retrocl_select_backend(void)
     Slapi_Backend *be = NULL;
     Slapi_Entry *referral = NULL;
     Slapi_Operation *op = NULL;
-    char errbuf[1024];
+    char errbuf[BUFSIZ];
 
     pb = slapi_pblock_new();
 
diff --git a/ldap/servers/plugins/retrocl/retrocl_po.c b/ldap/servers/plugins/retrocl/retrocl_po.c
index c1fbd3d8..bc8110cb 100644
--- a/ldap/servers/plugins/retrocl/retrocl_po.c
+++ b/ldap/servers/plugins/retrocl/retrocl_po.c
@@ -128,7 +128,7 @@ write_replog_db(
     const char          *newsuperior
 )
 {
-    char		*pat, *edn;
+    char		*edn;
     struct berval	*vals[ 2 ];
     struct berval	val;
     Slapi_Entry		*e;
@@ -146,9 +146,7 @@ write_replog_db(
 	    changenum, ( dn == NULL ) ? "NULL" : dn );
 
     /* Construct the dn of this change record */
-    pat = "%s=%lu,%s";
-    edn = slapi_ch_malloc( strlen( pat ) + strlen( RETROCL_CHANGELOG_DN) + 20 );
-    sprintf( edn, pat, attr_changenumber, changenum, RETROCL_CHANGELOG_DN);
+    edn = slapi_ch_smprintf( "%s=%lu,%s", attr_changenumber, changenum, RETROCL_CHANGELOG_DN);
 
     /*
      * Create the entry struct, and fill in fields common to all types
diff --git a/ldap/servers/plugins/retrocl/retrocl_trim.c b/ldap/servers/plugins/retrocl/retrocl_trim.c
index c35f8cfe..92e75502 100644
--- a/ldap/servers/plugins/retrocl/retrocl_trim.c
+++ b/ldap/servers/plugins/retrocl/retrocl_trim.c
@@ -71,10 +71,7 @@ delete_changerecord( changeNumber cnum )
     char	*dnbuf;
     int		delrc;
 
-    dnbuf = slapi_ch_malloc( strlen( attr_changenumber ) + 20 + 
-			     strlen(RETROCL_CHANGELOG_DN));
-    /* Delete the record */
-    sprintf( dnbuf, "%s=%ld, %s", attr_changenumber, cnum, 
+    dnbuf = slapi_ch_smprintf("%s=%ld, %s", attr_changenumber, cnum, 
 	     RETROCL_CHANGELOG_DN);
     pb = slapi_pblock_new ();
     slapi_delete_internal_set_pb ( pb, dnbuf, NULL /*controls*/, NULL /* uniqueid */,
@@ -167,7 +164,7 @@ static Slapi_Entry *get_changerecord( changeNumber cnum, int *err )
 	return NULL;
     }
     crtp->crt_nentries = crtp->crt_err = 0; crtp->crt_entry = NULL;
-    sprintf( fstr, "%s=%ld", attr_changenumber, cnum );
+    PR_snprintf( fstr, sizeof(fstr), "%s=%ld", attr_changenumber, cnum );
     
     pb = slapi_pblock_new ();
     slapi_search_internal_set_pb (pb, RETROCL_CHANGELOG_DN, 
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
index eee9d1b2..b9fb94fa 100644
--- a/ldap/servers/plugins/rever/des.c
+++ b/ldap/servers/plugins/rever/des.c
@@ -25,7 +25,8 @@
 #include <seccomon.h>
 #include <pk11func.h>
 
-#include "rever.h" 
+#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
+#include "rever.h"
 #include <slap.h>
 #include "slapi-plugin.h"
 #include <uuid.h>
@@ -60,8 +61,6 @@ static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear,
 static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
 static void freeDes(struct pk11ContextStore *out);
 
-static int init = 0;
-
 void
 init_des_plugin()
 {
diff --git a/ldap/servers/plugins/roles/Makefile b/ldap/servers/plugins/roles/Makefile
index bbc97abd..5b26225b 100644
--- a/ldap/servers/plugins/roles/Makefile
+++ b/ldap/servers/plugins/roles/Makefile
@@ -84,9 +84,6 @@ endif
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
 
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
-
 # Target to push the built binary to an installed server
 #ROLES_PUSH = $(addprefix $(INSTDIR)lib/, $(notdir $(ROLES)))
 #push: $(ROLES_PUSH)
diff --git a/ldap/servers/plugins/roles/roles_cache.c b/ldap/servers/plugins/roles/roles_cache.c
index a4417335..59873b54 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -129,7 +129,6 @@ static void roles_cache_wait_on_change(void * arg);
 static void roles_cache_trigger_update_suffix(void *handle, char *be_name, int old_be_state, int new_be_state);
 static void roles_cache_trigger_update_role(char *dn, Slapi_Entry *role_entry, Slapi_DN *be_dn, int operation);
 static int roles_cache_update(roles_cache_def *suffix_to_update);
-static int roles_get_roles_from_entry(Slapi_DN * suffix, Slapi_PBlock **int_search_pb);
 static int roles_cache_create_role_under(roles_cache_def** roles_cache_suffix, Slapi_Entry *entry);
 static int roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **result, int hint);
 static int roles_cache_determine_class(Slapi_Entry *role_entry);
@@ -955,7 +954,7 @@ static int roles_cache_add_roles_from_suffix(Slapi_DN *suffix_dn, roles_cache_de
 	roles_cache_search_roles info;
 	Slapi_PBlock *int_search_pb = NULL;
 
-    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "--> roles_get_roles_from_entry\n");
+    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "--> roles_cache_add_roles_from_suffix\n");
 	
 	info.suffix_def = suffix_def;
 	info.rc = LDAP_NO_SUCH_OBJECT;
@@ -987,7 +986,7 @@ static int roles_cache_add_roles_from_suffix(Slapi_DN *suffix_dn, roles_cache_de
 		rc = 0;
 	}
 
-    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "<-- roles_get_roles_from_entry\n");
+    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "<-- roles_cache_add_roles_from_suffix\n");
 
 	return(rc);
 }
@@ -1391,9 +1390,7 @@ static int roles_cache_object_nested_from_dn(Slapi_DN *role_dn, role_object_nest
 int roles_cache_listroles(Slapi_Entry *entry, int return_values, Slapi_ValueSet **valueset_out)
 {
     roles_cache_def *roles_cache = NULL;
-	role_object *this_role = NULL;
     int rc = 0;
-    Avlnode * tree = NULL;
 	roles_cache_build_result arg;
 	Slapi_Backend *backend = NULL;
  
@@ -1946,8 +1943,6 @@ static void roles_cache_role_def_delete(roles_cache_def *role_def)
 */
 static void roles_cache_role_def_free(roles_cache_def *role_def)
 {
-	roles_cache_def *next_def = NULL;
-
 	slapi_log_error(SLAPI_LOG_PLUGIN, 
 					ROLES_PLUGIN_SUBSYSTEM, "--> roles_cache_role_def_free\n");
 	if ( role_def == NULL )
diff --git a/ldap/servers/plugins/roles/roles_plugin.c b/ldap/servers/plugins/roles/roles_plugin.c
index 0b4785ce..77019761 100644
--- a/ldap/servers/plugins/roles/roles_plugin.c
+++ b/ldap/servers/plugins/roles/roles_plugin.c
@@ -186,13 +186,20 @@ int roles_sp_get_value(vattr_sp_handle *handle,
 
 int roles_sp_compare_value(vattr_sp_handle *handle, vattr_context *c, Slapi_Entry *e, char *type, Slapi_Value *test_this, int* result,int flags, void *hint)
 {
-	int rc = 0;
+	int rv;
 	Slapi_DN the_dn;
 
 	/* Extract the role's DN from the value passed in */
+	/* possible problem here - slapi_value_get_string returns a pointer to the
+	   raw bv_val in the value, which is not guaranteed to be null terminated,
+	   but probably is for any value passed into this function */
 	slapi_sdn_init_dn_byref(&the_dn,slapi_value_get_string(test_this));
 
-	return (roles_check(e,&the_dn,result));
+	rv = roles_check(e,&the_dn,result);
+
+	slapi_sdn_done(&the_dn);
+
+	return rv;
 }
 
 int roles_sp_list_types(vattr_sp_handle *handle,Slapi_Entry *e,vattr_type_list_context *type_context,int flags)
diff --git a/ldap/servers/plugins/shared/utils.c b/ldap/servers/plugins/shared/utils.c
index 93bbed3a..cd9efc6c 100644
--- a/ldap/servers/plugins/shared/utils.c
+++ b/ldap/servers/plugins/shared/utils.c
@@ -21,6 +21,7 @@
 ***********************************************************************/
 
 #include "plugin-utils.h"
+#include "nspr.h"
 
 static char *plugin_name = "utils";
 
@@ -129,17 +130,17 @@ entryHasObjectClass(Slapi_PBlock *pb, Slapi_Entry *e,
 Slapi_PBlock *
 dnHasObjectClass( const char *baseDN, const char *objectClass ) {
 	int result = 0;
+	char *filter = NULL;
 	Slapi_PBlock *spb = NULL;
 
 	BEGIN
 		Slapi_Entry **entries;
-		char filter[1024];
 		char *attrs[2];
 
 		/* Perform the search - the new pblock needs to be freed */
 		attrs[0] = "objectclass";
 		attrs[1] = NULL;
-		sprintf( filter, "objectclass=%s", objectClass );
+		filter = PR_smprintf("objectclass=%s", objectClass );
 		if ( !(spb = readPblockAndEntry( baseDN, filter, attrs) ) ) {
 			break;
 		}
@@ -161,6 +162,9 @@ dnHasObjectClass( const char *baseDN, const char *objectClass ) {
 		}
     END
 
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	return spb;
 }
 
@@ -174,17 +178,17 @@ Slapi_PBlock *
 dnHasAttribute( const char *baseDN, const char *attrName ) {
 	int result = 0;
 	Slapi_PBlock *spb = NULL;
+	char *filter = NULL;
 
 	BEGIN
         int sres;
 		Slapi_Entry **entries;
-		char filter[1024];
 		char *attrs[2];
 
 		/* Perform the search - the new pblock needs to be freed */
 		attrs[0] = (char *)attrName;
 		attrs[1] = NULL;
-		sprintf( filter, "%s=*", attrName );
+		filter = PR_smprintf( "%s=*", attrName );
 		spb = slapi_search_internal((char *)baseDN, LDAP_SCOPE_BASE,
 									filter, NULL, attrs, 0);
 		if ( !spb ) {
@@ -217,6 +221,9 @@ dnHasAttribute( const char *baseDN, const char *attrName ) {
 		}
     END
 
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	return spb;
 }
 
diff --git a/ldap/servers/plugins/statechange/Makefile b/ldap/servers/plugins/statechange/Makefile
index f082af3b..e2efb1c1 100644
--- a/ldap/servers/plugins/statechange/Makefile
+++ b/ldap/servers/plugins/statechange/Makefile
@@ -73,6 +73,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/statechange/statechange.c b/ldap/servers/plugins/statechange/statechange.c
index c0e21b4b..7730595a 100644
--- a/ldap/servers/plugins/statechange/statechange.c
+++ b/ldap/servers/plugins/statechange/statechange.c
@@ -330,7 +330,7 @@ static void *_statechange_unregister(char *dn, char *filter, notify_callback the
 
 	slapi_lock_mutex(buffer_lock);
 
-	if(func = statechange_find_notify(dn, filter, thefunc))
+	if((func = statechange_find_notify(dn, filter, thefunc)))
 	{
 		func->prev->next = func->next;
 		func->next->prev = func->prev;
diff --git a/ldap/servers/plugins/uiduniq/7bit.c b/ldap/servers/plugins/uiduniq/7bit.c
index c7448078..15081a90 100644
--- a/ldap/servers/plugins/uiduniq/7bit.c
+++ b/ldap/servers/plugins/uiduniq/7bit.c
@@ -77,7 +77,6 @@ static void
 issue_error(Slapi_PBlock *pb, int result, char *type, char *value)
 {
   char *moreinfop;
-  int sz;
 
   slapi_log_error(SLAPI_LOG_PLUGIN, plugin_name,
       "%s result %d\n", type, result);
@@ -85,9 +84,7 @@ issue_error(Slapi_PBlock *pb, int result, char *type, char *value)
   if (value == NULL) {
     value = "unknown";
   }
-  sz = strlen(moreInfo) + strlen(value) + 1;
-  moreinfop = (char *)slapi_ch_malloc(sz);
-  sprintf(moreinfop, "%s%s", moreInfo, value);
+  moreinfop = slapi_ch_smprintf("%s%s", moreInfo, value);
 
   /* Send failure to the client */
   slapi_send_ldap_result(pb, result, 0, moreinfop, 0, 0);
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index 2d1c69b0..e8698a68 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -443,7 +443,7 @@ findSubtreeAndSearch(char *parentDN, const char *attrName, Slapi_Attr *attr,
 
   while (NULL != (parentDN = slapi_dn_parent(parentDN)))
   {
-        if (spb = dnHasObjectClass(parentDN, markerObjectClass))
+        if ((spb = dnHasObjectClass(parentDN, markerObjectClass)))
         {
           freePblock(spb);
           /*
diff --git a/ldap/servers/plugins/views/Makefile b/ldap/servers/plugins/views/Makefile
index 678a0290..e6e4282c 100644
--- a/ldap/servers/plugins/views/Makefile
+++ b/ldap/servers/plugins/views/Makefile
@@ -74,6 +74,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/views/views.c b/ldap/servers/plugins/views/views.c
index 86c2f758..8d7d903f 100644
--- a/ldap/servers/plugins/views/views.c
+++ b/ldap/servers/plugins/views/views.c
@@ -380,7 +380,6 @@ static int views_close( Slapi_PBlock *pb )
 static int views_cache_create()
 {
 	int ret = -1;
-	static int firstTime = 1;
 
 	slapi_log_error( SLAPI_LOG_TRACE, VIEWS_PLUGIN_SUBSYSTEM, "--> views_cache_create\n");
 
@@ -704,8 +703,6 @@ static void views_cache_create_applied_filter(viewEntry *pView)
 	Slapi_Filter *pCurrentFilter = 0;
 	Slapi_Filter *pBuiltFilter = 0;
 	Slapi_Filter *pViewEntryExcludeFilter = 0;
-	char *buf = 0;
-	int len = 0;
 
 	if(pView->includeAncestorFiltersFilter)
 	{
@@ -763,17 +760,13 @@ static void views_cache_create_applied_filter(viewEntry *pView)
  */
 static void views_cache_create_exclusion_filter(viewEntry *pView)
 {
+/*
 	viewEntry *current = pView;
 	Slapi_Filter *pOrSubFilter = 0;
-	Slapi_Filter *excludeChildFiltersFilter = 0;
-	Slapi_Filter *pChildExcludeSubFilter = 0;
-	Slapi_Filter *pViewEntryExcludeFilter = 0;
 	int child_count = 0;
-	int len = 0;
+*/
+	Slapi_Filter *excludeChildFiltersFilter = 0;
 	char *buf = 0;
-	Slapi_RDN *rdn = 0;
-	char *str_rdn = 0;
-	Slapi_Filter *pCurrentFilter = 0;
 
 	/* create exclusion filter for one level searches
 	 * this requires the rdns of the grandchildren of
@@ -853,12 +846,14 @@ Slapi_Filter *views_cache_create_descendent_filter(viewEntry *ancestor, PRBool u
 	while(child_count < ancestor->child_count)
 	{
 		Slapi_Filter *pDescendentSubFilter = 0;
+/*
 		Slapi_RDN *rdn = 0;
 		char *str_rdn = 0;
+		int len = 0;
+*/
 		Slapi_Filter *pCurrentFilter = 0;
 		viewEntry *currentChild = ancestor->pChildren[child_count];
 		char *buf = 0;
-		int len = 0;
 
 		/* for each child we need to add its descendants
 		 * we do this now before processing this view
@@ -920,7 +915,9 @@ Slapi_Filter *views_cache_create_descendent_filter(viewEntry *ancestor, PRBool u
  */
 static void views_cache_create_inclusion_filter(viewEntry *pView)
 {
+#if 0
 	viewEntry *head = theCache.pCacheViews;
+#endif
 /*	viewEntry *current; */
 /*	Slapi_Filter *view_filter; */
 	char *view_filter_str;
@@ -950,7 +947,7 @@ static void views_cache_create_inclusion_filter(viewEntry *pView)
 		slapi_sdn_get_rdn(viewDN,viewRDN);
 		viewRDNstr = (char *)slapi_rdn_get_rdn(viewRDN);
 
-		buf = calloc(1, strlen(viewRDNstr) + 11 ); /* 3 for filter */
+		buf = slapi_ch_calloc(1, strlen(viewRDNstr) + 11 ); /* 3 for filter */
 		sprintf(buf, "(%s)", viewRDNstr );
 		viewSubFilter = slapi_str2filter( buf );
 		
@@ -1050,8 +1047,6 @@ static int views_cache_build_view_list(viewEntry **pViews)
 	char *attrs[2];
 	int suffixIndex = 0;
 	int valIndex = 0;
-	int cos_def_available = 0;
-	static int firstTime = 1;
 
 	slapi_log_error(SLAPI_LOG_TRACE, VIEWS_PLUGIN_SUBSYSTEM, "--> views_cache_build_view_list\n");
 
@@ -1141,7 +1136,6 @@ struct dn_views_info {
 
 static int	views_dn_views_cb (Slapi_Entry* e, void *callback_data) {
 	struct dn_views_info *info;
-	char *filter = 0;
 	char *pDn = 0;
 	struct berval **dnVals;
 	Slapi_Attr *dnAttr;
diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c
index 320bf2a0..0d4f7853 100644
--- a/ldap/servers/slapd/add.c
+++ b/ldap/servers/slapd/add.c
@@ -110,7 +110,6 @@ do_add( Slapi_PBlock *pb )
 		if ( !normtype || !*normtype ) {
 			rc = LDAP_INVALID_SYNTAX;
 			PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
-			ebuf[BUFSIZ-1] = '\0';
 			op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), ebuf);
 			send_ldap_result( pb, rc, NULL, ebuf, 0, NULL );
 			free( type );
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index 0e07fa1d..112d5caf 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -245,9 +245,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
 				char	*normalized_options;
 
 				normalized_options = attr_syntax_normalize_no_lookup( attroptions );
-				a->a_type = slapi_ch_malloc( strlen(asi->asi_name)
-						+ strlen(normalized_options) +1 );
-				sprintf( a->a_type, "%s%s", asi->asi_name, normalized_options );
+				a->a_type = slapi_ch_smprintf("%s%s", asi->asi_name, normalized_options );
 				slapi_ch_free_string( &normalized_options );
 			}
 		}
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 92643cf9..2b0828d4 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -267,7 +267,7 @@ client_auth_init ()
     	*val = '\0';
     } 
 
-    strcpy(netsite_root, instancedir);
+    PL_strncpyz(netsite_root, instancedir, MAXPATHLEN);
     slapi_ch_free_string(&instancedir);
     filename = PR_smprintf("%s%s", netsite_root, client_auth_config_file);
 
diff --git a/ldap/servers/slapd/back-ldbm/archive.c b/ldap/servers/slapd/back-ldbm/archive.c
index 58460a84..e3eb0152 100644
--- a/ldap/servers/slapd/back-ldbm/archive.c
+++ b/ldap/servers/slapd/back-ldbm/archive.c
@@ -165,9 +165,7 @@ int ldbm_back_archive2ldbm( Slapi_PBlock *pb )
                 c = *p;
                 *p = '\0';
             }
-            bakup_dir = (char *)slapi_ch_malloc(strlen(directory) + 
-                                                 sizeof("tmp") + 13);
-            sprintf(bakup_dir, "%s%ctmp_%010d", directory, c, time(0));
+            bakup_dir = slapi_ch_smprintf("%s%ctmp_%010d", directory, c, time(0));
             LDAPDebug( LDAP_DEBUG_ANY,
                       "archive2db: backup dir: %s\n", bakup_dir, 0, 0);
             *p = c;
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 9d4aa094..34bb51ba 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -544,6 +544,7 @@ static void dblayer_select_ncache(size_t cachesize, int *ncachep)
    the maximum chunk size, then we should use that instead.
    For now we just guess in dblayer_pick_ncache().
  */
+#if 0
 static void dblayer_get_ncache(size_t cachesize, int *ncachep)
 {
     int myncache;
@@ -597,6 +598,7 @@ cleanup:
     slapi_ch_free((void **)&head);
     return;
 }
+#endif
 
 static void dblayer_init_dbenv(DB_ENV *pEnv, dblayer_private *priv)
 {
@@ -921,7 +923,7 @@ static int dblayer_grok_directory(char *directory, int flags)
         {
             break;
         }
-        sprintf(filename,"%s/%s",directory,direntry->name);
+        PR_snprintf(filename, MAXPATHLEN, "%s/%s",directory,direntry->name);
         
         /* Right now this is set up to only look at files here. 
          * With multiple instances of the backend the are now other directories
@@ -1003,7 +1005,7 @@ dblayer_inst_exists(ldbm_instance *inst, char *dbname)
         dbnamep = dbname;
     else
         dbnamep = ID2ENTRY LDBM_FILENAME_SUFFIX;
-    sprintf(id2entry_file, "%s%c%s%c%s", parent_dir, sep, inst->inst_dir_name,
+    PR_snprintf(id2entry_file, sizeof(id2entry_file), "%s%c%s%c%s", parent_dir, sep, inst->inst_dir_name,
                                          sep, dbnamep);
     prst = PR_Access(id2entry_file, PR_ACCESS_EXISTS);
     if (PR_SUCCESS == prst)
@@ -1014,7 +1016,6 @@ dblayer_inst_exists(ldbm_instance *inst, char *dbname)
 /*
  * create a new DB_ENV and fill it with the goodies from dblayer_private
  */
-#define INIT_MAX_DIRS 32
 static int 
 dblayer_make_env(struct dblayer_private_env **env, struct ldbminfo *li)
 {
@@ -1022,7 +1023,6 @@ dblayer_make_env(struct dblayer_private_env **env, struct ldbminfo *li)
     struct dblayer_private_env *pEnv;
     char *home_dir = NULL;
     int ret;
-    int data_dirs = INIT_MAX_DIRS;
     Object *inst_obj;
     ldbm_instance *inst = NULL;
 
@@ -1753,9 +1753,7 @@ int dblayer_instance_start(backend *be, int mode)
         char *subname;
         struct dblayer_private_env *mypEnv;
 
-        id2entry_file = slapi_ch_malloc(strlen(inst->inst_dir_name) +
-                                     strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2);
-        sprintf(id2entry_file, "%s/%s", inst->inst_dir_name, 
+        id2entry_file = slapi_ch_smprintf("%s/%s", inst->inst_dir_name, 
                 ID2ENTRY LDBM_FILENAME_SUFFIX);
 
         open_flags = DB_CREATE | DB_THREAD;
@@ -1877,13 +1875,9 @@ int dblayer_instance_start(backend *be, int mode)
             !dblayer_inst_exists(inst, NULL))
         {
             char *abs_id2entry_file = NULL;
-            int abs_len;
             /* create a file with abs path, then try again */
 
-            abs_len = strlen(inst_dirp) +
-                      strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2;
-            abs_id2entry_file = (char *)slapi_ch_malloc(abs_len);
-            sprintf(abs_id2entry_file, "%s%c%s", inst_dirp, 
+            abs_id2entry_file = slapi_ch_smprintf( "%s%c%s", inst_dirp, 
                     get_sep(inst_dirp), ID2ENTRY LDBM_FILENAME_SUFFIX);
             DB_OPEN(mypEnv->dblayer_openflags,
                 dbp, NULL/* txnid */, abs_id2entry_file, subname, DB_BTREE,
@@ -2054,8 +2048,7 @@ int dblayer_get_aux_id2entry(backend *be, DB **ppDB, DB_ENV **ppEnv)
 
     inst_dirp = dblayer_get_full_inst_dir(li, inst, inst_dir, MAXPATHLEN);
     priv->dblayer_home_directory =
-            slapi_ch_malloc(strlen(inst_dirp) + strlen("dbenv") + 2);
-    sprintf(priv->dblayer_home_directory, "%s/dbenv", inst_dirp);
+            slapi_ch_smprintf("%s/dbenv", inst_dirp);
     priv->dblayer_log_directory = slapi_ch_strdup(priv->dblayer_home_directory);
 
     prst = PR_GetFileInfo(inst_dirp, &prfinfo);
@@ -2126,9 +2119,7 @@ int dblayer_get_aux_id2entry(backend *be, DB **ppDB, DB_ENV **ppEnv)
         goto err;
     }
 
-    id2entry_file = slapi_ch_malloc(strlen(inst->inst_dir_name) +
-                                     strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2);
-    sprintf(id2entry_file, "%s/%s",
+    id2entry_file = slapi_ch_smprintf("%s/%s",
         inst->inst_dir_name, ID2ENTRY LDBM_FILENAME_SUFFIX);
 
     PR_ASSERT(dblayer_inst_exists(inst, NULL));
@@ -2183,16 +2174,17 @@ int dblayer_release_aux_id2entry(backend *be, DB *pDB, DB_ENV *pEnv)
 
     inst_dirp = dblayer_get_full_inst_dir(inst->inst_li, inst,
                                           inst_dir, MAXPATHLEN);
-    envdir = slapi_ch_malloc(strlen(inst_dirp) + strlen("dbenv") + 2);
-    sprintf(envdir, "%s/dbenv", inst_dirp);
+    envdir = slapi_ch_smprintf("%s/dbenv", inst_dirp);
 
 done:
     if (pDB)
        pDB->close(pDB, 0);
     if (pEnv)
        pEnv->close(pEnv, 0);
-    if (envdir)
+    if (envdir) {
         ldbm_delete_dirs(envdir);
+		slapi_ch_free_string(&envdir);
+	}
     if (inst_dirp != inst_dir)
         slapi_ch_free_string(&inst_dirp);
     return 0;
@@ -2462,7 +2454,6 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
     char *rel_path = NULL;
     dblayer_private_env *pENV = 0;
     dblayer_private *priv = NULL;
-    int len;
     int return_value = 0;
     DB *dbp = NULL;
     char *subname = NULL;
@@ -2491,18 +2482,14 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
             return -1;
         }
     }
-    len = strlen(indexname) + strlen(LDBM_FILENAME_SUFFIX) + 1;
-    file_name = slapi_ch_malloc(len);
-    len += strlen(inst->inst_dir_name) + 1;
-    rel_path = slapi_ch_malloc(len);
 
     pENV = priv->dblayer_env;
     if (inst->import_env)
         pENV = inst->import_env;
 
     PR_ASSERT(NULL != pENV);
-    sprintf(file_name, "%s%s", indexname, LDBM_FILENAME_SUFFIX);
-    sprintf(rel_path, "%s/%s", inst->inst_dir_name, file_name);
+    file_name = slapi_ch_smprintf("%s%s", indexname, LDBM_FILENAME_SUFFIX);
+    rel_path = slapi_ch_smprintf("%s/%s", inst->inst_dir_name, file_name);
 
     open_flags = DB_THREAD;
     if (open_flag & DBOPEN_CREATE)
@@ -2582,13 +2569,10 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
         char inst_dir[MAXPATHLEN];
         char *inst_dirp = NULL;
         char *abs_file_name = NULL;
-        int abs_len;
         /* create a file with abs path, then try again */
 
         inst_dirp = dblayer_get_full_inst_dir(li, inst, inst_dir, MAXPATHLEN);
-        abs_len = strlen(inst_dirp) + strlen(file_name) + 2;
-        abs_file_name = (char *)slapi_ch_malloc(abs_len);
-        sprintf(abs_file_name, "%s%c%s",
+        abs_file_name = slapi_ch_smprintf("%s%c%s",
                 inst_dirp, get_sep(inst_dirp), file_name);
         DB_OPEN(pENV->dblayer_openflags,
                 dbp, NULL/* txnid */, abs_file_name, subname, DB_BTREE,
@@ -3476,14 +3460,14 @@ static int checkpoint_threadmain(void *param)
                 /* zap 'em ! */
                 for (listp = list; *listp != NULL; ++listp)
                 {    
-                    sprintf(filename,"%s/%s",prefix,*listp);
+                    PR_snprintf(filename,sizeof(filename),"%s/%s",prefix,*listp);
                     if (priv->dblayer_circular_logging) {
                         checkpoint_debug_message(debug_checkpointing,
                             "Deleting %s\n",filename, 0, 0);
                         unlink(filename);    
                     } else {
                         char new_filename[MAXPATHLEN];
-                        sprintf(new_filename,"%s/old.%s",
+                        PR_snprintf(new_filename,sizeof(new_filename),"%s/old.%s",
                                 prefix,*listp);
                         checkpoint_debug_message(debug_checkpointing,
                             "Renaming %s\n",filename,0, 0);
@@ -3760,7 +3744,7 @@ static int commit_good_database(dblayer_private *priv)
     int return_value = 0;
     int num_bytes;
 
-    sprintf(filename,"%s/guardian",priv->dblayer_home_directory);
+    PR_snprintf(filename,sizeof(filename), "%s/guardian",priv->dblayer_home_directory);
 
     prfd = PR_Open(filename, PR_RDWR | PR_CREATE_FILE | PR_TRUNCATE,
         priv->dblayer_file_mode );
@@ -3770,7 +3754,7 @@ static int commit_good_database(dblayer_private *priv)
             filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
         return -1;
     } 
-    sprintf(line,"cachesize:%lu\nncache:%d\nversion:%d\n",
+    PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
             priv->dblayer_cachesize, priv->dblayer_ncache, 3);
     num_bytes = strlen(line);
     return_value = slapi_write_buffer(prfd, line, num_bytes);
@@ -3814,7 +3798,7 @@ static int read_metadata(struct ldbminfo *li)
     priv->dblayer_previous_cachesize = 0;
     priv->dblayer_previous_ncache = 0;
     /* Open the guard file and read stuff, then delete it */
-    sprintf(filename,"%s/guardian",priv->dblayer_home_directory);
+    PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
 
     memset(&prfinfo, '\0', sizeof(PRFileInfo));
     (void)PR_GetFileInfo(filename, &prfinfo);
@@ -4042,7 +4026,7 @@ static int _dblayer_delete_instance_dir(ldbm_instance *inst, int startdb)
                                           PR_SKIP_DOT_DOT))) {
         if (! direntry->name)
             break;
-        sprintf(filename, "%s/%s", inst_dirp, direntry->name);
+        PR_snprintf(filename, MAXPATHLEN, "%s/%s", inst_dirp, direntry->name);
         if (pEnv &&
             strcmp(LDBM_FILENAME_SUFFIX , last_four_chars(direntry->name)) == 0)
         {
@@ -4153,7 +4137,7 @@ int dblayer_delete_database_ex(struct ldbminfo *li, char *instance)
         if (! direntry->name)
             break;
 
-		sprintf(filename, "%s/%s", priv->dblayer_home_directory, 
+		PR_snprintf(filename, MAXPATHLEN, "%s/%s", priv->dblayer_home_directory, 
 			direntry->name);
 
 		/* Do not call PR_Delete on the instance directories if they exist.
@@ -4244,7 +4228,7 @@ int dblayer_database_size(struct ldbminfo *li, unsigned int *size)
             {
                 break;
             }
-            sprintf(filename,"%s/%s",priv->dblayer_home_directory,direntry->name);
+            PR_snprintf(filename,MAXPATHLEN, "%s/%s",priv->dblayer_home_directory,direntry->name);
             return_value = PR_GetFileInfo(filename, &info);
             if (PR_SUCCESS == return_value)
             {
@@ -4292,9 +4276,7 @@ static int count_dbfiles_in_dir(char *directory, int *count, int recurse)
             if (NULL == direntry->name) {
                 break;
             }
-            direntry_name = slapi_ch_malloc(strlen(directory) +
-                                            strlen(direntry->name) + 2);
-            sprintf(direntry_name, "%s/%s", directory, direntry->name);
+            direntry_name = PR_smprintf("%s/%s", directory, direntry->name);
             if ((PR_GetFileInfo(direntry_name, &info) == PR_SUCCESS) &&
                 (PR_FILE_DIRECTORY == info.type) && recurse) {
                 /* Recurse into this directory but not any further.  This is
@@ -4303,7 +4285,9 @@ static int count_dbfiles_in_dir(char *directory, int *count, int recurse)
                  * not be any more directories in an instance directory. */
                 count_dbfiles_in_dir(direntry_name, count, 0 /* don't recurse */);
             }
-            slapi_ch_free((void**)&direntry_name);
+			if (direntry_name) {
+				PR_smprintf_free(direntry_name);
+			}
             if (strcmp( LDBM_FILENAME_SUFFIX , last_four_chars(direntry->name)) == 0) {
                 (*count)++;
             }
@@ -4481,8 +4465,7 @@ int dblayer_copy_directory(struct ldbminfo *li,
         sep = get_sep(inst_dirp);
         if (*(inst_dirp+len-1) == sep)
             sep = '\0';
-        new_src_dir = (char *)slapi_ch_malloc(strlen(src_dir) + len + 2);
-        sprintf(new_src_dir, "%s%c%s", inst_dirp, sep, src_dir);
+        new_src_dir = slapi_ch_smprintf("%s%c%s", inst_dirp, sep, src_dir);
     }
 
     dirhandle = PR_OpenDir(new_src_dir);
@@ -4529,14 +4512,11 @@ int dblayer_copy_directory(struct ldbminfo *li,
                     mysep = get_sep(prefix);
                 }
 
-                new_dest_dir = slapi_ch_malloc(strlen(dest_dir) +
-                                   strlen(relative_instance_name) + 
-                                   strlen(prefix) + 3);
                 if (mysep)
-                    sprintf(new_dest_dir, "%s%c%s%c%s",
+                    new_dest_dir = slapi_ch_smprintf("%s%c%s%c%s",
                         prefix, mysep, dest_dir, mysep, relative_instance_name);
                 else
-                    sprintf(new_dest_dir, "%s/%s",
+                    new_dest_dir = slapi_ch_smprintf("%s/%s",
                         dest_dir, relative_instance_name);
                 /* } */
                 if (PR_SUCCESS == PR_GetFileInfo(new_dest_dir, &info))
@@ -4553,12 +4533,8 @@ int dblayer_copy_directory(struct ldbminfo *li,
                 }
             }
 
-            filename1 = slapi_ch_malloc(strlen(new_src_dir) +
-                                        strlen(direntry->name) + 2);
-            sprintf(filename1, "%s/%s", new_src_dir, direntry->name);
-            filename2 = slapi_ch_malloc(strlen(new_dest_dir) +
-                                        strlen(direntry->name) + 2);
-            sprintf(filename2, "%s/%s", new_dest_dir, direntry->name);
+            filename1 = slapi_ch_smprintf("%s/%s", new_src_dir, direntry->name);
+            filename2 = slapi_ch_smprintf("%s/%s", new_dest_dir, direntry->name);
 
             if (restore) {
                 LDAPDebug(LDAP_DEBUG_ANY, "Restoring file %d (%s)\n",
@@ -4763,6 +4739,7 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
             }
 
             if (ok) {
+				size_t p1len, p2len;
                 char **listptr;
                 
                 prefix = NULL;
@@ -4773,14 +4750,14 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
                     prefix = home_dir;
                 }
                 /* log files have the same filename len(100 is a safety net:) */
-                pathname1 = (char *)slapi_ch_malloc(strlen(prefix) +
-                    strlen(*listB) + 100);
-                pathname2 = (char *)slapi_ch_malloc(strlen(dest_dir) +
-                    strlen(*listB) + 100);
+				p1len = strlen(prefix) + strlen(*listB) + 100;
+                pathname1 = (char *)slapi_ch_malloc(p1len);
+				p2len = strlen(dest_dir) + strlen(*listB) + 100;
+                pathname2 = (char *)slapi_ch_malloc(p2len);
                 /* We copy those over */
                 for (listptr = listB; (*listptr) && ok; ++listptr) {
-                    sprintf(pathname1, "%s/%s", prefix, *listptr);
-                    sprintf(pathname2, "%s/%s", dest_dir, *listptr);
+                    PR_snprintf(pathname1, p1len, "%s/%s", prefix, *listptr);
+                    PR_snprintf(pathname2, p2len, "%s/%s", dest_dir, *listptr);
                     LDAPDebug(LDAP_DEBUG_ANY, "Backing up file %d (%s)\n",
                         cnt, pathname2, 0);
                     if (task)
@@ -4831,12 +4808,8 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
     }
 
     /* now copy the version file */
-    pathname1 = (char *)slapi_ch_malloc(strlen(home_dir) +
-                                        strlen(DBVERSION_FILENAME) + 2);
-    pathname2 = (char *)slapi_ch_malloc(strlen(dest_dir) +
-                                        strlen(DBVERSION_FILENAME) + 2);
-    sprintf(pathname1, "%s/%s", home_dir, DBVERSION_FILENAME);
-    sprintf(pathname2, "%s/%s", dest_dir, DBVERSION_FILENAME);
+    pathname1 = slapi_ch_smprintf("%s/%s", home_dir, DBVERSION_FILENAME);
+    pathname2 = slapi_ch_smprintf("%s/%s", dest_dir, DBVERSION_FILENAME);
     LDAPDebug(LDAP_DEBUG_ANY, "Backing up file %d (%s)\n",
               cnt, pathname2, 0);
     if (task) {
@@ -4914,7 +4887,7 @@ int dblayer_delete_transaction_logs(const char * log_dir)
                 PR_GetError(),slapd_pr_strerror(PR_GetError()), 0);
                 break;
             }
-            sprintf(filename1, "%s/%s", log_dir, direntry->name);
+            PR_snprintf(filename1, MAXPATHLEN, "%s/%s", log_dir, direntry->name);
             pre = PR_GetFileInfo(filename1, &info);
             if (pre == PR_SUCCESS && PR_FILE_DIRECTORY == info.type) {
                 continue;
@@ -4981,8 +4954,8 @@ static int dblayer_copy_dirand_contents(char* src_dir, char* dst_dir, int mode,
       }
 
 
-       sprintf(filename1, "%s/%s", src_dir, direntry->name);
-       sprintf(filename2, "%s/%s", dst_dir, direntry->name);
+       PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
+       PR_snprintf(filename2, MAXPATHLEN, "%s/%s", dst_dir, direntry->name);
        LDAPDebug(LDAP_DEBUG_ANY, "Moving file %s\n",
                           filename2, 0, 0);
       /* Is this entry a directory? */
@@ -5040,7 +5013,7 @@ static int dblayer_fri_trim(char *fri_dir_path, char* bename)
 			break;
 			}
 
-			sprintf(filename, "%s/%s", fri_dir_path, direntry->name);
+			PR_snprintf(filename, MAXPATHLEN, "%s/%s", fri_dir_path, direntry->name);
 
 			/* Is this entry a directory? */
 			tmp_rval = PR_GetFileInfo(filename, &info);
@@ -5092,7 +5065,6 @@ error:
 static int dblayer_fri_restore(char *home_dir, char *src_dir, dblayer_private *priv, Slapi_Task *task, char** new_src_dir, char* bename)
 {
 		int retval = 0;
-		size_t fribak_dir_length = 0;
 		char *fribak_dir_path = NULL;
 		char *fribak_dir_name = "fribak";
 		int mode = priv->dblayer_file_mode;
@@ -5101,9 +5073,7 @@ static int dblayer_fri_restore(char *home_dir, char *src_dir, dblayer_private *p
 
 
 		/* First create the recovery directory */
-		fribak_dir_length = strlen(home_dir) + strlen(fribak_dir_name) + 4; /* 4 for the '/../' */
-		fribak_dir_path = (char *) slapi_ch_malloc(fribak_dir_length + 1); /* add one for the terminator */		
-		sprintf(fribak_dir_path,"%s/../%s",home_dir,fribak_dir_name);
+		fribak_dir_path = slapi_ch_smprintf("%s/../%s",home_dir,fribak_dir_name);
 		if((-1 == PR_MkDir(fribak_dir_path,NEWDIR_MODE)))
 		{
 		  LDAPDebug(LDAP_DEBUG_ANY, "dblayer_fri_restore: %s exists\n",fribak_dir_path, 0, 0);
@@ -5220,7 +5190,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
     	while ((direntry = PR_ReadDir(dirhandle, PR_SKIP_DOT | PR_SKIP_DOT_DOT))
 			&& direntry->name)
 		{
-            sprintf(filename1, "%s/%s", src_dir, direntry->name);
+            PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
 			if(!frirestore || strcmp(direntry->name,bename)==0)
 			{
                 tmp_rval = PR_GetFileInfo(filename1, &info);
@@ -5285,7 +5255,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
 
 
                 /* Is this entry a directory? */
-                sprintf(filename1, "%s/%s", real_src_dir, direntry->name);
+                PR_snprintf(filename1, MAXPATHLEN, "%s/%s", real_src_dir, direntry->name);
                 tmp_rval = PR_GetFileInfo(filename1, &info);
                 if (tmp_rval == PR_SUCCESS && PR_FILE_DIRECTORY == info.type) {
                     /* This is an instance directory. It contains the *.db#
@@ -5334,8 +5304,8 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
                     prefix = home_dir;
                 }
                 mkdir_p(prefix, 0700);
-                sprintf(filename1, "%s/%s", real_src_dir, direntry->name);
-                sprintf(filename2, "%s/%s", prefix, direntry->name);
+                PR_snprintf(filename1, MAXPATHLEN, "%s/%s", real_src_dir, direntry->name);
+                PR_snprintf(filename2, MAXPATHLEN, "%s/%s", prefix, direntry->name);
                 LDAPDebug(LDAP_DEBUG_ANY, "Restoring file %d (%s)\n",
                           cnt, filename2, 0);
                 if (task) {
@@ -5454,20 +5424,6 @@ error_out:
     return return_value;
 }
 
-
-static char *dblayer_make_friendly_instance_name(ldbm_instance *inst)
-{
-    char *name = slapi_ch_strdup(inst->inst_name);
-    int x;
-
-    if (name == NULL)
-        return NULL;
-    for (x = 0; name[x]; x++)
-        if (name[x] == ' ')
-            name[x] = '_';
-    return name;
-}
-
 /*
  * inst_dir_name is a relative path  (from 6.21)
  *     ==> txn log stores relative paths and becomes relocatable
@@ -5479,7 +5435,6 @@ static char *dblayer_make_friendly_instance_name(ldbm_instance *inst)
  */
 int dblayer_get_instance_data_dir(backend *be)
 {
-    struct ldbminfo *li = (struct ldbminfo *)be->be_database->plg_private;
     ldbm_instance *inst = (ldbm_instance *)be->be_instance_info;
     char *full_namep = NULL;
     char full_name[MAXPATHLEN];
@@ -5582,9 +5537,7 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
          a = (struct attrinfo *)avl_getnext())
     {
         PRFileInfo info;
-        ofile = slapi_ch_malloc(strlen(inst_dirp) +
-                                strlen(a->ai_type) + strlen(oldext) + 2);
-        sprintf(ofile, "%s/%s%s", inst_dirp, a->ai_type, oldext);
+        ofile = slapi_ch_smprintf("%s/%s%s", inst_dirp, a->ai_type, oldext);
 
         if (PR_GetFileInfo(ofile, &info) != PR_SUCCESS)
         {
@@ -5600,9 +5553,7 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
                     rval, dblayer_strerror(rval), 0);
             goto done;
         }
-        nfile = slapi_ch_malloc(strlen(inst_dirp) +
-                                strlen(a->ai_type) + strlen(newext) + 2);
-        sprintf(nfile, "%s/%s%s", inst_dirp, a->ai_type, newext);
+        nfile = slapi_ch_smprintf("%s/%s%s", inst_dirp, a->ai_type, newext);
         LDAPDebug(LDAP_DEBUG_TRACE, "update_db_ext: rename %s -> %s\n",
             ofile, nfile, 0);
 
@@ -5628,12 +5579,8 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
                     rval, dblayer_strerror(rval), 0);
         goto done;
     }
-    ofile = slapi_ch_malloc(strlen(inst_dirp) +
-                            strlen(ID2ENTRY) + strlen(oldext) + 2);
-    nfile = slapi_ch_malloc(strlen(inst_dirp) +
-                            strlen(ID2ENTRY) + strlen(newext) + 2);
-    sprintf(ofile, "%s/%s%s", inst_dirp, ID2ENTRY, oldext);
-    sprintf(nfile, "%s/%s%s", inst_dirp, ID2ENTRY, newext);
+    ofile = slapi_ch_smprintf("%s/%s%s", inst_dirp, ID2ENTRY, oldext);
+    nfile = slapi_ch_smprintf("%s/%s%s", inst_dirp, ID2ENTRY, newext);
     LDAPDebug(LDAP_DEBUG_TRACE, "update_db_ext: rename %s -> %s\n",
             ofile, nfile, 0);
     rval = thisdb->rename(thisdb, (const char *)ofile, NULL /* subdb */,
diff --git a/ldap/servers/slapd/back-ldbm/dbversion.c b/ldap/servers/slapd/back-ldbm/dbversion.c
index 5b8bbe9a..3dccb36d 100644
--- a/ldap/servers/slapd/back-ldbm/dbversion.c
+++ b/ldap/servers/slapd/back-ldbm/dbversion.c
@@ -13,18 +13,18 @@ mk_dbversion_fullpath(struct ldbminfo *li, const char *directory, char *filename
     {
         if (is_fullpath((char *)directory))
         {
-            sprintf(filename, "%s/%s", directory, DBVERSION_FILENAME);
+            PR_snprintf(filename, MAXPATHLEN*2, "%s/%s", directory, DBVERSION_FILENAME);
         }
         else
         {
             char *home_dir = dblayer_get_home_dir(li, NULL);
             /* if relpath, nsslapd-dbhome_directory should be set */
-            sprintf(filename,"%s/%s/%s", home_dir,directory,DBVERSION_FILENAME);
+            PR_snprintf(filename, MAXPATHLEN*2,"%s/%s/%s", home_dir,directory,DBVERSION_FILENAME);
         }
     }
     else
     {
-        sprintf(filename, "%s/%s", directory, DBVERSION_FILENAME);
+        PR_snprintf(filename, MAXPATHLEN*2, "%s/%s", directory, DBVERSION_FILENAME);
     }
 }
 
diff --git a/ldap/servers/slapd/back-ldbm/id2entry.c b/ldap/servers/slapd/back-ldbm/id2entry.c
index 9b53c4af..c63d6550 100644
--- a/ldap/servers/slapd/back-ldbm/id2entry.c
+++ b/ldap/servers/slapd/back-ldbm/id2entry.c
@@ -13,7 +13,6 @@
 int
 id2entry_add_ext( backend *be, struct backentry *e, back_txn *txn, int encrypt  )
 {
-    struct ldbminfo *li = (struct ldbminfo *) be->be_database->plg_private;
     ldbm_instance *inst = (ldbm_instance *) be->be_instance_info;
     DB     *db = NULL;
     DB_TXN *db_txn = NULL;
@@ -137,7 +136,6 @@ id2entry_delete( backend *be, struct backentry *e, back_txn *txn )
 struct backentry *
 id2entry( backend *be, ID id, back_txn *txn, int *err  )
 {
-    struct ldbminfo  *li = (struct ldbminfo *) be->be_database->plg_private;
     ldbm_instance    *inst = (ldbm_instance *) be->be_instance_info;
     DB               *db = NULL;
     DB_TXN           *db_txn = NULL;
diff --git a/ldap/servers/slapd/back-ldbm/import-merge.c b/ldap/servers/slapd/back-ldbm/import-merge.c
index fcffde31..61414604 100644
--- a/ldap/servers/slapd/back-ldbm/import-merge.c
+++ b/ldap/servers/slapd/back-ldbm/import-merge.c
@@ -277,16 +277,13 @@ static int import_count_merge_input_files(ldbm_instance *inst,
 
     for (i = 0; i < passes; i++) {
 	int fd;
-	char *filename = NULL;
-	size_t filename_length = strlen(inst->inst_dir_name) + 1 + 
-	    strlen(indexname) + 10 ;
+	char *filename = slapi_ch_smprintf("%s/%s.%d%s", inst->inst_dir_name, indexname, i+1,
+		LDBM_FILENAME_SUFFIX);
 
-	filename = slapi_ch_malloc(filename_length);
 	if (NULL == filename) {
 	    return -1;
 	}
-	sprintf(filename, "%s/%s.%d%s", inst->inst_dir_name, indexname, i+1,
-		LDBM_FILENAME_SUFFIX);
+
 	fd = dblayer_open_huge_file(filename, O_RDONLY, 0);
 	slapi_ch_free( (void**)&filename);
 	if (fd >= 0) {
@@ -320,14 +317,11 @@ static int import_open_merge_input_files(backend *be, char *indexname,
     }
     for (i = 0; i < passes; i++) {
 	DB *pDB = NULL;
-	char *filename = NULL;
-	size_t filename_length = strlen(indexname) + 10 ;
+	char *filename = slapi_ch_smprintf("%s.%d", indexname, i+1);
 
-	filename = slapi_ch_malloc(filename_length);
 	if (NULL == filename) {
 	    return -1;
 	}
-	sprintf(filename,"%s.%d", indexname, i+1);
 
 	if (vlv_isvlv(filename)) {
 		ret = dblayer_open_file(be, filename, 0, INDEX_VLV, &pDB);
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index 76de92c2..489668b7 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -252,7 +252,7 @@ import_get_version(char *str)
 		my_version = atoi(valuecharptr);
 		*(str + offset) = '#';
 		/* the memory below was not allocated by the slapi_ch_ functions */
-		if (errmsg) slapi_ch_free((void **) &errmsg);
+		if (errmsg) PR_smprintf_free(errmsg);
 		if (retmalloc) slapi_ch_free((void **) &valuecharptr);
 		break;
 	    } 
@@ -1736,8 +1736,7 @@ dse_conf_backup_core(struct ldbminfo *li, char *dest_dir, char *file_name, char
     }
     else
     {
-        filename = (char *)slapi_ch_malloc(strlen(file_name) + dlen + 2);
-        sprintf(filename, "%s/%s", dest_dir, file_name);
+        filename = slapi_ch_smprintf("%s/%s", dest_dir, file_name);
     }
     LDAPDebug(LDAP_DEBUG_TRACE, "dse_conf_backup(%s): backup file %s\n",
               filter, filename, 0);
@@ -1896,8 +1895,7 @@ dse_conf_verify_core(struct ldbminfo *li, char *src_dir, char *file_name, char *
     Slapi_Entry **curr_entries = NULL;
     Slapi_PBlock srch_pb;
     
-    filename = (char *)slapi_ch_malloc(strlen(file_name) + strlen(src_dir) + 2);
-    sprintf(filename, "%s/%s", src_dir, file_name);
+    filename = slapi_ch_smprintf("%s/%s", src_dir, file_name);
 
     if (PR_SUCCESS != PR_Access(filename, PR_ACCESS_READ_OK))
     {
@@ -1961,10 +1959,7 @@ dse_conf_verify_core(struct ldbminfo *li, char *src_dir, char *file_name, char *
 
 	if (entry_filter != NULL)
 	{ /* Single instance restoration */
-		int mylen = 0;
-		mylen = strlen(entry_filter) + strlen(li->li_plugin->plg_dn) + 2;
-        search_scope = slapi_ch_malloc(mylen);
-		sprintf(search_scope, "%s,%s", entry_filter, li->li_plugin->plg_dn);
+        search_scope = slapi_ch_smprintf("%s,%s", entry_filter, li->li_plugin->plg_dn);
 	} else { /* Normal restoration */
         search_scope = slapi_ch_strdup(li->li_plugin->plg_dn);
 	}
@@ -1993,8 +1988,7 @@ out:
 
     slapi_ch_free_string(&filename);
 
-	if (search_scope)
-		slapi_ch_free(&search_scope);
+	slapi_ch_free_string(&search_scope);
 
 
     if (fd > 0)
@@ -2012,17 +2006,11 @@ dse_conf_verify(struct ldbminfo *li, char *src_dir, char *bename)
 	
 	if (bename != NULL) /* This was a restore of a single backend */
 	{
-		int mylen = 0;
 		/* Entry filter string */
-		mylen = strlen(bename) + strlen("cn=") + 2;
-        entry_filter = slapi_ch_malloc(mylen);
-		sprintf(entry_filter, "cn=%s", bename);
+        entry_filter = slapi_ch_smprintf("cn=%s", bename);
 
-		mylen = 0;
 		/* Instance search filter */
-		mylen = strlen(DSE_INSTANCE_FILTER) + strlen(bename) + strlen("(&(cn=))") + 2;
-        instance_entry_filter = slapi_ch_malloc(mylen);
-		sprintf(instance_entry_filter, "(&%s(cn=%s))", DSE_INSTANCE_FILTER, bename);
+        instance_entry_filter = slapi_ch_smprintf("(&%s(cn=%s))", DSE_INSTANCE_FILTER, bename);
 	} else {
 	    instance_entry_filter = slapi_ch_strdup(DSE_INSTANCE_FILTER);
 	}
@@ -2032,10 +2020,8 @@ dse_conf_verify(struct ldbminfo *li, char *src_dir, char *bename)
     rval += dse_conf_verify_core(li, src_dir, DSE_INDEX, DSE_INDEX_FILTER,
                 "Index Config", entry_filter);
 
-	if (entry_filter)
-		slapi_ch_free(&entry_filter);
-	if (instance_entry_filter)
-		slapi_ch_free(&instance_entry_filter);
+	slapi_ch_free_string(&entry_filter);
+	slapi_ch_free_string(&instance_entry_filter);
 
     return rval;
 }
diff --git a/ldap/servers/slapd/back-ldbm/import.c b/ldap/servers/slapd/back-ldbm/import.c
index 0e5744b4..49d478a9 100644
--- a/ldap/servers/slapd/back-ldbm/import.c
+++ b/ldap/servers/slapd/back-ldbm/import.c
@@ -902,20 +902,14 @@ int import_make_merge_filenames(char *directory, char *indexname, int pass,
        and need to be renamed to: attributename<LDBM_FILENAME_SUFFIX>.n
        where n is the pass number.
        */
-    size_t oldname_length = strlen(directory) + 1 + strlen(indexname) + 
-    strlen(LDBM_FILENAME_SUFFIX) + 1 ;
-    /* Enough space for an 8-digit pass number */
-    size_t newname_length = oldname_length + 9;
-
-    *oldname = slapi_ch_malloc(oldname_length);
-    if (NULL == oldname)
-    return -1;
-    *newname = slapi_ch_malloc(newname_length);
-    if (NULL == newname)
-    return -1;
-    sprintf(*oldname, "%s/%s%s", directory, indexname, LDBM_FILENAME_SUFFIX);
-    sprintf(*newname, "%s/%s.%d%s", directory, indexname, pass,
+    *oldname = slapi_ch_smprintf("%s/%s%s", directory, indexname, LDBM_FILENAME_SUFFIX);
+    *newname = slapi_ch_smprintf("%s/%s.%d%s", directory, indexname, pass,
         LDBM_FILENAME_SUFFIX);
+	if (!*oldname || !*newname) {
+		slapi_ch_free_string(oldname);
+		slapi_ch_free_string(newname);
+		return -1;
+	}
     return 0;
 }
 
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index 5dc2bd2a..0b9bc3a5 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -23,8 +23,6 @@ valuearray_minus_valuearray(
     Slapi_Value **a, 
     Slapi_Value **b
 );
-static int index_addordel_values( backend *be, const char *type, struct berval **vals, struct berval **evals, ID id, int flags, back_txn *txn );
-static int index_addordel_values_ext( backend *be, const char *type, struct berval **vals, struct berval **evals, ID id, int flags, back_txn *txn,int *idl_disposition, void *buffer_handle );
 
 const char* indextype_PRESENCE = "pres";
 const char* indextype_EQUALITY = "eq";
@@ -1519,7 +1517,7 @@ index_addordel_values_ext_sv(
     char	*basetmp, *basetype;
     
     LDAPDebug( LDAP_DEBUG_TRACE,
-               "=> index_addordel_values( \"%s\", %lu )\n", type, (u_long)id, 0 );
+               "=> index_addordel_values_ext_sv( \"%s\", %lu )\n", type, (u_long)id, 0 );
 
     basetype = buf;
     if ( (basetmp = slapi_attr_basetype( type, buf, sizeof(buf) ))
@@ -1533,7 +1531,7 @@ index_addordel_values_ext_sv(
 		slapi_ch_free_string( &basetmp );
         return( 0 );
     }
-    LDAPDebug( LDAP_DEBUG_ARGS, "   index_addordel_values indexmask 0x%x\n",
+    LDAPDebug( LDAP_DEBUG_ARGS, "   index_addordel_values_ext_sv indexmask 0x%x\n",
                ai->ai_indexmask, 0, 0 );
     if ( (err = dblayer_get_index_file( be, ai, &db, DBOPEN_CREATE )) != 0 ) {
         LDAPDebug( LDAP_DEBUG_ANY,
@@ -1678,7 +1676,7 @@ index_addordel_values_ext_sv(
         slapi_ch_free( (void**)&basetmp );
     }
 
-    LDAPDebug (LDAP_DEBUG_TRACE, "<= index_addordel_values\n", 0, 0, 0 );
+    LDAPDebug (LDAP_DEBUG_TRACE, "<= index_addordel_values_ext_sv\n", 0, 0, 0 );
     return( 0 );
 
  bad:
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attr.c b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
index 657de14a..47586996 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attr.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
@@ -203,8 +203,7 @@ attr_index_config(
 				    if (!strcasecmp (index_rules[j], officialOID)) {
 					official_rules[k++] = slapi_ch_strdup (officialOID);
 				    } else {
-					char* preamble = slapi_ch_malloc (strlen (fname) + 30);
-					sprintf (preamble, "%s: line %d", fname, lineno);
+					char* preamble = slapi_ch_smprintf("%s: line %d", fname, lineno);
 					LDAPDebug (LDAP_DEBUG_ANY, "%s: use \"%s\" instead of \"%s\" (ignored)\n",
 						   preamble, officialOID, index_rules[j] );
 					slapi_ch_free((void**)&preamble);
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
index 8912aeec..01673b9e 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
@@ -107,14 +107,11 @@ attrcrypt_keymgmt_get_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECKEY
 	Slapi_Entry *entry = NULL;
 	char *dn_template = "cn=%s,cn=encrypted attribute keys,cn=%s,cn=ldbm database,cn=plugins,cn=config";
 	char *instance_name =  li->inst_name;
-	size_t dn_string_length = 0;
 	char *dn_string = NULL;
 	Slapi_Attr *keyattr = NULL;
 	
 	LDAPDebug(LDAP_DEBUG_TRACE,"-> attrcrypt_keymgmt_get_key\n", 0, 0, 0);
-	dn_string_length = strlen(dn_template) + strlen(instance_name) + strlen(acs->ace->cipher_display_name);
-	dn_string = slapi_ch_malloc(dn_string_length);
-	sprintf(dn_string, dn_template, acs->ace->cipher_display_name, instance_name);
+	dn_string = slapi_ch_smprintf(dn_template, acs->ace->cipher_display_name, instance_name);
 	/* Fetch the entry */
 	getConfigEntry(dn_string, &entry);
 	/* Did we find the entry ? */
@@ -136,6 +133,7 @@ attrcrypt_keymgmt_get_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECKEY
 	} else {
 		ret = -2; /* Means: we didn't find the entry (which happens if the key has never been generated) */	
 	}
+	slapi_ch_free_string(&dn_string);
 	LDAPDebug(LDAP_DEBUG_TRACE,"<- attrcrypt_keymgmt_get_key\n", 0, 0, 0);
 	return ret;
 }
@@ -162,10 +160,7 @@ attrcrypt_keymgmt_store_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECK
     			"objectclass:extensibleObject\n"
     			"cn:%s\n";
 		char *instance_name =  li->inst_name;
-		char *entry_string = NULL;
-		size_t entry_string_length = strlen(entry_template) + strlen(instance_name) + (strlen(acs->ace->cipher_display_name)*2);
-		entry_string = slapi_ch_malloc(entry_string_length);
-		sprintf(entry_string, entry_template,acs->ace->cipher_display_name,instance_name,acs->ace->cipher_display_name);
+		char *entry_string = slapi_ch_smprintf(entry_template,acs->ace->cipher_display_name,instance_name,acs->ace->cipher_display_name);
 		e = slapi_str2entry(entry_string, 0);
 		/* Add the key as a binary attribute */
 		key_as_berval.bv_val = wrapped_symmetric_key.data;
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
index 8d08178e..dc8b91af 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
@@ -166,7 +166,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb, Slapi_Entry* e, Sl
         ret = SLAPI_DSE_CALLBACK_ERROR;
     }
 	if (attribute_name) {
-		slapi_ch_free(&attribute_name);
+		slapi_ch_free_string(&attribute_name);
 	}
 	return ret;
 }
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index f0ddfd3b..96fb225d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -54,7 +54,7 @@ int ldbm_config_add_dse_entries(struct ldbminfo *li, char **entries, char *strin
 
     for(x = 0; strlen(entries[x]) > 0; x++) {
         util_pb = slapi_pblock_new();
-        sprintf(entry_string, entries[x], string1, string2, string3);
+        PR_snprintf(entry_string, 512, entries[x], string1, string2, string3);
         e = slapi_str2entry(entry_string, 0);
         slapi_add_entry_internal_set_pb(util_pb, e, NULL, li->li_identity, 0);
         slapi_pblock_set(util_pb, SLAPI_DSE_DONT_WRITE_WHEN_ADDING, 
@@ -252,7 +252,7 @@ done:
             if (res != LDAP_SUCCESS) {
                 return res;
             }
-            sprintf(tmpbuf, "%s/db", s );
+            PR_snprintf(tmpbuf, BUFSIZ, "%s/db", s );
             val = tmpbuf;
         }
         slapi_ch_free((void **) &(li->li_new_directory));
@@ -628,7 +628,8 @@ static int ldbm_config_db_trickle_percentage_set(void *arg, void *value, char *e
     int val = (int) value;
     
     if (val < 0 || val > 100) {
-        sprintf(errorbuf, "Error: Invalid value for %s (%d). Must be between 0 and 100\n", CONFIG_DB_TRICKLE_PERCENTAGE, val);
+        PR_snprintf(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+					"Error: Invalid value for %s (%d). Must be between 0 and 100\n", CONFIG_DB_TRICKLE_PERCENTAGE, val);
         LDAPDebug(LDAP_DEBUG_ANY, "%s", errorbuf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
     }
@@ -1039,7 +1040,6 @@ static int ldbm_config_set_use_vlv_index(void *arg, void *value, char *errorbuf,
     int val = (int) value;
         
     if (apply) {
-        int setval = 0;
         if (val) {
             li->li_use_vlv = 1;
         } else {
@@ -1197,7 +1197,7 @@ static config_info ldbm_config[] = {
 void ldbm_config_setup_default(struct ldbminfo *li) 
 {
     config_info *config;
-    char err_buf[BUFSIZ];
+    char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
     
     for (config = ldbm_config; config->config_name != NULL; config++) {
         ldbm_config_set((void *)li, config->config_name, ldbm_config, NULL /* use default */, err_buf, CONFIG_PHASE_INITIALIZATION, 1 /* apply */);
@@ -1212,7 +1212,7 @@ ldbm_config_read_instance_entries(struct ldbminfo *li, const char *backend_type)
     Slapi_Entry **entries = NULL;
 
     /* Construct the base dn of the subtree that holds the instance entries. */
-    sprintf(basedn, "cn=%s, cn=plugins, cn=config", backend_type);
+    PR_snprintf(basedn, BUFSIZ, "cn=%s, cn=plugins, cn=config", backend_type);
 
     /* Do a search of the subtree containing the instance entries */
     tmp_pb = slapi_pblock_new();
@@ -1246,8 +1246,8 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
      * cn=config, cn=ldbm database, cn=plugins, cn=config.  If the entry is
      * there, then we process the config information it stores.
      */
-    sprintf(dn, "cn=config, cn=%s, cn=plugins, cn=config", 
-            li->li_plugin->plg_name);
+    PR_snprintf(dn, BUFSIZ, "cn=config, cn=%s, cn=plugins, cn=config", 
+				li->li_plugin->plg_name);
     search_pb = slapi_pblock_new();
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE, 
         "objectclass=*", NULL, 0, NULL, NULL, li->li_identity, 0);
@@ -1285,7 +1285,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
     ldbm_config_read_instance_entries(li, li->li_plugin->plg_name);
 
     /* setup the dse callback functions for the ldbm backend config entry */
-    sprintf(dn, "cn=config, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=config, cn=%s, cn=plugins, cn=config",
             li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_config_search_entry_callback,
@@ -1298,14 +1298,14 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
         (void *) li);
 
     /* setup the dse callback functions for the ldbm backend monitor entry */
-    sprintf(dn, "cn=monitor, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=plugins, cn=config",
             li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_monitor_search,
         (void *)li);
 
     /* And the ldbm backend database monitor entry */
-    sprintf(dn, "cn=database, cn=monitor, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=database, cn=monitor, cn=%s, cn=plugins, cn=config",
         li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_dbmonitor_search,
@@ -1313,7 +1313,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
 
     /* setup the dse callback functions for the ldbm backend instance
      * entries */
-    sprintf(dn, "cn=%s, cn=plugins, cn=config", li->li_plugin->plg_name);
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=plugins, cn=config", li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsBackendInstance)",
         ldbm_instance_add_instance_entry_callback, (void *) li);
@@ -1334,6 +1334,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
 /* Utility function used in creating config entries.  Using the
  * config_info, this function gets info and formats in the correct
  * way.
+ * buf is char[BUFSIZ]
  */
 void ldbm_config_get(void *arg, config_info *config, char *buf)
 {
@@ -1360,7 +1361,7 @@ void ldbm_config_get(void *arg, config_info *config, char *buf)
         /* Remember the get function for strings returns memory
          * that must be freed. */
         tmp_string = (char *) config->config_get_fn(arg);
-        sprintf(buf, "%s", (char *) tmp_string);
+        PR_snprintf(buf, BUFSIZ, "%s", (char *) tmp_string);
         slapi_ch_free((void **)&tmp_string);
         break;
     case CONFIG_TYPE_ONOFF:
@@ -1455,14 +1456,14 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
     config = get_config_info(config_array, attr_name);
     if (NULL == config) {
         LDAPDebug(LDAP_DEBUG_CONFIG, "Unknown config attribute %s\n", attr_name, 0, 0);
-        sprintf(err_buf, "Unknown config attribute %s\n", attr_name);
+        PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Unknown config attribute %s\n", attr_name);
         return LDAP_SUCCESS; /* Ignore unknown attributes */
     }
 
     /* Some config attrs can't be changed while the server is running. */
     if (phase == CONFIG_PHASE_RUNNING && 
         !(config->config_flags & CONFIG_FLAG_ALLOW_RUNNING_CHANGE)) {
-        sprintf(err_buf, "%s can't be modified while the server is running.\n", attr_name);
+        PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "%s can't be modified while the server is running.\n", attr_name);
         LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
         return LDAP_UNWILLING_TO_PERFORM;
     }
@@ -1491,19 +1492,19 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 		llval = db_atoi(str_val, &err);
 		/* check for parsing error (e.g. not a number) */
 		if (err) {
-			sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
 					str_val, attr_name);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for overflow */
 		} else if (LL_CMP(llval, >, llmaxint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is greater than the maximum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is greater than the maximum %d\n",
 					str_val, attr_name, maxint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for underflow */
 		} else if (LL_CMP(llval, <, llminint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is less than the minimum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is less than the minimum %d\n",
 					str_val, attr_name, minint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
@@ -1530,19 +1531,19 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 		llval = db_atoi(str_val, &err);
 		/* check for parsing error (e.g. not a number) */
 		if (err) {
-			sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
 					str_val, attr_name);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for overflow */
 		} else if (LL_CMP(llval, >, llmaxint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is greater than the maximum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is greater than the maximum %d\n",
 					str_val, attr_name, maxint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for underflow */
 		} else if (LL_CMP(llval, <, llminint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is less than the minimum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is less than the minimum %d\n",
 					str_val, attr_name, minint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
@@ -1563,13 +1564,13 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 
         /* check for parsing error (e.g. not a number) */
         if (err == EINVAL) {
-            sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+            PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
                     str_val, attr_name);
             LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
             /* check for overflow */
         } else if (err == ERANGE) {
-            sprintf(err_buf, "Error: value %s for attr %s is outside the range of representable values\n",
+            PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is outside the range of representable values\n",
                     str_val, attr_name);
             LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
@@ -1605,7 +1606,7 @@ static int parse_ldbm_config_entry(struct ldbminfo *li, Slapi_Entry *e, config_i
         char *attr_name = NULL;
         Slapi_Value *sval = NULL;
         struct berval *bval;
-        char err_buf[BUFSIZ];
+        char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
         
         slapi_attr_get_type(attr, &attr_name);
         
@@ -1613,7 +1614,6 @@ static int parse_ldbm_config_entry(struct ldbminfo *li, Slapi_Entry *e, config_i
         if (ldbm_config_ignored_attr(attr_name)) {
             continue;
         }
-        
         slapi_attr_first_value(attr, &sval);
         bval = (struct berval *) slapi_value_get_berval(sval);
         
@@ -1663,7 +1663,7 @@ int ldbm_config_modify_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefore
             if ((mods[i]->mod_op & LDAP_MOD_DELETE) || 
                 ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD)) { 
                 rc= LDAP_UNWILLING_TO_PERFORM; 
-                sprintf(returntext, "%s attributes is not allowed", 
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed", 
                         (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding"); 
             } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                 /* This assumes there is only one bval for this mod. */
@@ -1694,7 +1694,7 @@ int ldbm_config_modify_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefore
  */
 void ldbm_config_internal_set(struct ldbminfo *li, char *attrname, char *value)
 {
-    char err_buf[BUFSIZ];
+    char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
     struct berval bval;
     
     bval.bv_val = value;
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
index b227d1d1..63826abb 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
@@ -172,7 +172,7 @@ ldbm_index_init_entry_callback(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* en
     if (*returncode == LDAP_SUCCESS) {
         return SLAPI_DSE_CALLBACK_OK;
     } else {
-        sprintf(returntext, "Problem initializing index entry %s\n",
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Problem initializing index entry %s\n",
                 slapi_entry_get_dn(e));
         return SLAPI_DSE_CALLBACK_ERROR;
     }
@@ -486,7 +486,7 @@ int ldbm_instance_config_add_index_entry(
     char **attrs = NULL;
     char **indexes = NULL;
     char **matchingRules = NULL;
-    char eBuf[BUFSIZ];
+    char *eBuf;
     int i = 0;
     int j = 0;
     char *basetype = NULL;
@@ -500,13 +500,13 @@ int ldbm_instance_config_add_index_entry(
         return(-1);
     }
 
-    strcpy(tmpAttrsStr,argv[0]);
+    PL_strncpyz(tmpAttrsStr,argv[0], 256);
     attrs = str2charray( tmpAttrsStr, "," );
-    strcpy(tmpIndexesStr,argv[1]);
+    PL_strncpyz(tmpIndexesStr,argv[1], 256);
     indexes = str2charray( tmpIndexesStr, ",");
 
     if(argc > 2) {
-        strcpy(tmpMatchingRulesStr,argv[2]);
+        PL_strncpyz(tmpMatchingRulesStr,argv[2], 1024);
         matchingRules = str2charray( tmpMatchingRulesStr, ",");
     }
 
@@ -514,7 +514,7 @@ int ldbm_instance_config_add_index_entry(
     {
         if('\0' == attrs[i][0]) continue;
         basetype = slapi_attr_basetype(attrs[i], NULL, 0);
-        sprintf(eBuf,
+        eBuf = PR_smprintf(
                 "dn: cn=%s, cn=index, cn=%s, cn=%s, cn=plugins, cn=config\n"
                 "objectclass:top\n"
                 "objectclass:nsIndex\n"
@@ -525,21 +525,20 @@ int ldbm_instance_config_add_index_entry(
                 (ldbm_attribute_always_indexed(basetype)?"true":"false"));
         for(j=0; indexes[j] != NULL; j++)
         {
-            strcat(eBuf, "nsIndexType:");
-            strcat(eBuf,indexes[j]);
-            strcat(eBuf,"\n");
+			eBuf = PR_sprintf_append(eBuf, "nsIndexType:%s\n", indexes[j]);
         }
         if((argc>2)&&(argv[2]))
         {
             for(j=0; matchingRules[j] != NULL; j++)
             { 
-                strcat(eBuf,"nsMatchingRule:");
-                strcat(eBuf,matchingRules[j]);
-                strcat(eBuf,"\n");
+				eBuf = PR_sprintf_append(eBuf, "nsMatchingRule:%s\n", matchingRules[j]);
             }
         }
 
         ldbm_config_add_dse_entry(li, eBuf, flags);
+		if (eBuf) {
+			PR_smprintf_free(eBuf);
+		}
 
         slapi_ch_free((void**)&basetype);
     }
@@ -615,7 +614,7 @@ int ldbm_instance_create_default_user_indexes(ldbm_instance *inst)
     strcpy(tmpBuf,"");
 
     /* Construct the base dn of the subtree that holds the default user indexes. */
-    sprintf(basedn, "cn=default indexes, cn=config, cn=%s, cn=plugins, cn=config", 
+    PR_snprintf(basedn, BUFSIZ, "cn=default indexes, cn=config, cn=%s, cn=plugins, cn=config", 
 	li->li_plugin->plg_name);
 
     /* Do a search of the subtree containing the index entries */
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
index 74fa64de..0b4ad372 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
@@ -114,7 +114,7 @@ ldbm_instance_config_instance_dir_get(void *arg)
         int len = strlen(inst->inst_parent_dir_name) +
                   strlen(inst->inst_dir_name) + 2;
         char *full_inst_dir = (char *)slapi_ch_malloc(len);
-        sprintf(full_inst_dir, "%s%c%s",
+        PR_snprintf(full_inst_dir, len, "%s%c%s",
             inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name),
             inst->inst_dir_name);
         return full_inst_dir;
@@ -274,7 +274,7 @@ read_instance_index_entries(ldbm_instance *inst)
 
     /* Construct the base dn of the subtree that holds the index entries 
      * for this instance. */
-    sprintf(basedn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(basedn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, inst->inst_li->li_plugin->plg_name); 
 
     /* Set up a tmp callback that will handle the init for each index entry */
@@ -310,7 +310,7 @@ read_instance_attrcrypt_entries(ldbm_instance *inst)
 
     /* Construct the base dn of the subtree that holds the index entries 
      * for this instance. */
-    sprintf(basedn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(basedn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, inst->inst_li->li_plugin->plg_name); 
 
     /* Set up a tmp callback that will handle the init for each index entry */
@@ -417,7 +417,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
      * cn=instance_name, cn=ldbm database, cn=plugins, cn=config.  If the
      * entry is there, then we process the config information it stores.
      */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     search_pb = slapi_pblock_new();
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE, 
@@ -451,7 +451,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
 
     /* now check for cn=monitor -- if not present, add default child entries */
     search_pb = slapi_pblock_new();
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE,
                                  "objectclass=*", NULL, 0, NULL, NULL,
@@ -472,7 +472,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     }
 
     /* setup the dse callback functions for the ldbm instance config entry */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)",
@@ -489,7 +489,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     /* delete is handled by a callback set in ldbm_config.c */
 
     /* don't forget the monitor! */
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     /* make callback on search; deny add/modify/delete */
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
@@ -504,7 +504,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     /* delete is okay */
 
     /* Callbacks to handle indexes */
-    sprintf(dn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsIndex)",
@@ -517,7 +517,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
         ldbm_instance_index_config_modify_callback, (void *) inst);
 
     /* Callbacks to handle attribute encryption */
-    sprintf(dn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, ldbm_instance_attrcrypt_filter,
@@ -641,8 +641,8 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB
                 /* naughty naughty, we don't allow this */
                 rc = LDAP_UNWILLING_TO_PERFORM;
                 if (returntext) {
-                    sprintf(returntext,
-                            "Can't change the root suffix of a backend");
+					PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+								"Can't change the root suffix of a backend");
                 }
                 LDAPDebug(LDAP_DEBUG_ANY,
                           "ldbm: modify attempted to change the root suffix "
@@ -660,7 +660,7 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB
             if ((mods[i]->mod_op & LDAP_MOD_DELETE) || 
                 (mods[i]->mod_op & LDAP_MOD_ADD)) { 
                 rc= LDAP_UNWILLING_TO_PERFORM; 
-                sprintf(returntext, "%s attributes is not allowed", 
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed", 
                         (mods[i]->mod_op & LDAP_MOD_DELETE) ?
                         "Deleting" : "Adding"); 
             } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
@@ -785,7 +785,7 @@ ldbm_instance_add_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBe
         LDAPDebug(LDAP_DEBUG_ANY, "WARNING: ldbm instance %s already exists\n",
                   instance_name, 0, 0);
         if (returntext != NULL)
-            sprintf(returntext, "An ldbm instance with the name %s already exists\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "An ldbm instance with the name %s already exists\n",
                     instance_name);
         if (returncode != NULL)
             *returncode = LDAP_UNWILLING_TO_PERFORM;
@@ -818,7 +818,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
     char dn[BUFSIZ];
 
     /* tear down callbacks for the instance config entry */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)",
@@ -834,7 +834,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         ldbm_instance_deny_config);
 
     /* now the cn=monitor entry */
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_monitor_instance_search);
@@ -844,7 +844,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_instance_deny_config);
 
     /* now the cn=index entries */
-    sprintf(dn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsIndex)",
@@ -857,7 +857,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         ldbm_instance_index_config_modify_callback);
 
     /* now the cn=encrypted attributes entries */
-    sprintf(dn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, ldbm_instance_attrcrypt_filter,
@@ -887,7 +887,7 @@ ldbm_instance_post_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry*
         LDAPDebug(LDAP_DEBUG_ANY, "ldbm: instance '%s' does not exist! (2)\n",
                   instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "No ldbm instance exists with the name '%s' (2)\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "No ldbm instance exists with the name '%s' (2)\n",
                     instance_name);
         }
         if (returncode) {
@@ -957,7 +957,7 @@ ldbm_instance_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entr
         LDAPDebug(LDAP_DEBUG_ANY, "ldbm: instance '%s' does not exist!\n",
                   instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "No ldbm instance exists with the name '%s'\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "No ldbm instance exists with the name '%s'\n",
                     instance_name);
         }
         if (returncode) {
@@ -973,7 +973,7 @@ ldbm_instance_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entr
                   "Cancel the task or wait for it to finish, "
                   "then try again.\n", instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "ldbm instance '%s' is in the middle of a "
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "ldbm instance '%s' is in the middle of a "
                     "task. Cancel the task or wait for it to finish, "
                     "then try again.\n", instance_name);
         }
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index 3e740f76..65f1a6f0 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -200,7 +200,7 @@ ldbm_back_search( Slapi_PBlock *pb )
 
                     dummyAttrs[0] = dummyAttr;
 
-                    sprintf(dn,"dn: oid=%s,cn=features,cn=config",LDAP_CONTROL_VLVREQUEST);
+                    PR_snprintf(dn,sizeof(dn),"dn: oid=%s,cn=features,cn=config",LDAP_CONTROL_VLVREQUEST);
                     feature= slapi_str2entry(dn,0);
                     r= plugin_call_acl_plugin (pb, feature, dummyAttrs, NULL, SLAPI_ACL_READ, ACLPLUGIN_ACCESS_DEFAULT, NULL);
                     slapi_entry_free(feature);
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 980c76e1..2e3d1d8d 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -85,14 +85,14 @@ int ldbm_back_fetch_incl_excl(Slapi_PBlock *pb, char ***include,
     /* normalize */
     if (pb_excl) {
 	for (i = 0; pb_excl[i]; i++) {
-	    strcpy(subtreeDn, pb_excl[i]);
+	    PL_strncpyz(subtreeDn, pb_excl[i], BUFSIZ);
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(exclude, slapi_ch_strdup(normSubtreeDn));
 	}
     }
     if (pb_incl) {
 	for (i = 0; pb_incl[i]; i++) {
-	    strcpy(subtreeDn, pb_incl[i]);
+	    PL_strncpyz(subtreeDn, pb_incl[i], BUFSIZ);
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(include, slapi_ch_strdup(normSubtreeDn));
 	}
@@ -2049,8 +2049,7 @@ int ldbm_back_upgradedb(Slapi_PBlock *pb)
             {
                 time_t tm = time(0);    /* long */
 
-                char *tmpname = (char *)slapi_ch_malloc(strlen(dest_dir) + 32);
-                sprintf(tmpname, "%s/%d", dest_dir, tm);
+                char *tmpname = slapi_ch_smprintf("%s/%d", dest_dir, tm);
                 dest_dir = tmpname;
             }
             else    /* not a directory */
diff --git a/ldap/servers/slapd/back-ldbm/misc.c b/ldap/servers/slapd/back-ldbm/misc.c
index 6f6a7cdb..1cfbbe81 100644
--- a/ldap/servers/slapd/back-ldbm/misc.c
+++ b/ldap/servers/slapd/back-ldbm/misc.c
@@ -14,14 +14,14 @@ void ldbm_nasty(const char* str, int c, int err)
     char *msg = NULL;
     char buffer[200];
     if (err == DB_LOCK_DEADLOCK) {
-        sprintf(buffer,"%s WARNING %d",str,c);
+        PR_snprintf(buffer,200,"%s WARNING %d",str,c);
     LDAPDebug(LDAP_DEBUG_TRACE,"%s, err=%d %s\n",
           buffer,err,(msg = dblayer_strerror( err )) ? msg : "");
    } else if (err == DB_RUNRECOVERY) {
         LDAPDebug(LDAP_DEBUG_ANY,"FATAL ERROR at %s (%d); server stopping as database recovery needed.\n", str,c,0);
     exit(1);
     } else {
-        sprintf(buffer,"%s BAD %d",str,c);
+        PR_snprintf(buffer,200,"%s BAD %d",str,c);
     LDAPDebug(LDAP_DEBUG_ANY,"%s, err=%d %s\n",
           buffer,err,(msg = dblayer_strerror( err )) ? msg : "");
     }
@@ -97,17 +97,12 @@ ldbm_attribute_always_indexed(const char *attrtype)
 char *
 compute_entry_tombstone_dn(const char *entrydn, const char *uniqueid)
 {
-    const char *tombstone_dn_pattern = "%s=%s, %s";
     char *tombstone_dn;
 
     PR_ASSERT(NULL != entrydn);
     PR_ASSERT(NULL != uniqueid);
 
-    tombstone_dn = slapi_ch_malloc(strlen(SLAPI_ATTR_UNIQUEID) +
-        strlen(tombstone_dn_pattern) +
-        strlen(uniqueid) +
-        strlen(entrydn) + 1);
-    sprintf(tombstone_dn, tombstone_dn_pattern,
+    tombstone_dn = slapi_ch_smprintf("%s=%s, %s",
         SLAPI_ATTR_UNIQUEID,
         uniqueid,
         entrydn);
@@ -248,7 +243,7 @@ ldbm_delete_dirs(char *path)
         if (! direntry->name)
             break;
 
-        sprintf(fullpath, "%s/%s", path, direntry->name);
+        PR_snprintf(fullpath, MAXPATHLEN, "%s/%s", path, direntry->name);
         rval = PR_GetFileInfo(fullpath, &info);
         if (PR_SUCCESS == rval)
         {
diff --git a/ldap/servers/slapd/back-ldbm/monitor.c b/ldap/servers/slapd/back-ldbm/monitor.c
index d182cd21..81c86f12 100644
--- a/ldap/servers/slapd/back-ldbm/monitor.c
+++ b/ldap/servers/slapd/back-ldbm/monitor.c
@@ -18,7 +18,7 @@
 
 #define MSETF(_attr, _x) do { \
     char tmp_atype[37]; \
-    sprintf(tmp_atype, _attr, _x); \
+    PR_snprintf(tmp_atype, sizeof(tmp_atype), _attr, _x); \
     MSET(tmp_atype); \
 } while (0)
 
@@ -63,11 +63,11 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
     vals[1] = NULL;
 
     /* database name */
-    sprintf(buf, "%s", li->li_plugin->plg_name);
+    PR_snprintf(buf, sizeof(buf), "%s", li->li_plugin->plg_name);
     MSET("database");
 
     /* read-only status */
-    sprintf( buf, "%d", inst->inst_be->be_readonly );
+    PR_snprintf( buf, sizeof(buf), "%d", inst->inst_be->be_readonly );
     MSET("readOnly");
 
     /* fetch cache statistics */
@@ -110,7 +110,6 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
         int fpos = 0;
 #endif
 		char *absolute_pathname = NULL;
-		size_t absolute_pathname_size = 0;
 
         /* only print out stats on files used by this instance */
         if (strlen(mpfstat[i]->file_name) < strlen(inst->inst_dir_name))
@@ -123,11 +122,9 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
 		 * for the purpose of stat() etc below...
 		 */
 		if (absolute_pathname) {
-			slapi_ch_free(&absolute_pathname);
+			slapi_ch_free_string(&absolute_pathname);
 		}
-		absolute_pathname_size = strlen(inst->inst_parent_dir_name) + strlen(mpfstat[i]->file_name) + 2;
-		absolute_pathname = slapi_ch_malloc(absolute_pathname_size);
-		sprintf(absolute_pathname, "%s%c%s" , inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name), mpfstat[i]->file_name );
+		absolute_pathname = slapi_ch_smprintf("%s%c%s" , inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name), mpfstat[i]->file_name );
 
 /* NPCTE fix for bugid 544365, esc 0. <P.R> <04-Jul-2001> */
 	/* Hide statistic of deleted files (mainly indexes) */
@@ -146,7 +143,7 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
 /* end of NPCTE fix for bugid 544365 */
 
         /* Get each file's stats */
-        sprintf(buf, "%s", mpfstat[i]->file_name);
+        PR_snprintf(buf, sizeof(buf), "%s", mpfstat[i]->file_name);
 #ifdef _WIN32
         /* 
          * For NT, switch the last
@@ -172,7 +169,7 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
         MSETF("dbFilePageOut-%d", i);
 
 		if (absolute_pathname) {
-				slapi_ch_free(&absolute_pathname);
+			slapi_ch_free_string(&absolute_pathname);
 		}
 
     }
@@ -206,7 +203,7 @@ int ldbm_back_monitor_search(Slapi_PBlock *pb, Slapi_Entry *e,
     vals[1] = NULL;
 
     /* database name */
-    sprintf(buf, "%s", li->li_plugin->plg_name);
+    PR_snprintf(buf, sizeof(buf), "%s", li->li_plugin->plg_name);
     MSET("database");
 
     /* we have to ask for file stats in order to get correct global stats */
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index e3a740c5..b99ab379 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -78,7 +78,7 @@ void sort_log_access(Slapi_PBlock *pb,sort_spec_thing *s,IDList *candidates)
 	int prefix_size = strlen(prefix);
 
 	buffer = stack_buffer;
-	size -= sprintf(buffer,"%s",prefix);
+	size -= PR_snprintf(buffer,sizeof(stack_buffer),"%s",prefix);
 	ret = print_out_sort_spec(buffer+prefix_size,s,&size);
 	if (0 != ret) {
 		/* It wouldn't fit in the buffer */
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index a93cd3e5..ff3aa79a 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -280,9 +280,7 @@ vlv_init(ldbm_instance *inst)
 
     /* Initialize lock first time through */
     if(be->vlvSearchList_lock == NULL) {
-        char *rwlockname = (char *)slapi_ch_malloc(sizeof("vlvSearchList") +
-                            strlen(inst->inst_name) + 2);
-        sprintf(rwlockname, "vlvSearchList_%s", inst->inst_name);
+        char *rwlockname = slapi_ch_smprintf("vlvSearchList_%s", inst->inst_name);
         be->vlvSearchList_lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, rwlockname);
         slapi_ch_free((void**)&rwlockname);
     }
@@ -303,7 +301,7 @@ vlv_init(ldbm_instance *inst)
     if (inst == NULL) {
         basedn = NULL;
     } else {
-        sprintf(buf, "cn=%s,cn=%s,cn=plugins,cn=config",
+        PR_snprintf(buf, sizeof(buf), "cn=%s,cn=%s,cn=plugins,cn=config",
                 inst->inst_name, inst->inst_li->li_plugin->plg_name);
         basedn = buf;
     }
@@ -359,7 +357,7 @@ vlv_remove_callbacks(ldbm_instance *inst) {
     if (inst == NULL) {
         basedn = NULL;
     } else {
-        sprintf(buf, "cn=%s,cn=%s,cn=plugins,cn=config",
+        PR_snprintf(buf, sizeof(buf), "cn=%s,cn=%s,cn=plugins,cn=config",
                 inst->inst_name, inst->inst_li->li_plugin->plg_name);
         basedn = buf;
     }
@@ -1888,8 +1886,7 @@ int vlv_delete_search_entry(Slapi_PBlock *pb, Slapi_Entry* e, ldbm_instance *ins
 	backend *be= inst->inst_be;
 
 	tag1=create_vlv_search_tag(dn);
-	buf=slapi_ch_malloc(strlen("cn=MCC ")+strlen(tag1)+strlen(", cn=")+strlen(inst->inst_name)+strlen(LDBM_PLUGIN_ROOT) + 1);
-	sprintf(buf,"%s%s%s%s%s","cn=MCC ",tag1,", cn=",inst->inst_name,LDBM_PLUGIN_ROOT);
+	buf=slapi_ch_smprintf("%s%s%s%s%s","cn=MCC ",tag1,", cn=",inst->inst_name,LDBM_PLUGIN_ROOT);
 	newdn=slapi_sdn_new_dn_byval(buf);
 	PR_RWLock_Wlock(be->vlvSearchList_lock);
 	p = vlvSearch_finddn((struct vlvSearch *)be->vlvSearchList, newdn);
@@ -1897,8 +1894,7 @@ int vlv_delete_search_entry(Slapi_PBlock *pb, Slapi_Entry* e, ldbm_instance *ins
     {	
 		LDAPDebug( LDAP_DEBUG_ANY, "Deleted Virtual List View Search (%s).\n", p->vlv_name, 0, 0);
 		tag2=create_vlv_search_tag(dn);
-		buf2=slapi_ch_malloc(strlen(TAG)+strlen(tag2)+strlen(buf)+2);
-		sprintf(buf2,"%s%s,%s",TAG,tag2,buf);
+		buf2=slapi_ch_smprintf("%s%s,%s",TAG,tag2,buf);
 		vlvSearch_removefromlist((struct vlvSearch **)&be->vlvSearchList,p->vlv_dn);
 		/* This line release lock to prevent recursive deadlock caused by slapi_internal_delete calling vlvDeleteSearchEntry */
 		PR_RWLock_Unlock(be->vlvSearchList_lock); 
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index ea59dfbc..42012af1 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -586,12 +586,10 @@ vlvIndex_init(struct vlvIndex* p, backend *be, struct vlvSearch* pSearch, const
     /* Create an index filename for the search */
     if(vlvIndex_createfilename(p,&filename))
     {
-        p->vlv_filename= slapi_ch_malloc(strlen(file_prefix) + strlen(filename) + strlen(file_suffix) + 1);
-        sprintf(p->vlv_filename,"%s%s%s",file_prefix,filename,file_suffix);
+        p->vlv_filename= slapi_ch_smprintf("%s%s%s",file_prefix,filename,file_suffix);
 
         /* Create an attrinfo structure */
-        p->vlv_attrinfo->ai_type= slapi_ch_malloc(strlen(file_prefix) + strlen(filename) + 1);
-        sprintf(p->vlv_attrinfo->ai_type,"%s%s",file_prefix,filename);
+        p->vlv_attrinfo->ai_type= slapi_ch_smprintf("%s%s",file_prefix,filename);
     	p->vlv_attrinfo->ai_indexmask= INDEX_VLV;
 
         /* Check if the index file actually exists */
diff --git a/ldap/servers/slapd/back-ldif/monitor.c b/ldap/servers/slapd/back-ldif/monitor.c
index 9ea741e1..facd79a3 100644
--- a/ldap/servers/slapd/back-ldif/monitor.c
+++ b/ldap/servers/slapd/back-ldif/monitor.c
@@ -47,7 +47,7 @@ ldif_back_monitor_info( Slapi_PBlock *pb, LDIF *db)
   
   /* Get the database name (be_type) */
   slapi_pblock_get( pb, SLAPI_BE_TYPE, &type);
-  sprintf( buf, "%s", type );
+  PR_snprintf( buf, sizeof(buf), "%s", type );
   val.bv_val = buf;
   val.bv_len = strlen( buf );
   slapi_entry_attr_merge( e, "database", vals );
diff --git a/ldap/servers/slapd/backend.c b/ldap/servers/slapd/backend.c
index 4c917310..bef800e5 100644
--- a/ldap/servers/slapd/backend.c
+++ b/ldap/servers/slapd/backend.c
@@ -16,11 +16,11 @@ be_init( Slapi_Backend *be, const char *type, const char *name, int isprivate, i
     be->be_suffixlock= PR_NewLock();
     be->be_suffixcount= 0;
 	/* e.g. dn: cn=config,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config */
-	sprintf(text, "cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text),"cn=%s,cn=%s,cn=plugins,cn=config", name, type);
     be->be_basedn= slapi_ch_strdup(slapi_dn_normalize(text));
-	sprintf(text, "cn=config,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text), "cn=config,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
 	be->be_configdn= slapi_ch_strdup(slapi_dn_normalize(text));
-	sprintf(text, "cn=monitor,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text), "cn=monitor,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
 	be->be_monitordn= slapi_ch_strdup(slapi_dn_normalize(text));
 	be->be_sizelimit = sizelimit;
 	be->be_timelimit = timelimit;
diff --git a/ldap/servers/slapd/backend_manager.c b/ldap/servers/slapd/backend_manager.c
index 10653aa5..842d2a55 100644
--- a/ldap/servers/slapd/backend_manager.c
+++ b/ldap/servers/slapd/backend_manager.c
@@ -417,31 +417,15 @@ be_add_instance (const char *name, void *plugin_identity)
 static char* 
 be_get_instance_dn (const char *index_name, const char *name)
 {
-	int len;
 	char *dn;
 
 	PR_ASSERT (name);
 
-	len =  strlen ("cn=config,") + strlen (name) + 
-		   strlen (LDBM_CLASS_PREFIX) + 4; /* 4 = "cn=" + ',' + '\0' */
-
-	if (index_name)
-	{
-		len += strlen (index_name) + strlen ("cn=index,") + 4; /* 4 = "cn=" + ',' */
-	}
-
-	dn = (char*)slapi_ch_malloc (len);
-	if (dn)
-	{
-		if (index_name)
-		{
-			sprintf (dn, "cn=%s,cn=index,cn=config,cn=%s,%s", index_name, name, 
-					 LDBM_CLASS_PREFIX);				
-		}
-		else
-		{
-			sprintf (dn, "cn=config,cn=%s,%s", name, LDBM_CLASS_PREFIX);	
-		}
+	if (index_name) {
+		dn = slapi_ch_smprintf("cn=%s,cn=index,cn=config,cn=%s,%s", index_name, name, 
+							   LDBM_CLASS_PREFIX);				
+	} else {
+		dn = slapi_ch_smprintf("cn=config,cn=%s,%s", name, LDBM_CLASS_PREFIX);	
 	}
 
 	return dn;
@@ -690,7 +674,6 @@ slapi_lookup_instance_name_by_suffix(char *suffix,
 	const char *thisdn;
 	int thisdnlen;
 	int suffixlen;
-	int maxinst = 1;
 	int i;
 	int rval = -1;
 
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index 617b464b..929b9a12 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -485,7 +485,7 @@ do_bind( Slapi_PBlock *pb )
                         break;
                     case LDAP_AUTH_SASL:
                         /* authtype = SLAPD_AUTH_SASL && saslmech: */
-                        sprintf(authtypebuf, "%s%s", SLAPD_AUTH_SASL, saslmech);
+                        PR_snprintf(authtypebuf, sizeof(authtypebuf), "%s%s", SLAPD_AUTH_SASL, saslmech);
                         authtype = authtypebuf;
                     break;
                     default: /* ??? */
diff --git a/ldap/servers/slapd/ch_malloc.c b/ldap/servers/slapd/ch_malloc.c
index 8e4e0ab2..615a664c 100644
--- a/ldap/servers/slapd/ch_malloc.c
+++ b/ldap/servers/slapd/ch_malloc.c
@@ -355,6 +355,51 @@ slapi_ch_free_string(char **s)
 	slapi_ch_free((void **)s);
 }
 
+/*
+  This function is just like PR_smprintf.  It works like sprintf
+  except that it allocates enough memory to hold the result
+  string and returns that allocated memory to the caller.  The
+  caller must use slapi_ch_free_string to free the memory.
+  It should only be used in those situations that will eventually free
+  the memory using slapi_ch_free_string e.g. allocating a string
+  that will be freed as part of pblock cleanup, or passed in to create
+  a Slapi_DN, or things of that nature.  If you have control of the
+  flow such that the memory will be allocated and freed in the same
+  scope, better to just use PR_smprintf and PR_smprintf_free instead
+  because it is likely faster.
+*/
+char *
+slapi_ch_smprintf(const char *fmt, ...)
+{
+	int ret;
+	int size = 100; /* plus strlen fmt */
+	int incr = 100; /* increment to add each time through */
+	char *p = NULL;
+
+	va_list ap;
+	size += strlen(fmt); /* need at least strlen(fmt) bytes */
+	if ((p = slapi_ch_malloc(size)) == NULL) {
+		return NULL;
+	}
+	while (1) {
+		/* Try to print in the allocated space. */
+		va_start(ap, fmt);
+		ret = PR_vsnprintf(p, size, fmt, ap);
+		va_end(ap);
+		/* If that worked, return the string. */
+		if (ret > -1 && ret < size) {
+			break; /* return p */
+		} else { /* try again with more space */
+			size += incr;
+			if ((p = slapi_ch_realloc(p, size)) == NULL) {
+				break;
+			}
+		}
+	}
+
+	return p;
+}
+
 /* ========================= NT Specific Leak Checking Code ================================== */
 
 #if defined(_WIN32) && defined(DEBUG)
@@ -640,7 +685,7 @@ memory_record_dump( caddr_t data, caddr_t arg )
 	}
 	mr_to_hex_dump(b1, mr->p, size, MR_DUMP_AMOUNT);
 	mr_to_char_dump(b2, mr->p, size, MR_DUMP_AMOUNT);
-	sprintf(b3,"%p %ld %s %s",mr->p,mr->size,b1,b2);
+	PR_snprintf(b3,sizeof(b3),"%p %ld %s %s",mr->p,mr->size,b1,b2);
 	LDAPDebug( LDAP_DEBUG_ANY, "%s\n",b3,0,0);
 	while(mr->ra[frame]!=0)
 	{
diff --git a/ldap/servers/slapd/configdse.c b/ldap/servers/slapd/configdse.c
index b396d685..b78ab7ce 100644
--- a/ldap/servers/slapd/configdse.c
+++ b/ldap/servers/slapd/configdse.c
@@ -339,7 +339,7 @@ modify_config_dse(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* e, in
 			if ((mods[i]->mod_op & LDAP_MOD_DELETE) ||
 				(mods[i]->mod_op & LDAP_MOD_ADD)) {
 				rc= LDAP_UNWILLING_TO_PERFORM;
-				sprintf(returntext, "%s attributes is not allowed",
+				PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
 						(mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
 			} else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
 				/* send all aci modifications to the backend */
@@ -410,7 +410,7 @@ postop_modify_config_dse(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry
 					continue;
 				while ( *(++p) == ' ' || *p == '\t' );
 				if ( strcasecmp (p, mods[i]->mod_type) == 0 ) {
-					sprintf(returntext,
+					PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
 						"The change of %s will not take effect "
 						"until the server is restarted", mods[i]->mod_type);
 					slapi_log_error (SLAPI_LOG_FATAL, NULL, "%s\n", returntext);
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 4e3994d1..8fc6e533 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -173,7 +173,6 @@ void
 connection_reset(Connection* conn, int ns, PRNetAddr * from, int fromLen, int is_SSL)
 {
     char *		pTmp = is_SSL ? "SSL " : "";
-    TCPLEN_T		l_fromLen = (TCPLEN_T)fromLen;
     TCPLEN_T		addrlen, destaddrlen;
     struct sockaddr_in	addr, destaddr;
     char		*str_ip, *str_destip, buf_ip[ 256 ], buf_destip[ 256 ];
diff --git a/ldap/servers/slapd/conntable.c b/ldap/servers/slapd/conntable.c
index 0eb82aeb..119ca8d7 100644
--- a/ldap/servers/slapd/conntable.c
+++ b/ldap/servers/slapd/conntable.c
@@ -220,6 +220,7 @@ connection_table_dump_active_connection (Connection *c)
                     c->c_mutex, c->c_next, c->c_prev);
 }
 
+#if 0 /* useful for debugging */
 static void 
 connection_table_dump_active_connections (Connection_Table *ct)
 {
@@ -237,6 +238,7 @@ connection_table_dump_active_connections (Connection_Table *ct)
     slapi_log_error(SLAPI_LOG_FATAL, "connection", "********** END DUMP ************\n");
 	PR_Unlock(ct->table_mutex);
 }
+#endif
 
 /*
  * There's a double linked list of active connections running through the array
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index ba8df8dd..66088cbc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -141,7 +141,7 @@ void *slapd_service_exit_wait()
 
 	_splitpath( module, drive, dir, fname, ext );
 
-	sprintf( exit_file_name, "%s%s%s", drive, dir, "exitnow.txt" );
+	PR_snprintf( exit_file_name, sizeof(exit_file_name), "%s%s%s", drive, dir, "exitnow.txt" );
 
     LDAPDebug( LDAP_DEBUG_ANY, "PURIFYING - Create %s to terminate the process.\n", exit_file_name, 0, 0 );
 
@@ -163,7 +163,7 @@ void *slapd_service_exit_wait()
 	DWORD dwWait;
 	char szDoneEvent[256];
 
-	sprintf(szDoneEvent, "NS_%s", pszServerName);
+	PR_snprintf(szDoneEvent, sizeof(szDoneEvent), "NS_%s", pszServerName);
 
 	hServDoneEvent = CreateEvent( NULL,			// default security attributes (LocalSystem)
 								  TRUE,			// manual reset event
@@ -242,8 +242,6 @@ accept_and_configure(int s, PRFileDesc *pr_acceptfd, PRNetAddr *pr_netaddr,
 	int addrlen, int secure, PRFileDesc **pr_clonefd)
 {
 	int ns = 0;
-	int ioblock_timeout = config_get_ioblocktimeout();
-	int enable_nagle = config_get_nagle();
 
 	PRIntervalTime pr_timeout = PR_MillisecondsToInterval(slapd_wakeup_timer);
 
@@ -2529,7 +2527,6 @@ int configure_pr_socket( PRFileDesc **pr_socket, int secure )
 {
 	int ns = 0;
 	int reservedescriptors = config_get_reservedescriptors();
-	int ioblock_timeout = config_get_ioblocktimeout();
 	int enable_nagle = config_get_nagle();
 
 	PRSocketOptionData pr_socketoption;
@@ -2641,7 +2638,6 @@ int configure_pr_socket( PRFileDesc **pr_socket, int secure )
 void configure_ns_socket( int * ns )
 {
 
-	int ioblock_timeout = config_get_ioblocktimeout();
 	int enable_nagle = config_get_nagle();
         int on;
 
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index 71e2fc8d..d1166054 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -1353,7 +1353,7 @@ int
 slapi_sdn_get_ndn_len(const Slapi_DN *sdn)
 {
     int r= 0;
-	const char *ndn=slapi_sdn_get_ndn(sdn);
+	(void)slapi_sdn_get_ndn(sdn); /* does the normalization if needed */
 	if(sdn->ndn!=NULL)
 	{
 		r= sdn->ndn_len;	
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 4ce9063e..2c47bcd5 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -327,11 +327,9 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
     char *realconfigdir = NULL;
 
     if (configdir!=NULL) {
-		realconfigdir = slapi_ch_malloc(strlen(configdir)+1);
-		strcpy(realconfigdir, configdir);
+		realconfigdir = slapi_ch_strdup(configdir);
     } else if (id!=NULL) {
-		realconfigdir = slapi_ch_malloc(strlen(id)+strlen(config_sub_dir)+3);
-		sprintf(realconfigdir, "%s/%s", id, config_sub_dir);
+		realconfigdir = slapi_ch_smprintf("%s/%s", id, config_sub_dir);
     }
     if(realconfigdir!=NULL)
     {
@@ -342,17 +340,13 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
             /* Set the full path name for the config DSE entry */
 			if (!strstr(filename, realconfigdir))
 			{
-				pdse->dse_filename = slapi_ch_malloc( strlen( realconfigdir ) +
-													  strlen( filename ) + 3 );
-				sprintf( pdse->dse_filename, "%s/%s", realconfigdir, filename );
+				pdse->dse_filename = slapi_ch_smprintf("%s/%s", realconfigdir, filename );
 			}
 			else
 				pdse->dse_filename = slapi_ch_strdup(filename);
 
 			if (!strstr(tmpfilename, realconfigdir)) {
-				pdse->dse_tmpfile = slapi_ch_malloc( strlen( realconfigdir ) +
-													 strlen( tmpfilename ) + 3 );
-				sprintf( pdse->dse_tmpfile, "%s/%s", realconfigdir, tmpfilename );
+				pdse->dse_tmpfile = slapi_ch_smprintf("%s/%s", realconfigdir, tmpfilename );
 			}
 			else
 				pdse->dse_tmpfile = slapi_ch_strdup(tmpfilename);
@@ -360,9 +354,7 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
 			if ( backfilename != NULL )
 			{
 				if (!strstr(backfilename, realconfigdir)) {
-					pdse->dse_fileback = slapi_ch_malloc( strlen( realconfigdir ) +
-														 strlen( backfilename ) + 3 );
-					sprintf( pdse->dse_fileback, "%s/%s", realconfigdir, backfilename );
+					pdse->dse_fileback = slapi_ch_smprintf("%s/%s", realconfigdir, backfilename );
 				}
 				else
 					pdse->dse_fileback = slapi_ch_strdup(backfilename);
@@ -373,9 +365,7 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
 			if ( startokfilename != NULL )
 			{
 				if (!strstr(startokfilename, realconfigdir)) {
-					pdse->dse_filestartOK = slapi_ch_malloc( strlen( realconfigdir ) +
-														 strlen( startokfilename ) + 3 );
-					sprintf( pdse->dse_filestartOK, "%s/%s", realconfigdir, startokfilename );
+					pdse->dse_filestartOK = slapi_ch_smprintf("%s/%s", realconfigdir, startokfilename );
 				}
 				else
 					pdse->dse_filestartOK = slapi_ch_strdup(startokfilename);
@@ -1343,8 +1333,8 @@ dse_delete_entry(struct dse* pdse, Slapi_PBlock *pb, const Slapi_Entry *e)
 
 	/* keep write lock for both tree deleting and file writing */
 	PR_RWLock_Wlock(pdse->dse_rwlock);
-    if (deleted_node = (struct dse_node *)avl_delete(&pdse->dse_tree,
-													 n, entry_dn_cmp))
+    if ((deleted_node = (struct dse_node *)avl_delete(&pdse->dse_tree,
+													  n, entry_dn_cmp)))
 		dse_node_delete(&deleted_node);
     dse_node_delete(&n);
 
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index d4d49733..0989b37f 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -176,7 +176,7 @@ str2entry_fast( char *s, int flags, int read_stateinfo )
 			if ( errmsg != NULL ) {
 			         LDAPDebug( LDAP_DEBUG_PARSE, "%s", errmsg, 0, 0 );
 				 /* the memory below was not allocated by the slapi_ch_ functions */
-				 slapi_ch_free( (void**)&errmsg );
+				 PR_smprintf_free(errmsg );
 			}
 			LDAPDebug( LDAP_DEBUG_TRACE,
 			    "<= str2entry_fast NULL (parse_line)\n", 0, 0, 0 );
@@ -584,7 +584,7 @@ str2entry_dupcheck( char *s, int flags, int read_stateinfo )
 		    if ( errmsg != NULL ) {
 		             LDAPDebug( LDAP_DEBUG_PARSE, "%s", errmsg, 0, 0 );
 			     /* the memory below was not allocated by the slapi_ch_ functions */
-			     slapi_ch_free( (void**)&errmsg );
+			     PR_smprintf_free(errmsg );
 		    }
 		    LDAPDebug( LDAP_DEBUG_TRACE,
 			    "<= slapi_str2entry NULL (parse_line)\n", 0, 0, 0 );
@@ -3018,8 +3018,7 @@ slapi_entries_diff(Slapi_Entry **old_entries, Slapi_Entry **curr_entries,
 
     if (NULL != logging_prestr && '\0' != *logging_prestr)
     {
-        my_logging_prestr = (char *)slapi_ch_malloc(strlen(logging_prestr) + 2);
-        sprintf(my_logging_prestr, "%s ", logging_prestr);
+        my_logging_prestr = slapi_ch_smprintf("%s ", logging_prestr);
     }
 
     for (oep = old_entries; oep != NULL && *oep != NULL; )
diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c
index c4da7c89..0d9a573b 100644
--- a/ldap/servers/slapd/extendop.c
+++ b/ldap/servers/slapd/extendop.c
@@ -72,7 +72,7 @@ static void extop_handle_import_start(Slapi_PBlock *pb, char *extoid,
 		/* slapi_str2entry modify its dn parameter so we must copy
 		 * this string each time we call it !
 		 */
-		sprintf(dn, "dn: oid=%s,cn=features,cn=config",
+		PR_snprintf(dn, sizeof(dn), "dn: oid=%s,cn=features,cn=config",
 			EXTOP_BULK_IMPORT_START_OID);
 
 		dummyAttrs[0] = dummyAttr;
diff --git a/ldap/servers/slapd/factory.c b/ldap/servers/slapd/factory.c
index dac2eb8c..d9acf0b9 100644
--- a/ldap/servers/slapd/factory.c
+++ b/ldap/servers/slapd/factory.c
@@ -445,7 +445,6 @@ void
 slapi_set_object_extension(int objecttype, void *object, int extensionhandle,
                            void *extension)
 {
-    void *object_extension = NULL;
     struct factory_type *ft = factory_type_store_get_factory_type(objecttype);
     if (ft != NULL) {
         char *object_base = (char *)object;
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 6ef97b62..2b30760f 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1691,7 +1691,7 @@ search_easter_egg( Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
     char *fstr= NULL;
     int retmalloc= 0;
 	char eggfilter[64];
-	sprintf(eggfilter,"(objectclass=%s)",EGG_OBJECT_CLASS);
+	PR_snprintf(eggfilter,sizeof(eggfilter),"(objectclass=%s)",EGG_OBJECT_CLASS);
     slapi_pblock_get( pb, SLAPI_SEARCH_STRFILTER, &fstr );
     if(fstr!=NULL && strcasecmp(fstr,eggfilter)==0)
     {
@@ -1711,7 +1711,7 @@ search_easter_egg( Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
 		    if ( errmsg != NULL ) {
 		             slapi_log_error( SLAPI_LOG_PARSE, "dse", "%s", errmsg );
 			     /* the memory below was not allocated by the slapi_ch_ functions */
-			     slapi_ch_free( (void**)&errmsg );
+			     PR_smprintf_free(errmsg );
 		    }
 		    return SLAPI_DSE_CALLBACK_ERROR;
 		}
@@ -1844,8 +1844,7 @@ int fedse_create_startOK(char *filename,  char *startokfilename, const char *con
         realconfigdir = slapi_ch_malloc(strlen(configdir)+1);
         strcpy(realconfigdir, configdir);
     } else if (id!=NULL) {
-        realconfigdir = slapi_ch_malloc(strlen(id)+strlen(config_sub_dir)+3);
-        sprintf(realconfigdir, "%s/%s", id, config_sub_dir);
+        realconfigdir = slapi_ch_smprintf("%s/%s", id, config_sub_dir);
     }
 	slapi_ch_free_string(&id);
     if(realconfigdir!=NULL)
@@ -1853,17 +1852,13 @@ int fedse_create_startOK(char *filename,  char *startokfilename, const char *con
 		/* Set the full path name for the config DSE entry */
 		if (!strstr(filename, realconfigdir))
 		{
-			dse_filename = slapi_ch_malloc( strlen( realconfigdir ) +
-												  strlen( filename ) + 3 );
-			sprintf( dse_filename, "%s/%s", realconfigdir, filename );
+			dse_filename = slapi_ch_smprintf("%s/%s", realconfigdir, filename );
 		}
 		else
 			dse_filename = slapi_ch_strdup(filename);
 
 		if (!strstr(startokfilename, realconfigdir)) {
-			dse_filestartOK = slapi_ch_malloc( strlen( realconfigdir ) +
-												 strlen( startokfilename ) + 3 );
-			sprintf( dse_filestartOK, "%s/%s", realconfigdir, startokfilename );
+			dse_filestartOK = slapi_ch_smprintf("%s/%s", realconfigdir, startokfilename );
 		}
 		else
 			dse_filestartOK = slapi_ch_strdup(startokfilename);
diff --git a/ldap/servers/slapd/filter.c b/ldap/servers/slapd/filter.c
index 1a382adf..b62fa425 100644
--- a/ldap/servers/slapd/filter.c
+++ b/ldap/servers/slapd/filter.c
@@ -101,18 +101,9 @@ filter_escape_filter_value_extended(struct slapi_filter *f)
 {
     char ebuf[BUFSIZ], *ptr;
     const char *estr;
-    size_t len = 9;
     
     estr  = escape_filter_value( f->f_mr_value.bv_val, f->f_mr_value.bv_len, ebuf );
-    if ( f->f_mr_type ) {
-        len += strlen( f->f_mr_type );
-    }
-    len += strlen(estr);
-    if ( f->f_mr_oid ) {
-        len += strlen( f->f_mr_oid );
-    }
-    ptr = slapi_ch_malloc( len );
-    sprintf( ptr, FILTER_EXTENDED_FMT,
+	ptr = slapi_ch_smprintf(FILTER_EXTENDED_FMT,
         f->f_mr_type ? f->f_mr_type : "",
         f->f_mr_dnAttrs ? ":dn" : "",
         f->f_mr_oid ? ":" : "",
@@ -131,8 +122,7 @@ filter_escape_filter_value(struct slapi_filter *f, const char *fmt, size_t len)
     
 	estr  = escape_filter_value( f->f_avvalue.bv_val, f->f_avvalue.bv_len, ebuf );
 	filter_compute_hash(f);
-    ptr = slapi_ch_malloc( len + strlen(f->f_avtype) + strlen( estr ));
-    sprintf( ptr, fmt, f->f_avtype, estr );
+    ptr = slapi_ch_smprintf(fmt, f->f_avtype, estr );
     return ptr;
 }
 
@@ -277,8 +267,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 			f->f_type = slapi_attr_syntax_normalize( type );
 			free( type );
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 5 + strlen( f->f_type ) );
-			sprintf( *fstr, "(%s=*)", f->f_type );
+			*fstr = slapi_ch_smprintf( "(%s=*)", f->f_type );
 		}
 		break;
 
@@ -318,8 +307,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(&%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(&%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -330,8 +318,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(|%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(|%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -343,8 +330,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(!%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(!%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -1193,7 +1179,7 @@ slapi_filter_to_string_internal( const struct slapi_filter *f, char *buf, size_t
 			   specifier .* with the bv_len as the length to avoid reading
 			   past bv_len in bv_val */
 			sprintf( buf, "(%s%s%.*s)", f->f_ava.ava_type, operator,
-					 f->f_ava.ava_value.bv_len,
+					 (int)f->f_ava.ava_value.bv_len,
 					 f->f_ava.ava_value.bv_val );
 			*bufsize -= size;
 		}
diff --git a/ldap/servers/slapd/generation.c b/ldap/servers/slapd/generation.c
index c9b8fb5b..3da1271f 100644
--- a/ldap/servers/slapd/generation.c
+++ b/ldap/servers/slapd/generation.c
@@ -24,8 +24,7 @@ new_dataversion()
 #else
     gmtime_r (&curtime, &t);
 #endif
-    dataversion = slapi_ch_malloc(16);
-    sprintf (dataversion, "0%.4li%.2i%.2i%.2i%.2i%.2i", 1900L + t.tm_year, 1 + t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    dataversion = slapi_ch_smprintf("0%.4li%.2i%.2i%.2i%.2i%.2i", 1900L + t.tm_year, 1 + t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
 	return dataversion;
 }
 
diff --git a/ldap/servers/slapd/getfilelist.c b/ldap/servers/slapd/getfilelist.c
index 38f334e3..48990bf2 100644
--- a/ldap/servers/slapd/getfilelist.c
+++ b/ldap/servers/slapd/getfilelist.c
@@ -35,15 +35,12 @@ add_file_to_list(caddr_t data, caddr_t arg)
 {
 	struct data_wrapper *dw = (struct data_wrapper *)arg;
 	if (dw) {
-		size_t size;
 		/* max is number of entries; the range of n is 0 - max-1 */
 		PR_ASSERT(dw->n <= dw->max);
 		PR_ASSERT(dw->list);
 		PR_ASSERT(data);
 		/* this strdup is free'd by free_filelist */
-		size = strlen(dw->dirname) + strlen(data) + 5;
-		dw->list[dw->n] = slapi_ch_calloc(size, 1);
-		sprintf(dw->list[dw->n++], "%s/%s", dw->dirname, data);
+		dw->list[dw->n++] = slapi_ch_smprintf("%s/%s", dw->dirname, data);
 		return 0;
 	}
 
@@ -61,10 +58,7 @@ file_is_type_x(const char *dirname, const char *filename, PRFileType x)
 {
 	struct PRFileInfo inf;
 	int status = 0;
-	size_t size = strlen(dirname) + strlen(filename) + 2; /* 1 for slash + 1 for null */
-	char *fullpath = slapi_ch_calloc(sizeof(char), size);
-
-	sprintf(fullpath, "%s/%s", dirname, filename);
+	char *fullpath = slapi_ch_smprintf("%s/%s", dirname, filename);
 	if (PR_SUCCESS == PR_GetFileInfo(fullpath, &inf) &&
 		inf.type == x)
 		status = 1;
@@ -197,14 +191,15 @@ free_filelist(char **filelist)
 /**
  * Returns a list of files in order of "priority" where priority is defined
  * as:
- * The filename must begin with the letter S.  The next two characters in
- * the filename are digits representing a number from 00 to 99.  The lower the
- * number the higher the priority.  For example, S00 is in the list before S01,
- * and S99 is the last item in the list.  The ordering of files with the same
- * priority cannot be guaranteed.  The pattern is the grep style regular expression
- * of filenames to match which is applied to the end of the string.
- * If you are a Solaris person, you may recognize this as the rules for init level
- * initialization using shell scripts under /etc/rcX.d/
+ * The first two characters in the filename are digits representing a
+ * number from 00 to 99.  The lower the number the higher the
+ * priority.  For example, 00 is in the list before 01, and 99 is the
+ * last item in the list.  The ordering of files with the same
+ * priority cannot be guaranteed.  The pattern is the grep style
+ * regular expression of filenames to match which is applied to the
+ * end of the string.  If you are a Solaris person, you may recognize
+ * this as the rules for init level initialization using shell scripts
+ * under /etc/rcX.d/
  */
 char **
 get_priority_filelist(const char *directory, const char *pattern)
@@ -212,15 +207,12 @@ get_priority_filelist(const char *directory, const char *pattern)
 	char *basepattern = "^[0-9][0-9]";
 	char *genericpattern = ".*"; /* used if pattern is null */
 	char *bigpattern = 0;
-	size_t len = 0;
 	char **retval = 0;
 
 	if (!pattern)
 		pattern = genericpattern;
 
-	len = strlen(basepattern) + strlen(pattern) + 1;
-	bigpattern = slapi_ch_calloc(sizeof(char), len);
-	sprintf(bigpattern, "%s%s", basepattern, pattern);
+	bigpattern = slapi_ch_smprintf("%s%s", basepattern, pattern);
 
 	retval = get_filelist(directory, bigpattern, 0, 0, 1);
 
diff --git a/ldap/servers/slapd/index_subsystem.c b/ldap/servers/slapd/index_subsystem.c
index f4946f3c..c8415496 100644
--- a/ldap/servers/slapd/index_subsystem.c
+++ b/ldap/servers/slapd/index_subsystem.c
@@ -73,7 +73,6 @@ static int index_subsys_decoder_done(Slapi_Filter *f);
 static int index_subsys_assign_decoders(Slapi_Filter *f);
 static int index_subsys_assign_decoder(Slapi_Filter *f);
 static int index_subsys_group_decoders(Slapi_Filter *f);
-static indexEntry *index_subsys_find_decoder(Slapi_Filter *f);
 static int index_subsys_unlink_subfilter(Slapi_Filter *fcomplex, Slapi_Filter *fsub);
 static int index_subsys_index_matches_associated(indexEntry *index, Slapi_Filter *f);
 
@@ -996,7 +995,6 @@ int slapi_index_register_index(char *plugin_id, indexed_item *registration_item,
 	indexEntry *index;
 	int a_matched_index = 0;
 	Slapi_Filter *tmp_f = slapi_str2filter(registration_item->index_filter);
-	int i = 0;
 	Slapi_Backend *be;
 	
 	if(!theCache)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 06d5aa16..f5816dcd 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1165,7 +1165,7 @@ config_set_pw_storagescheme( const char *attrname, char *value, char *errorbuf,
 	they are in clear. We don't take it */ 
 
 	if ( scheme_list != NULL ) {
-		sprintf( errorbuf,
+			PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
 				"pw_storagescheme: invalid encoding scheme - %s\nValid values are: %s\n", value, scheme_list );
 	}
 	retVal = LDAP_UNWILLING_TO_PERFORM;
@@ -1445,14 +1445,6 @@ config_set_pw_exp( const char *attrname, char *value, char *errorbuf, int apply
   int retVal = LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
-  /* password policy is disabled in DirLite. */
-  if ( config_is_slapd_lite() ) {
-	if ( NULL != value && strcasecmp(value, "off") != 0 ) {
-	  PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_PW_EXP_ERR );
-	  retVal = LDAP_UNWILLING_TO_PERFORM;
-	  return retVal;
-	}
-  }
   retVal = config_set_onoff ( attrname,
 							  value, 
 							  &(slapdFrontendConfig->pw_policy.pw_exp),
@@ -1765,7 +1757,6 @@ int
 config_set_rootpw( const char *attrname, char *value, char *errorbuf, int apply ) {
   int retVal =  LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
-  char *hashedpw = NULL;
   struct pw_scheme *is_hashed = NULL;
 
   if ( config_value_is_null( attrname, value, errorbuf, 0 )) {
@@ -1787,8 +1778,8 @@ config_set_rootpw( const char *attrname, char *value, char *errorbuf, int apply
 	free_pw_scheme(is_hashed);
   }
   else {
-	hashedpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value); 
-	slapdFrontendConfig->rootpw = slapi_ch_strdup ( hashedpw );
+	/* pwd enc func returns slapi_ch_malloc memory */
+	slapdFrontendConfig->rootpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value); 
   }
   
   CFG_UNLOCK_WRITE(slapdFrontendConfig);
@@ -2032,17 +2023,7 @@ config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, in
   if ( 0 == getrlimit( RLIMIT_NOFILE, &rlp ) ) {
 	  maxVal = (int)rlp.rlim_max;
   }
-  
-  /* DirLite: limit the number of concurent connections by limiting 
-   * maxdescriptors.
-   */
-
-  if ( config_is_slapd_lite() && nValue > SLAPD_LITE_MAXDESCRIPTORS ) {
-	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_MAXDESCRIPTORS_ERR );
-	retVal = LDAP_UNWILLING_TO_PERFORM;
-	nValue = SLAPD_LITE_MAXDESCRIPTORS;
-  }
-	  
+  	  
   if ( nValue < 1 || nValue > maxVal ) {
 	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid value %d, maximum file descriptors must range from 1 to %d (the current process limit)",
 			attrname, nValue, maxVal );
@@ -2220,12 +2201,6 @@ config_set_defaultreferral( const char *attrname, struct berval **value, char *e
   int retVal =  LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
   
-  if ( config_is_slapd_lite() ) {
-	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_DEFAULT_REFERRAL_ERR );
-	retVal = LDAP_UNWILLING_TO_PERFORM;
-	return retVal;
-  }
-
   if ( config_value_is_null( attrname, (char *)value, errorbuf, 0 )) {
 	return LDAP_OPERATIONS_ERROR;
   }
@@ -2531,10 +2506,6 @@ int config_set_referral_mode(const char *attrname, char *url, char *errorbuf, in
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
 	slapdFrontendConfig->refer_mode=REFER_MODE_OFF;
-	if ( config_is_slapd_lite() ) {
-	  PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_REFERRAL_MODE_ERR );
-	  return LDAP_UNWILLING_TO_PERFORM;
-	}
 
     if ((!url) || (!url[0])) {
 	strcpy(errorbuf, "referral url must have a value");
@@ -2554,7 +2525,7 @@ config_set_versionstring( const char *attrname, char *version, char *errorbuf, i
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
   
   if ((!version) || (!version[0])) {
-	strcpy(errorbuf, "versionstring must have a value");
+	PL_strncpyz(errorbuf, "versionstring must have a value", SLAPI_DSE_RETURNTEXT_SIZE);
 	return LDAP_OPERATIONS_ERROR;
   }
   if (apply) {
diff --git a/ldap/servers/slapd/libslapd.def b/ldap/servers/slapd/libslapd.def
index 44f5cb70..eee9cc2e 100644
--- a/ldap/servers/slapd/libslapd.def
+++ b/ldap/servers/slapd/libslapd.def
@@ -401,7 +401,7 @@ EXPORTS
     slapi_matchingrule_get                  @398
     slapi_matchingrule_set                  @399
 	config_set_port 	@400
-; Available for reuse 	@401
+	slapi_ch_smprintf 	@401
 	config_set_secureport 	@402
 	config_set_SSLclientAuth 	@403
 	config_set_workingdir	@404
diff --git a/ldap/servers/slapd/localhost.c b/ldap/servers/slapd/localhost.c
index 3afb9331..0a367ad7 100644
--- a/ldap/servers/slapd/localhost.c
+++ b/ldap/servers/slapd/localhost.c
@@ -226,7 +226,7 @@ get_config_DN()
 						 0, 0, 0);
 			c = slapi_ch_malloc (20);
 		}
-		sprintf (c, "cn=ldap://%s:%lu", host ? host : "", config_get_port());
+		sprintf (c, "cn=ldap://%s:%d", host ? host : "", config_get_port());
 		config_DN = c;
 	}
 
diff --git a/ldap/servers/slapd/lock.c b/ldap/servers/slapd/lock.c
index ef21b841..6f13497e 100644
--- a/ldap/servers/slapd/lock.c
+++ b/ldap/servers/slapd/lock.c
@@ -25,8 +25,7 @@ lock_fopen( char *fname, char *type, FILE **lfp )
 	char	buf[MAXPATHLEN];
 
 	/* open the lock file */
-	strcpy( buf, fname );
-	strcat( buf, ".lock" );
+	PR_snprintf( buf, MAXPATHLEN, "%s%s", fname, ".lock" );
 	if ( (*lfp = fopen( buf, "w" )) == NULL ) {
 		LDAPDebug( LDAP_DEBUG_ANY, "could not open \"%s\"\n", buf, 0, 0 );
 		return( NULL );
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 10b6032b..091abca2 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -184,7 +184,9 @@ void g_set_detached(int val)
 void g_log_init(int log_enabled)
 {
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+#if defined( XP_WIN32 )
 	char * instancedir = NULL;
+#endif
 
 	ts_time_lock = PR_NewLock();
 	if (! ts_time_lock)
@@ -208,7 +210,7 @@ void g_log_init(int log_enabled)
     if( !hSlapdEventSource  )
     {
         char szMessage[256];
-        sprintf( szMessage, "Directory Server %s is terminating. Failed "
+        PR_snprintf( szMessage, sizeof(szMessage), "Directory Server %s is terminating. Failed "
             "to set the EventLog source.", pszServerName);
         MessageBox(GetDesktopWindow(), szMessage, " ", 
             MB_ICONEXCLAMATION | MB_OK);
@@ -1568,7 +1570,7 @@ int error_log_openf( char *pathname, int locked)
 	loginfo.log_error_file = slapi_ch_strdup(pathname); 		
 
 	/* store the rotation info fiel path name */
-	 sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	slapi_ch_free ((void**)&loginfo.log_errorinfo_file);
 	loginfo.log_errorinfo_file = slapi_ch_strdup ( buf );
 
@@ -1607,7 +1609,7 @@ audit_log_openf( char *pathname, int locked)
 	loginfo.log_audit_file = slapi_ch_strdup ( pathname );
 
 	/* store the rotation info file path name */
-	sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	loginfo.log_auditinfo_file = slapi_ch_strdup ( buf );
 
 	/*
@@ -1795,7 +1797,7 @@ vslapd_log_error(
     else  /* stderr is always unbuffered */
 	fprintf(stderr, "%s", buffer);
 
-    free (vbuf);
+    PR_smprintf_free (vbuf);
     return( 0 );
 }
 
@@ -1962,7 +1964,7 @@ int access_log_openf(char *pathname, int locked)
 	loginfo.log_access_file = slapi_ch_strdup ( pathname );
 
 	/* store the rotation info fiel path name */
-	sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	loginfo.log_accessinfo_file = slapi_ch_strdup ( buf );
 
 	/*
@@ -2038,7 +2040,7 @@ log__open_accesslogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1 /*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_access_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_access_file, tbuf);
 			if (PR_Rename (loginfo.log_access_file, newfile) != PR_SUCCESS) {
 				loginfo.log_access_fdes = NULL;
     				if (!locked)  LOG_ACCESS_UNLOCK_WRITE();
@@ -2085,13 +2087,13 @@ log__open_accesslogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /* long */);
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf (buffer,sizeof(buffer),"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_access_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short*/);
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
                         loginfo.log_access_file, tbuf, logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
@@ -2265,14 +2267,14 @@ log__delete_access_logfile()
 	if (loginfo.log_access_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_access_fdes);
                 loginfo.log_access_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_access_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_access_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
@@ -2375,7 +2377,7 @@ delete_logfile:
 
 	/* Delete the access file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_access_file, tbuf);
+	PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
 	if (PR_Delete(buffer) != PR_SUCCESS) {
 		LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.%s\n",
@@ -2686,7 +2688,7 @@ log_get_loglist(int logtype)
 	i = 0;
 	while (logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);
-		sprintf(buf, "%s.%s", file, tbuf);
+		PR_snprintf(buf, sizeof(buf), "%s.%s", file, tbuf);
 		list[i] = slapi_ch_strdup(buf);
 		i++;
 		logp = logp->l_next;
@@ -2739,14 +2741,14 @@ log__delete_error_logfile()
 	if (loginfo.log_error_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_error_fdes);
                 loginfo.log_error_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_error_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_error_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_error_file,0,0);
@@ -2848,7 +2850,7 @@ delete_logfile:
 
 	/* Delete the error file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_error_file, tbuf);
+	PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
 	PR_Delete(buffer);
 	slapi_ch_free((void**)&delete_logp);
 	loginfo.log_numof_error_logs--;
@@ -2886,14 +2888,14 @@ log__delete_audit_logfile()
 	if (loginfo.log_audit_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_audit_fdes);
                 loginfo.log_audit_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_audit_file);
+		PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_audit_file);
+		PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
@@ -2995,7 +2997,7 @@ delete_logfile:
 
 	/* Delete the audit file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_audit_file, tbuf );
+	PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
 	if (PR_Delete(buffer) != PR_SUCCESS) {
 		LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.%s\n",
@@ -3227,7 +3229,7 @@ log__open_errorlogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1/*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_error_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_error_file, tbuf);
 			if (PR_Rename (loginfo.log_error_file, newfile) != PR_SUCCESS) {
 				return LOG_UNABLE_TO_OPENFILE;
 			}
@@ -3273,13 +3275,13 @@ log__open_errorlogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /*long */);
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf(buffer, sizeof(buffer),"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_error_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
                         loginfo.log_error_file,	tbuf, logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
@@ -3347,7 +3349,7 @@ log__open_auditlogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1 /*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_audit_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_audit_file, tbuf);
 			if (PR_Rename (loginfo.log_audit_file, newfile) != PR_SUCCESS) {
 				if (!locked) LOG_AUDIT_UNLOCK_WRITE();
 				return LOG_UNABLE_TO_OPENFILE;
@@ -3394,13 +3396,13 @@ log__open_auditlogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /*long */);	
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_audit_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);	
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%d) (%d)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%d) (%d)\n",
                         loginfo.log_audit_file, tbuf, (int)logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 5dfeb337..fe2518a2 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -216,7 +216,7 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
 {
   PRDir *dir;
   PRDirEntry *entry;
-  char dirname[MAXPATHLEN + 1], file[MAXPATHLEN + 1];
+  char file[MAXPATHLEN + 1];
   char *log=NULL, *ptr=NULL;
   int rc=0;
 
@@ -240,7 +240,7 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
     /* change the owner for each of the files in the dir */
     while( (entry = PR_ReadDir(dir , PR_SKIP_BOTH )) !=NULL ) 
     {
-	sprintf(file,"%s/%s",log,entry->name);
+	PR_snprintf(file,MAXPATHLEN+1,"%s/%s",log,entry->name);
 	chown_if_not_owner( file, pw->pw_uid, -1 ); 
     }
     PR_CloseDir( dir );
@@ -255,7 +255,6 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
 static void
 fix_ownership() 
 {
-	int len, n;
 	struct passwd* pw=NULL;
 	char dirname[MAXPATHLEN + 1];
 
@@ -272,7 +271,7 @@ fix_ownership()
 
 	/* The instance directory needs to be owned by the local user */
 	chown_if_not_owner( slapdFrontendConfig->instancedir, pw->pw_uid, -1 );
-	sprintf(dirname,"%s/config",slapdFrontendConfig->instancedir);
+	PR_snprintf(dirname,sizeof(dirname),"%s/config",slapdFrontendConfig->instancedir);
 	chown_dir_files(dirname, pw, PR_FALSE); /* config directory */
 	chown_dir_files(slapdFrontendConfig->accesslog, pw, PR_TRUE); /* do access log directory */
 	chown_dir_files(slapdFrontendConfig->auditlog, pw, PR_TRUE);  /* do audit log directory */
@@ -493,7 +492,7 @@ static void ids_get_platform_solaris(char *buf)
     sbuf[0] = '\0';
     sysinfo(SI_PLATFORM,sbuf,128);
     
-    sprintf(buf,"%ssparc%s-%s-solaris",
+    PR_snprintf(buf,sizeof(buf),"%ssparc%s-%s-solaris",
 	    is_u ? "u" : "",
 	    sizeof(long) == 4 ? "" : "v9",
 	    sbuf);
@@ -867,7 +866,7 @@ main( int argc, char **argv)
 	if( !hSlapdEventSource  )
 	{
 		char szMessage[256];
-		sprintf( szMessage, "Directory Server %s is terminating. Failed "
+		PR_snprintf( szMessage, sizeof(szMessage), "Directory Server %s is terminating. Failed "
 			"to set the EventLog source.", pszServerName);
 		MessageBox(GetDesktopWindow(), szMessage, " ", 
 			MB_ICONEXCLAMATION | MB_OK);
@@ -1067,7 +1066,7 @@ main( int argc, char **argv)
     		else
     		{
     			char szMessage[256];
-    			sprintf( szMessage, "The Directory Server %s is terminating due to an error. Check server port specification", pszServerName);
+    			PR_snprintf( szMessage, sizeof(szMessage), "The Directory Server %s is terminating due to an error. Check server port specification", pszServerName);
     			MessageBox(GetDesktopWindow(), szMessage,	" ", MB_ICONEXCLAMATION | MB_OK);
     		}
 #endif
@@ -1645,8 +1644,7 @@ process_command_line(int argc, char **argv, char *myname,
 		case 't':	/* attribute type to index - may be repeated */
 		case 'T':	/* VLV Search to index - may be repeated */
 			if ( slapd_exemode == SLAPD_EXEMODE_DB2INDEX ) {
-                char *p= slapi_ch_malloc(strlen(optarg_ext) + 2);
-                sprintf(p,"%c%s",i,optarg_ext);
+                char *p= slapi_ch_smprintf("%c%s",i,optarg_ext);
     			charray_add( &db2index_attrs, p);
 				break;
             }
@@ -1775,16 +1773,14 @@ lookup_instance_name_by_suffix(char *suffix,
     if (pb == NULL)
         goto done;
 
-    query = slapi_ch_malloc(strlen((const char *)suffix) + 80);         /* round up */
+	if (isexact)
+    	query = slapi_ch_smprintf("(&(objectclass=nsmappingtree)(|(cn=\"%s\")(cn=%s)))", suffix, suffix);
+	else
+    	query = slapi_ch_smprintf("(&(objectclass=nsmappingtree)(|(cn=*%s\")(cn=*%s)))", suffix, suffix);
 
     if (query == NULL)
 		goto done;
 
-	if (isexact)
-    	sprintf(query, "(&(objectclass=nsmappingtree)(|(cn=\"%s\")(cn=%s)))", suffix, suffix);
-	else
-    	sprintf(query, "(&(objectclass=nsmappingtree)(|(cn=*%s\")(cn=*%s)))", suffix, suffix);
-
     slapi_search_internal_set_pb(pb, "cn=mapping tree,cn=config",
         LDAP_SCOPE_SUBTREE, query, NULL, 0, NULL, NULL,
         (void *)plugin_get_default_component_id(), 0);
@@ -1858,12 +1854,11 @@ static struct slapdplugin *lookup_plugin_by_instance_name(const char *name)
     if (pb == NULL)
         return NULL;
 
-    query = slapi_ch_malloc(strlen(name) + 80);         /* round up */
+    query = slapi_ch_smprintf("(&(cn=%s)(objectclass=nsBackendInstance))", name);
     if (query == NULL) {
         slapi_pblock_destroy(pb);
         return NULL;
     }
-    sprintf(query, "(&(cn=%s)(objectclass=nsBackendInstance))", name);
 
     slapi_search_internal_set_pb(pb, "cn=plugins,cn=config",
         LDAP_SCOPE_SUBTREE, query, NULL, 0, NULL, NULL,
@@ -2363,7 +2358,6 @@ static int
 slapd_exemode_db2archive()
 {
     int return_value= 0;
-	Slapi_Backend *be = NULL;
 	Slapi_PBlock pb;
 	struct slapdplugin *backend_plugin;
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
@@ -2419,7 +2413,6 @@ static int
 slapd_exemode_archive2db()
 {
     int return_value= 0;
-	Slapi_Backend *be = NULL;
 	Slapi_PBlock pb;
 	struct slapdplugin *backend_plugin;
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 572b1b29..a25f0ab3 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -874,13 +874,10 @@ mapping_tree_node_get_children(mapping_tree_node *target, int is_root)
      * Since we don't really support it, children of the root node won't
      * have a MAPPING_TREE_PARENT_ATTRIBUTE. */
     if (is_root) {
-        filter = slapi_ch_malloc(strlen(MAPPING_TREE_PARENT_ATTRIBUTE)+38);
-        sprintf(filter, "(&(objectclass=nsMappingTree)(!(%s=*)))",
+        filter = slapi_ch_smprintf("(&(objectclass=nsMappingTree)(!(%s=*)))",
                  MAPPING_TREE_PARENT_ATTRIBUTE);
     } else {
-        filter = slapi_ch_malloc(strlen(slapi_sdn_get_dn(target->mtn_subtree))
-                    + strlen(MAPPING_TREE_PARENT_ATTRIBUTE) + 36);
-        sprintf(filter, "(&(objectclass=nsMappingTree)(%s=\"%s\"))",
+        filter = slapi_ch_smprintf("(&(objectclass=nsMappingTree)(%s=\"%s\"))",
             MAPPING_TREE_PARENT_ATTRIBUTE, 
             slapi_sdn_get_dn(target->mtn_subtree));
     }
@@ -1097,7 +1094,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 
             if ((backends == NULL) && (node->mtn_state == MTN_BACKEND))
             {
-                sprintf(returntext, "mapping tree entry need at least one nsslapd-backend\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "mapping tree entry need at least one nsslapd-backend\n");
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
                 mtn_unlock();
                 free_get_backends_from_attr(&backends, &be_names, &be_states, &be_list_count);
@@ -1125,7 +1122,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
              */
             if ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) != LDAP_MOD_REPLACE)
             {
-                sprintf(returntext, "must use replace operation to change state\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "must use replace operation to change state\n");
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
                 slapi_sdn_free(&subtree);
                 return SLAPI_DSE_CALLBACK_ERROR;
@@ -1145,7 +1142,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
             {
                 if (slapi_entry_attr_find(entryAfter, "nsslapd-backend", &attr))
                 {
-                    sprintf(returntext, "need to set nsslapd-backend before moving to backend state\n");
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "need to set nsslapd-backend before moving to backend state\n");
                     slapi_sdn_free(&subtree);
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     return SLAPI_DSE_CALLBACK_ERROR;
@@ -1157,7 +1154,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
             {
                 if (slapi_entry_attr_find(entryAfter, "nsslapd-referral", &attr))
                 {
-                    sprintf(returntext, "need to set nsslapd-referral before moving to referral state\n");
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "need to set nsslapd-referral before moving to referral state\n");
                     slapi_sdn_free(&subtree);
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     return SLAPI_DSE_CALLBACK_ERROR;
@@ -1193,7 +1190,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
                 if ((node->mtn_state == MTN_REFERRAL) ||
                     (node->mtn_state == MTN_REFERRAL_ON_UPDATE))
                 {
-                    sprintf(returntext,
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
                              "cannot delete referrals in this state\n");
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     mtn_unlock();
@@ -1281,7 +1278,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 
             if (plugin == NULL)
             {
-                sprintf(returntext, "cannot find distribution plugin\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "cannot find distribution plugin\n");
                 slapi_ch_free((void **) &plugin_fct);
                 slapi_ch_free((void **) &plugin_lib);
                 slapi_sdn_free(&subtree);
@@ -1297,7 +1294,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
         else
         {
             /* only one parameter configured -> ERROR */
-            sprintf(returntext,
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
                  "must define distribution function and library\n");
             slapi_ch_free((void **) &plugin_fct);
             slapi_ch_free((void **) &plugin_lib);
@@ -1430,7 +1427,7 @@ int mapping_tree_entry_delete_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
     {
         result = SLAPI_DSE_CALLBACK_ERROR;
         *returncode = LDAP_UNWILLING_TO_PERFORM;
-        sprintf(returntext, "this node has some children");
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "this node has some children");
         goto done;
     }
 
@@ -2008,9 +2005,9 @@ int slapi_mapping_tree_select(Slapi_PBlock *pb, Slapi_Backend **be, Slapi_Entry
             (op_type != SLAPI_OPERATION_BIND) && 
             (op_type != SLAPI_OPERATION_UNBIND)) {
             ret = LDAP_UNWILLING_TO_PERFORM;
-            strcpy(errorbuf, slapi_config_get_readonly() ? 
+            PL_strncpyz(errorbuf, slapi_config_get_readonly() ? 
                     "Server is read-only" :
-                    "database is read-only");
+                    "database is read-only", BUFSIZ);
             slapi_be_Unlock(*be);
             *be = NULL;
         }
@@ -2177,7 +2174,7 @@ void slapi_mapping_tree_free_all(Slapi_Backend **be_list, Slapi_Entry **referral
     {
         Slapi_Backend * be;
     
-        while (be = be_list[index++])
+        while ((be = be_list[index++]))
         {
             slapi_log_error(SLAPI_LOG_ARGS, NULL, "mapping tree release backend : %s\n", slapi_be_get_name(be));
             slapi_be_Unlock(be);
@@ -2188,7 +2185,7 @@ void slapi_mapping_tree_free_all(Slapi_Backend **be_list, Slapi_Entry **referral
     if (referral_list[index] != NULL)
     {
         Slapi_Entry * referral;
-        while (referral = referral_list[index++])
+        while ((referral = referral_list[index++]))
         {
             slapi_entry_free(referral);
         }
@@ -2237,7 +2234,7 @@ int slapi_mapping_tree_select_and_check(Slapi_PBlock *pb,char *newdn, Slapi_Back
     if ((*be) && ((*be != new_be) || mtn_sdn_has_child(target_sdn)))
     {
         ret = LDAP_UNWILLING_TO_PERFORM;
-        sprintf(errorbuf, "Cannot move entries accross backends\n");
+        PR_snprintf(errorbuf, BUFSIZ, "Cannot move entries accross backends\n");
         goto unlock_and_return;
     }
 
@@ -2356,10 +2353,11 @@ static int mtn_get_be(mapping_tree_node *target_node, Slapi_PBlock *pb,
     target_sdn = operation_get_target_spec (op);
 
     if (target_node->mtn_state == MTN_DISABLED) {
-        if (errorbuf)
-            sprintf(errorbuf,
+		if (errorbuf) {
+			PR_snprintf(errorbuf, BUFSIZ,
                 "Warning: Operation attempted on a disabled node : %s\n",
-                    slapi_sdn_get_dn(target_node->mtn_subtree));
+				slapi_sdn_get_dn(target_node->mtn_subtree));
+		}
         result = LDAP_OPERATIONS_ERROR;
         return result;
     }
@@ -2475,7 +2473,7 @@ static int mtn_get_be(mapping_tree_node *target_node, Slapi_PBlock *pb,
             (*index)++;
             if (NULL == *referral) {
                 if (errorbuf) {
-                    sprintf(errorbuf, 
+                    PR_snprintf(errorbuf, BUFSIZ,
                     "Mapping tree node for %s is set to return a referral,"
                         " but no referral is configured for it",
                         slapi_sdn_get_ndn(target_node->mtn_subtree));
@@ -2672,7 +2670,6 @@ get_mapping_tree_node_by_name(mapping_tree_node * node, char * be_name)
 char* 
 slapi_get_mapping_tree_node_configdn (const Slapi_DN *root)
 {
-    int len;
     char *dn;
 
     if(mapping_tree_freed){
@@ -2682,9 +2679,7 @@ slapi_get_mapping_tree_node_configdn (const Slapi_DN *root)
     if (root == NULL)
         return NULL;
 
-    len = strlen (slapi_sdn_get_dn(root)) + strlen (MAPPING_TREE_BASE_DN) + 7; /* cn= + " + " + , + \0 */
-    dn = (char*)slapi_ch_malloc (len);
-    sprintf (dn, "cn=\"%s\",%s", slapi_sdn_get_dn(root), MAPPING_TREE_BASE_DN);
+    dn = slapi_ch_smprintf("cn=\"%s\",%s", slapi_sdn_get_dn(root), MAPPING_TREE_BASE_DN);
 
     return dn;
 }
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 1e73f7c6..dcb28795 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -162,7 +162,6 @@ do_modify( Slapi_PBlock *pb )
 		if ( !mod->mod_type || !*mod->mod_type ) {
 			char ebuf[BUFSIZ];
 			PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
-			ebuf[BUFSIZ-1] = '\0';
 			op_shared_log_error_access (pb, "MOD", dn, ebuf);
 			send_ldap_result( pb, LDAP_INVALID_SYNTAX, NULL, ebuf, 0, NULL );
 			slapi_ch_free((void **)&type);
diff --git a/ldap/servers/slapd/monitor.c b/ldap/servers/slapd/monitor.c
index 2321223e..cfea7ded 100644
--- a/ldap/servers/slapd/monitor.c
+++ b/ldap/servers/slapd/monitor.c
@@ -166,8 +166,7 @@ slapd_get_version_value( void )
         versionstring = config_get_versionstring();
         buildnum = config_get_buildnum();
 
-        vs = slapi_ch_malloc( strlen(versionstring) + strlen( buildnum) + 3 );
-        sprintf( vs, "%s B%s", versionstring, buildnum );
+        vs = slapi_ch_smprintf("%s B%s", versionstring, buildnum );
 
         slapi_ch_free( (void **) &buildnum);
         slapi_ch_free( (void **) &versionstring);
diff --git a/ldap/servers/slapd/ntwdog/cron_conf.c b/ldap/servers/slapd/ntwdog/cron_conf.c
index 78e2c3ac..7d130c4f 100644
--- a/ldap/servers/slapd/ntwdog/cron_conf.c
+++ b/ldap/servers/slapd/ntwdog/cron_conf.c
@@ -261,7 +261,7 @@ static cron_conf_obj *get_object(FILE *fp)
 
 		  if (q)
 		    {
-		      sprintf(command, "%s", q);
+		      PR_snprintf(command, S_BUF_SIZE, "%s", q);
 		      /* debug("Setting command to '%s'", command); */
 		      hascom++;
 		    }
@@ -294,7 +294,7 @@ static cron_conf_obj *get_object(FILE *fp)
 
 		  if (q)
 		    {
-		      sprintf(dir, "%s", q);
+		      PR_snprintf(dir, S_BUF_SIZE, "%s", q);
 		      /* debug("Setting dir to '%s'", dir); */
 		      hasdir++;
 		    }
@@ -313,7 +313,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hasuser)
 		{
-		  sprintf(user, "%s", q);
+		  PR_snprintf(user, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting user to '%s'", user); */
 		  hasuser++;
 		}
@@ -331,7 +331,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hastime)
 		{
-		  sprintf(start_time, "%s", q);
+		  PR_snprintf(start_time, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting time to '%s'", start_time); */
 		  hastime++;
 		}
@@ -349,7 +349,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hasdays)
 		{
-		  sprintf(days, "%s", q);
+		  PR_snprintf(days, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting days to '%s'", days); */
 		  hasdays++;
 		}
diff --git a/ldap/servers/slapd/ntwdog/ntcron.c b/ldap/servers/slapd/ntwdog/ntcron.c
index d3bcb43a..1cb31300 100644
--- a/ldap/servers/slapd/ntwdog/ntcron.c
+++ b/ldap/servers/slapd/ntwdog/ntcron.c
@@ -55,7 +55,7 @@ BOOL CRON_CheckTime(LPSYSTEMTIME lpstNow, char *szTime)
 	char szCurrentTime[16];
 	char szStartTime[16];
 
-	strcpy(szStartTime, szTime);
+	strncpy(szStartTime, szTime, sizeof(szStartTime)-1);
 
 	if(szTime[1] == ':')
 		wsprintf(szStartTime, "0%s", szTime);
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 847cdd31..7ff8ff06 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -740,7 +740,7 @@ process_entry(Slapi_PBlock *pb, Slapi_Entry *e, int send_result)
     return 0;
 }
 
-
+#if 0
 /* Loops through search entries and sends them to the client. 
  * returns -1 on error, 0 if result packet was sent or 1 if
  * result packet wasn't sent
@@ -883,6 +883,7 @@ iterate_with_lookahead(Slapi_PBlock *pb, Slapi_Backend *be, int send_result, int
 		return 0;
     }
 }
+#endif
 
 /* Loops through search entries and sends them to the client. 
  * returns -1 on error or 1 if result packet wasn't sent.
@@ -1095,7 +1096,6 @@ static int  send_results (Slapi_PBlock *pb, int send_result, int * nentries)
 {
 	Slapi_Backend *be; 
 	int rc;
-	struct berval **urls = NULL;
 
 	slapi_pblock_get (pb, SLAPI_BACKEND, &be);
 
diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c
index f0403721..2ff03411 100644
--- a/ldap/servers/slapd/passwd_extop.c
+++ b/ldap/servers/slapd/passwd_extop.c
@@ -173,11 +173,8 @@ passwd_modify_extop( Slapi_PBlock *pb )
 	char		*oldPasswd = NULL;
 	char		*newPasswd = NULL;
 	char		*errMesg = NULL;
-	char		**reqvals = NULL;
 	int             ret=0, rc=0;
 	unsigned long	tag=0, len=-1;
-	LDAPControl	**ctrlp = NULL; /* unused */
-	Slapi_Operation *operation = NULL; /* unused */
 	struct berval *extop_value = NULL;
 	BerElement	*ber = NULL;
 	Slapi_Entry *targetEntry=NULL;
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index 3db20f67..38dc7f44 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -94,10 +94,11 @@ typedef struct entry_and_plugin {
 	struct entry_and_plugin *next;
 } entry_and_plugin_t;
 
-static entry_and_plugin_t *plugin_entries = NULL;
 static entry_and_plugin_t *dep_plugin_entries = NULL; /* for dependencies */
 
 #if 0
+static entry_and_plugin_t *plugin_entries = NULL;
+
 static void
 add_plugin_entries()
 {
@@ -184,9 +185,7 @@ slapi_register_plugin(
 	int ii = 0;
     int rc = 0;
 	Slapi_Entry *e = slapi_entry_alloc();
-	char *dn = slapi_ch_calloc(1, strlen(name) + strlen(PLUGIN_BASE_DN) + 10);
-
-	sprintf(dn, "cn=%s, %s", name, PLUGIN_BASE_DN);
+	char *dn = slapi_ch_smprintf("cn=%s, %s", name, PLUGIN_BASE_DN);
 	/* this function consumes dn */
 	slapi_entry_init(e, dn, NULL);
 
@@ -199,7 +198,7 @@ slapi_register_plugin(
 
 	for (ii = 0; argv && argv[ii]; ++ii) {
 		char argname[64];
-		sprintf(argname, "%s%d", ATTR_PLUGIN_ARG, ii);
+		PR_snprintf(argname, sizeof(argname), "%s%d", ATTR_PLUGIN_ARG, ii);
 		slapi_entry_attr_set_charptr(e, argname, argv[ii]);
 	}
 
@@ -2123,13 +2122,13 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group,
 	/* add the plugin arguments */
 	value = 0;
 	ii = 0;
-	sprintf(attrname, "%s%d", ATTR_PLUGIN_ARG, ii);
+	PR_snprintf(attrname, sizeof(attrname), "%s%d", ATTR_PLUGIN_ARG, ii);
 	while ((value = slapi_entry_attr_get_charptr(plugin_entry, attrname)) != NULL)
 	{
 		charray_add(&plugin->plg_argv, value);
 		plugin->plg_argc++;
 		++ii;
-		sprintf(attrname, "%s%d", ATTR_PLUGIN_ARG, ii);
+		PR_snprintf(attrname, sizeof(attrname), "%s%d", ATTR_PLUGIN_ARG, ii);
 	}
 
 	memset((char *)&pb, '\0', sizeof(pb));
@@ -2430,9 +2429,7 @@ char* plugin_get_dn (const struct slapdplugin *plugin)
 	if (plugin->plg_name == NULL)
 		return NULL;
 
-	plugindn = (char*)slapi_ch_malloc (strlen (pattern) + strlen (plugin->plg_name));
-	if (plugindn)
-		sprintf (plugindn, pattern, plugin->plg_name);
+	plugindn = slapi_ch_smprintf(pattern, plugin->plg_name);
 
 	return plugindn;
 }
diff --git a/ldap/servers/slapd/protect_db.c b/ldap/servers/slapd/protect_db.c
index 3f9c5c16..4efe729a 100644
--- a/ldap/servers/slapd/protect_db.c
+++ b/ldap/servers/slapd/protect_db.c
@@ -247,7 +247,7 @@ sample_and_update(char *dir_name)
 	if (is_process_up(pid)) {
 	    result = (long) pid;
 	} else {
-	    sprintf(file_name, "%s/%s", dir_name, entry->name);
+	    PR_snprintf(file_name, MAXPATHLEN, "%s/%s", dir_name, entry->name);
 	    PR_Delete(file_name);
 	}
     }
@@ -293,7 +293,7 @@ remove_and_update(char *dir_name)
 	    continue;
 	}	
 	if (!is_process_up(pid) || pid == our_pid) {
-	    sprintf(file_name, "%s/%s", dir_name, entry->d_name);
+	    PR_snprintf(file_name, MAXPATHLEN, "%s/%s", dir_name, entry->d_name);
 	    unlink(file_name);
 	}
     }
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 09f04d0b..7ad6ee4d 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -455,8 +455,6 @@ void send_referrals_from_entry(Slapi_PBlock *pb, Slapi_Entry *referral);
 
 #define DSE_BACKEND             "frontend-internal"
 
-#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
-
 struct dse *dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfilename, const char *configdir);
 struct dse *dse_new_with_filelist(char *filename, char *tmpfilename, char *backfilename, char *startokfilename, const char *configdir, char **filelist);
 int dse_deletedse(Slapi_PBlock *pb);
@@ -1148,6 +1146,12 @@ void ids_sasl_check_bind(Slapi_PBlock *pb);
 void ids_sasl_server_new(Connection *conn);
 
 /*
+ * sasl_io.c
+ */
+/* This function should be called under the connection mutex */
+int sasl_io_setup(Connection *c);
+
+/*
  * daemon.c
  */
 #ifndef LINUX
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 1b55b954..76e6c5d6 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -353,7 +353,6 @@ int checkPrefix(char *cipher, char *schemaName, char **encrypt)
 int
 pw_rever_decode(char *cipher, char **plain, const char * attr_name)
 {
-	char	*dec = NULL;
 	struct pw_scheme	*pwsp = NULL;
 	struct slapdplugin	*p = NULL;
 
@@ -510,7 +509,6 @@ update_pw_info ( Slapi_PBlock *pb , char *old_pw) {
 
 	Slapi_Mods	smods;
 	char *timestr;
-	Slapi_PBlock 	*mod_result_pb = NULL;
 	time_t 		pw_exp_date;
 	time_t          cur_time;
 	char 		*dn;
@@ -979,7 +977,6 @@ pw_mod_allowchange_aci(int pw_prohibit_change) {
 	char		*values_mod[2];
 	LDAPMod		mod;
 	LDAPMod		*mods[2];
-	char		*aci_pw = NULL;
 	Slapi_Backend *be;
 	char *cookie = NULL;
 
@@ -1243,104 +1240,104 @@ new_passwdPolicy(Slapi_PBlock *pb, char *dn)
 				{
 					slapi_attr_get_type(attr, &attr_name);
 					if (!strcasecmp(attr_name, "passwordminage")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_minage = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmaxage")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_maxage = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordwarning")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_warning = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordhistory")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_history = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordinhistory")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_inhistory = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordlockout")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_lockout = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmaxfailure")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_maxfailure = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordunlock")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_unlock = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordlockoutduration")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_lockduration = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordresetfailurecount")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_resetfailurecount = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordchange")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_change = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}       
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmustchange")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_must_change = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordchecksyntax")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_syntax = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordminlength")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_minlength = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordexp")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_exp = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordgracelimit")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_gracelimit = slapi_value_get_int(*sval);
 						}
 					}
@@ -1554,7 +1551,7 @@ check_pw_storagescheme_value( const char *attr_name, char *value, long minval, l
 		*/ 
 
 		if ( scheme_list != NULL ) {
-			sprintf( errorbuf,
+			PR_snprintf ( errorbuf, BUFSIZ, 
 				"%s: invalid encoding scheme - %s\nValid values are: %s\n",
 				CONFIG_PW_STORAGESCHEME_ATTRIBUTE, value, scheme_list );
 		}
diff --git a/ldap/servers/slapd/pw_retry.c b/ldap/servers/slapd/pw_retry.c
index 094d1587..daf9a8c0 100644
--- a/ldap/servers/slapd/pw_retry.c
+++ b/ldap/servers/slapd/pw_retry.c
@@ -13,7 +13,6 @@
 /* prototypes                                                               */
 /****************************************************************************/
 /* Slapi_Entry *get_entry ( Slapi_PBlock *pb, const char *dn ); */
-static void set_reset_time ( Slapi_PBlock *pb, time_t cur_time );
 static void set_retry_cnt ( Slapi_PBlock *pb, int count);
 static void set_retry_cnt_and_time ( Slapi_PBlock *pb, int count, time_t cur_time);
 
@@ -92,7 +91,6 @@ void set_retry_cnt_and_time ( Slapi_PBlock *pb, int count, time_t cur_time ) {
 	Slapi_Mods	smods;
 	time_t      reset_time;
 	char		*timestr;
-	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 	passwdPolicy *pwpolicy = NULL;
 
 	slapi_pblock_get( pb, SLAPI_TARGET_DN, &dn );
@@ -119,7 +117,6 @@ void set_retry_cnt_mods(Slapi_PBlock *pb, Slapi_Mods *smods, int count)
 	char 		*timestr;
 	time_t		unlock_time;
 	char        retry_cnt[8]; /* 1-65535 */
-	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 	char *dn = NULL; 
 	passwdPolicy *pwpolicy = NULL;
 
@@ -162,32 +159,6 @@ void set_retry_cnt ( Slapi_PBlock *pb, int count) {
 	slapi_mods_done(&smods);
 }
 
-static
-void set_reset_time ( Slapi_PBlock *pb, time_t cur_time ) {
-	char            *dn;
-	Slapi_Mods	smods;
-	time_t          reset_time;
-	char *timestr;
-	int resetfailurecount;
-	passwdPolicy *pwpolicy = NULL;
-
-	slapi_pblock_get( pb, SLAPI_TARGET_DN, &dn );
-	
-	pwpolicy = new_passwdPolicy(pb, dn);
-	resetfailurecount = pwpolicy->pw_resetfailurecount;
-
-	slapi_mods_init(&smods, 0);
-
-	reset_time = time_plus_sec ( cur_time, resetfailurecount );
-
-	timestr = format_genTime ( reset_time );
-	slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "retryCountResetTime", timestr);
-	slapi_ch_free((void **)&timestr);
-
-	pw_apply_mods(dn, &smods);
-	slapi_mods_done(&smods);
-	delete_passwdPolicy(&pwpolicy);
-}
 
 Slapi_Entry *get_entry ( Slapi_PBlock *pb, const char *dn)
 {
diff --git a/ldap/servers/slapd/referral.c b/ldap/servers/slapd/referral.c
index 4391c6b9..cede05d6 100644
--- a/ldap/servers/slapd/referral.c
+++ b/ldap/servers/slapd/referral.c
@@ -1089,13 +1089,11 @@ get_data_source(Slapi_PBlock *pb, const Slapi_DN *sdn, int orc, void *cfrp)
 		/* Get the basic referral */
 		bv = slapi_ch_bvdup(the_refs->ra_refs[walker]->ref_referral);
 		old_referral_string = bv->bv_val;
-		/* The longest new string will be one character longer than the old one */
-		new_referral_string = slapi_ch_malloc(bv->bv_len + 1); 
 		/* Re-write it to replace ldap with ldaps, and remove the port information */
 		/* The original string will look like this: ldap://host:port */
 		/* We need to make it look like this: ldaps://host */
 		/* Potentially the ":port" part might be missing from the original */
-		sprintf(new_referral_string, "%s%s" , LDAPS_URL_PREFIX, old_referral_string + strlen(LDAP_URL_PREFIX) );
+		new_referral_string = slapi_ch_smprintf("%s%s" , LDAPS_URL_PREFIX, old_referral_string + strlen(LDAP_URL_PREFIX) );
 		/* Go looking for the port */
 		p = new_referral_string + (strlen(LDAPS_URL_PREFIX) + 1);
 		while (*p != '\0' && *p != ':') p++;
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 4995a620..9a406e85 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -943,7 +943,6 @@ static int send_all_attrs(Slapi_Entry *e,char **attrs,Slapi_Operation *op,Slapi_
 			/**********************************************/
 			int item_count = 0;
 			int iter = 0;
-			int j = 0;
 			Slapi_DN *namespace_dn;
 			Slapi_Backend *backend=0;
 			vattr_context *ctx;
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index ec2068f1..2ac029b4 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -64,6 +64,7 @@ sasl_map_private *sasl_map_new_private()
 	return new_priv;
 }
 
+#if 0 /* unused for now */
 static void 
 sasl_map_free_private(sasl_map_private **priv)
 {
@@ -71,6 +72,7 @@ sasl_map_free_private(sasl_map_private **priv)
 	slapi_ch_free((void**)priv);
 	*priv = NULL;
 }
+#endif
 
 /* This function does a shallow copy on the payload data supplied, so the caller should not free it, and it needs to be allocated using slapi_ch_malloc() */
 static 
@@ -425,10 +427,7 @@ sasl_map_str_concat(char *s1, char *s2)
 	if (NULL == s2) {
 		return (slapi_ch_strdup(s1));
 	} else {
-		size_t s1len = strlen(s1);
-		size_t length = s1len +  + strlen(s2);
-		char *newstr = slapi_ch_malloc(length + 2);
-		sprintf(newstr,"%s@%s",s1,s2);
+		char *newstr = slapi_ch_smprintf("%s@%s",s1,s2);
 		return newstr;
 	}
 }
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 669abcd2..1a6c2f14 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -840,7 +840,7 @@ void ids_sasl_check_bind(Slapi_PBlock *pb)
         }
 
         /* set the connection bind credentials */
-        sprintf(authtype, "%s%s", SLAPD_AUTH_SASL, mech);
+        PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech);
         bind_credentials_set(pb->pb_conn, authtype, dn, 
                              NULL, NULL, NULL, bind_target_entry);
 
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index b8324b7c..a078df1b 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2777,9 +2777,8 @@ read_oc_ldif ( const char *input, struct objclass **oc, char *errorbuf,
   ** ocname-oid
   */
   if ( strcasecmp ( pOcOid, "NAME" ) == 0 ) {
-	free( pOcOid );
-	pOcOid = slapi_ch_malloc( 8 + strlen(psbOcName->buffer));
-	sprintf(pOcOid, "%s-oid", psbOcName->buffer );
+	slapi_ch_free_string( &pOcOid );
+	pOcOid = slapi_ch_smprintf("%s-oid", psbOcName->buffer );
   }
 
   if ( schema_ds4x_compat ) nextinput = input;
@@ -3194,9 +3193,8 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
 	 * attrname-oid 
 	 */ 
 	if ( strcasecmp ( pOid, "NAME" ) == 0 ) { 
-		free( pOid ); 
-		pOid = slapi_ch_malloc( 8 + strlen(first_attr_name)); 
-		sprintf(pOid, "%s-oid", first_attr_name ); 
+		slapi_ch_free_string( &pOid ); 
+		pOid = slapi_ch_smprintf("%s-oid", first_attr_name ); 
 	} 
 
 	/* look for the optional DESCription */
@@ -3645,8 +3643,7 @@ schema_check_oid( const char *name, const char *oid, PRBool isAttribute,
   }
   
   /* check to see if the OID is <name>-oid */
-  namePlusOid = (char *) slapi_ch_malloc( strlen(name) + 256);
-  sprintf(namePlusOid, "%s-oid", name );
+  namePlusOid = slapi_ch_smprintf("%s-oid", name );
   rc = strcasecmp( oid, namePlusOid );
   slapi_ch_free( (void **) &namePlusOid );
 
@@ -3974,9 +3971,7 @@ init_schema_dse(const char *configdir)
 
 	slapi_sdn_init_dn_byref(&schema,"cn=schema");
 
-	schemadir = slapi_ch_calloc(1, strlen(configdir)
-					+ strlen(SCHEMA_SUBDIR_NAME) + 5);
-	sprintf(schemadir, "%s/%s", configdir, SCHEMA_SUBDIR_NAME);
+	schemadir = slapi_ch_smprintf("%s/%s", configdir, SCHEMA_SUBDIR_NAME);
 
 	filelist = get_priority_filelist(schemadir, ".*ldif$");
 	if (!filelist || !*filelist)
@@ -3992,8 +3987,7 @@ init_schema_dse(const char *configdir)
 		int ii = 0;
 		while (filelist[ii]) ++ii;
 		userschemafile = filelist[ii-1];
-		userschematmpfile = slapi_ch_calloc(1, strlen(userschemafile) + 5);
-		sprintf(userschematmpfile, "%s.tmp", userschemafile);
+		userschematmpfile = slapi_ch_smprintf("%s.tmp", userschemafile);
 	}
 
     if(rc && (pschemadse==NULL))
@@ -4477,7 +4471,7 @@ schema_create_errormsg(
 		if ( NULL != name ) {
 			rc = PR_snprintf( errorbuf, errorbufsize, prefix, name );
 		}
-		if ( rc >= 0 ) {
+		if ( (rc >= 0) && (rc < errorbufsize) ) {
 			(void)PR_vsnprintf( errorbuf + rc, errorbufsize - rc, fmt, ap );
 		}
 		va_end( ap );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 13048aa9..8247e5ad 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -10,8 +10,7 @@
 
  
 /* Used by SSL and DES plugin */
-#ifndef _TOK
-#define _TOK
+#ifdef NEED_TOK_DES
 static char  tokDes[34] = "Communicator Generic Crypto Svcs";
 static char ptokDes[34] = "Internal (Software) Token        ";
 #endif
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 968c33a3..e9e4a15a 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -817,7 +817,7 @@ void slapi_ch_free_string( char **s );
 struct berval*  slapi_ch_bvdup(const struct berval*);
 struct berval** slapi_ch_bvecdup(struct berval**);
 void slapi_ch_bvfree(struct berval** v);
-
+char * slapi_ch_smprintf(const char *fmt, ...);
 
 /*
  * syntax plugin routines
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index 4344a02a..fc956615 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1037,6 +1037,10 @@ typedef int (*dseCallbackFn)(Slapi_PBlock *, Slapi_Entry *, Slapi_Entry *,
 #define DSE_FLAG_PREOP          0x0001
 #define DSE_FLAG_POSTOP         0x0002
 
+/* This is the size of the returntext parameter passed to the config callback function,
+   which is the "char *" argument to dseCallbackFn above */
+#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
+
 int slapi_config_register_callback(int operation, int flags, const char *base, int scope, const char *filter, dseCallbackFn fn, void *fn_arg);
 int slapi_config_remove_callback(int operation, int flags, const char *base, int scope, const char *filter, dseCallbackFn fn);
 int config_is_slapd_lite( void );
diff --git a/ldap/servers/slapd/snmp_collator.c b/ldap/servers/slapd/snmp_collator.c
index 68fe4423..3c0f5e65 100644
--- a/ldap/servers/slapd/snmp_collator.c
+++ b/ldap/servers/slapd/snmp_collator.c
@@ -234,9 +234,7 @@ char *make_ds_url(char *host, int port){
 
   char *url;
   
-   url = (char *)slapi_ch_malloc( (strlen(host) + PORT_LEN + URL_CHARS_LEN + 1) * sizeof(char));
- 
-   sprintf(url,"ldap://%s:%d/",host, port);
+   url = slapi_ch_smprintf("ldap://%s:%d/",host, port);
  
    return url;
 }
@@ -362,7 +360,7 @@ int snmp_collator_start()
 	 * Get directory for our stats file
 	 */
 
-  sprintf(szStatsFile, "%s/logs/%s", instancedir, 
+  PR_snprintf(szStatsFile, sizeof(szStatsFile), "%s/logs/%s", instancedir, 
 		  AGT_STATS_FILE);
   tmpstatsfile = szStatsFile;
 
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 96e6be33..70ca82da 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -31,6 +31,7 @@
 #include <string.h>
 #include <errno.h>
 
+#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
 #include "slap.h"
 
 #include "svrcore.h"
@@ -183,7 +184,7 @@ _conf_setciphers(char *ciphers)
           case '-':
             active = 0; break;
           default:
-			sprintf(err, "invalid ciphers <%s>: format is "
+			PR_snprintf(err, sizeof(err), "invalid ciphers <%s>: format is "
 					"+cipher1,-cipher2...", raw);
             return slapi_ch_strdup(err);
         }
@@ -200,7 +201,7 @@ _conf_setciphers(char *ciphers)
                 }
             }
             if(!_conf_ciphers[x].name) {
-                sprintf(err, "unknown cipher %s", ciphers);
+                PR_snprintf(err, sizeof(err), "unknown cipher %s", ciphers);
                 return slapi_ch_strdup(err);
             }
         }
@@ -213,73 +214,6 @@ _conf_setciphers(char *ciphers)
 /* SSL Policy stuff */
 
 /*
- * Policy table
- */
-static struct policy
-{
-  long   ciphersuite;
-  int    exportPolicy;
-} policy_table[] = {
-  { SSL_EN_RC4_128_WITH_MD5,              SSL_NOT_ALLOWED },
-  { SSL_EN_RC4_128_EXPORT40_WITH_MD5,     SSL_ALLOWED },
-  { SSL_EN_RC2_128_CBC_WITH_MD5,          SSL_NOT_ALLOWED },
-  { SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_ALLOWED },
-  { SSL_EN_IDEA_128_CBC_WITH_MD5,         SSL_NOT_ALLOWED },
-  { SSL_EN_DES_64_CBC_WITH_MD5,           SSL_NOT_ALLOWED },
-  { SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     SSL_NOT_ALLOWED },
-
-  /* SSL v3 Cipher Suites */
-  { SSL_RSA_WITH_NULL_MD5,                SSL_ALLOWED },
-#if 0
-  { SSL_RSA_WITH_NULL_SHA,                SSL_ALLOWED },
-#endif
-  { SSL_RSA_EXPORT_WITH_RC4_40_MD5,       SSL_ALLOWED },
-  { SSL_RSA_WITH_RC4_128_MD5,             SSL_RESTRICTED },
-#if 0
-  { SSL_RSA_WITH_RC4_128_SHA,             SSL_NOT_ALLOWED },
-#endif
-  { SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5,   SSL_ALLOWED },
-
-#if 0
-  { SSL_RSA_WITH_IDEA_CBC_SHA,            SSL_NOT_ALLOWED },
-  { SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,    SSL_ALLOWED },
-#endif
-
-  { SSL_RSA_WITH_DES_CBC_SHA,             SSL_NOT_ALLOWED },
-  { SSL_RSA_WITH_3DES_EDE_CBC_SHA,        SSL_RESTRICTED },
-
-#if 0
-  { SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_DSS_WITH_DES_CBC_SHA,          SSL_NOT_ALLOWED },
-  { SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED },
-  { SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_RSA_WITH_DES_CBC_SHA,          SSL_NOT_ALLOWED },
-  { SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED },
-
-  { SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DHE_DSS_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-  { SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DHE_RSA_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-
-  { SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5,   SSL_ALLOWED },
-  { SSL_DH_ANON_WITH_RC4_128_MD5,         SSL_NOT_ALLOWED },
-  { SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_ANON_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-#endif
-
-  { SSL_FORTEZZA_DMS_WITH_NULL_SHA,       SSL_NOT_ALLOWED },
-  { SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, SSL_NOT_ALLOWED },
-  { SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,    SSL_NOT_ALLOWED },
-
-  { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,   SSL_RESTRICTED },
-  { SSL_RSA_FIPS_WITH_DES_CBC_SHA,        SSL_NOT_ALLOWED },
-};
-
-
-/*
  * SSLPLCY_Install
  *
  * Call the SSL_CipherPolicySet function for each ciphersuite.
@@ -312,7 +246,7 @@ static void
 slapd_SSL_report(int degree, char *fmt, va_list args)
 {
     char buf[2048];
-    vsprintf( buf, fmt, args );
+    PR_vsnprintf( buf, sizeof(buf), fmt, args );
     LDAPDebug( LDAP_DEBUG_ANY, "SSL %s: %s\n",
 	       (degree == LOG_FAILURE) ? "failure" : "alert",
 	       buf, 0 );
@@ -336,16 +270,6 @@ slapd_SSL_warn(char *fmt, ...)
     va_end(args);
 }
 
-
-static void
-server_free_alias_dir(char *s)
-{
-  void *mem = s;
-
-  slapi_ch_free(&mem);
-}
-
-
 /**
  * Get a particular entry
  */
@@ -533,7 +457,7 @@ slapd_nss_init(int init_ssl, int config_available)
 						   (keyfn ? "found" : "not found"),
 						   (certfn ? "found" : "not found"));
 		}
-		sprintf(certPref, "%s-", val);
+		PR_snprintf(certPref, sizeof(certPref), "%s-", val);
 		strcpy(keyPref, certPref);
 		strcpy(val, "alias/");
 	}
@@ -875,7 +799,7 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
                     strcpy(cert_name, personality);
                 else
                     /* external PKCS #11 token - attach token name */
-                    sprintf(cert_name, "%s:%s", token, personality);
+                    PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
             }
             else {
                 errorCode = PR_GetError();
@@ -1210,7 +1134,7 @@ slapd_SSL_client_auth (LDAP* ld)
 						/* external PKCS #11 token - attach token name */
 						/*ssltoken was already dupped and we don't need it anymore*/
 						token = ssltoken;
-						sprintf(cert_name, "%s:%s", token, personality);
+						PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
 			  }
  			} else {
 			  errorCode = PR_GetError(); 
@@ -1236,7 +1160,7 @@ slapd_SSL_client_auth (LDAP* ld)
 				token = ssltoken; /*ssltoken was already dupped and we don't need it anymore*/
 
 				/* external PKCS #11 token - attach token name */
-				sprintf(cert_name, "%s:%s", token, personality);
+				PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
 			} else {
 			  errorCode = PR_GetError();
 			  slapd_SSL_warn("Security Initialization: Failed to get cipher "
@@ -1459,7 +1383,7 @@ char* slapd_get_tmp_dir()
 #endif
 	}
 
-	sprintf(tmp,"%s/tmp",instanceDir);
+	PR_snprintf(tmp,sizeof(tmp),"%s/tmp",instanceDir);
 
 #if defined( XP_WIN32 )
 	for(ilen=0;ilen < strlen(tmp); ilen++)
diff --git a/ldap/servers/slapd/start_tls_extop.c b/ldap/servers/slapd/start_tls_extop.c
index 915ad1b0..9f65ff2a 100644
--- a/ldap/servers/slapd/start_tls_extop.c
+++ b/ldap/servers/slapd/start_tls_extop.c
@@ -47,7 +47,10 @@ start_tls( Slapi_PBlock *pb )
 	Connection      *conn;
 	PRFileDesc      *oldsocket, *newsocket;
 	int             secure;
-	int             ns, oldnativesocket;
+	int             ns;
+#ifdef _WIN32
+	int				oldnativesocket;
+#endif
 	int             rv;
 
 	/* Get the pb ready for sending Start TLS Extended Responses back to the client. 
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index e1e6f1af..20e42b95 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -1256,10 +1256,9 @@ static int task_index_add(Slapi_PBlock *pb, Slapi_Entry *e,
     	for (idx = slapi_attr_first_value(attr, &val);
              idx >= 0; idx = slapi_attr_next_value(attr, idx, &val)) {
             const char *indexname = slapi_value_get_string(val);
-            char *index = (char *)slapi_ch_malloc(strlen(indexname) + 2);
+            char *index = slapi_ch_smprintf("t%s", indexname);
 
             if (index != NULL) {
-                sprintf(index, "t%s", indexname);
                 charray_add(&indexlist, index);
             }
     	}
@@ -1270,10 +1269,9 @@ static int task_index_add(Slapi_PBlock *pb, Slapi_Entry *e,
     	for (idx = slapi_attr_first_value(attr, &val);
              idx >= 0; idx = slapi_attr_next_value(attr, idx, &val)) {
             const char *indexname = slapi_value_get_string(val);
-            char *index = (char *)slapi_ch_malloc(strlen(indexname) + 2);
+            char *index = slapi_ch_smprintf("T%s", indexname);
 
             if (index != NULL) {
-                sprintf(index, "T%s", indexname);
                 charray_add(&indexlist, index);
             }
     	}
@@ -1347,7 +1345,6 @@ task_upgradedb_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
     Slapi_Backend *be = NULL;
     Slapi_Task *task = NULL;
     Slapi_PBlock mypb;
-    PRThread *thread = NULL;
     const char *archive_dir = NULL;
     const char *force = NULL;
     const char *database_type = "ldbm database";
@@ -1587,11 +1584,10 @@ int slapi_task_register_handler(const char *name, dseCallbackFn func)
     int ret = -1;
     int x;
 
-    dn = slapi_ch_malloc(strlen(name) + strlen(TASK_BASE_DN) + 20);
+    dn = slapi_ch_smprintf("cn=%s, %s", name, TASK_BASE_DN);
     if (dn == NULL) {
         goto out;
     }
-    sprintf(dn, "cn=%s, %s", name, TASK_BASE_DN);
 
     pb = slapi_pblock_new();
     if (pb == NULL) {
diff --git a/ldap/servers/slapd/time.c b/ldap/servers/slapd/time.c
index a4253c3a..a008134f 100644
--- a/ldap/servers/slapd/time.c
+++ b/ldap/servers/slapd/time.c
@@ -188,8 +188,7 @@ format_localTime (time_t from)
 #else
     localtime_r (&from, &t);
 #endif
-    into = slapi_ch_malloc (15);
-    sprintf (into, "%.4li%.2i%.2i%.2i%.2i%.2i",
+    into = slapi_ch_smprintf("%.4li%.2i%.2i%.2i%.2i%.2i",
              1900L + t.tm_year, t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.
 tm_sec);
     return into;
diff --git a/ldap/servers/slapd/tools/ldif.c b/ldap/servers/slapd/tools/ldif.c
index 98f8f6d4..29f480e9 100644
--- a/ldap/servers/slapd/tools/ldif.c
+++ b/ldap/servers/slapd/tools/ldif.c
@@ -99,7 +99,7 @@ int main( int argc, char **argv )
 			perror( "malloc" );
 		    return( 1 );
 		}
-		while ( buf = fgets(buf, maxlen, stdin) ) {
+		while ( (buf = fgets(buf, maxlen, stdin)) ) {
 			/* if buffer was filled, expand and keep reading unless last char
 			is linefeed, in which case it is OK for buffer to be full */
 			while( ((curlen = strlen(buf)) == (maxlen - 1)) && buf[curlen-1] != '\n' ) {
diff --git a/ldap/servers/slapd/tools/mmldif.c b/ldap/servers/slapd/tools/mmldif.c
index 995b7bc3..68ec793f 100644
--- a/ldap/servers/slapd/tools/mmldif.c
+++ b/ldap/servers/slapd/tools/mmldif.c
@@ -297,7 +297,6 @@ int mm_diff(stats_t *statsp)
     char        fingerprint[16];
     int stat;
     int count;
-    int firsttime = TRUE;
     int records = 0;
     int added;
     struct entryblock *block, *next;
@@ -586,7 +585,7 @@ int mm_diff(stats_t *statsp)
 
 static void usage(char *m)
 {
-    fprintf(stderr,"usage: mmldif [-c] [-D] [-o out.ldif] in1.ldif in2.ldif ...\n\n", m);
+    fprintf(stderr,"usage: %s [-c] [-D] [-o out.ldif] in1.ldif in2.ldif ...\n\n", m);
     fprintf(stderr,"-c\tWrite a change file (.delta) for each input file\n");
     fprintf(stderr,"-D\tPrint debugging information\n");
     fprintf(stderr,"-o\tWrite authoritative data to this file\n");
@@ -1217,7 +1216,6 @@ putvalue(
     int	len;
     char *	sptr;
     int	rc;
-    int	simpletxt = TRUE;
 
     lptr = line;
     if (tag != NULL) {
@@ -1314,7 +1312,7 @@ signedmemcmp(unsigned char * a, int lena, unsigned char * b, int lenb)
             return lena;
         if (!lena)
             return -1;
-        if (c=(int)*a - (int)*b)
+        if ((c=(int)*a - (int)*b))
             return c;
         lena--;
         lenb--;
@@ -1436,17 +1434,17 @@ int main(int argc, char *argv[])
 
     memset(&stats, 0, sizeof(stats));
 
-    if (rc = mm_init(argc, argv))
+    if ((rc = mm_init(argc, argv)))
         return rc;
 
     if ((mm_diff(&stats) == IDDS_MM_OK)
 	&&  (license_limit > 0)) {
         if (license_count > license_limit * 98.0 / 100)
-            fprintf(stderr, "That was over 98% of your license limit.\n");
+            fprintf(stderr, "That was over 98%% of your license limit.\n");
         else if (license_count > license_limit * 95.0 / 100)
-            fprintf(stderr, "That was over 95% of your license limit.\n");
+            fprintf(stderr, "That was over 95%% of your license limit.\n");
         else if (license_count > license_limit * 90.0 / 100)
-            fprintf(stderr, "That was over 90% of your license limit.\n");
+            fprintf(stderr, "That was over 90%% of your license limit.\n");
     }
     mm_fin_winner();
     printf("start time %s", ctime(&stats.diff_start_time));
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index 80affdcb..bb5df4c5 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -247,7 +247,7 @@ slapd_config(const char *configdir)
 	char *lastp = 0;
 	char *entrystr = 0;
 
-	sprintf(configfile, "%s/%s", configdir, CONFIG_FILENAME);
+	PR_snprintf(configfile, sizeof(configfile), "%s/%s", configdir, CONFIG_FILENAME);
 	if ( (rc = PR_GetFileInfo( configfile, &prfinfo )) != PR_SUCCESS )
 	{
 		fprintf(stderr,
diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index 767441cc..7d8fa0b4 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -77,7 +77,7 @@ do_escape_string (
 
     last = str + len - 1;
     for (s = str; s <= last; ++s) {
-	if ( esc = (*special)((unsigned char)*s)) {
+	if ( (esc = (*special)((unsigned char)*s))) {
 	    const char* first = str;
 	    char* bufNext = buf;
 	    int bufSpace = BUFSIZ - 4;
@@ -445,7 +445,7 @@ void slapd_nasty(char* str, int c, int err)
 {
 	char *msg = NULL;
 	char buffer[100];
-	sprintf(buffer,"%s BAD %d",str,c);
+	PR_snprintf(buffer,sizeof(buffer), "%s BAD %d",str,c);
 	LDAPDebug(LDAP_DEBUG_ANY,"%s, err=%d %s\n",buffer,err,(msg = strerror( err )) ? msg : "");
 }
 
diff --git a/ldap/servers/slapd/uuid.c b/ldap/servers/slapd/uuid.c
index f490fbae..317b745c 100644
--- a/ldap/servers/slapd/uuid.c
+++ b/ldap/servers/slapd/uuid.c
@@ -441,14 +441,13 @@ static int read_state_from_file (const char *configDir)
 	}
 	else 
 	{
-		path = (char*)slapi_ch_malloc(strlen(configDir) + strlen(STATE_FILE) + 2);
+		path = slapi_ch_smprintf("%s/%s", configDir, STATE_FILE);    
 		if (path == NULL)
 		{
 			slapi_log_error (SLAPI_LOG_FATAL, MODULE, "read_state: "
 							"memory allocation failed.\n");
 			return (UUID_MEMORY_ERROR);
 		}
-		sprintf (path, "%s/%s", configDir, STATE_FILE);    
 	}
 
 	/* open or create state file for read/write and keep it in sync */
diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c
index 26bdd61f..37ee814c 100644
--- a/ldap/servers/slapd/vattr.c
+++ b/ldap/servers/slapd/vattr.c
@@ -380,7 +380,6 @@ int vattr_test_filter( /* Entry we're interested in */ Slapi_Entry *e,
 
 	if (list) {
 		vattr_sp_handle *current_handle = NULL;
-		Slapi_Attr *cache_attr = NULL;
 		/* first lets consult the cache to save work */
 		int cache_status;
 					
@@ -618,8 +617,6 @@ slapi_vattr_values_get_sp(vattr_context *c,
 		if (list) {
 			vattr_sp_handle *current_handle = NULL;
 			void *hint = NULL;
-			Slapi_Attr* cache_attr = 0;
-			char *vattr_type = NULL;
 			/* first lets consult the cache to save work */
 			int cache_status;
 						
@@ -814,8 +811,6 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
 		if (list) {
 			vattr_sp_handle *current_handle = NULL;
 			void *hint = NULL;
-			Slapi_Attr* cache_attr = 0;
-			char *vattr_type=NULL;
 			/* first lets consult the cache to save work */
 			int cache_status;
 			
@@ -1947,7 +1942,6 @@ objAttrValue *vattr_map_entry_build_schema(char *type_name)
 {
 	objAttrValue *ret = 0;
 	struct objclass	*oc;
-	int attr_index = 0;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "--> vattr_map_entry_build_schema\n",0,0,0);