r16674: After removing each individual post-3.0.23rc3 change:

This pulls is what I considered safe fixes from SAMBA_3_0.
This boiled down to either Klocwork fixes or obvious compiler
warning fixes.  I did not include any changes to fnuction 
signatures not the version change to the passdb API.

Also pulled in the 3 nmbd fixes requested by Jeremy
and the wildcard delete fix.

This code will sit for a few days in the cooker and then
become 3.0.23 if nothing blows up.  I don't care how many 
more compile warning fixes people throw into SAMBA_3_0.

46 files changed, 236 insertions, 142 deletions

diff --git a/examples/misc/adssearch.pl b/examples/misc/adssearch.pl
index a26bb3b6c45..6a677fa2055 100755
--- a/examples/misc/adssearch.pl
+++ b/examples/misc/adssearch.pl
@@ -87,7 +87,7 @@ GetOptions(
 	'base|b=s'	=> \$opt_base,
 	'D|DN=s'	=> \$opt_binddn,
 	'debug=i'	=> \$opt_debug,
-	'extendeddn|e'	=> \$opt_display_extendeddn,
+	'extendeddn|e=i'	=> \$opt_display_extendeddn,
 	'help'		=> \$opt_help,
 	'host|h=s'	=> \$opt_host,
 	'machine|P'	=> \$opt_machine,
@@ -1396,12 +1396,12 @@ sub gen_controls {
 		>
 	);
 
-	my $ctl_extended_dn_val = $asn_extended_dn->encode( mode => '1');
-	my $ctl_extended_dn =Net::LDAP::Control->new( 
-		type => $ads_controls{'LDAP_SERVER_EXTENDED_DN_OID'},
-		critical => 'true',
-		value => $ctl_extended_dn_val);
-
+	# only w2k3 accepts '1' and needs the ctl_val, w2k does not accept a ctl_val
+	my $ctl_extended_dn_val = $asn_extended_dn->encode( mode => $opt_display_extendeddn);
+	my $ctl_extended_dn = Net::LDAP::Control->new( 
+			type => $ads_controls{'LDAP_SERVER_EXTENDED_DN_OID'},
+			critical => 'true',
+			value => $opt_display_extendeddn ? $ctl_extended_dn_val : "");
 
 	# setup notify control
 	my $ctl_notification = Net::LDAP::Control->new( 
@@ -1421,7 +1421,7 @@ sub gen_controls {
 		push(@ctrls_s, "LDAP_PAGED_RESULT_OID_STRING" );
 	}
 
-	if ($opt_display_extendeddn) {
+	if (defined($opt_display_extendeddn)) {
 		push(@ctrls, $ctl_extended_dn);
 		push(@ctrls_s, "LDAP_SERVER_EXTENDED_DN_OID");
 	} 
diff --git a/packaging/RHEL/setup/smb.init b/packaging/RHEL/setup/smb.init
index 30d7d403dd9..af85b2c079a 100644
--- a/packaging/RHEL/setup/smb.init
+++ b/packaging/RHEL/setup/smb.init
@@ -71,14 +71,14 @@ start() {
 stop() {
 	KIND="SMB"
 	echo -n $"Shutting down $KIND services: "
-	killproc smbd -TERM
+	killproc smbd
 	RETVAL=$?
 	[ $RETVAL -eq 0 ] && rm -f /var/run/smbd.pid
 	echo
 	KIND="NMB"
 	if [ x"$ISNETBIOSDISABLED" != x"Yes" ]; then
 		echo -n $"Shutting down $KIND services: "
-		killproc nmbd -TERM
+		killproc nmbd 
 		RETVAL2=$?
 		[ $RETVAL2 -eq 0 ] && rm -f /var/run/nmbd.pid
 		[ $RETVAL -eq 0 -a $RETVAL2 -eq 0 ] && rm -f /var/lock/subsys/smb 
diff --git a/packaging/RHEL/setup/winbind.init b/packaging/RHEL/setup/winbind.init
index e778e61e9cf..a99038f9c71 100644
--- a/packaging/RHEL/setup/winbind.init
+++ b/packaging/RHEL/setup/winbind.init
@@ -49,7 +49,7 @@ stop() {
         echo
 	KIND="Winbind"
 	echo -n $"Shutting down $KIND services: "
-	killproc winbindd -TERM
+	killproc winbindd
 	RETVAL=$?
 	[ $RETVAL -eq 0 ] && rm -f /var/run/winbindd.pid && rm -f /var/lock/subsys/winbindd
 	echo ""
diff --git a/packaging/RedHat-9/smb.init b/packaging/RedHat-9/smb.init
index 79f4f322d03..9b45ebabb34 100755
--- a/packaging/RedHat-9/smb.init
+++ b/packaging/RedHat-9/smb.init
@@ -30,15 +30,8 @@ case "$1" in
   stop)
 	echo -n "Shutting down SMB services: "
 
-	## we have to get all the smbd process here instead of just the
-	## main parent (i.e. killproc) because it can take a long time
-	## for an individual process to process a TERM signal
-	smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
-	for pid in $smbdpids; do
-		kill -TERM $pid
-	done
-	## nmbd is ok to kill using killproc()
-	killproc nmbd -TERM
+	killproc smbd 
+	killproc nmbd 
 	rm -f /var/lock/subsys/smb
 	echo ""
 	;;
diff --git a/source/auth/auth_ntlmssp.c b/source/auth/auth_ntlmssp.c
index 76071075483..6cf987a48b1 100644
--- a/source/auth/auth_ntlmssp.c
+++ b/source/auth/auth_ntlmssp.c
@@ -176,7 +176,7 @@ NTSTATUS auth_ntlmssp_start(AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
 	(*auth_ntlmssp_state)->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
 	(*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
 	(*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password;
-	(*auth_ntlmssp_state)->ntlmssp_state->server_role = lp_server_role();
+	(*auth_ntlmssp_state)->ntlmssp_state->server_role = (enum server_types)lp_server_role();
 
 	return NT_STATUS_OK;
 }
diff --git a/source/client/client.c b/source/client/client.c
index 0a695436f57..3c2d7afe2d6 100644
--- a/source/client/client.c
+++ b/source/client/client.c
@@ -3464,6 +3464,9 @@ static int do_message_op(void)
 			}
 			break;
 		case 'E':
+			if (dbf) {
+				x_fclose(dbf);
+			}
 			dbf = x_stderr;
 			display_set_stderr();
 			break;
diff --git a/source/client/smbctool.c b/source/client/smbctool.c
index 3233ee49554..fd385ee6817 100644
--- a/source/client/smbctool.c
+++ b/source/client/smbctool.c
@@ -3605,6 +3605,9 @@ static int do_message_op(void)
 			}
 			break;
 		case 'E':
+			if (dbf) {
+				x_fclose(dbf);
+			}
 			dbf = x_stderr;
 			display_set_stderr();
 			break;
diff --git a/source/client/smbspool.c b/source/client/smbspool.c
index e5cd4f2e8e6..c9a7fbe10ef 100644
--- a/source/client/smbspool.c
+++ b/source/client/smbspool.c
@@ -72,6 +72,7 @@ static int		smb_print(struct cli_state *, char *, FILE *);
   struct cli_state *cli;	/* SMB interface */
   char null_str[1];
   int tries = 0;
+  const char *dev_uri;
 
   null_str[0] = '\0';
 
@@ -132,8 +133,9 @@ static int		smb_print(struct cli_state *, char *, FILE *);
   * Find the URI...
   */
 
-  if (getenv("DEVICE_URI") != NULL)
-    strncpy(uri, getenv("DEVICE_URI"), sizeof(uri) - 1);
+  dev_uri = getenv("DEVICE_URI");
+  if (dev_uri)
+    strncpy(uri, dev_uri, sizeof(uri) - 1);
   else if (strncmp(argv[0], "smb://", 6) == 0)
     strncpy(uri, argv[0], sizeof(uri) - 1);
   else
diff --git a/source/include/ads.h b/source/include/ads.h
index 74a29e4f795..0ef84b48058 100644
--- a/source/include/ads.h
+++ b/source/include/ads.h
@@ -5,6 +5,7 @@
 */
 
 enum wb_posix_mapping {
+	WB_POSIX_MAP_UNKNOWN    = -1,
 	WB_POSIX_MAP_TEMPLATE 	= 0, 
 	WB_POSIX_MAP_SFU 	= 1, 
 	WB_POSIX_MAP_RFC2307 	= 2,
diff --git a/source/include/rpc_reg.h b/source/include/rpc_reg.h
index b24b640237f..c454a1d6f94 100644
--- a/source/include/rpc_reg.h
+++ b/source/include/rpc_reg.h
@@ -91,7 +91,7 @@
  * Registry key types
  *	Most keys are going to be GENERIC -- may need a better name?
  *	HKPD and HKPT are used by reg_perfcount.c
- *		they are special keys that congtain performance data
+ *		they are special keys that contain performance data
  */
 #define REG_KEY_GENERIC		0
 #define REG_KEY_HKPD		1
@@ -99,7 +99,7 @@
 
 /* 
  * container for function pointers to enumeration routines
- * for vitural registry view 
+ * for virtual registry view 
  */ 
  
 typedef struct {
diff --git a/source/include/smb.h b/source/include/smb.h
index 5aa06347f8c..e0f2e8483cb 100644
--- a/source/include/smb.h
+++ b/source/include/smb.h
@@ -869,6 +869,12 @@ struct byte_range_lock {
 				 enum brl_flavour lock_flav, \
 				 br_off start, br_off size)
 
+#define LOCKING_FN_CAST() \
+	void (*)(struct share_mode_entry *, const char *, const char *)
+
+#define LOCKING_FN(fn) \
+	void (*fn)(struct share_mode_entry *, const char *, const char *)
+
 struct bitmap {
 	uint32 *b;
 	unsigned int n;
diff --git a/source/lib/util_str.c b/source/lib/util_str.c
index 6fe1668e880..7c9c6a6da8e 100644
--- a/source/lib/util_str.c
+++ b/source/lib/util_str.c
@@ -2372,6 +2372,9 @@ void sprintf_append(TALLOC_CTX *mem_ctx, char **string, ssize_t *len,
 
  error:
 	*len = -1;
+	if (mem_ctx == NULL) {
+		SAFE_FREE(*string);
+	}
 	*string = NULL;
 }
 
diff --git a/source/libmsrpc/cac_winreg.c b/source/libmsrpc/cac_winreg.c
index acd83f40760..6ef898eb16d 100644
--- a/source/libmsrpc/cac_winreg.c
+++ b/source/libmsrpc/cac_winreg.c
@@ -65,6 +65,7 @@ int cac_RegConnect(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegConnect
    key = talloc(mem_ctx, POLICY_HND);
    if(!key) {
       hnd->status = NT_STATUS_NO_MEMORY;
+      return CAC_FAILURE;
    }
 
    err = rpccli_reg_connect( pipe_hnd, mem_ctx, op->in.root, op->in.access, key);
diff --git a/source/libmsrpc/libmsrpc_internal.c b/source/libmsrpc/libmsrpc_internal.c
index f57063dc42e..3a47361db29 100644
--- a/source/libmsrpc/libmsrpc_internal.c
+++ b/source/libmsrpc/libmsrpc_internal.c
@@ -368,16 +368,16 @@ SAM_USERINFO_CTR *cac_MakeUserInfoCtr(TALLOC_CTX *mem_ctx, CacUserInfo *info) {
    unix_to_nt_time(&pass_must_change_time, info->pass_must_change_time);
 
    /*initialize the strings*/
-   init_unistr2(&user_name, info->username, STR_TERMINATE);
-   init_unistr2(&full_name, info->full_name, STR_TERMINATE);
-   init_unistr2(&home_dir, info->home_dir, STR_TERMINATE);
-   init_unistr2(&dir_drive, info->home_drive, STR_TERMINATE);
-   init_unistr2(&log_scr, info->logon_script, STR_TERMINATE);
-   init_unistr2(&prof_path, info->profile_path, STR_TERMINATE);
-   init_unistr2(&desc, info->description, STR_TERMINATE);
-   init_unistr2(&wkstas, info->workstations, STR_TERMINATE);
-   init_unistr2(&unk, "\0", STR_TERMINATE);
-   init_unistr2(&mung_dial, info->dial, STR_TERMINATE);
+   init_unistr2(&user_name, info->username, UNI_STR_TERMINATE);
+   init_unistr2(&full_name, info->full_name, UNI_STR_TERMINATE);
+   init_unistr2(&home_dir, info->home_dir, UNI_STR_TERMINATE);
+   init_unistr2(&dir_drive, info->home_drive, UNI_STR_TERMINATE);
+   init_unistr2(&log_scr, info->logon_script, UNI_STR_TERMINATE);
+   init_unistr2(&prof_path, info->profile_path, UNI_STR_TERMINATE);
+   init_unistr2(&desc, info->description, UNI_STR_TERMINATE);
+   init_unistr2(&wkstas, info->workstations, UNI_STR_TERMINATE);
+   init_unistr2(&unk, "\0", UNI_STR_TERMINATE);
+   init_unistr2(&mung_dial, info->dial, UNI_STR_TERMINATE);
 
    /*manually set passmustchange*/
    ctr->info.id21->passmustchange = (info->pass_must_change) ? 0x01 : 0x00;
diff --git a/source/libsmb/clilist.c b/source/libsmb/clilist.c
index 9ab05d2b4af..e18bb185d56 100644
--- a/source/libsmb/clilist.c
+++ b/source/libsmb/clilist.c
@@ -185,7 +185,6 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 	BOOL First = True;
 	int ff_searchcount=0;
 	int ff_eos=0;
-	int ff_lastname=0;
 	int ff_dir_handle=0;
 	int loop_count = 0;
 	char *rparam=NULL, *rdata=NULL;
@@ -297,11 +296,9 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 			ff_dir_handle = SVAL(p,0);
 			ff_searchcount = SVAL(p,2);
 			ff_eos = SVAL(p,4);
-			ff_lastname = SVAL(p,8);
 		} else {
 			ff_searchcount = SVAL(p,0);
 			ff_eos = SVAL(p,2);
-			ff_lastname = SVAL(p,6);
 		}
 
 		if (ff_searchcount == 0) {
diff --git a/source/libsmb/clirap2.c b/source/libsmb/clirap2.c
index a327bae3174..147683689d6 100644
--- a/source/libsmb/clirap2.c
+++ b/source/libsmb/clirap2.c
@@ -211,11 +211,20 @@ int cli_NetGroupAdd(struct cli_state *cli, RAP_GROUP_INFO_1 * grinfo )
 	    +WORDSIZE                    /* info level    */
 	    +WORDSIZE];                  /* reserved word */
 
-  char data[1024];
-    
   /* offset into data of free format strings.  Will be updated */
   /* by PUTSTRINGP macro and end up with total data length.    */
   int soffset = RAP_GROUPNAME_LEN + 1 + DWORDSIZE; 
+  char *data;
+  size_t data_size;
+
+  /* Allocate data. */
+  data_size = MAX(soffset + strlen(grinfo->comment) + 1, 1024);
+
+  data = SMB_MALLOC(data_size);
+  if (!data) {
+    DEBUG (1, ("Malloc fail\n"));
+    return -1;
+  }
 
   /* now send a SMBtrans command with api WGroupAdd */
   
@@ -253,6 +262,7 @@ int cli_NetGroupAdd(struct cli_state *cli, RAP_GROUP_INFO_1 * grinfo )
       DEBUG(4,("NetGroupAdd failed\n"));
     }
   
+  SAFE_FREE(data);
   SAFE_FREE(rparam);
   SAFE_FREE(rdata);
 
diff --git a/source/libsmb/smb_signing.c b/source/libsmb/smb_signing.c
index 4ff74ca464c..d68f161e231 100644
--- a/source/libsmb/smb_signing.c
+++ b/source/libsmb/smb_signing.c
@@ -612,7 +612,6 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si, BO
 	uint32 saved_seq;
 	unsigned char calc_md5_mac[16];
 	unsigned char *server_sent_mac;
-	uint mid;
 
 	if (!si->doing_signing)
 		return True;
@@ -622,8 +621,6 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si, BO
 		return False;
 	}
 
-	mid = SVAL(inbuf, smb_mid);
-
 	/* We always increment the sequence number. */
 	data->send_seq_num += 2;
 
diff --git a/source/locking/locking.c b/source/locking/locking.c
index 01f12bbb58d..9d3ca956014 100644
--- a/source/locking/locking.c
+++ b/source/locking/locking.c
@@ -1274,7 +1274,7 @@ static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
 	const char *sharepath;
 	const char *fname;
 	int i;
-	void (*traverse_callback)(struct share_mode_entry *, const char *, const char *) = state;
+	LOCKING_FN(traverse_callback) = (LOCKING_FN_CAST())state;
 
 	/* Ensure this is a locking_key record. */
 	if (kbuf.dsize != sizeof(struct locking_key))
diff --git a/source/nmbd/nmbd.c b/source/nmbd/nmbd.c
index 9c8f99df252..26495d25c13 100644
--- a/source/nmbd/nmbd.c
+++ b/source/nmbd/nmbd.c
@@ -173,6 +173,11 @@ static BOOL reload_interfaces(time_t t)
 	for (n=iface_count() - 1; n >= 0; n--) {
 		struct interface *iface = get_interface(n);
 
+		if (!iface) {
+			DEBUG(2,("reload_interfaces: failed to get interface %d\n", n));
+			continue;
+		}
+
 		/*
 		 * We don't want to add a loopback interface, in case
 		 * someone has added 127.0.0.1 for smbd, nmbd needs to
diff --git a/source/nmbd/nmbd_namelistdb.c b/source/nmbd/nmbd_namelistdb.c
index fb32ce1aad1..d71eb5479a2 100644
--- a/source/nmbd/nmbd_namelistdb.c
+++ b/source/nmbd/nmbd_namelistdb.c
@@ -120,7 +120,7 @@ struct name_record *find_name_on_subnet(struct subnet_record *subrec,
 		if( self_only && (name_ret->data.source != SELF_NAME) && (name_ret->data.source != PERMANENT_NAME) ) {
 			DEBUG( 9, ( "find_name_on_subnet: on subnet %s - self name %s NOT FOUND\n",
 						subrec->subnet_name, nmb_namestr(nmbname) ) );
-			return False;
+			return NULL;
 		}
 
 		DEBUG( 9, ("find_name_on_subnet: on subnet %s - found name %s source=%d\n",
diff --git a/source/nmbd/nmbd_serverlistdb.c b/source/nmbd/nmbd_serverlistdb.c
index cc762ae8d23..ea27f9d4e5a 100644
--- a/source/nmbd/nmbd_serverlistdb.c
+++ b/source/nmbd/nmbd_serverlistdb.c
@@ -214,7 +214,7 @@ static uint32 write_this_server_name( struct subnet_record *subrec,
 	struct work_record *iwork;
 
 	/* Go through all the subnets we have already seen. */
-	for (ssub = FIRST_SUBNET; ssub != subrec; ssub = NEXT_SUBNET_INCLUDING_UNICAST(ssub)) {
+	for (ssub = FIRST_SUBNET; ssub && (ssub != subrec); ssub = NEXT_SUBNET_INCLUDING_UNICAST(ssub)) {
 		for(iwork = ssub->workgrouplist; iwork; iwork = iwork->next) {
 			if(find_server_in_workgroup( iwork, servrec->serv.name) != NULL) {
 				/*
diff --git a/source/nmbd/nmbd_subnetdb.c b/source/nmbd/nmbd_subnetdb.c
index 3b9be2c2ce9..04df3e9a4f9 100644
--- a/source/nmbd/nmbd_subnetdb.c
+++ b/source/nmbd/nmbd_subnetdb.c
@@ -203,6 +203,11 @@ BOOL create_subnets(void)
 	for (i = 0 ; i < num_interfaces; i++) {
 		struct interface *iface = get_interface(i);
 
+		if (!iface) {
+			DEBUG(2,("create_subnets: can't get interface %d.\n", i ));
+			continue;
+		}
+
 		/*
 		 * We don't want to add a loopback interface, in case
 		 * someone has added 127.0.0.1 for smbd, nmbd needs to
diff --git a/source/nmbd/nmbd_winsserver.c b/source/nmbd/nmbd_winsserver.c
index 29d5c41de82..75841414bc4 100644
--- a/source/nmbd/nmbd_winsserver.c
+++ b/source/nmbd/nmbd_winsserver.c
@@ -35,6 +35,24 @@
 TDB_CONTEXT *wins_tdb;
 
 /****************************************************************************
+ Delete all the temporary name records on the in-memory linked list.
+*****************************************************************************/
+
+static void wins_delete_all_tmp_in_memory_records(void)
+{
+	struct name_record *nr = NULL;
+	struct name_record *nrnext = NULL;
+
+	/* Delete all temporary name records on the wins subnet linked list. */
+	for( nr = wins_server_subnet->namelist; nr; nr = nrnext) {
+		nrnext = nr->next;
+		DLIST_REMOVE(wins_server_subnet->namelist, nr);
+		SAFE_FREE(nr->data.ip);
+		SAFE_FREE(nr);
+	}
+}
+
+/****************************************************************************
  Convert a wins.tdb record to a struct name_record. Add in our global_scope().
 *****************************************************************************/
 
@@ -76,6 +94,7 @@ static struct name_record *wins_record_to_name_record(TDB_DATA key, TDB_DATA dat
 	if (!namerec) {
 		return NULL;
 	}
+	ZERO_STRUCTP(namerec);
 
 	namerec->data.ip = SMB_MALLOC_ARRAY(struct in_addr, num_ips);
 	if (!namerec->data.ip) {
@@ -216,6 +235,14 @@ struct name_record *find_name_on_wins_subnet(const struct nmb_name *nmbname, BOO
 		return NULL;
 	}
 
+	/* Self names only - these include permanent names. */
+	if( self_only && (namerec->data.source != SELF_NAME) && (namerec->data.source != PERMANENT_NAME) ) {
+		DEBUG( 9, ( "find_name_on_wins_subnet: self name %s NOT FOUND\n", nmb_namestr(nmbname) ) );
+		SAFE_FREE(namerec->data.ip);
+		SAFE_FREE(namerec);
+		return NULL;
+	}
+
 	/* Search for this name record on the list. Replace it if found. */
 
 	for( nr = wins_server_subnet->namelist; nr; nr = nr->next) {
@@ -294,7 +321,6 @@ BOOL remove_name_from_wins_namelist(struct name_record *namerec)
 	ret = tdb_delete(wins_tdb, key);
 
 	DLIST_REMOVE(wins_server_subnet->namelist, namerec);
-	SAFE_FREE(namerec->data.ip);
 
 	/* namerec must be freed by the caller */
 
@@ -1739,6 +1765,11 @@ static void process_wins_dmb_query_request(struct subnet_record *subrec,
 
 	num_ips = 0;
 
+	/* First, clear the in memory list - we're going to re-populate
+	   it with the tdb_traversal in fetch_all_active_wins_1b_names. */
+
+	wins_delete_all_tmp_in_memory_records();
+
 	fetch_all_active_wins_1b_names();
 
 	for( namerec = subrec->namelist; namerec; namerec = namerec->next ) {
@@ -2176,8 +2207,6 @@ we are not the wins owner !\n", nmb_namestr(&namerec->name)));
 void initiate_wins_processing(time_t t)
 {
 	static time_t lasttime = 0;
-	struct name_record *nr = NULL;
-	struct name_record *nrnext = NULL;
 
 	if (!lasttime) {
 		lasttime = t;
@@ -2193,14 +2222,7 @@ void initiate_wins_processing(time_t t)
 
 	tdb_traverse(wins_tdb, wins_processing_traverse_fn, &t);
 
-	
-	/* Delete all temporary name records on the wins subnet linked list. */
-	for( nr = wins_server_subnet->namelist; nr; nr = nrnext) {
-		nrnext = nr->next;
-		DLIST_REMOVE(wins_server_subnet->namelist, nr);
-		SAFE_FREE(nr->data.ip);
-		SAFE_FREE(nr);
-	}
+	wins_delete_all_tmp_in_memory_records();
 
 	wins_write_database(t, True);
 
diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index 1eb2659905b..34d23ebf8fa 100644
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -97,6 +97,7 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 	}
 
 	size = prs_data_size(&ps);
+	SAFE_FREE(state->response.extra_data.data);
 	state->response.extra_data.data = SMB_MALLOC(size);
 	if (!state->response.extra_data.data) {
 		prs_mem_free(&ps);
@@ -1365,6 +1366,7 @@ done:
 		cell += 1;
 
 		/* Append an AFS token string */
+		SAFE_FREE(state->response.extra_data.data);
 		state->response.extra_data.data =
 			afs_createtoken_str(afsname, cell);
 
@@ -1614,6 +1616,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 
 			DEBUG(5, ("Setting unix username to [%s]\n", username_out));
 
+			SAFE_FREE(state->response.extra_data.data);
 			state->response.extra_data.data = SMB_STRDUP(username_out);
 			if (!state->response.extra_data.data) {
 				result = NT_STATUS_NO_MEMORY;
diff --git a/source/param/params.c b/source/param/params.c
index 6669e80191d..6d036e40f69 100644
--- a/source/param/params.c
+++ b/source/param/params.c
@@ -3,9 +3,9 @@
  *
  * This module Copyright (C) 1990-1998 Karl Auer
  *
- * Rewritten almost completely by Christopher R. Hertel
- * at the University of Minnesota, September, 1997.
- * This module Copyright (C) 1997-1998 by the University of Minnesota
+ * Rewritten almost completely by Christopher R. Hertel, 1997.
+ * This module Copyright (C) 1997-1998 by Christopher R. Hertel
+ * 
  * -------------------------------------------------------------------------- **
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/source/passdb/passdb.c b/source/passdb/passdb.c
index d4e788ff680..cbb30ead023 100644
--- a/source/passdb/passdb.c
+++ b/source/passdb/passdb.c
@@ -1329,6 +1329,7 @@ BOOL pdb_copy_sam_account(struct samu *dst, struct samu *src )
 
 	len = init_buffer_from_sam_v3(&buf, src, False);
 	if (len == -1 || !buf) {
+		SAFE_FREE(buf);
 		return False;
 	}
 
diff --git a/source/passdb/pdb_tdb.c b/source/passdb/pdb_tdb.c
index 0dc46bec2d0..f3ae4b7b02e 100644
--- a/source/passdb/pdb_tdb.c
+++ b/source/passdb/pdb_tdb.c
@@ -902,13 +902,19 @@ static int tdbsam_traverse_setpwent(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data,
 		/* save a copy of the key */
 		
 		ptr->key.dptr = memdup( key.dptr, key.dsize );
+		if (!ptr->key.dptr) {
+			DEBUG(0,("tdbsam_traverse_setpwent: memdup failed\n"));
+			/* just return 0 and let the traversal continue */
+			SAFE_FREE(ptr);
+			return 0;
+		}
+
 		ptr->key.dsize = key.dsize;
 		
 		DLIST_ADD( tdbsam_pwent_list, ptr );
 	
 	}
 	
-	
 	return 0;
 }
 
@@ -1304,7 +1310,6 @@ static BOOL tdb_update_ridrec_only( struct samu* newpwd, int flag )
 
 static BOOL tdb_update_sam(struct pdb_methods *my_methods, struct samu* newpwd, int flag)
 {
-	uint32		user_rid;
 	BOOL            result = True;
 
 	/* invalidate the existing TDB iterator if it is open */
@@ -1319,7 +1324,7 @@ static BOOL tdb_update_sam(struct pdb_methods *my_methods, struct samu* newpwd,
 	}
 #endif
 
-	if ( !(user_rid = pdb_get_user_rid(newpwd)) ) {
+	if (!pdb_get_user_rid(newpwd)) {
 		DEBUG(0,("tdb_update_sam: struct samu (%s) with no RID!\n", pdb_get_username(newpwd)));
 		return False;
 	}
diff --git a/source/printing/printing.c b/source/printing/printing.c
index c7ca917af0e..9dd6bec0be4 100644
--- a/source/printing/printing.c
+++ b/source/printing/printing.c
@@ -234,7 +234,7 @@ void printing_end(void)
  when asked for (and only when supported)
 ****************************************************************************/
 
-static struct printif *get_printer_fns_from_type( int type )
+static struct printif *get_printer_fns_from_type( enum printing_types type )
 {
 	struct printif *printer_fns = &generic_printif;
 
@@ -257,7 +257,7 @@ static struct printif *get_printer_fns_from_type( int type )
 
 static struct printif *get_printer_fns( int snum )
 {
-	return get_printer_fns_from_type( lp_printing(snum) );
+	return get_printer_fns_from_type( (enum printing_types)lp_printing(snum) );
 }
 
 
@@ -1370,7 +1370,7 @@ static void print_queue_receive(int msg_type, struct process_id src,
 	}
 
 	print_queue_update_with_lock(sharename, 
-		get_printer_fns_from_type(printing_type),
+		get_printer_fns_from_type((enum printing_types)printing_type),
 		lpqcommand, lprmcommand );
 
 	return;
@@ -1480,7 +1480,7 @@ static void print_queue_update(int snum, BOOL force)
 	
 	/* get the length */
 
-	len = tdb_pack( buffer, len, "fdPP",
+	len = tdb_pack( NULL, 0, "fdPP",
 		sharename,
 		type,
 		lpqcommand, 
diff --git a/source/registry/reg_eventlog.c b/source/registry/reg_eventlog.c
index 1c65c9b2178..ea2b274f88a 100644
--- a/source/registry/reg_eventlog.c
+++ b/source/registry/reg_eventlog.c
@@ -36,7 +36,6 @@ BOOL eventlog_init_keys( void )
 	pstring evtfilepath;
 	REGSUBKEY_CTR *subkeys;
 	REGVAL_CTR *values;
-	uint32 uiDisplayNameId;
 	uint32 uiMaxSize;
 	uint32 uiRetention;
 	uint32 uiCategoryCount;
@@ -92,7 +91,7 @@ BOOL eventlog_init_keys( void )
 
 			/* hard code some initial values */
 
-			uiDisplayNameId = 0x00000100;
+			/* uiDisplayNameId = 0x00000100; */
 			uiMaxSize = 0x00080000;
 			uiRetention = 0x93A80;
 
diff --git a/source/registry/reg_perfcount.c b/source/registry/reg_perfcount.c
index c69e7b7e14e..04a99c3af69 100644
--- a/source/registry/reg_perfcount.c
+++ b/source/registry/reg_perfcount.c
@@ -1040,10 +1040,10 @@ uint32 reg_perfcount_get_perf_data_block(uint32 base_index,
 					 PERF_DATA_BLOCK *block,
 					 char *object_ids)
 {
-	uint32 buffer_size = 0, last_counter;
+	uint32 buffer_size = 0;
 	const char *fname = counters_directory( NAMES_DB );
 	TDB_CONTEXT *names;
-	int retval;
+	int retval = 0;
 	
 	names = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDONLY, 0444);
 
@@ -1059,7 +1059,7 @@ uint32 reg_perfcount_get_perf_data_block(uint32 base_index,
 		return 0;
 	}
 
-	last_counter = reg_perfcount_get_last_counter(base_index);
+	reg_perfcount_get_last_counter(base_index);
     
 	if(object_ids == NULL)
 	{
@@ -1075,6 +1075,10 @@ uint32 reg_perfcount_get_perf_data_block(uint32 base_index,
 
 	tdb_close(names);
 
+	if (retval == -1) {
+		return 0;
+	}
+
 	return buffer_size + block->HeaderLength;
 }
 
diff --git a/source/registry/reg_printing.c b/source/registry/reg_printing.c
index a712a7c9706..3ecff3d6964 100644
--- a/source/registry/reg_printing.c
+++ b/source/registry/reg_printing.c
@@ -225,7 +225,9 @@ static int key_printers_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 
 	/* get information for a specific printer */
 	
-	reg_split_path( printers_key, &printername, &printerdatakey );
+	if (!reg_split_path( printers_key, &printername, &printerdatakey )) {
+		return -1;
+	}
 
 	/* validate the printer name */
 
@@ -314,7 +316,9 @@ static BOOL key_printers_store_keys( const char *key, REGSUBKEY_CTR *subkeys )
 		return add_printers_by_registry( subkeys );
 	}
 	
-	reg_split_path( printers_key, &printername, &printerdatakey );
+	if (!reg_split_path( printers_key, &printername, &printerdatakey )) {
+		return False;
+	}
 	
 	/* lookup the printer */
 	
@@ -482,7 +486,10 @@ static int key_printers_fetch_values( const char *key, REGVAL_CTR *values )
 	
 	/* lookup the printer object */
 	
-	reg_split_path( printers_key, &printername, &printerdatakey );
+	if (!reg_split_path( printers_key, &printername, &printerdatakey )) {
+		return -1;
+	}
+	
 	if ( !W_ERROR_IS_OK( get_a_printer(NULL, &printer, 2, printername) ) )
 		goto done;
 		
@@ -672,7 +679,9 @@ static BOOL key_printers_store_values( const char *key, REGVAL_CTR *values )
 		return regdb_store_values( KEY_WINNT_PRINTERS, values );
 	}
 	
-	reg_split_path( printers_key, &printername, &keyname );
+	if (!reg_split_path( printers_key, &printername, &keyname )) {
+		return False;
+	}
 
 	if ( !W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, printername) ) )
 		return False;
@@ -754,7 +763,9 @@ static int key_driver_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 	
 	pstrcpy( key2, keystr );
 	keystr = key2;
-	reg_split_path( keystr, &base, &subkeypath );
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
 	
 	/* sanity check */
 	
@@ -777,7 +788,9 @@ static int key_driver_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 	/* more of the key path to process */
 	
 	keystr = subkeypath;
-	reg_split_path( keystr, &base, &subkeypath );	
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
 		
 	/* ...\Print\Environements\...\Drivers\ */
 	
@@ -809,7 +822,9 @@ static int key_driver_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 
 	if ( strequal(base, "Print Processors") ) {
 		keystr = subkeypath;
-		reg_split_path( keystr, &base, &subkeypath );
+		if (!reg_split_path( keystr, &base, &subkeypath )) {
+			return -1;
+		}
 
 		/* no subkeys below this point */
 
@@ -824,7 +839,10 @@ static int key_driver_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 	/* only dealing with drivers from here on out */
 
 	keystr = subkeypath;
-	reg_split_path( keystr, &base, &subkeypath );
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
+
 	version = atoi(&base[strlen(base)-1]);
 			
 	switch (env_index) {
@@ -947,7 +965,9 @@ static int driver_arch_fetch_values( char *key, REGVAL_CTR *values )
 	NT_PRINTER_DRIVER_INFO_LEVEL	driver_ctr;
 	WERROR		w_result;
 
-	reg_split_path( key, &base, &subkeypath );
+	if (!reg_split_path( key, &base, &subkeypath )) {
+		return -1;
+	}
 	
 	/* no values in 'Environments\Drivers\Windows NT x86' */
 	
@@ -964,7 +984,9 @@ static int driver_arch_fetch_values( char *key, REGVAL_CTR *values )
 	fstrcpy( arch_environment, base );
 	
 	keystr = subkeypath;
-	reg_split_path( keystr, &base, &subkeypath );
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
 
 	if ( strequal(base, "Print Processors") )
 		return 0;
@@ -981,7 +1003,9 @@ static int driver_arch_fetch_values( char *key, REGVAL_CTR *values )
 	   The subkey name has to be Version-XX */
 	
 	keystr = subkeypath;
-	reg_split_path( keystr, &base, &subkeypath );
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
 
 	if ( !subkeypath )
 		return 0;
@@ -991,7 +1015,9 @@ static int driver_arch_fetch_values( char *key, REGVAL_CTR *values )
 	/* BEGIN PRINTER DRIVER NAME BLOCK */
 	
 	keystr = subkeypath;
-	reg_split_path( keystr, &base, &subkeypath );
+	if (!reg_split_path( keystr, &base, &subkeypath )) {
+		return -1;
+	}
 	
 	/* don't go any deeper for now */
 	
diff --git a/source/registry/reg_shares.c b/source/registry/reg_shares.c
index 85ac812101a..5a3e9a131b6 100644
--- a/source/registry/reg_shares.c
+++ b/source/registry/reg_shares.c
@@ -124,6 +124,7 @@ static int shares_value_info( const char *key, REGVAL_CTR *val )
 		num_values = handle_printing_subpath( path, NULL, val );
 #endif
 		
+	SAFE_FREE(path);
 	
 	return num_values;
 }
diff --git a/source/rpc_parse/parse_eventlog.c b/source/rpc_parse/parse_eventlog.c
index 5e28a4aba5d..4aff9734eed 100644
--- a/source/rpc_parse/parse_eventlog.c
+++ b/source/rpc_parse/parse_eventlog.c
@@ -353,18 +353,18 @@ BOOL eventlog_io_r_read_eventlog(const char *desc,
 
 	/* Now pad with whitespace until the end of the response buffer */
 
-	r_u->end_of_entries_padding =
-		SMB_CALLOC_ARRAY(uint8,
-				 q_u->max_read_size - r_u->num_bytes_in_resp);
+	if (q_u->max_read_size - r_u->num_bytes_in_resp) {
+		r_u->end_of_entries_padding = SMB_CALLOC_ARRAY(uint8, q_u->max_read_size - r_u->num_bytes_in_resp);
 
-	if(!(prs_uint8s(False, "end of entries padding", ps, 
-		depth, r_u->end_of_entries_padding,
-		(q_u->max_read_size - r_u->num_bytes_in_resp))))
-	{
-		return False;
-	}
+		if(!(prs_uint8s(False, "end of entries padding", ps, 
+				depth, r_u->end_of_entries_padding,
+				(q_u->max_read_size - r_u->num_bytes_in_resp)))) {
+			free(r_u->end_of_entries_padding);
+			return False;
+		}
 
-	free(r_u->end_of_entries_padding);
+		free(r_u->end_of_entries_padding);
+	}
 
 	/* We had better be DWORD aligned here */
 
diff --git a/source/rpc_server/srv_eventlog_lib.c b/source/rpc_server/srv_eventlog_lib.c
index e04aefa7e1b..66be1dc34ff 100644
--- a/source/rpc_server/srv_eventlog_lib.c
+++ b/source/rpc_server/srv_eventlog_lib.c
@@ -201,6 +201,12 @@ BOOL make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
 
 		len = tdb_unpack( ret.dptr, ret.dsize, "ddddd", &reclen,
 				  &tresv1, &trecnum, &timegen, &timewr );
+		if (len == -1) {
+			DEBUG( 10,("make_way_for_eventlogs: tdb_unpack failed.\n"));
+			tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+			return False;
+		}
+
 		DEBUG( 8,
 		       ( "read record %d, record size is [%d], total so far [%d]\n",
 			 i, reclen, nbytes ) );
diff --git a/source/rpc_server/srv_eventlog_nt.c b/source/rpc_server/srv_eventlog_nt.c
index c1c0b6a0e24..79839a0a52a 100644
--- a/source/rpc_server/srv_eventlog_nt.c
+++ b/source/rpc_server/srv_eventlog_nt.c
@@ -289,12 +289,10 @@ Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
 	int srecno;
 	int reclen;
 	int len;
-	uint8 *rbuff;
 
 	pstring *wpsource, *wpcomputer, *wpsid, *wpstrs, *puserdata;
 
 	key.dsize = sizeof( int32 );
-	rbuff = NULL;
 
 	srecno = recno;
 	key.dptr = ( char * ) &srecno;
diff --git a/source/rpc_server/srv_samr_nt.c b/source/rpc_server/srv_samr_nt.c
index bfae47ef250..da2bb8c3b56 100644
--- a/source/rpc_server/srv_samr_nt.c
+++ b/source/rpc_server/srv_samr_nt.c
@@ -1956,7 +1956,7 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
 	
 	TALLOC_FREE(sampass);
 
-	return NT_STATUS_OK;
+	return nt_status;
 }
 
 /*******************************************************************
diff --git a/source/rpcclient/cmd_spoolss.c b/source/rpcclient/cmd_spoolss.c
index 7f8bbbcd8c9..ed5653eb704 100644
--- a/source/rpcclient/cmd_spoolss.c
+++ b/source/rpcclient/cmd_spoolss.c
@@ -1895,7 +1895,7 @@ static WERROR cmd_spoolss_enum_forms(struct rpc_pipe_client *cli,
 	WERROR werror;
 	char *servername = NULL, *printername = NULL;
 	BOOL got_handle = False;
-	uint32 needed, offered, num_forms, level = 1, i;
+	uint32 num_forms, level = 1, i;
 	FORM_1 *forms;
 	
 	/* Parse the command arguements */
@@ -1922,7 +1922,6 @@ static WERROR cmd_spoolss_enum_forms(struct rpc_pipe_client *cli,
 
 	/* Enumerate forms */
 
-	offered = needed = 0;
 	werror = rpccli_spoolss_enumforms(cli, mem_ctx, &handle, level, &num_forms, &forms);
 
 	if (!W_ERROR_IS_OK(werror))
@@ -2150,7 +2149,7 @@ static WERROR cmd_spoolss_enum_jobs(struct rpc_pipe_client *cli,
 				      const char **argv)
 {
 	WERROR result;
-	uint32 needed, offered, level = 1, num_jobs, i;
+	uint32 level = 1, num_jobs, i;
 	BOOL got_hnd = False;
 	pstring printername;
 	fstring servername, user;
@@ -2185,7 +2184,6 @@ static WERROR cmd_spoolss_enum_jobs(struct rpc_pipe_client *cli,
 
 	/* Enumerate ports */
 
-	offered = needed = 0;
 	result = rpccli_spoolss_enumjobs(cli, mem_ctx, &hnd, level, 0, 1000,
 		&num_jobs, &ctr);
 
diff --git a/source/sam/nss_info.c b/source/sam/nss_info.c
index 3d0e658a358..6d01916754e 100644
--- a/source/sam/nss_info.c
+++ b/source/sam/nss_info.c
@@ -22,6 +22,20 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_IDMAP
 
+static enum wb_posix_mapping wb_posix_map_type(const char *map_str)
+{
+	if (strequal(map_str, "template")) 
+		return WB_POSIX_MAP_TEMPLATE;
+	else if (strequal(map_str, "sfu"))
+		return WB_POSIX_MAP_SFU;
+	else if (strequal(map_str, "rfc2307"))
+		return WB_POSIX_MAP_RFC2307;
+	else if (strequal(map_str, "unixinfo"))
+		return WB_POSIX_MAP_UNIXINFO;
+	
+	return WB_POSIX_MAP_UNKNOWN;
+}
+
 /* winbind nss info = rfc2307 SO36:sfu FHAIN:rfc2307 PANKOW:template
  *
  * syntax is:
@@ -43,7 +57,7 @@ enum wb_posix_mapping get_nss_info(const char *domain_name)
 		return WB_POSIX_MAP_TEMPLATE;
 	}
 
-	if ((map_templ = wb_posix_map_type(list[0])) == -1) {
+	if ((map_templ = wb_posix_map_type(list[0])) == WB_POSIX_MAP_UNKNOWN) {
 		DEBUG(0,("get_nss_info: invalid setting: %s\n", list[0]));
 		return WB_POSIX_MAP_TEMPLATE;
 	}
@@ -64,7 +78,7 @@ enum wb_posix_mapping get_nss_info(const char *domain_name)
 		
 			enum wb_posix_mapping type;
 			
-			if ((type = wb_posix_map_type(p)) == -1) {
+			if ((type = wb_posix_map_type(p)) == WB_POSIX_MAP_UNKNOWN) {
 				DEBUG(0,("get_nss_info: invalid setting: %s\n", p));
 				/* return WB_POSIX_MAP_TEMPLATE; */
 				continue;
@@ -95,17 +109,3 @@ const char *wb_posix_map_str(enum wb_posix_mapping mtype)
 	}
 	return NULL;
 }
-
-enum wb_posix_mapping wb_posix_map_type(const char *map_str)
-{
-	if (strequal(map_str, "template")) 
-		return WB_POSIX_MAP_TEMPLATE;
-	else if (strequal(map_str, "sfu"))
-		return WB_POSIX_MAP_SFU;
-	else if (strequal(map_str, "rfc2307"))
-		return WB_POSIX_MAP_RFC2307;
-	else if (strequal(map_str, "unixinfo"))
-		return WB_POSIX_MAP_UNIXINFO;
-	
-	return -1;
-}
diff --git a/source/smbd/dir.c b/source/smbd/dir.c
index 27a4182c220..5ba9e1ed575 100644
--- a/source/smbd/dir.c
+++ b/source/smbd/dir.c
@@ -636,12 +636,7 @@ BOOL dptr_SearchDir(struct dptr_struct *dptr, const char *name, long *poffset, S
 		return False;
 	}
 
-	if (SearchDir(dptr->dir_hnd, name, poffset)) {
-		if (is_visible_file(dptr->conn, dptr->path, name, pst, True)) {
-			return True;
-		}
-	}
-	return False;
+	return SearchDir(dptr->dir_hnd, name, poffset);
 }
 
 /****************************************************************************
@@ -854,6 +849,8 @@ static BOOL user_can_read_file(connection_struct *conn, char *name, SMB_STRUCT_S
 
 	/* If we can't stat it does not show it */
 	if (!VALID_STAT(*pst) && (SMB_VFS_STAT(conn, name, pst) != 0)) {
+		DEBUG(10,("user_can_read_file: SMB_VFS_STAT failed for file %s with error %s\n",
+			name, strerror(errno) ));
 		return False;
 	}
 
@@ -992,6 +989,7 @@ BOOL is_visible_file(connection_struct *conn, const char *dir_path, const char *
 
 	/* If it's a vetoed file, pretend it doesn't even exist */
 	if (use_veto && IS_VETO_PATH(conn, name)) {
+		DEBUG(10,("is_visible_file: file %s is vetoed.\n", name ));
 		return False;
 	}
 
@@ -1003,16 +1001,19 @@ BOOL is_visible_file(connection_struct *conn, const char *dir_path, const char *
 		}
 		/* Honour _hide unreadable_ option */
 		if (hide_unreadable && !user_can_read_file(conn, entry, pst)) {
+			DEBUG(10,("is_visible_file: file %s is unreadable.\n", entry ));
 			SAFE_FREE(entry);
 			return False;
 		}
 		/* Honour _hide unwriteable_ option */
 		if (hide_unwriteable && !user_can_write_file(conn, entry, pst)) {
+			DEBUG(10,("is_visible_file: file %s is unwritable.\n", entry ));
 			SAFE_FREE(entry);
 			return False;
 		}
 		/* Honour _hide_special_ option */
 		if (hide_special && file_is_special(conn, entry, pst)) {
+			DEBUG(10,("is_visible_file: file %s is special.\n", entry ));
 			SAFE_FREE(entry);
 			return False;
 		}
diff --git a/source/smbd/map_username.c b/source/smbd/map_username.c
index 1f523cc89f1..7cbde3c59ea 100644
--- a/source/smbd/map_username.c
+++ b/source/smbd/map_username.c
@@ -82,7 +82,7 @@ BOOL map_username(fstring user)
 
 		/* should be either no lines or a single line with the mapped username */
 
-		if (numlines) {
+		if (numlines && qlines) {
 			DEBUG(3,("Mapped user %s to %s\n", user, qlines[0] ));
 			fstrcpy( user, qlines[0] );
 		}
diff --git a/source/smbd/posix_acls.c b/source/smbd/posix_acls.c
index 40cb6698a02..6e403dba92a 100644
--- a/source/smbd/posix_acls.c
+++ b/source/smbd/posix_acls.c
@@ -1483,7 +1483,7 @@ Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
 		 * Only add to the file ACL if not inherit only.
 		 */
 
-		if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
+		if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
 			DLIST_ADD_END(file_ace, current_ace, tmp_ace);
 
 			/*
diff --git a/source/utils/eventlogadm.c b/source/utils/eventlogadm.c
index 8cf79fcf14b..036ce3ad4b9 100644
--- a/source/utils/eventlogadm.c
+++ b/source/utils/eventlogadm.c
@@ -89,7 +89,7 @@ int DoWriteCommand( int argc, char **argv, BOOL debugflag, char *exename )
 	pstring linein;
 	BOOL is_eor;
 	Eventlog_entry ee;
-	int pret, rcnum;
+	int rcnum;
 
 	f1 = stdin;
 	if ( !f1 ) {
@@ -121,7 +121,7 @@ int DoWriteCommand( int argc, char **argv, BOOL debugflag, char *exename )
 		is_eor = False;
 
 
-		pret = parse_logentry( ( char * ) &linein, &ee, &is_eor );
+		parse_logentry( ( char * ) &linein, &ee, &is_eor );
 		/* should we do something with the return code? */
 
 		if ( is_eor ) {
@@ -161,7 +161,6 @@ int main( int argc, char *argv[] )
 {
 	int opt, rc;
 	char *exename;
-	char *srcname, *eventlogname;
 
 
 	fstring opname;
@@ -173,7 +172,6 @@ int main( int argc, char *argv[] )
 	lp_load( dyn_CONFIGFILE, True, False, False, True);
 
 	exename = argv[0];
-	srcname = NULL;
 
 	/* default */
 
@@ -190,7 +188,7 @@ int main( int argc, char *argv[] )
 			break;
 
 		case 'h':
-			usage( argv[0] );
+			usage( exename );
 			display_eventlog_names(  );
 			exit( 0 );
 			break;
@@ -211,7 +209,6 @@ int main( int argc, char *argv[] )
 	}
 
 	/*  note that the separate command types should call usage if they need to... */
-	eventlogname = *argv;
 	while ( 1 ) {
 		if ( !StrCaseCmp( opname, "addsource" ) ) {
 			rc = DoAddSourceCommand( argc, argv, opt_debug,
diff --git a/source/utils/net_rpc.c b/source/utils/net_rpc.c
index f29398c822c..190992e3741 100644
--- a/source/utils/net_rpc.c
+++ b/source/utils/net_rpc.c
@@ -1442,7 +1442,7 @@ do { if (strequal(ctx->thiscmd, name)) { \
 
 #define SETSTR(name, rec, flag) \
 do { if (strequal(ctx->thiscmd, name)) { \
-	init_unistr2(&usr->uni_##rec, argv[0], STR_TERMINATE); \
+	init_unistr2(&usr->uni_##rec, argv[0], UNI_STR_TERMINATE); \
 	init_uni_hdr(&usr->hdr_##rec, &usr->uni_##rec); \
 	usr->fields_present |= ACCT_##flag; } \
 } while (0);
diff --git a/source/utils/net_rpc_registry.c b/source/utils/net_rpc_registry.c
index 10ba28e0239..873cb7b4597 100644
--- a/source/utils/net_rpc_registry.c
+++ b/source/utils/net_rpc_registry.c
@@ -410,6 +410,7 @@ static int rpc_registry_dump( int argc, const char **argv )
 	
 	if ((nk = regfio_rootkey( registry )) == NULL) {
 		d_fprintf(stderr, "Could not get rootkey\n");
+		regfio_close( registry );
 		return 1;
 	}
 	d_printf("[%s]\n", nk->keyname);
@@ -433,7 +434,7 @@ static int rpc_registry_dump( int argc, const char **argv )
 
 static int rpc_registry_copy( int argc, const char **argv )
 {
-	REGF_FILE   *infile, *outfile;
+	REGF_FILE   *infile = NULL, *outfile = NULL;
 	REGF_NK_REC *nk;
 	int result = 1;
 	
@@ -452,7 +453,7 @@ static int rpc_registry_copy( int argc, const char **argv )
 	d_printf("Opening %s....", argv[1]);
 	if ( !(outfile = regfio_open( argv[1], (O_RDWR|O_CREAT|O_TRUNC), (S_IREAD|S_IWRITE) )) ) {
 		d_fprintf(stderr, "Failed to open %s for writing\n", argv[1]);
-		goto out_close_infile;
+		goto out;
 	}
 	d_printf("ok\n");
 	
@@ -460,7 +461,7 @@ static int rpc_registry_copy( int argc, const char **argv )
 	
 	if ((nk = regfio_rootkey( infile )) == NULL) {
 		d_fprintf(stderr, "Could not get rootkey\n");
-		goto out_close_infile;
+		goto out;
 	}
 	d_printf("RootKey: [%s]\n", nk->keyname);
 
@@ -468,13 +469,18 @@ static int rpc_registry_copy( int argc, const char **argv )
 
 	result = 0;
 
+out:
+
 	d_printf("Closing %s...", argv[1]);
-	regfio_close( outfile );
+	if (outfile) {
+		regfio_close( outfile );
+	}
 	d_printf("ok\n");
 
-out_close_infile:
 	d_printf("Closing %s...", argv[0]);
-	regfio_close( infile );
+	if (infile) {
+		regfio_close( infile );
+	}
 	d_printf("ok\n");
 
 	return( result);
diff --git a/source/utils/net_usershare.c b/source/utils/net_usershare.c
index 09ef8bd97f9..7d6f8d56e27 100644
--- a/source/utils/net_usershare.c
+++ b/source/utils/net_usershare.c
@@ -368,13 +368,10 @@ static int info_fn(struct file_list *fl, void *priv)
 	pstrcpy(acl_str, "usershare_acl=");
 
 	for (num_aces = 0; num_aces < psd->dacl->num_aces; num_aces++) {
-		char access_str[2];
 		const char *domain;
 		const char *name;
 		NTSTATUS ntstatus;
 
-		access_str[1] = '\0';
-
 		ntstatus = net_lookup_name_from_sid(ctx, &psd->dacl->ace[num_aces].trustee, &domain, &name);
 
 		if (NT_STATUS_IS_OK(ntstatus)) {
@@ -765,7 +762,7 @@ static int net_usershare_add(int argc, const char **argv)
 		const char *my_argv[2];
 		my_argv[0] = sharename;
 		my_argv[1] = NULL;
-		net_usershare_info(1, argv);
+		net_usershare_info(1, my_argv);
 	}
 
 	SAFE_FREE(sharename);
diff --git a/source/web/neg_lang.c b/source/web/neg_lang.c
index ca671822d87..fb79f41f13c 100644
--- a/source/web/neg_lang.c
+++ b/source/web/neg_lang.c
@@ -86,6 +86,10 @@ void web_set_lang(const char *lang_string)
 		lang_num++;
 	}
 	pl = SMB_MALLOC_ARRAY(struct pri_list, lang_num);
+	if (!pl) {
+		return;
+	}
+
 	for (i = 0; i < lang_num; i++) {
 		char *pri_code;
 		if ((pri_code=strstr(lang_list[i], ";q="))) {