Merge ldb_search() and ldb_search_exp_fmt() into a simgle function.

The previous ldb_search() interface made it way too easy to leak results,
and being able to use a printf-like expression turns to be really useful.

13 files changed, 63 insertions, 80 deletions

diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index fa8276e7b4b..2b74d722a18 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -1024,7 +1024,7 @@ const struct dom_sid *samdb_domain_sid(struct ldb_context *ldb)
 		goto failed;
 	}
 
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
+	ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
 
 	if (ret != LDB_SUCCESS) {
 		goto failed;
@@ -1137,13 +1137,12 @@ struct ldb_dn *samdb_ntds_settings_dn(struct ldb_context *ldb)
 	}
 	
 
-	ret = ldb_search(ldb, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, NULL, root_attrs, &root_res);
+	ret = ldb_search(ldb, tmp_ctx, &root_res, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
 	if (ret) {
 		DEBUG(1,("Searching for dsServiceName in rootDSE failed: %s\n", 
 			 ldb_errstring(ldb)));
 		goto failed;
 	}
-	talloc_steal(tmp_ctx, root_res);
 
 	if (root_res->count != 1) {
 		goto failed;
@@ -1189,11 +1188,10 @@ const struct GUID *samdb_ntds_invocation_id(struct ldb_context *ldb)
 		goto failed;
 	}
 
-	ret = ldb_search(ldb, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, NULL, attrs, &res);
+	ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
 	if (ret) {
 		goto failed;
 	}
-	talloc_steal(tmp_ctx, res);
 
 	if (res->count != 1) {
 		goto failed;
@@ -1283,11 +1281,10 @@ const struct GUID *samdb_ntds_objectGUID(struct ldb_context *ldb)
 		goto failed;
 	}
 
-	ret = ldb_search(ldb, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, NULL, attrs, &res);
+	ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
 	if (ret) {
 		goto failed;
 	}
-	talloc_steal(tmp_ctx, res);
 
 	if (res->count != 1) {
 		goto failed;
@@ -1397,14 +1394,13 @@ bool samdb_is_pdc(struct ldb_context *ldb)
 		return false;
 	}
 
-	ret = ldb_search(ldb, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, NULL, dom_attrs, &dom_res);
+	ret = ldb_search(ldb, tmp_ctx, &dom_res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, dom_attrs, NULL);
 	if (ret) {
 		DEBUG(1,("Searching for fSMORoleOwner in %s failed: %s\n", 
 			 ldb_dn_get_linearized(ldb_get_default_basedn(ldb)), 
 			 ldb_errstring(ldb)));
 		goto failed;
 	}
-	talloc_steal(tmp_ctx, dom_res);
 	if (dom_res->count != 1) {
 		goto failed;
 	}
@@ -1444,17 +1440,17 @@ bool samdb_is_gc(struct ldb_context *ldb)
 	}
 
 	/* Query cn=ntds settings,.... */
-	ret = ldb_search(ldb, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, NULL, attrs, &res);
+	ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
 	if (ret) {
+		talloc_free(tmp_ctx);
 		return false;
 	}
 	if (res->count != 1) {
-		talloc_free(res);
+		talloc_free(tmp_ctx);
 		return false;
 	}
 
 	options = ldb_msg_find_attr_as_int(res->msgs[0], "options", 0);
-	talloc_free(res);
 	talloc_free(tmp_ctx);
 
 	/* if options attribute has the 0x00000001 flag set, then enable the global catlog */
@@ -1478,10 +1474,9 @@ int samdb_search_for_parent_domain(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 	if (local_ctx == NULL) return LDB_ERR_OPERATIONS_ERROR;
 	
 	while ((sdn = ldb_dn_get_parent(local_ctx, sdn))) {
-		ret = ldb_search(ldb, sdn, LDB_SCOPE_BASE, 
-				 "(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain))", attrs, &res);
+		ret = ldb_search(ldb, local_ctx, &res, sdn, LDB_SCOPE_BASE, attrs,
+				 "(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain))");
 		if (ret == LDB_SUCCESS) {
-			talloc_steal(local_ctx, res);
 			if (res->count == 1) {
 				break;
 			}
@@ -1955,7 +1950,7 @@ struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 	struct ldb_result *res_domain_ref;
 	char *escaped_domain = ldb_binary_encode_string(mem_ctx, domain_name);
 	/* find the domain's DN */
-	int ret_domain = ldb_search_exp_fmt(ldb, mem_ctx, 
+	int ret_domain = ldb_search(ldb, mem_ctx,
 					    &res_domain_ref, 
 					    samdb_partitions_dn(ldb, mem_ctx), 
 					    LDB_SCOPE_ONELEVEL, 
@@ -1967,7 +1962,7 @@ struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 	}
 	
 	if (res_domain_ref->count == 0) {
-		ret_domain = ldb_search_exp_fmt(ldb, mem_ctx, 
+		ret_domain = ldb_search(ldb, mem_ctx,
 						&res_domain_ref, 
 						samdb_dns_domain_to_dn(ldb, mem_ctx, domain_name),
 						LDB_SCOPE_BASE,
diff --git a/source4/dsdb/repl/drepl_partitions.c b/source4/dsdb/repl/drepl_partitions.c
index 8a1c5aa31a8..4f7afc08542 100644
--- a/source4/dsdb/repl/drepl_partitions.c
+++ b/source4/dsdb/repl/drepl_partitions.c
@@ -48,8 +48,8 @@ WERROR dreplsrv_load_partitions(struct dreplsrv_service *s)
 	basedn = ldb_dn_new(s, s->samdb, NULL);
 	W_ERROR_HAVE_NO_MEMORY(basedn);
 
-	ret = ldb_search(s->samdb, basedn, LDB_SCOPE_BASE, 
-			 "(objectClass=*)", attrs, &r);
+	ret = ldb_search(s->samdb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
+			 "(objectClass=*)");
 	talloc_free(basedn);
 	if (ret != LDB_SUCCESS) {
 		return WERR_FOOBAR;
@@ -57,7 +57,6 @@ WERROR dreplsrv_load_partitions(struct dreplsrv_service *s)
 		talloc_free(r);
 		return WERR_FOOBAR;
 	}
-	talloc_steal(s, r);
 
 	el = ldb_msg_find_element(r->msgs[0], "namingContexts");
 	if (!el) {
@@ -201,15 +200,14 @@ static WERROR dreplsrv_refresh_partition(struct dreplsrv_service *s,
 	DEBUG(2, ("dreplsrv_refresh_partition(%s)\n",
 		ldb_dn_get_linearized(p->dn)));
 
-	ret = ldb_search(s->samdb, p->dn, LDB_SCOPE_BASE,
-			 "(objectClass=*)", attrs, &r);
+	ret = ldb_search(s->samdb, mem_ctx, &r, p->dn, LDB_SCOPE_BASE, attrs,
+			 "(objectClass=*)");
 	if (ret != LDB_SUCCESS) {
 		return WERR_FOOBAR;
 	} else if (r->count != 1) {
 		talloc_free(r);
 		return WERR_FOOBAR;
 	}
-	talloc_steal(mem_ctx, r);
 
 	ZERO_STRUCT(p->nc);
 	p->nc.dn	= ldb_dn_alloc_linearized(p, p->dn);
diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c
index 369b06c3059..7324d898a65 100644
--- a/source4/dsdb/samdb/cracknames.c
+++ b/source4/dsdb/samdb/cracknames.c
@@ -107,8 +107,8 @@ static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, stru
 		return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 	}
 
-	ret = ldb_search(ldb_ctx, service_dn, LDB_SCOPE_BASE, "(objectClass=nTDSService)",
-			 directory_attrs, &res);
+	ret = ldb_search(ldb_ctx, tmp_ctx, &res, service_dn, LDB_SCOPE_BASE,
+			 directory_attrs, "(objectClass=nTDSService)");
 
 	if (ret != LDB_SUCCESS && ret != LDB_ERR_NO_SUCH_OBJECT) {
 		DEBUG(1, ("ldb_search: dn: %s not found: %s", service_dn_str, ldb_errstring(ldb_ctx)));
@@ -121,7 +121,6 @@ static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, stru
 		DEBUG(1, ("ldb_search: dn: %s not found", service_dn_str));
 		return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 	}
-	talloc_steal(tmp_ctx, res);
 	
 	spnmappings = ldb_msg_find_element(res->msgs[0], "sPNMappings");
 	if (!spnmappings || spnmappings->num_values == 0) {
@@ -292,7 +291,7 @@ static WERROR DsCrackNameUPN(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 	
 	realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 
-	ldb_ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &domain_res, 
+	ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
 				     samdb_partitions_dn(sam_ctx, mem_ctx), 
 				     LDB_SCOPE_ONELEVEL,
 				     domain_attrs,
@@ -737,7 +736,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 
 	if (domain_filter) {
 		/* if we have a domain_filter look it up and set the result_basedn and the dns_domain_name */
-		ldb_ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &domain_res, 
+		ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
 					     partitions_basedn,
 					     LDB_SCOPE_ONELEVEL,
 					     domain_attrs,
@@ -774,7 +773,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 		if (domain_res) {
 			result_basedn = samdb_result_dn(sam_ctx, mem_ctx, domain_res->msgs[0], "ncName", NULL);
 			
-			ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &res, 
+			ret = ldb_search(sam_ctx, mem_ctx, &res,
 						 result_basedn, LDB_SCOPE_SUBTREE, 
 						 result_attrs, "%s", result_filter);
 			if (ret != LDB_SUCCESS) {
@@ -936,7 +935,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 		
 		if (samdb_find_attribute(sam_ctx, result, "objectClass", "domain")) {
 
-			ldb_ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &domain_res, 
+			ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
 						     partitions_basedn,
 						     LDB_SCOPE_ONELEVEL,
 						     domain_attrs,
@@ -976,7 +975,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 					return WERR_OK;
 				}
 				dom_sid->num_auths--;
-				ldb_ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &domain_res, 
+				ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
 							     NULL,
 							     LDB_SCOPE_BASE,
 							     attrs,
@@ -1000,7 +999,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 					return WERR_OK;
 				}
 
-				ldb_ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &domain_res2, 
+				ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res2,
 							     partitions_basedn,
 							     LDB_SCOPE_ONELEVEL,
 							     domain_attrs,
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
index bc998a835a9..6836f95873e 100644
--- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
+++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
@@ -409,14 +409,12 @@ static int kludge_acl_init(struct ldb_module *module)
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
-			 LDB_SCOPE_BASE,
-			 NULL, attrs,
-			 &res);
+	ret = ldb_search(module->ldb, mem_ctx, &res,
+			 ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
+			 LDB_SCOPE_BASE, attrs, NULL);
 	if (ret != LDB_SUCCESS) {
 		goto done;
 	}
-	talloc_steal(mem_ctx, res);
 	if (res->count == 0) {
 		goto done;
 	}
diff --git a/source4/dsdb/samdb/ldb_modules/naming_fsmo.c b/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
index 084540f68d0..70f3e8ddfda 100644
--- a/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
@@ -64,10 +64,9 @@ static int naming_fsmo_init(struct ldb_module *module)
 	}
 	module->private_data = naming_fsmo;
 
-	ret = ldb_search(module->ldb, naming_dn,
-			 LDB_SCOPE_BASE,
-			 NULL, naming_attrs,
-			 &naming_res);
+	ret = ldb_search(module->ldb, mem_ctx, &naming_res,
+			 naming_dn, LDB_SCOPE_BASE,
+			 naming_attrs, NULL);
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "naming_fsmo_init: no partitions dn present: (skip loading of naming contexts details)\n");
@@ -81,7 +80,6 @@ static int naming_fsmo_init(struct ldb_module *module)
 		talloc_free(mem_ctx);
 		return ret;
 	}
-	talloc_steal(mem_ctx, naming_res);
 	if (naming_res->count == 0) {
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "naming_fsmo_init: no cross-ref container present: (skip loading of naming contexts details)\n");
diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index 9cae6ab7b53..0cd0baf6255 100644
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -807,15 +807,13 @@ static int partition_init(struct ldb_module *module)
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@PARTITION"),
-			 LDB_SCOPE_BASE,
-			 NULL, attrs,
-			 &res);
+	ret = ldb_search(module->ldb, mem_ctx, &res,
+			 ldb_dn_new(mem_ctx, module->ldb, "@PARTITION"),
+			 LDB_SCOPE_BASE, attrs, NULL);
 	if (ret != LDB_SUCCESS) {
 		talloc_free(mem_ctx);
 		return ret;
 	}
-	talloc_steal(mem_ctx, res);
 	if (res->count == 0) {
 		talloc_free(mem_ctx);
 		return ldb_next_init(module);
diff --git a/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c b/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
index 09d56d77c93..a5e7031a26f 100644
--- a/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
@@ -63,10 +63,9 @@ static int pdc_fsmo_init(struct ldb_module *module)
 	}
 	module->private_data = pdc_fsmo;
 
-	ret = ldb_search(module->ldb, pdc_dn,
-			 LDB_SCOPE_BASE,
-			 NULL, pdc_attrs,
-			 &pdc_res);
+	ret = ldb_search(module->ldb, mem_ctx, &pdc_res,
+			 pdc_dn, LDB_SCOPE_BASE,
+			 pdc_attrs, NULL);
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "pdc_fsmo_init: no domain object present: (skip loading of domain details)\n");
@@ -79,7 +78,6 @@ static int pdc_fsmo_init(struct ldb_module *module)
 		talloc_free(mem_ctx);
 		return ret;
 	}
-	talloc_steal(mem_ctx, pdc_res);
 	if (pdc_res->count == 0) {
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "pdc_fsmo_init: no domain object present: (skip loading of domain details)\n");
diff --git a/source4/dsdb/samdb/ldb_modules/proxy.c b/source4/dsdb/samdb/ldb_modules/proxy.c
index 0d065425ca7..d0a315e45a4 100644
--- a/source4/dsdb/samdb/ldb_modules/proxy.c
+++ b/source4/dsdb/samdb/ldb_modules/proxy.c
@@ -73,7 +73,7 @@ static int load_proxy_info(struct ldb_module *module)
 	if (dn == NULL) {
 		goto failed;
 	}
-	ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	ret = ldb_search(module->ldb, proxy, &res, dn, LDB_SCOPE_BASE, NULL, NULL);
 	talloc_free(dn);
 	if (ret != LDB_SUCCESS || res->count != 1) {
 		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Can't find @PROXYINFO\n");
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index bd491bd011e..cf720669b94 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -131,7 +131,7 @@ static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
 	int ret;
 	const char *str;
 
-	ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
+	ret = ldb_search(module->ldb, mem_ctx, &res, dn, LDB_SCOPE_BASE, attrs, "nextRid=*");
 	if (ret != LDB_SUCCESS) {
 		return ret;
 	}
@@ -207,7 +207,7 @@ static int samldb_get_new_sid(struct ldb_module *module,
 
 	/* find the domain sid */
 
-	ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
+	ret = ldb_search(module->ldb, mem_ctx, &res, dom_dn, LDB_SCOPE_BASE, attrs, "objectSid=*");
 	if (ret != LDB_SUCCESS) {
 		ldb_asprintf_errstring(module->ldb,
 					"samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
@@ -261,7 +261,7 @@ int samldb_notice_sid(struct ldb_module *module,
 	uint32_t old_rid;
 
 	/* find if this SID already exists */
-	ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &res,
+	ret = ldb_search(module->ldb, mem_ctx, &res,
 				 NULL, LDB_SCOPE_SUBTREE, attrs,
 				 "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
 	if (ret == LDB_SUCCESS) {
@@ -291,7 +291,7 @@ int samldb_notice_sid(struct ldb_module *module,
 	dom_sid->num_auths--;
 
 	/* find the domain DN */
-	ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &dom_res,
+	ret = ldb_search(module->ldb, mem_ctx, &dom_res,
 				 NULL, LDB_SCOPE_SUBTREE, attrs,
 				 "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))", 
 				 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
@@ -371,7 +371,7 @@ static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX
 	do {
 		*name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
 		/* TODO: Figure out exactly what this is meant to conflict with */
-		ret = ldb_search_exp_fmt(module->ldb,
+		ret = ldb_search(module->ldb,
 					 mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
 					 "samAccountName=%s",
 					 ldb_binary_encode_string(mem_ctx, *name));
diff --git a/source4/dsdb/samdb/ldb_modules/update_keytab.c b/source4/dsdb/samdb/ldb_modules/update_keytab.c
index b36c2c9b714..68973124ebe 100644
--- a/source4/dsdb/samdb/ldb_modules/update_keytab.c
+++ b/source4/dsdb/samdb/ldb_modules/update_keytab.c
@@ -59,8 +59,8 @@ static int add_modified(struct ldb_module *module, struct ldb_dn *dn, bool delet
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE,
-			 filter, attrs, &res);
+	ret = ldb_search(module->ldb, data, &res,
+			 dn, LDB_SCOPE_BASE, attrs, "%s", filter);
 	if (ret != LDB_SUCCESS) {
 		talloc_free(filter);
 		return ret;
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index b5b7ddfdc6d..5d928ebce35 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -175,7 +175,7 @@ int samdb_copy_template(struct ldb_context *ldb,
 	}
 	
 	/* pull the template record */
-	ret = ldb_search(templates_ldb, basedn, LDB_SCOPE_BASE, "distinguishedName=*", NULL, &res);	
+	ret = ldb_search(templates_ldb, msg, &res, basedn, LDB_SCOPE_BASE, NULL, "distinguishedName=*");
 	talloc_free(basedn);
 	if (ret != LDB_SUCCESS) {
 		*errstring = talloc_steal(msg, ldb_errstring(templates_ldb));
diff --git a/source4/dsdb/schema/schema_init.c b/source4/dsdb/schema/schema_init.c
index 3ed7daee595..d983e3c2720 100644
--- a/source4/dsdb/schema/schema_init.c
+++ b/source4/dsdb/schema/schema_init.c
@@ -525,18 +525,21 @@ WERROR dsdb_read_prefixes_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 		return WERR_FOOBAR;
 	}
 
-	ret = ldb_search(ldb, schema_dn, LDB_SCOPE_BASE,NULL, schema_attrs,&schema_res);
+	ret = ldb_search(ldb, mem_ctx, &schema_res, schema_dn, LDB_SCOPE_BASE, schema_attrs, NULL);
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		DEBUG(0,("dsdb_read_prefixes_from_ldb: no prefix map present\n"));
+		talloc_free(schema_res);
 		return WERR_FOOBAR;
 	} else if (ret != LDB_SUCCESS) {
 		DEBUG(0,("dsdb_read_prefixes_from_ldb: failed to search the schema head\n"));
+		talloc_free(schema_res);
 		return WERR_FOOBAR;
 	}
 
 	prefix_val = ldb_msg_find_ldb_val(schema_res->msgs[0], "prefixMap");
 	if (!prefix_val) {
 		DEBUG(0,("dsdb_read_prefixes_from_ldb: no prefixMap attribute found\n"));
+		talloc_free(schema_res);
 		return WERR_FOOBAR;
 	}
 
@@ -550,9 +553,12 @@ WERROR dsdb_read_prefixes_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		DEBUG(0,("dsdb_read_prefixes_from_ldb: ndr_pull_struct_blob failed\n"));
 		talloc_free(blob);
+		talloc_free(schema_res);
 		return WERR_FOOBAR;
 	}
 
+	talloc_free(schema_res);
+
 	if (blob->version != PREFIX_MAP_VERSION_DSDB) {
 		DEBUG(0,("dsdb_read_prefixes_from_ldb: blob->version incorect\n"));
 		talloc_free(blob);
@@ -905,7 +911,7 @@ static int fetch_oc_recursive(struct ldb_context *ldb, struct ldb_dn *schemadn,
 		const char *name = ldb_msg_find_attr_as_string(search_from->msgs[i], 
 							       "lDAPDisplayname", NULL);
 
-		ret = ldb_search_exp_fmt(ldb, mem_ctx, &res,
+		ret = ldb_search(ldb, mem_ctx, &res,
 					schemadn, LDB_SCOPE_SUBTREE, NULL,
 					"(&(&(objectClass=classSchema)(subClassOf=%s))(!(lDAPDisplayName=%s)))",
 					name, name);
@@ -946,9 +952,9 @@ static int fetch_objectclass_schema(struct ldb_context *ldb, struct ldb_dn *sche
 	}
 	
 	/* Download 'top' */
-	ret = ldb_search(ldb, schemadn, LDB_SCOPE_SUBTREE, 
-			 "(&(objectClass=classSchema)(lDAPDisplayName=top))", 
-			 NULL, &top_res);
+	ret = ldb_search(ldb, local_ctx, &top_res,
+			 schemadn, LDB_SCOPE_SUBTREE, NULL,
+			 "(&(objectClass=classSchema)(lDAPDisplayName=top))");
 	if (ret != LDB_SUCCESS) {
 		*error_string = talloc_asprintf(mem_ctx, 
 						"dsdb_schema: failed to search for top classSchema object: %s",
@@ -956,8 +962,6 @@ static int fetch_objectclass_schema(struct ldb_context *ldb, struct ldb_dn *sche
 		return ret;
 	}
 
-	talloc_steal(local_ctx, top_res);
-
 	if (top_res->count != 1) {
 		*error_string = talloc_asprintf(mem_ctx, 
 						"dsdb_schema: failed to find top classSchema object");
@@ -1008,10 +1012,8 @@ int dsdb_schema_from_schema_dn(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 	/*
 	 * setup the prefix mappings and schema info
 	 */
-	ret = ldb_search(ldb, schema_dn,
-			 LDB_SCOPE_BASE,
-			 NULL, schema_attrs,
-			 &schema_res);
+	ret = ldb_search(ldb, tmp_ctx, &schema_res,
+			 schema_dn, LDB_SCOPE_BASE, schema_attrs, NULL);
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		talloc_free(tmp_ctx);
 		return ret;
@@ -1022,7 +1024,6 @@ int dsdb_schema_from_schema_dn(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 		talloc_free(tmp_ctx);
 		return ret;
 	}
-	talloc_steal(tmp_ctx, schema_res);
 	if (schema_res->count != 1) {
 		*error_string_out = talloc_asprintf(mem_ctx, 
 			      "dsdb_schema: [%u] schema heads found on a base search",
@@ -1034,10 +1035,9 @@ int dsdb_schema_from_schema_dn(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 	/*
 	 * load the attribute definitions
 	 */
-	ret = ldb_search(ldb, schema_dn,
-			 LDB_SCOPE_ONELEVEL,
-			 "(objectClass=attributeSchema)", NULL,
-			 &a_res);
+	ret = ldb_search(ldb, tmp_ctx, &a_res,
+			 schema_dn, LDB_SCOPE_ONELEVEL, NULL,
+			 "(objectClass=attributeSchema)");
 	if (ret != LDB_SUCCESS) {
 		*error_string_out = talloc_asprintf(mem_ctx, 
 				       "dsdb_schema: failed to search attributeSchema objects: %s",
@@ -1045,7 +1045,6 @@ int dsdb_schema_from_schema_dn(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
 		talloc_free(tmp_ctx);
 		return ret;
 	}
-	talloc_steal(tmp_ctx, a_res);
 
 	/*
 	 * load the objectClass definitions
diff --git a/source4/dsdb/schema/schema_set.c b/source4/dsdb/schema/schema_set.c
index 2303b88a059..b6e8ed46c28 100644
--- a/source4/dsdb/schema/schema_set.c
+++ b/source4/dsdb/schema/schema_set.c
@@ -116,7 +116,7 @@ static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schem
 
 
 	/* Try to avoid churning the attributes too much - we only want to do this if they have changed */
-	ret = ldb_search_exp_fmt(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg->dn));
+	ret = ldb_search(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg->dn));
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		ret = ldb_add(ldb, msg);
 	} else if (ret != LDB_SUCCESS) {
@@ -144,7 +144,7 @@ static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schem
 
 	/* Now write out the indexs, as found in the schema (if they have changed) */
 
-	ret = ldb_search_exp_fmt(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg_idx->dn));
+	ret = ldb_search(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg_idx->dn));
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 		ret = ldb_add(ldb, msg_idx);
 	} else if (ret != LDB_SUCCESS) {