diff --git a/include/ldap_schema.h b/include/ldap_schema.h
index ab75f7062a..860432f87c 100644
--- a/include/ldap_schema.h
+++ b/include/ldap_schema.h
@@ -118,6 +118,7 @@ typedef struct ldap_objectclass {
 #define LDAP_SCHEMA_ALLOW_DESCR_PREFIX	0x08 /* Allow descr as OID prefix    */
 #define LDAP_SCHEMA_ALLOW_OID_MACRO	0x10 /* Allow OID macros in slapd    */
 #define LDAP_SCHEMA_ALLOW_ALL		0x1f /* Be very liberal in parsing   */
+#define	LDAP_SCHEMA_SKIP		0x80 /* Don't malloc any result      */
 
 LDAP_F( LDAP_CONST char * )
 ldap_syntax2name LDAP_P((
diff --git a/libraries/libldap/getdn.c b/libraries/libldap/getdn.c
index 5f3ce02d8e..6d3fffab6a 100644
--- a/libraries/libldap/getdn.c
+++ b/libraries/libldap/getdn.c
@@ -20,6 +20,7 @@
 #include <ac/time.h>
 
 #include "ldap-int.h"
+#include "ldap_schema.h"
 
 /* extension to UFN that turns trailing "dc=value" rdns in DNS style,
  * e.g. "ou=People,dc=openldap,dc=org" => "People, openldap.org" */
@@ -505,14 +506,18 @@ ldapava_new( const struct berval *attr, const struct berval *val,
 	assert( attr );
 	assert( val );
 
-	ava = LDAP_MALLOC( sizeof( LDAPAVA ) );
+	ava = LDAP_MALLOC( sizeof( LDAPAVA ) + attr->bv_len + 1 );
 	
 	/* should we test it? */
 	if ( ava == NULL ) {
 		return( NULL );
 	}
 
-	ava->la_attr = *attr;
+	ava->la_attr.bv_len = attr->bv_len;
+	ava->la_attr.bv_val = (char *)(ava+1);
+	AC_MEMCPY( ava->la_attr.bv_val, attr->bv_val, attr->bv_len );
+	ava->la_attr.bv_val[attr->bv_len] = '\0';
+
 	ava->la_value = *val;
 	ava->la_flags = flags;
 
@@ -533,7 +538,10 @@ ldap_avafree( LDAPAVA *ava )
 	assert( ava->la_private == NULL );
 #endif
 
+#if 0
+	/* la_attr is now contiguous with ava, not freed separately */
 	free( ava->la_attr.bv_val );
+#endif
 	free( ava->la_value.bv_val );
 
 	LDAP_FREE( ava );
@@ -702,7 +710,7 @@ ldap_str2dn( const char *str, LDAPDN **dn, unsigned flags )
 			} else {
 				int i;
 
-				newDN[0] = (LDAPRDN **)newDN+1;
+				newDN[0] = (LDAPRDN **)(newDN+1);
 
 				if ( LDAP_DN_DCE( flags ) ) {
 					/* add in reversed order */
@@ -878,23 +886,14 @@ ldap_str2rdn( const char *str, LDAPRDN **rdn, const char **n, unsigned flags )
 		
 		case B4OIDATTRTYPE: {
 			int 		err = LDAP_SUCCESS;
-			char		*type;
 			
-			type = parse_numericoid( &p, &err, 0 );
-			if ( type == NULL ) {
+			attrType.bv_val = parse_numericoid( &p, &err,
+				LDAP_SCHEMA_SKIP);
+
+			if ( err != LDAP_SUCCESS ) {
 				goto parsing_error;
 			}
-
-			if ( flags & LDAP_DN_SKIP ) {
-				/*
-				 * FIXME: hack for skipping a rdn; 
-				 * need a cleaner solution
-				 */
-				LDAP_FREE( type );
-
-			} else {
-				ber_str2bv( type, 0, 0, &attrType );
-			}
+			attrType.bv_len = p - attrType.bv_val;
 
 			attrTypeEncoding = LDAP_AVA_BINARY;
 
@@ -961,11 +960,7 @@ ldap_str2rdn( const char *str, LDAPRDN **rdn, const char **n, unsigned flags )
 				break;
 			}
 
-			attrType.bv_val = LDAP_STRNDUP( startPos, len );
-			if ( attrType.bv_val == NULL ) {
-				rc = LDAP_NO_MEMORY;
-				goto parsing_error;
-			}
+			attrType.bv_val = (char *)startPos;
 			attrType.bv_len = len;
 
 			break;
@@ -1157,7 +1152,7 @@ ldap_str2rdn( const char *str, LDAPRDN **rdn, const char **n, unsigned flags )
 					} else {
 						int i;
 
-						newRDN[0] = (LDAPAVA**) newRDN+1;
+						newRDN[0] = (LDAPAVA**)(newRDN+1);
 
 						for (i=0; i<navas; i++)
 							newRDN[0][i] = tmpRDN[i];
diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
index d042c1b292..e8c7ab08bf 100644
--- a/libraries/libldap/ldap-int.h
+++ b/libraries/libldap/ldap-int.h
@@ -61,7 +61,9 @@
 
 #undef Debug
 #define Debug( level, fmt, arg1, arg2, arg3 ) \
-	ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) )
+	do { if ( ldap_debug & level ) \
+	ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) ); \
+	} while ( 0 )
 
 #define LDAP_Debug( subsystem, level, fmt, arg1, arg2, arg3 )\
 	ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) )
diff --git a/libraries/libldap/schema.c b/libraries/libldap/schema.c
index 40e92caac0..6f70208469 100644
--- a/libraries/libldap/schema.c
+++ b/libraries/libldap/schema.c
@@ -800,7 +800,7 @@ parse_whsp(const char **sp)
 char *
 parse_numericoid(const char **sp, int *code, const int flags)
 {
-	char * res;
+	char * res = NULL;
 	const char * start = *sp;
 	int len;
 	int quoted = 0;
@@ -831,22 +831,25 @@ parse_numericoid(const char **sp, int *code, const int flags)
 	}
 	/* Now *sp points at the char past the numericoid. Perfect. */
 	len = *sp - start;
-	res = LDAP_MALLOC(len+1);
-	if (!res) {
-		*code = LDAP_SCHERR_OUTOFMEM;
-		return(NULL);
-	}
-	strncpy(res,start,len);
-	res[len] = '\0';
 	if ( flags & LDAP_SCHEMA_ALLOW_QUOTED && quoted ) {
 		if ( **sp == '\'' ) {
 			(*sp)++;
 		} else {
 			*code = LDAP_SCHERR_UNEXPTOKEN;
-			LDAP_FREE(res);
 			return NULL;
 		}
 	}
+	if (flags & LDAP_SCHEMA_SKIP) {
+		res = start;
+	} else {
+		res = LDAP_MALLOC(len+1);
+		if (!res) {
+			*code = LDAP_SCHERR_OUTOFMEM;
+			return(NULL);
+		}
+		strncpy(res,start,len);
+		res[len] = '\0';
+	}
 	return(res);
 }
 
diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index 96236b04b0..15f71ebbf1 100644
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -1218,13 +1218,13 @@ connection_input(
 	char 		*cdn = NULL;
 #endif
 
-	if ( conn->c_currentber == NULL && (conn->c_currentber = ber_alloc())
+	if ( conn->c_currentber == NULL && (conn->c_currentber = ber_alloc_t(0))
 	    == NULL ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG(( "connection", LDAP_LEVEL_ERR,
-			   "connection_input: conn %d  ber_alloc failed.\n", conn->c_connid ));
+			   "connection_input: conn %d  ber_alloc_t failed.\n", conn->c_connid ));
 #else
-		Debug( LDAP_DEBUG_ANY, "ber_alloc failed\n", 0, 0, 0 );
+		Debug( LDAP_DEBUG_ANY, "ber_alloc_t failed\n", 0, 0, 0 );
 #endif
 		return -1;
 	}
diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index 73bc489d3c..65c9281da5 100644
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -250,8 +250,7 @@ LDAPDN_rewrite( LDAPDN *dn, unsigned flags )
 			/* 
 			 * Replace attr oid/name with the canonical name
 			 */
-			free( ava->la_attr.bv_val );
-			ber_dupbv( &ava->la_attr, &ad->ad_cname );
+			ava->la_attr = ad->ad_cname;
 
 			if( flags & SLAP_LDAPDN_PRETTY ) {
 				transf = ad->ad_type->sat_syntax->ssyn_pretty;