diff --git a/CHANGES b/CHANGES
index ca3c6a1af508feaa52ae1e21617412593582b0c8..882aa0ae96e68bb4c79eef3eef83c8190b61d613 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,7 @@ OpenLDAP 2.0 Change Log
 OpenLDAP 2.0.19 Engineering
 	Fixed -lldap cacertfile bug
 	Fixed back-ldbm not filter indexing
+	Fixed back-passwd e_ndn bug
 	Fixed slapd suffix "" bugs (ITS#1430)
 	Fixed various memory leaks
 	Updated slapd emfile/enfile handling
diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c
index 6970826252499b7ddce9625aeb3511667c557bc0..bf91be1f94cc685f251899a08ef976c3c7ad905c 100644
--- a/libraries/liblber/decode.c
+++ b/libraries/liblber/decode.c
@@ -585,13 +585,14 @@ ber_scanf ( BerElement *ber,
 			    tag != LBER_DEFAULT && rc != LBER_DEFAULT;
 			    tag = ber_next_element( ber, &len, last ) )
 			{
-				void *save = *sss;
+				char **save = *sss;
 
 				*sss = (char **) LBER_REALLOC( *sss,
 					(j + 2) * sizeof(char *) );
 
 				if( *sss == NULL ) {
-					LBER_FREE( save );
+					save[j] = NULL;
+					ber_memvfree( (void **) save );
 					rc = LBER_DEFAULT;
 					goto breakout;
 				}
@@ -599,8 +600,7 @@ ber_scanf ( BerElement *ber,
 				rc = ber_get_stringa( ber, &((*sss)[j]) );
 				j++;
 			}
-			if ( j > 0 )
-				(*sss)[j] = NULL;
+			if ( j > 0 ) (*sss)[j] = NULL;
 			break;
 
 		case 'V':	/* sequence of strings + lengths */
@@ -611,13 +611,14 @@ ber_scanf ( BerElement *ber,
 			    tag != LBER_DEFAULT && rc != LBER_DEFAULT;
 			    tag = ber_next_element( ber, &len, last ) )
 			{
-				void *save = *bv;
+				struct berval **save = *bv;
 
 				*bv = (struct berval **) LBER_REALLOC( *bv,
 					(j + 2) * sizeof(struct berval *) );
 		
 				if( *bv == NULL ) {
-					LBER_FREE( save );
+					save[j] = NULL;
+					ber_bvecfree( save );
 					rc = LBER_DEFAULT;
 					goto breakout;
 				}
@@ -625,8 +626,7 @@ ber_scanf ( BerElement *ber,
 				rc = ber_get_stringal( ber, &((*bv)[j]) );
 				j++;
 			}
-			if ( j > 0 )
-				(*bv)[j] = NULL;
+			if ( j > 0 ) (*bv)[j] = NULL;
 			break;
 
 		case 'x':	/* skip the next element - whatever it is */
@@ -734,11 +734,7 @@ breakout:
 		case 'v':	/* sequence of strings */
 			sss = va_arg( ap, char *** );
 			if ( *sss ) {
-				for (j = 0;  (*sss)[j];  j++) {
-					LBER_FREE( (*sss)[j] );
-					(*sss)[j] = NULL;
-				}
-				LBER_FREE( *sss );
+				ber_memvfree( (void **) *sss );
 				*sss = NULL;
 			}
 			break;