found my lber bug... ber_buf should have been freed in ber_peek_tag. Ugh!

clients/tools/ldapsearch.c

@@ -382,6 +382,7 @@ static int dosearch(
 
     matches = 0;
     first = 1;
+    res = NULL;
     while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
 	    == LDAP_RES_SEARCH_ENTRY ) {
 	matches++;
@@ -393,6 +394,7 @@ static int dosearch(
 	}
 	print_entry( ld, e, attrsonly );
 	ldap_msgfree( res );
+	res = NULL;
     }
     if ( rc == -1 ) {
 	ldap_perror( ld, "ldap_result" );

include/lber.h

@@ -67,7 +67,7 @@ LDAP_BEGIN_DECL
 #define LBER_INVALID(tag) ( ( (tag) & 0xFFFFFF80UL ) != 0 )
 #define LBER_ERROR		0xffffffffUL
 #define LBER_DEFAULT		0xffffffffUL
-/* #define LBER_END_SEQORSET	0xfffffffeUL *//* not part of LDAP C-API */
+#define LBER_END_SEQORSET	0xfffffffeUL /* not part of LDAP C-API */
 
 /* general BER types we know about */
 #define LBER_BOOLEAN		0x01UL

libraries/liblber/decode.c

@@ -139,7 +139,7 @@ ber_peek_tag(
 
 	tag = ber_skip_tag( ber, len );
 
-	ber_free( ber, 1 );
+	ber_free( ber, 0 );
 	return( tag );
 }
 

libraries/liblber/io.c

@@ -443,7 +443,7 @@ ber_get_next( Sockbuf *sb, unsigned long *len, BerElement *ber )
 	 */
 	
 	if (ber->ber_rwptr == NULL) {
-		/* assert( ber->ber_buf == NULL ); */
+		assert( ber->ber_buf == NULL );
 		ber->ber_rwptr = (char *) &ber->ber_tag;
 		ber->ber_tag = 0;
 	}