src/back-nis.c     |  3 +++

 src/back-sch-nss.c | 13 ++++++++-----

 src/back-sch.c     |  6 ++++--

 tests/wrap-pam.c   |  2 +-

 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/back-nis.c b/src/back-nis.c

index adf378e..2001222 100644

--- a/src/back-nis.c

+++ b/src/back-nis.c

@@ -488,6 +488,9 @@ backend_map_config_filter(const char *format,

 		}

 	}

 	ret = malloc(l + 1);

+	if (ret == NULL) {

+		return NULL;

+	}

 	for (i = j = 0; format[i] != '\0'; i++) {

 		if (format[i] == '%') {

 			switch (format[i + 1]) {

diff --git a/src/back-sch-nss.c b/src/back-sch-nss.c

index df04a96..b595f3b 100644

--- a/src/back-sch-nss.c

+++ b/src/back-sch-nss.c

@@ -589,19 +589,22 @@ repeat:

 		return NULL;

 	}

-	do {

+	for(rc = NSS_STATUS_TRYAGAIN; rc == NSS_STATUS_TRYAGAIN;) {

 		rc = backend_nss_getgrouplist(ctx, user_name, pwd.pw_gid,

 					      grouplist, &ngroups,

 					      &lerrno);

-		if ((rc != NSS_STATUS_SUCCESS)) {

-			tmp_list = realloc(grouplist, ngroups * sizeof(gid_t));

-			if (tmp_list == NULL) {

+		if (rc == NSS_STATUS_TRYAGAIN) {

+			tmp_list = NULL;

+			if (lerrno == ERANGE) {

+				tmp_list = realloc(grouplist, ngroups * sizeof(gid_t));

+			}

+			if ((tmp_list == NULL) || (lerrno == ENOMEM)) {

 				free(grouplist);

 				return NULL;

 			}

 			grouplist = tmp_list;

 		}

-	} while (rc != NSS_STATUS_SUCCESS);

+	}

 	entries = calloc(ngroups + 1, sizeof(entries[0]));

 	if (entries == NULL) {

diff --git a/src/back-sch.c b/src/back-sch.c

index d806627..172d619 100644

--- a/src/back-sch.c

+++ b/src/back-sch.c

@@ -1369,8 +1369,9 @@ backend_search_find_set_dn_cb(const char *group, void *cb_data)

 	/* Check the group itself. */

 	group_dn = slapi_sdn_new_dn_byval(group);

-	if (slapi_sdn_scope_test(group_dn, cbdata->target_dn,

-				 cbdata->scope) == 1) {

+	if (backend_should_descend(group_dn,

+				   cbdata->target_dn,

+				   cbdata->scope)) {

 		cbdata->answer = TRUE;

 		slapi_sdn_free(&group_dn);

 		return TRUE;

@@ -1792,6 +1793,7 @@ backend_search_cb(Slapi_PBlock *pb)

 		slapi_ch_free_string(&target);

 		if (cbdata.answer == FALSE) {

 			/* None of the configured trees in the sets matched the target at all, ignore search */

+			slapi_sdn_free(&cbdata.target_dn);

 			return 0;

 		}

 	}

diff --git a/tests/wrap-pam.c b/tests/wrap-pam.c

index 45fa0fc..136aae1 100644

--- a/tests/wrap-pam.c

+++ b/tests/wrap-pam.c

@@ -90,7 +90,7 @@ pam_numerror(const char *name)

 }

 const char *

-pam_strerror(pam_handle_t *pamh, int errnum)

+pam_strerror(const pam_handle_t *pamh, int errnum)

 {

 	unsigned int i;