diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index ec219867ec..daebef8ef5 100644
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -1367,7 +1367,7 @@ print_entry(
 						bvals[ i ].bv_val, bvals[ i ].bv_len );
 				}
 			}
-			ber_bvarray_free( bvals );
+			ber_memfree( bvals );
 		}
 	}
 
diff --git a/libraries/libldap/getattr.c b/libraries/libldap/getattr.c
index 6e67e71c68..bbe5020561 100644
--- a/libraries/libldap/getattr.c
+++ b/libraries/libldap/getattr.c
@@ -121,7 +121,10 @@ ldap_next_attribute( LDAP *ld, LDAPMessage *entry, BerElement *ber )
 	return attr;
 }
 
-/* Fetch attribute type and optionally fetch values */
+/* Fetch attribute type and optionally fetch values. The type
+ * and values are referenced in-place from the BerElement, they are
+ * not dup'd into malloc'd memory.
+ */
 /* ARGSUSED */
 int
 ldap_get_attribute_ber( LDAP *ld, LDAPMessage *entry, BerElement *ber,
@@ -146,8 +149,11 @@ ldap_get_attribute_ber( LDAP *ld, LDAPMessage *entry, BerElement *ber,
 	attr->bv_len = 0;
 
 	if ( ber_pvt_ber_remaining( ber ) ) {
+		ber_len_t siz = sizeof( BerValue );
+
 		/* skip sequence, snarf attribute type */
-		tag = ber_scanf( ber, vals ? "{mW}" : "{mx}", attr, vals ); 
+		tag = ber_scanf( ber, vals ? "{mM}" : "{mx}", attr, vals,
+			&siz, 0 ); 
 		if( tag == LBER_ERROR ) {
 			rc = ld->ld_errno = LDAP_DECODING_ERROR;
 		}