From a593f3d0c16b8a9ac7bf9346abb0812f5d2ce69b Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Jul 30 2019 20:25:58 +0000
Subject: Issue 50506 - Replace slapi_entry_attr_get_charptr() with slapi_entry_attr_get_ref()


Description:

There has been a pattern/habit in the code of using slapi_entry_attr_get_charptr()
to get an attribute value, but this function strdup's the entry's attribute value.
In almost all cases the slapi_entry_attr_get_charptr() value is freed right away -
it is not consumed. This is causing unnecessary malloc/free's which adds to
fragmentation and hurts performance. Instead, if the attribute value is not consumed
we should use slapi_entry_attr_get_ref() instead, which just grabs a pointer to
the attribute value.

relates: https://pagure.io/389-ds-base/issue/50506

ASAN & covscan approved

Reviewed by: lkrispen(Thanks!)

---

diff --git a/ldap/servers/plugins/addn/addn.c b/ldap/servers/plugins/addn/addn.c
index 61301a1..2b90d0e 100644
--- a/ldap/servers/plugins/addn/addn.c
+++ b/ldap/servers/plugins/addn/addn.c
@@ -258,7 +258,7 @@ addn_prebind(Slapi_PBlock *pb)
     }
 
     /* Now we can get our suffix. */
-    be_suffix = slapi_entry_attr_get_charptr(domain_config, "addn_base");
+    be_suffix = (char *)slapi_entry_attr_get_ref(domain_config, "addn_base");
     be_suffix_dn = slapi_sdn_new_dn_byval(be_suffix);
 
     /* Get our filter. From the config */
@@ -375,7 +375,6 @@ out:
     }
     slapi_entry_free(domain_config);
     slapi_sdn_free(&be_suffix_dn);
-    slapi_ch_free_string(&be_suffix);
     slapi_ch_free_string(&dn_bind_escaped);
     slapi_ch_free_string(&dn_domain_escaped);
     slapi_ch_free_string(&filter);
diff --git a/ldap/servers/plugins/automember/automember.c b/ldap/servers/plugins/automember/automember.c
index 4ad9db9..d7919a0 100644
--- a/ldap/servers/plugins/automember/automember.c
+++ b/ldap/servers/plugins/automember/automember.c
@@ -151,7 +151,7 @@ automember_init(Slapi_PBlock *pb)
     int status = 0;
     char *plugin_identity = NULL;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
 
@@ -160,13 +160,12 @@ automember_init(Slapi_PBlock *pb)
 
     /* get args */
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) && plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         plugin_is_betxn = 1;
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
         premod = SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     /* Store the plugin identity for later use.
      * Used for internal operations. */
@@ -346,7 +345,7 @@ automember_start(Slapi_PBlock *pb)
 
     /* Check and set if we should process modify operations */
     if ((slapi_pblock_get(pb, SLAPI_ADD_ENTRY, &plugin_entry) == 0) && plugin_entry){
-        if ((do_modify = slapi_fetch_attr(plugin_entry, AUTOMEMBER_DO_MODIFY, NULL)) ) {
+        if ((do_modify = slapi_entry_attr_get_ref(plugin_entry, AUTOMEMBER_DO_MODIFY)) ) {
             if (strcasecmp(do_modify, "on") && strcasecmp(do_modify, "off")) {
                 slapi_log_err(SLAPI_LOG_ERR, AUTOMEMBER_PLUGIN_SUBSYSTEM,
                               "automember_start - %s: invalid value \"%s\". Valid values are \"on\" or \"off\".  Using default of \"on\"\n",
@@ -546,9 +545,8 @@ automember_parse_config_entry(Slapi_Entry *e, int apply)
     }
 
     /* If marked as disabled, just bail. */
-    value = slapi_entry_attr_get_charptr(e, AUTOMEMBER_DISABLED_TYPE);
+    value = (char *)slapi_entry_attr_get_ref(e, AUTOMEMBER_DISABLED_TYPE);
     if (value) {
-        slapi_ch_free_string(&value);
         goto bail;
     }
 
@@ -586,7 +584,7 @@ automember_parse_config_entry(Slapi_Entry *e, int apply)
     }
 
     /* Load the filter */
-    value = slapi_entry_attr_get_charptr(e, AUTOMEMBER_FILTER_TYPE);
+    value = (char *)slapi_entry_attr_get_ref(e, AUTOMEMBER_FILTER_TYPE);
     if (value) {
         /* Convert to a Slapi_Filter to improve performance. */
         if (NULL == (entry->filter = slapi_str2filter(value))) {
@@ -597,9 +595,6 @@ automember_parse_config_entry(Slapi_Entry *e, int apply)
                           AUTOMEMBER_FILTER_TYPE, entry->dn, value);
             ret = -1;
         }
-
-        slapi_ch_free_string(&value);
-
         if (ret != 0) {
             goto bail;
         }
@@ -642,7 +637,7 @@ automember_parse_config_entry(Slapi_Entry *e, int apply)
     }
 
     /* Load the grouping attr */
-    value = slapi_entry_attr_get_charptr(e, AUTOMEMBER_GROUPING_ATTR_TYPE);
+    value = (char *)slapi_entry_attr_get_ref(e, AUTOMEMBER_GROUPING_ATTR_TYPE);
     if (value) {
         if (automember_parse_grouping_attr(value, &(entry->grouping_attr),
                                            &(entry->grouping_value)) != 0) {
@@ -654,8 +649,6 @@ automember_parse_config_entry(Slapi_Entry *e, int apply)
                           entry->dn, value);
             ret = -1;
         }
-
-        slapi_ch_free_string(&value);
         if (ret != 0) {
             goto bail;
         }
@@ -1000,7 +993,7 @@ automember_parse_regex_entry(struct configEntry *config, Slapi_Entry *e)
                   "--> automember_parse_regex_entry\n");
 
     /* Make sure the target group was specified. */
-    target_group = slapi_entry_attr_get_charptr(e, AUTOMEMBER_TARGET_GROUP_TYPE);
+    target_group = (char *)slapi_entry_attr_get_ref(e, AUTOMEMBER_TARGET_GROUP_TYPE);
     if (!target_group) {
         slapi_log_err(SLAPI_LOG_ERR, AUTOMEMBER_PLUGIN_SUBSYSTEM,
                       "automember_parse_regex_entry - The %s config "
@@ -1149,8 +1142,6 @@ automember_parse_regex_entry(struct configEntry *config, Slapi_Entry *e)
     }
 
 bail:
-    slapi_ch_free_string(&target_group);
-
     slapi_log_err(SLAPI_LOG_TRACE, AUTOMEMBER_PLUGIN_SUBSYSTEM,
                   "<-- automember_parse_regex_entry\n");
 }
@@ -1634,7 +1625,6 @@ automember_update_member_value(Slapi_Entry *member_e, const char *group_dn, char
     LDAPMod *mods[2];
     char *vals[2];
     char *member_value = NULL;
-    int freeit = 0;
     int rc = 0;
     Slapi_DN *group_sdn;
     Slapi_Entry *group_entry = NULL;
@@ -1664,8 +1654,7 @@ automember_update_member_value(Slapi_Entry *member_e, const char *group_dn, char
     if (slapi_attr_type_cmp(grouping_value, "dn", SLAPI_TYPE_CMP_EXACT) == 0) {
         member_value = slapi_entry_get_ndn(member_e);
     } else {
-        member_value = slapi_entry_attr_get_charptr(member_e, grouping_value);
-        freeit = 1;
+        member_value = (char *)slapi_entry_attr_get_ref(member_e, grouping_value);
     }
 
     /*
@@ -1742,10 +1731,6 @@ automember_update_member_value(Slapi_Entry *member_e, const char *group_dn, char
     }
 
 out:
-    /* Cleanup */
-    if (freeit) {
-        slapi_ch_free_string(&member_value);
-    }
     slapi_pblock_destroy(mod_pb);
 
     return rc;
@@ -2243,12 +2228,12 @@ automember_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter __attr
     /*
      *  Grab the task params
      */
-    if ((base_dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((base_dn = slapi_entry_attr_get_ref(e, "basedn")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((filter = slapi_fetch_attr(e, "filter", 0)) == NULL) {
+    if ((filter = slapi_entry_attr_get_ref(e, "filter")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -2517,17 +2502,17 @@ automember_task_add_export_updates(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry
 
     *returncode = LDAP_SUCCESS;
 
-    if ((ldif = slapi_fetch_attr(e, "ldif", 0)) == NULL) {
+    if ((ldif = slapi_entry_attr_get_ref(e, "ldif")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((base_dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((base_dn = slapi_entry_attr_get_ref(e, "basedn")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((filter = slapi_fetch_attr(e, "filter", 0)) == NULL) {
+    if ((filter = slapi_entry_attr_get_ref(e, "filter")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -2725,12 +2710,12 @@ automember_task_add_map_entries(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *e
     /*
      *  Get the params
      */
-    if ((ldif_in = slapi_fetch_attr(e, "ldif_in", 0)) == NULL) {
+    if ((ldif_in = slapi_entry_attr_get_ref(e, "ldif_in")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((ldif_out = slapi_fetch_attr(e, "ldif_out", 0)) == NULL) {
+    if ((ldif_out = slapi_entry_attr_get_ref(e, "ldif_out")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index 1ee2713..3206078 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -988,10 +988,9 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
                       "----------> %s [%s]\n", DNA_TYPE, entry->types[i]);
     }
 
-    value = slapi_entry_attr_get_charptr(e, DNA_NEXTVAL);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_NEXTVAL);
     if (value) {
         entry->nextval = strtoull(value, 0, 0);
-        slapi_ch_free_string(&value);
     } else {
         slapi_log_err(SLAPI_LOG_ERR, DNA_PLUGIN_SUBSYSTEM,
                       "dna_parse_config_entry - The %s config "
@@ -1024,10 +1023,9 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
     entry->interval = 1;
 
 #ifdef DNA_ENABLE_INTERVAL
-    value = slapi_entry_attr_get_charptr(e, DNA_INTERVAL);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_INTERVAL);
     if (value) {
         entry->interval = strtoull(value, 0, 0);
-        slapi_ch_free_string(&value);
     }
 
     slapi_log_err(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
@@ -1123,10 +1121,9 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
 
     /* optional, if not specified set -1 which is converted to the max unsigned
      * value */
-    value = slapi_entry_attr_get_charptr(e, DNA_MAXVAL);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_MAXVAL);
     if (value) {
         entry->maxval = strtoull(value, 0, 0);
-        slapi_ch_free_string(&value);
     } else {
         entry->maxval = -1;
     }
@@ -1249,7 +1246,7 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
                       entry->shared_cfg_base);
     }
 
-    value = slapi_entry_attr_get_charptr(e, DNA_THRESHOLD);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_THRESHOLD);
     if (value) {
         entry->threshold = strtoull(value, 0, 0);
 
@@ -1261,8 +1258,6 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
             slapi_log_err(SLAPI_LOG_ERR, DNA_PLUGIN_SUBSYSTEM,
                           "----------> %s too low, setting to [%s]\n", DNA_THRESHOLD, value);
         }
-
-        slapi_ch_free_string(&value);
     } else {
         entry->threshold = 1;
     }
@@ -1271,10 +1266,9 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
                   "dna_parse_config_entry - %s [%" PRIu64 "]\n", DNA_THRESHOLD,
                   entry->threshold);
 
-    value = slapi_entry_attr_get_charptr(e, DNA_RANGE_REQUEST_TIMEOUT);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_RANGE_REQUEST_TIMEOUT);
     if (value) {
         entry->timeout = strtoull(value, 0, 0);
-        slapi_ch_free_string(&value);
     } else {
         entry->timeout = DNA_DEFAULT_TIMEOUT;
     }
@@ -1283,7 +1277,7 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
                   "dna_parse_config_entry - %s [%" PRIu64 "]\n", DNA_RANGE_REQUEST_TIMEOUT,
                   entry->timeout);
 
-    value = slapi_entry_attr_get_charptr(e, DNA_NEXT_RANGE);
+    value = (char *)slapi_entry_attr_get_ref(e, DNA_NEXT_RANGE);
     if (value) {
         char *p = NULL;
 
@@ -1329,8 +1323,6 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry *e, int apply)
                           DNA_NEXT_RANGE, entry->dn);
             ret = DNA_FAILURE;
         }
-
-        slapi_ch_free_string(&value);
     }
 
     /* If we were only called to validate config, we can
@@ -2295,7 +2287,7 @@ dna_first_free_value(struct configEntry *config_entry,
     int multitype = 0;
     int result, status;
     PRUint64 tmpval, sval, i;
-    char *strval = NULL;
+    const char *strval = NULL;
 
     /* check if the config is already out of range */
     if (config_entry->nextval > config_entry->maxval) {
@@ -2419,7 +2411,7 @@ dna_first_free_value(struct configEntry *config_entry,
          * type from the list of types directly. */
         sval = 0;
         for (i = 0; NULL != entries[i]; i++) {
-            strval = slapi_entry_attr_get_charptr(entries[i], config_entry->types[0]);
+            strval = slapi_entry_attr_get_ref(entries[i], config_entry->types[0]);
             errno = 0;
             sval = strtoull(strval, 0, 0);
             if (errno) {
@@ -2427,7 +2419,6 @@ dna_first_free_value(struct configEntry *config_entry,
                 status = LDAP_OPERATIONS_ERROR;
                 goto cleanup;
             }
-            slapi_ch_free_string(&strval);
 
             if (tmpval != sval)
                 break;
@@ -2453,7 +2444,6 @@ dna_first_free_value(struct configEntry *config_entry,
 
 cleanup:
     slapi_ch_free_string(&filter);
-    slapi_ch_free_string(&strval);
     slapi_free_search_results_internal(pb);
     slapi_pblock_destroy(pb);
 
@@ -2974,7 +2964,7 @@ dna_get_replica_bind_creds(char *range_dn, struct dnaServer *server, char **bind
     char *attrs[6];
     char *filter = NULL;
     char *bind_cred = NULL;
-    char *transport = NULL;
+    const char *transport = NULL;
     Slapi_Entry **entries = NULL;
     int ret = LDAP_OPERATIONS_ERROR;
 
@@ -3059,7 +3049,7 @@ dna_get_replica_bind_creds(char *range_dn, struct dnaServer *server, char **bind
         *bind_dn = slapi_entry_attr_get_charptr(entries[0], DNA_REPL_BIND_DN);
         *bind_method = slapi_entry_attr_get_charptr(entries[0], DNA_REPL_BIND_METHOD);
         bind_cred = slapi_entry_attr_get_charptr(entries[0], DNA_REPL_CREDS);
-        transport = slapi_entry_attr_get_charptr(entries[0], DNA_REPL_TRANSPORT);
+        transport = slapi_entry_attr_get_ref(entries[0], DNA_REPL_TRANSPORT);
         *port = slapi_entry_attr_get_int(entries[0], DNA_REPL_PORT);
 
         /* Check if we should use SSL */
@@ -3116,11 +3106,10 @@ dna_get_replica_bind_creds(char *range_dn, struct dnaServer *server, char **bind
     ret = 0;
 
 bail:
-    slapi_ch_free_string(&transport);
+    slapi_ch_free_string(&bind_cred);
     slapi_ch_free_string(&filter);
     slapi_sdn_free(&range_sdn);
     slapi_ch_free_string(&replica_dn);
-    slapi_ch_free_string(&bind_cred);
     slapi_free_search_results_internal(pb);
     slapi_pblock_destroy(pb);
 
@@ -3479,19 +3468,17 @@ _dna_pre_op_add(Slapi_PBlock *pb, Slapi_Entry *e, char **errstr)
                  * for types where the magic value is set.  We do not
                  * generate a value for missing types. */
                 for (i = 0; config_entry->types && config_entry->types[i]; i++) {
-                    value = slapi_entry_attr_get_charptr(e, config_entry->types[i]);
+                    value = (char *)slapi_entry_attr_get_ref(e, config_entry->types[i]);
                     if (value) {
                         if (config_entry->generate == NULL || !slapi_UTF8CASECMP(config_entry->generate, value)) {
                             slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[i]));
                         }
-                        slapi_ch_free_string(&value);
                     }
                 }
             } else {
                 /* For a single type range, we generate the value if
                  * the magic value is set or if the type is missing. */
-                value = slapi_entry_attr_get_charptr(e, config_entry->types[0]);
-
+                value = (char *)slapi_entry_attr_get_ref(e, config_entry->types[0]);
                 if ((config_entry->generate == NULL) || (0 == value) ||
                     (value && !slapi_UTF8CASECMP(config_entry->generate, value))) {
                     slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[0]));
@@ -4153,28 +4140,24 @@ dna_be_txn_pre_op(Slapi_PBlock *pb, int modtype)
                      * for types where the magic value is set.  We do not
                      * generate a value for missing types. */
                     for (i = 0; config_entry->types && config_entry->types[i]; i++) {
-                        value = slapi_entry_attr_get_charptr(e, config_entry->types[i]);
-
+                        value = (char *)slapi_entry_attr_get_ref(e, config_entry->types[i]);
                         if (value && !slapi_UTF8CASECMP(value, DNA_NEEDS_UPDATE)) {
                             slapi_ch_array_add(&types_to_generate,
                                                slapi_ch_strdup(config_entry->types[i]));
                             /* Need to remove DNA_NEEDS_UPDATE */
                             slapi_entry_attr_delete(e, config_entry->types[i]);
                         }
-                        slapi_ch_free_string(&value);
                     }
                 } else {
                     /* For a single type range, we generate the value if
                      * the magic value is set or if the type is missing. */
-                    value = slapi_entry_attr_get_charptr(e, config_entry->types[0]);
-
+                    value = (char *)slapi_entry_attr_get_ref(e, config_entry->types[0]);
                     if (0 == value || (value && !slapi_UTF8CASECMP(value, DNA_NEEDS_UPDATE))) {
                         slapi_ch_array_add(&types_to_generate,
                                            slapi_ch_strdup(config_entry->types[0]));
                         /* Need to remove DNA_NEEDS_UPDATE */
                         slapi_entry_attr_delete(e, config_entry->types[0]);
                     }
-                    slapi_ch_free_string(&value);
                 }
             } else {
                 /* check mods for DNA_NEEDS_UPDATE*/
diff --git a/ldap/servers/plugins/linkedattrs/fixup_task.c b/ldap/servers/plugins/linkedattrs/fixup_task.c
index 4c7ab8c..f47ccf6 100644
--- a/ldap/servers/plugins/linkedattrs/fixup_task.c
+++ b/ldap/servers/plugins/linkedattrs/fixup_task.c
@@ -51,7 +51,7 @@ linked_attrs_fixup_task_add(Slapi_PBlock *pb,
     }
 
     /* get arg(s) and setup our task data */
-    linkdn = slapi_fetch_attr(e, "linkdn", 0);
+    linkdn = slapi_entry_attr_get_ref(e, "linkdn");
     if (linkdn) {
         mytaskdata->linkdn = slapi_dn_normalize(slapi_ch_strdup(linkdn));
     }
diff --git a/ldap/servers/plugins/linkedattrs/linked_attrs.c b/ldap/servers/plugins/linkedattrs/linked_attrs.c
index 4f9fb10..fe58504 100644
--- a/ldap/servers/plugins/linkedattrs/linked_attrs.c
+++ b/ldap/servers/plugins/linkedattrs/linked_attrs.c
@@ -140,7 +140,7 @@ linked_attrs_init(Slapi_PBlock *pb)
     int status = 0;
     char *plugin_identity = NULL;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
 
@@ -149,13 +149,12 @@ linked_attrs_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         plugin_is_betxn = 1;
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
         premod = SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     /* Store the plugin identity for later use.
      * Used for internal operations. */
diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c
index b54eb39..40bd4b3 100644
--- a/ldap/servers/plugins/memberof/memberof.c
+++ b/ldap/servers/plugins/memberof/memberof.c
@@ -169,7 +169,7 @@ memberof_postop_init(Slapi_PBlock *pb)
     int ret = 0;
     char *memberof_plugin_identity = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     char *preop_plugin_type = NULL;
     int delfn = SLAPI_PLUGIN_POST_DELETE_FN;
     int mdnfn = SLAPI_PLUGIN_POST_MODRDN_FN;
@@ -182,7 +182,7 @@ memberof_postop_init(Slapi_PBlock *pb)
     /* get args */
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         usetxn = 1;
         delfn = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
@@ -190,7 +190,6 @@ memberof_postop_init(Slapi_PBlock *pb)
         modfn = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
         addfn = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (usetxn) {
         preop_plugin_type = "betxnpreoperation";
@@ -2908,7 +2907,7 @@ memberof_task_add(Slapi_PBlock *pb,
     *returncode = LDAP_SUCCESS;
 
     /* get arg(s) */
-    if ((dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((dn = slapi_entry_attr_get_ref(e, "basedn")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c
index 6729c3a..586be11 100644
--- a/ldap/servers/plugins/memberof/memberof_config.c
+++ b/ldap/servers/plugins/memberof/memberof_config.c
@@ -193,8 +193,8 @@ memberof_validate_config(Slapi_PBlock *pb,
     Slapi_DN **exclude_dn = NULL;
     char *syntaxoid = NULL;
     char *config_dn = NULL;
-    char *skip_nested = NULL;
-    char *auto_add_oc = NULL;
+    const char *skip_nested = NULL;
+    const char *auto_add_oc = NULL;
     char **entry_scopes = NULL;
     char **entry_exclude_scopes = NULL;
     int not_dn_syntax = 0;
@@ -268,7 +268,7 @@ memberof_validate_config(Slapi_PBlock *pb,
         goto done;
     }
 
-    if ((skip_nested = slapi_entry_attr_get_charptr(e, MEMBEROF_SKIP_NESTED_ATTR))) {
+    if ((skip_nested = slapi_entry_attr_get_ref(e, MEMBEROF_SKIP_NESTED_ATTR))) {
         if (strcasecmp(skip_nested, "on") != 0 && strcasecmp(skip_nested, "off") != 0) {
             PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
                         "The %s configuration attribute must be set to "
@@ -279,9 +279,9 @@ memberof_validate_config(Slapi_PBlock *pb,
     }
 
     /* Setup a default auto add OC */
-    auto_add_oc = slapi_entry_attr_get_charptr(e, MEMBEROF_AUTO_ADD_OC);
+    auto_add_oc = slapi_entry_attr_get_ref(e, MEMBEROF_AUTO_ADD_OC);
     if (auto_add_oc == NULL) {
-        auto_add_oc = slapi_ch_strdup(NSMEMBEROF);
+        auto_add_oc = NSMEMBEROF;
     }
 
     if (auto_add_oc != NULL) {
@@ -300,9 +300,8 @@ memberof_validate_config(Slapi_PBlock *pb,
         }
     }
 
-    if ((config_dn = slapi_entry_attr_get_charptr(e, SLAPI_PLUGIN_SHARED_CONFIG_AREA))) {
+    if ((config_dn = (char *)slapi_entry_attr_get_ref(e, SLAPI_PLUGIN_SHARED_CONFIG_AREA))) {
         /* Now check the shared config attribute, validate it now */
-
         Slapi_Entry *e = NULL;
         int rc = 0;
 
@@ -436,9 +435,6 @@ done:
     slapi_ch_free((void **)&entry_scopes);
     slapi_ch_free((void **)&entry_exclude_scopes);
     slapi_sdn_free(&config_sdn);
-    slapi_ch_free_string(&config_dn);
-    slapi_ch_free_string(&skip_nested);
-    slapi_ch_free_string(&auto_add_oc);
 
     if (*returncode != LDAP_SUCCESS) {
         return SLAPI_DSE_CALLBACK_ERROR;
@@ -468,11 +464,11 @@ memberof_apply_config(Slapi_PBlock *pb __attribute__((unused)),
     char *filter_str = NULL;
     int num_groupattrs = 0;
     int groupattr_name_len = 0;
-    char *allBackends = NULL;
+    const char *allBackends = NULL;
     char **entryScopes = NULL;
     char **entryScopeExcludeSubtrees = NULL;
     char *sharedcfg = NULL;
-    char *skip_nested = NULL;
+    const char *skip_nested = NULL;
     char *auto_add_oc = NULL;
     int num_vals = 0;
 
@@ -481,7 +477,7 @@ memberof_apply_config(Slapi_PBlock *pb __attribute__((unused)),
     /*
      * Check if this is a shared config entry
      */
-    sharedcfg = slapi_entry_attr_get_charptr(e, SLAPI_PLUGIN_SHARED_CONFIG_AREA);
+    sharedcfg = (char *)slapi_entry_attr_get_ref(e, SLAPI_PLUGIN_SHARED_CONFIG_AREA);
     if (sharedcfg) {
         if ((config_sdn = slapi_sdn_new_dn_byval(sharedcfg))) {
             slapi_search_internal_get_entry(config_sdn, NULL, &config_entry, memberof_get_plugin_id());
@@ -505,8 +501,8 @@ memberof_apply_config(Slapi_PBlock *pb __attribute__((unused)),
      */
     groupattrs = slapi_entry_attr_get_charray(e, MEMBEROF_GROUP_ATTR);
     memberof_attr = slapi_entry_attr_get_charptr(e, MEMBEROF_ATTR);
-    allBackends = slapi_entry_attr_get_charptr(e, MEMBEROF_BACKEND_ATTR);
-    skip_nested = slapi_entry_attr_get_charptr(e, MEMBEROF_SKIP_NESTED_ATTR);
+    allBackends = slapi_entry_attr_get_ref(e, MEMBEROF_BACKEND_ATTR);
+    skip_nested = slapi_entry_attr_get_ref(e, MEMBEROF_SKIP_NESTED_ATTR);
     auto_add_oc = slapi_entry_attr_get_charptr(e, MEMBEROF_AUTO_ADD_OC);
 
     if (auto_add_oc == NULL) {
@@ -674,10 +670,7 @@ done:
     slapi_sdn_free(&config_sdn);
     slapi_entry_free(config_entry);
     slapi_ch_array_free(groupattrs);
-    slapi_ch_free_string(&sharedcfg);
     slapi_ch_free_string(&memberof_attr);
-    slapi_ch_free_string(&allBackends);
-    slapi_ch_free_string(&skip_nested);
     slapi_ch_free((void **)&entryScopes);
     slapi_ch_free((void **)&entryScopeExcludeSubtrees);
 
diff --git a/ldap/servers/plugins/mep/mep.c b/ldap/servers/plugins/mep/mep.c
index a7b60e1..a636622 100644
--- a/ldap/servers/plugins/mep/mep.c
+++ b/ldap/servers/plugins/mep/mep.c
@@ -154,7 +154,7 @@ mep_init(Slapi_PBlock *pb)
     int status = 0;
     char *plugin_identity = NULL;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
     int predel = SLAPI_PLUGIN_PRE_DELETE_FN;
@@ -165,7 +165,7 @@ mep_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         plugin_is_betxn = 1;
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
@@ -173,7 +173,6 @@ mep_init(Slapi_PBlock *pb)
         predel = SLAPI_PLUGIN_BE_TXN_PRE_DELETE_FN;
         premdn = SLAPI_PLUGIN_BE_TXN_PRE_MODRDN_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     /* Store the plugin identity for later use.
      * Used for internal operations. */
@@ -534,7 +533,7 @@ mep_parse_config_entry(Slapi_Entry *e, int apply)
     }
 
     /* Load the origin filter */
-    value = slapi_entry_attr_get_charptr(e, MEP_FILTER_TYPE);
+    value = (char *)slapi_entry_attr_get_ref(e, MEP_FILTER_TYPE);
     if (value) {
         /* Convert to a Slapi_Filter to improve performance. */
         if (NULL == (entry->origin_filter = slapi_str2filter(value))) {
@@ -546,8 +545,6 @@ mep_parse_config_entry(Slapi_Entry *e, int apply)
             ret = -1;
         }
 
-        slapi_ch_free_string(&value);
-
         if (ret != 0) {
             goto bail;
         }
@@ -1238,7 +1235,7 @@ mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin)
     }
 
     /* Ensure that a RDN type was specified in the template. */
-    if ((rdn_type = slapi_entry_attr_get_charptr(template, MEP_RDN_ATTR_TYPE)) == NULL) {
+    if ((rdn_type = (char *)slapi_entry_attr_get_ref(template, MEP_RDN_ATTR_TYPE)) == NULL) {
         slapi_log_err(SLAPI_LOG_ERR, MEP_PLUGIN_SUBSYSTEM,
                       "mep_create_managed_entry - The %s config attribute "
                       "was not found in template \"%s\".  This attribute "
@@ -1334,7 +1331,7 @@ mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin)
             rdn_vals = slapi_ldap_explode_dn(origin_dn, 1);
             rdn_val = rdn_vals[0];
         } else {
-            rdn_val = slapi_entry_attr_get_charptr(managed_entry, rdn_type);
+            rdn_val = (char *)slapi_entry_attr_get_ref(managed_entry, rdn_type);
         }
 
         /* Create the DN using the mapped RDN value
@@ -1342,8 +1339,6 @@ mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin)
         dn = slapi_ch_smprintf("%s=%s,%s", rdn_type, rdn_val, config->managed_base);
         if (origin) {
             slapi_ldap_value_free(rdn_vals);
-        } else {
-            slapi_ch_free_string(&rdn_val);
         }
 
         if (dn != NULL) {
@@ -1371,7 +1366,6 @@ mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin)
 
 done:
     slapi_ch_array_free(vals);
-    slapi_ch_free_string(&rdn_type);
 
     if (err != 0) {
         slapi_entry_free(managed_entry);
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
index 977e052..19a3428 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
@@ -377,7 +377,7 @@ pam_passthru_validate_config(Slapi_Entry *e, char *returntext)
     Slapi_Filter *pam_filter = NULL;
 
     /* first, get the missing_suffix flag and validate it */
-    missing_suffix_str = slapi_entry_attr_get_charptr(e, PAMPT_MISSING_SUFFIX_ATTR);
+    missing_suffix_str = (char *)slapi_entry_attr_get_ref(e, PAMPT_MISSING_SUFFIX_ATTR);
     if ((missing_suffix = missing_suffix_to_int(missing_suffix_str)) < 0 ||
         !check_missing_suffix_flag(missing_suffix)) {
         if (returntext) {
@@ -453,8 +453,8 @@ pam_passthru_validate_config(Slapi_Entry *e, char *returntext)
         }
     }
 
-    pam_ident_attr = slapi_entry_attr_get_charptr(e, PAMPT_PAM_IDENT_ATTR);
-    map_method = slapi_entry_attr_get_charptr(e, PAMPT_MAP_METHOD_ATTR);
+    pam_ident_attr = (char *)slapi_entry_attr_get_ref(e, PAMPT_PAM_IDENT_ATTR);
+    map_method = (char *)slapi_entry_attr_get_ref(e, PAMPT_MAP_METHOD_ATTR);
     if (map_method) {
         int one, two, three;
         if (PAM_PASSTHRU_SUCCESS !=
@@ -495,7 +495,7 @@ pam_passthru_validate_config(Slapi_Entry *e, char *returntext)
     }
 
     /* Validate filter by converting to Slapi_Filter */
-    pam_filter_str = slapi_entry_attr_get_charptr(e, PAMPT_FILTER_ATTR);
+    pam_filter_str = (char *)slapi_entry_attr_get_ref(e, PAMPT_FILTER_ATTR);
     if (pam_filter_str) {
         pam_filter = slapi_str2filter(pam_filter_str);
         if (pam_filter == NULL) {
@@ -519,14 +519,10 @@ pam_passthru_validate_config(Slapi_Entry *e, char *returntext)
     rc = PAM_PASSTHRU_SUCCESS;
 
 done:
-    slapi_ch_free_string(&map_method);
-    slapi_ch_free_string(&pam_ident_attr);
     slapi_ch_array_free(excludes);
     excludes = NULL;
     slapi_ch_array_free(includes);
     includes = NULL;
-    slapi_ch_free_string(&missing_suffix_str);
-    slapi_ch_free_string(&pam_filter_str);
     slapi_filter_free(pam_filter, 1);
 
     return rc;
@@ -589,7 +585,7 @@ pam_passthru_apply_config(Slapi_Entry *e)
     int inserted = 0;
 
     pam_ident_attr = slapi_entry_attr_get_charptr(e, PAMPT_PAM_IDENT_ATTR);
-    map_method = slapi_entry_attr_get_charptr(e, PAMPT_MAP_METHOD_ATTR);
+    map_method = (char *)slapi_entry_attr_get_ref(e, PAMPT_MAP_METHOD_ATTR);
     new_service = slapi_entry_attr_get_charptr(e, PAMPT_SERVICE_ATTR);
     excludes = slapi_entry_attr_get_charray(e, PAMPT_EXCLUDES_ATTR);
     includes = slapi_entry_attr_get_charray(e, PAMPT_INCLUDES_ATTR);
@@ -690,7 +686,6 @@ bail:
         pam_passthru_free_config_entry(&entry);
     }
     slapi_ch_free_string(&new_service);
-    slapi_ch_free_string(&map_method);
     slapi_ch_free_string(&pam_ident_attr);
     slapi_ch_free_string(&filter_str);
     slapi_ch_array_free(excludes);
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
index 472c18f..7f5fb02 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
@@ -104,9 +104,8 @@ derive_from_bind_entry(Slapi_PBlock *pb, const Slapi_DN *bindsdn, MyStrBuf *pam_
         init_my_str_buf(pam_id, NULL);
         *locked = 1;
     } else {
-        char *val = slapi_entry_attr_get_charptr(entry, map_ident_attr);
+        char *val = (char *)slapi_entry_attr_get_ref(entry, map_ident_attr);
         init_my_str_buf(pam_id, val);
-        slapi_ch_free_string(&val);
     }
 
     slapi_entry_free(entry);
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptpreop.c b/ldap/servers/plugins/pam_passthru/pam_ptpreop.c
index b62c3c6..3d00675 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptpreop.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptpreop.c
@@ -88,7 +88,7 @@ pam_passthruauth_init(Slapi_PBlock *pb)
 {
     int status = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int is_betxn = 0;
     int preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
@@ -105,8 +105,7 @@ pam_passthruauth_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry,
-                                                    "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         is_betxn = 1;
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
@@ -114,7 +113,6 @@ pam_passthruauth_init(Slapi_PBlock *pb)
         predel = SLAPI_PLUGIN_BE_TXN_PRE_DELETE_FN;
         premdn = SLAPI_PLUGIN_BE_TXN_PRE_MODRDN_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (is_betxn) {
         if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
@@ -256,7 +254,7 @@ pam_passthru_postop_init(Slapi_PBlock *pb)
 {
     int status = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int is_betxn = 0;
     int postadd = SLAPI_PLUGIN_POST_ADD_FN;
     int postmod = SLAPI_PLUGIN_POST_MODIFY_FN;
@@ -265,8 +263,7 @@ pam_passthru_postop_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry,
-                                                    "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         postadd = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
         postmod = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
@@ -274,7 +271,6 @@ pam_passthru_postop_init(Slapi_PBlock *pb)
         postdel = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
         is_betxn = 1;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01) ||
         slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc) ||
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index c56e55f..56efb23 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -154,7 +154,7 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
         *isvirt = 1; /* nsAccountLock is implemeted as nsRole */
     }
     /* first, see if the attribute is a "real" attribute */
-    strval = slapi_entry_attr_get_charptr(ds_entry, "nsAccountLock");
+    strval = (char*)slapi_entry_attr_get_ref(ds_entry, "nsAccountLock");
     if (strval) { /* value is real */
         if (isvirt) {
             *isvirt = 0; /* value is real */
@@ -163,7 +163,6 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
         if (PL_strncasecmp(strval, "true", 4) == 0) {
             rc = 0; /* account is disabled */
         }
-        slapi_ch_free_string(&strval);
         slapi_log_err(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
                       "<-- _check_account_lock - entry [%s] has real "
                       "attribute nsAccountLock and entry %s locked\n",
diff --git a/ldap/servers/plugins/referint/referint.c b/ldap/servers/plugins/referint/referint.c
index 9e4e680..7319976 100644
--- a/ldap/servers/plugins/referint/referint.c
+++ b/ldap/servers/plugins/referint/referint.c
@@ -150,7 +150,7 @@ int
 referint_postop_init(Slapi_PBlock *pb)
 {
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int delfn = SLAPI_PLUGIN_POST_DELETE_FN;
     int mdnfn = SLAPI_PLUGIN_POST_MODRDN_FN;
     int modfn = SLAPI_PLUGIN_POST_MODIFY_FN; /* for config changes */
@@ -172,7 +172,7 @@ referint_postop_init(Slapi_PBlock *pb)
     /* get the args */
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         delfn = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
         mdnfn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
@@ -181,17 +181,15 @@ referint_postop_init(Slapi_PBlock *pb)
         premodfn = SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN;
         use_txn = 1;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (plugin_entry) {
         char *plugin_attr_value;
         char **plugin_attr_values;
 
-        plugin_attr_value = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-pluginAllowReplUpdates");
+        plugin_attr_value = (char *)slapi_entry_attr_get_ref(plugin_entry, "nsslapd-pluginAllowReplUpdates");
         if (plugin_attr_value && strcasecmp(plugin_attr_value, "on") == 0) {
             allow_repl = 1;
         }
-        slapi_ch_free_string(&plugin_attr_value);
 
         plugin_attr_values = slapi_entry_attr_get_charray(plugin_entry, "nsslapd-pluginEntryScope");
         if (plugin_attr_values) {
@@ -311,17 +309,16 @@ load_config(Slapi_PBlock *pb, Slapi_Entry *config_entry, int apply)
         tmp_config->delay = -2;
     }
 
-    if ((value = slapi_entry_attr_get_charptr(config_entry, REFERINT_ATTR_DELAY))) {
+
+    if ((value = (char *)slapi_entry_attr_get_ref(config_entry, REFERINT_ATTR_DELAY))) {
         char *endptr = NULL;
         tmp_config->delay = strtol(value, &endptr, 10);
         if (!(value && !*endptr) || tmp_config->delay < -1) {
             slapi_log_err(SLAPI_LOG_ERR, REFERINT_PLUGIN_SUBSYSTEM, "load_config - invalid value \"%s\" for %s; should be >= -1\n",
                           value, REFERINT_ATTR_DELAY);
-            slapi_ch_free_string(&value);
             rc = SLAPI_PLUGIN_FAILURE;
             goto done;
         }
-        slapi_ch_free_string(&value);
         new_config_present = 1;
     }
     if ((value = slapi_entry_attr_get_charptr(config_entry, REFERINT_ATTR_LOGFILE))) {
@@ -1715,7 +1712,7 @@ referint_validate_config(Slapi_PBlock *pb)
             goto bail;
         }
 
-        if ((config_area = slapi_entry_attr_get_charptr(resulting_entry, SLAPI_PLUGIN_SHARED_CONFIG_AREA))) {
+        if ((config_area = (char *)slapi_entry_attr_get_ref(resulting_entry, SLAPI_PLUGIN_SHARED_CONFIG_AREA))) {
             rc = slapi_dn_syntax_check(pb, config_area, 1);
             if (rc) { /* syntax check failed */
                 slapi_log_err(SLAPI_LOG_ERR, REFERINT_PLUGIN_SUBSYSTEM, "referint_validate_config - "
@@ -1757,7 +1754,6 @@ bail:
     slapi_entry_free(e);
     slapi_entry_free(resulting_entry);
     slapi_sdn_free(&config_sdn);
-    slapi_ch_free_string(&config_area);
     slapi_mods_free(&smods);
 
     return rc;
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index 12a58c6..9187e2f 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -684,18 +684,18 @@ changelog5_dup_config(changelog5Config *config)
 static void
 changelog5_extract_config(Slapi_Entry *entry, changelog5Config *config)
 {
-    char *arg;
+    const char *arg;
+    char *max_age = NULL;
 
     memset(config, 0, sizeof(*config));
     config->dir = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_DIR_ATTRIBUTE);
     replace_bslash(config->dir);
 
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_MAXENTRIES_ATTRIBUTE);
+    arg = slapi_entry_attr_get_ref(entry, CONFIG_CHANGELOG_MAXENTRIES_ATTRIBUTE);
     if (arg) {
         config->maxEntries = atoi(arg);
-        slapi_ch_free_string(&arg);
     }
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE);
+    arg = slapi_entry_attr_get_ref(entry, CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE);
     if (arg) {
         if (slapi_is_duration_valid(arg)) {
             config->compactInterval = (long)slapi_parse_duration(arg);
@@ -704,12 +704,11 @@ changelog5_extract_config(Slapi_Entry *entry, changelog5Config *config)
                           "changelog5_extract_config - %s: invalid value \"%s\", ignoring the change.\n",
                           CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, arg);
         }
-        slapi_ch_free_string(&arg);
     } else {
         config->compactInterval = CHANGELOGDB_COMPACT_INTERVAL;
     }
 
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_TRIM_ATTRIBUTE);
+    arg = slapi_entry_attr_get_ref(entry, CONFIG_CHANGELOG_TRIM_ATTRIBUTE);
     if (arg) {
         if (slapi_is_duration_valid(arg)) {
             config->trimInterval = (long)slapi_parse_duration(arg);
@@ -719,20 +718,19 @@ changelog5_extract_config(Slapi_Entry *entry, changelog5Config *config)
                           CONFIG_CHANGELOG_TRIM_ATTRIBUTE, arg);
             config->trimInterval = CHANGELOGDB_TRIM_INTERVAL;
         }
-        slapi_ch_free_string(&arg);
     } else {
         config->trimInterval = CHANGELOGDB_TRIM_INTERVAL;
     }
 
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_MAXAGE_ATTRIBUTE);
-    if (arg) {
-        if (slapi_is_duration_valid(arg)) {
-            config->maxAge = arg;
+    max_age = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_MAXAGE_ATTRIBUTE);
+    if (max_age) {
+        if (slapi_is_duration_valid(max_age)) {
+            config->maxAge = max_age;
         } else {
+            slapi_ch_free_string(&max_age);
             slapi_log_err(SLAPI_LOG_NOTICE, repl_plugin_name_cl,
                           "changelog5_extract_config - %s: invalid value \"%s\", ignoring the change.\n",
-                          CONFIG_CHANGELOG_MAXAGE_ATTRIBUTE, arg);
-            slapi_ch_free_string(&arg);
+                          CONFIG_CHANGELOG_MAXAGE_ATTRIBUTE, max_age);
             config->maxAge = slapi_ch_strdup(CL5_STR_IGNORE);
         }
     } else {
@@ -742,20 +740,18 @@ changelog5_extract_config(Slapi_Entry *entry, changelog5Config *config)
     /*
      * changelog encryption
      */
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_ENCRYPTION_ALGORITHM);
+    arg = slapi_entry_attr_get_ref(entry, CONFIG_CHANGELOG_ENCRYPTION_ALGORITHM);
     if (arg) {
         config->dbconfig.encryptionAlgorithm = slapi_ch_strdup(arg);
-        slapi_ch_free_string(&arg);
     } else {
         config->dbconfig.encryptionAlgorithm = NULL; /* no encryption */
     }
     /*
      * symmetric key
      */
-    arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_SYMMETRIC_KEY);
+    arg = slapi_entry_attr_get_ref(entry, CONFIG_CHANGELOG_SYMMETRIC_KEY);
     if (arg) {
         config->dbconfig.symmetricKey = slapi_ch_strdup(arg);
-        slapi_ch_free_string(&arg);
     } else {
         config->dbconfig.symmetricKey = NULL; /* no symmetric key */
     }
diff --git a/ldap/servers/plugins/replication/cl5_test.c b/ldap/servers/plugins/replication/cl5_test.c
index 70b6f35..940ee2d 100644
--- a/ldap/servers/plugins/replication/cl5_test.c
+++ b/ldap/servers/plugins/replication/cl5_test.c
@@ -656,9 +656,8 @@ configureChangelog()
     }
 
     slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
-    str = slapi_entry_attr_get_charptr(entries[0], INSTANCE_ATTR);
+    str = (char*)slapi_entry_attr_get_ref(entries[0], INSTANCE_ATTR);
     PR_snprintf(cl_dir, sizeof(cl_dir), "%s/%s", str, "cl5db");
-    slapi_ch_free((void **)&str);
     slapi_entry_add_string(e, CONFIG_CHANGELOG_DIR_ATTRIBUTE, cl_dir);
 
     slapi_free_search_results_internal(pb);
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c
index 8e4586d..0ef39df 100644
--- a/ldap/servers/plugins/replication/repl5_agmt.c
+++ b/ldap/servers/plugins/replication/repl5_agmt.c
@@ -250,9 +250,9 @@ agmt_new_from_entry(Slapi_Entry *e)
     char errormsg[SLAPI_DSE_RETURNTEXT_SIZE];
     char *tmpstr;
     char **denied_attrs = NULL;
-    char *auto_initialize = NULL;
+    const char *auto_initialize = NULL;
     char *val_nsds5BeginReplicaRefresh = "start";
-    char *val = NULL;
+    const char *val = NULL;
     int64_t ptimeout = 0;
     int rc = 0;
 
@@ -280,27 +280,22 @@ agmt_new_from_entry(Slapi_Entry *e)
         store the effect of 'nsds5BeginReplicaRefresh' attribute's value
         in it.
     */
-    auto_initialize = slapi_entry_attr_get_charptr(e, type_nsds5BeginReplicaRefresh);
+    auto_initialize = slapi_entry_attr_get_ref(e, type_nsds5BeginReplicaRefresh);
     if ((auto_initialize != NULL) && (strcasecmp(auto_initialize, val_nsds5BeginReplicaRefresh) == 0)) {
         ra->auto_initialize = STATE_PERFORMING_TOTAL_UPDATE;
     } else {
         ra->auto_initialize = STATE_PERFORMING_INCREMENTAL_UPDATE;
     }
 
-    if (auto_initialize) {
-        slapi_ch_free_string(&auto_initialize);
-    }
-
     /* Host name of remote replica */
     ra->hostname = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaHost);
 
     /* Port number for remote replica instance */
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaPort))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaPort))){
         int64_t port;
-        if (repl_config_valid_num(type_nsds5ReplicaPort, val, 1, 65535, &rc, errormsg, &port) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaPort, (char *)val, 1, 65535, &rc, errormsg, &port) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->port = port;
     }
 
@@ -332,40 +327,37 @@ agmt_new_from_entry(Slapi_Entry *e)
 
     /* timeout. */
     ra->timeout = DEFAULT_TIMEOUT;
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaTimeout))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaTimeout))) {
         int64_t timeout;
-        if (repl_config_valid_num(type_nsds5ReplicaTimeout, val, 0, INT_MAX, &rc, errormsg, &timeout) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaTimeout, (char *)val, 0, INT_MAX, &rc, errormsg, &timeout) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->timeout = timeout;
     }
 
     /* flow control update window. */
     ra->flowControlWindow = DEFAULT_FLOWCONTROL_WINDOW;
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaFlowControlWindow))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaFlowControlWindow))){
         int64_t flow;
-        if (repl_config_valid_num(type_nsds5ReplicaFlowControlWindow, val, 0, INT_MAX, &rc, errormsg, &flow) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaFlowControlWindow, (char *)val, 0, INT_MAX, &rc, errormsg, &flow) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->flowControlWindow = flow;
     }
 
     /* flow control update pause. */
     ra->flowControlPause = DEFAULT_FLOWCONTROL_PAUSE;
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaFlowControlPause))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaFlowControlPause))){
         int64_t pause;
-        if (repl_config_valid_num(type_nsds5ReplicaFlowControlPause, val, 0, INT_MAX, &rc, errormsg, &pause) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaFlowControlPause, (char *)val, 0, INT_MAX, &rc, errormsg, &pause) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->flowControlPause = pause;
     }
 
     /* continue on missing change ? */
     ra->ignoreMissingChange = 0;
-    tmpstr = slapi_entry_attr_get_charptr(e, type_replicaIgnoreMissingChange);
+    tmpstr = (char *)slapi_entry_attr_get_ref(e, type_replicaIgnoreMissingChange);
     if (NULL != tmpstr) {
         if (strcasecmp(tmpstr, "off") == 0 || strcasecmp(tmpstr, "never") == 0) {
             ra->ignoreMissingChange = 0;
@@ -373,8 +365,7 @@ agmt_new_from_entry(Slapi_Entry *e)
             ra->ignoreMissingChange = 1;
         } else if (strcasecmp(tmpstr, "always") == 0) {
             ra->ignoreMissingChange = -1;
-        }
-        slapi_ch_free_string(&tmpstr);
+        };
     }
 
     /* DN of entry at root of replicated area */
@@ -394,17 +385,15 @@ agmt_new_from_entry(Slapi_Entry *e)
     }
 
     /* If this agmt has its own timeout, grab it, otherwise use the replica's protocol timeout */
-    if ((val = slapi_entry_attr_get_charptr(e, type_replicaProtocolTimeout))){
-        if (repl_config_valid_num(type_replicaProtocolTimeout, val, 0, INT_MAX, &rc, errormsg, &ptimeout) != 0) {
+    if ((val = slapi_entry_attr_get_ref(e, type_replicaProtocolTimeout))){
+        if (repl_config_valid_num(type_replicaProtocolTimeout, (char *)val, 0, INT_MAX, &rc, errormsg, &ptimeout) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         slapi_counter_set_value(ra->protocol_timeout, ptimeout);
     }
 
-
     /* Replica enabled */
-    tmpstr = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaEnabled);
+    tmpstr = (char *)slapi_entry_attr_get_ref(e, type_nsds5ReplicaEnabled);
     if (NULL != tmpstr) {
         if (strcasecmp(tmpstr, "off") == 0) {
             ra->is_enabled = PR_FALSE;
@@ -414,10 +403,8 @@ agmt_new_from_entry(Slapi_Entry *e)
             slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "agmt_new_from_entry - "
                     "Warning invalid value for nsds5ReplicaEnabled (%s), value must be \"on\" or \"off\".  "
                     "Ignoring this repl agreement.\n", tmpstr);
-            slapi_ch_free_string(&tmpstr);
             goto loser;
         }
-        slapi_ch_free_string(&tmpstr);
     } else {
         ra->is_enabled = PR_TRUE;
     }
@@ -429,22 +416,20 @@ agmt_new_from_entry(Slapi_Entry *e)
     }
 
     /* busy wait time - time to wait after getting REPLICA BUSY from consumer */
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaBusyWaitTime))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaBusyWaitTime))){
         int64_t busytime = 0;
-        if (repl_config_valid_num(type_nsds5ReplicaBusyWaitTime, val, 0, INT_MAX, &rc, errormsg, &busytime) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaBusyWaitTime, (char *)val, 0, INT_MAX, &rc, errormsg, &busytime) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->busywaittime = busytime;
     }
 
     /* pause time - time to pause after a session has ended */
-    if ((val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaSessionPauseTime))){
+    if ((val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaSessionPauseTime))){
         int64_t pausetime = 0;
-        if (repl_config_valid_num(type_nsds5ReplicaSessionPauseTime, val, 0, INT_MAX, &rc, errormsg, &pausetime) != 0) {
+        if (repl_config_valid_num(type_nsds5ReplicaSessionPauseTime, (char *)val, 0, INT_MAX, &rc, errormsg, &pausetime) != 0) {
             goto loser;
         }
-        slapi_ch_free_string(&val);
         ra->pausetime = pausetime;
     }
     /* consumer's RUV */
@@ -548,10 +533,9 @@ agmt_new_from_entry(Slapi_Entry *e)
      *  Extract the attributes to strip for "empty" mods
      */
     ra->attrs_to_strip = NULL;
-    tmpstr = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaStripAttrs);
+    tmpstr = (char *)slapi_entry_attr_get_ref(e, type_nsds5ReplicaStripAttrs);
     if (NULL != tmpstr) {
         ra->attrs_to_strip = slapi_str2charray_ext(tmpstr, " ", 0);
-        slapi_ch_free_string(&tmpstr);
     }
 
     if (!agmt_is_valid(ra)) {
@@ -576,7 +560,6 @@ agmt_new_from_entry(Slapi_Entry *e)
 loser:
     slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name,
                   "agmt_new_from_entry - Failed to parse agreement, skipping.\n");
-    slapi_ch_free_string(&val);
     agmt_delete((void **)&ra);
     return NULL;
 }
@@ -1709,11 +1692,11 @@ agmt_validate_replicated_attributes(Repl_Agmt *ra, int total)
 static int
 agmt_set_bind_method_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
 {
-    char *tmpstr = NULL;
+    const char *tmpstr = NULL;
     int return_value = 0;
 
     PR_ASSERT(NULL != ra);
-    tmpstr = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaBindMethod);
+    tmpstr = slapi_entry_attr_get_ref((Slapi_Entry *)e, type_nsds5ReplicaBindMethod);
 
     if (NULL == tmpstr || strcasecmp(tmpstr, "SIMPLE") == 0) {
         ra->bindmethod = BINDMETHOD_SIMPLE_AUTH;
@@ -1726,7 +1709,6 @@ agmt_set_bind_method_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
     } else {
         ra->bindmethod = BINDMETHOD_SIMPLE_AUTH;
     }
-    slapi_ch_free((void **)&tmpstr);
     return return_value;
 }
 
@@ -1755,10 +1737,10 @@ agmt_set_bind_method_from_entry(Repl_Agmt *ra, const Slapi_Entry *e)
 static int
 agmt_set_transportinfo_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
 {
-    char *tmpstr;
+    const char *tmpstr;
     int rc = 0;
 
-    tmpstr = slapi_entry_attr_get_charptr(e, type_nsds5TransportInfo);
+    tmpstr = slapi_entry_attr_get_ref((Slapi_Entry *)e, type_nsds5TransportInfo);
     if (!tmpstr || !strcasecmp(tmpstr, "LDAP")) {
         ra->transport_flags = 0;
     } else if (strcasecmp(tmpstr, "SSL") == 0 || strcasecmp(tmpstr, "LDAPS") == 0) {
@@ -1768,7 +1750,6 @@ agmt_set_transportinfo_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
     }
     /* else do nothing - invalid value is a no-op */
 
-    slapi_ch_free_string(&tmpstr);
     return (rc);
 }
 
@@ -2913,7 +2894,7 @@ agmt_is_enabled(Repl_Agmt *ra)
 int
 agmt_set_enabled_from_entry(Repl_Agmt *ra, Slapi_Entry *e, char *returntext)
 {
-    char *attr_val = NULL;
+    const char *attr_val = NULL;
     int rc = 0;
 
     if (ra == NULL) {
@@ -2921,7 +2902,8 @@ agmt_set_enabled_from_entry(Repl_Agmt *ra, Slapi_Entry *e, char *returntext)
     }
 
     PR_Lock(ra->lock);
-    attr_val = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaEnabled);
+
+    attr_val = slapi_entry_attr_get_ref(e, type_nsds5ReplicaEnabled);
     if (attr_val) {
         PRBool is_enabled = PR_TRUE;
         if (strcasecmp(attr_val, "off") == 0) {
@@ -2934,11 +2916,9 @@ agmt_set_enabled_from_entry(Repl_Agmt *ra, Slapi_Entry *e, char *returntext)
                           attr_val);
             PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Invalid value for nsds5ReplicaEnabled, "
                                                                "the value must be \"on\" or \"off\".\n");
-            slapi_ch_free_string(&attr_val);
             PR_Unlock(ra->lock);
             return -1;
         }
-        slapi_ch_free_string(&attr_val);
         if (is_enabled) {
             if (!ra->is_enabled) {
                 ra->is_enabled = PR_TRUE;
@@ -2985,7 +2965,7 @@ agmt_set_attrs_to_strip(Repl_Agmt *ra, Slapi_Entry *e)
 {
     char *tmpstr = NULL;
 
-    tmpstr = slapi_entry_attr_get_charptr(e, type_nsds5ReplicaStripAttrs);
+    tmpstr = (char *)slapi_entry_attr_get_ref(e, type_nsds5ReplicaStripAttrs);
 
     PR_Lock(ra->lock);
     if (ra->attrs_to_strip) {
@@ -2999,7 +2979,6 @@ agmt_set_attrs_to_strip(Repl_Agmt *ra, Slapi_Entry *e)
     PR_Unlock(ra->lock);
 
     prot_notify_agmt_changed(ra->protocol, ra->long_name);
-    slapi_ch_free_string(&tmpstr);
 
     return 0;
 }
diff --git a/ldap/servers/plugins/replication/repl5_agmtlist.c b/ldap/servers/plugins/replication/repl5_agmtlist.c
index cf3db9f..1bed8ad 100644
--- a/ldap/servers/plugins/replication/repl5_agmtlist.c
+++ b/ldap/servers/plugins/replication/repl5_agmtlist.c
@@ -523,9 +523,8 @@ agmtlist_modify_callback(Slapi_PBlock *pb,
             }
         } else if (slapi_attr_types_equivalent(mods[i]->mod_type,
                                                "nsds5debugreplicatimeout")) {
-            char *val = slapi_entry_attr_get_charptr(e, "nsds5debugreplicatimeout");
+            char *val = (char *)slapi_entry_attr_get_ref(e, "nsds5debugreplicatimeout");
             repl5_set_debug_timeout(val);
-            slapi_ch_free_string(&val);
         } else if (slapi_attr_is_last_mod(mods[i]->mod_type) ||
                    strcasecmp(mods[i]->mod_type, "description") == 0) {
             /* ignore modifier's name and timestamp attributes and the description. */
diff --git a/ldap/servers/plugins/replication/repl5_plugins.c b/ldap/servers/plugins/replication/repl5_plugins.c
index 324e382..e5ed6de 100644
--- a/ldap/servers/plugins/replication/repl5_plugins.c
+++ b/ldap/servers/plugins/replication/repl5_plugins.c
@@ -88,9 +88,9 @@ multimaster_set_local_purl()
                                                            "Server configuration missing\n");
             rc = -1;
         } else {
-            char *host = slapi_entry_attr_get_charptr(entries[0], "nsslapd-localhost");
-            char *port = slapi_entry_attr_get_charptr(entries[0], "nsslapd-port");
-            char *sslport = slapi_entry_attr_get_charptr(entries[0], "nsslapd-secureport");
+            char *host = (char *)slapi_entry_attr_get_ref(entries[0], "nsslapd-localhost");
+            char *port = (char *)slapi_entry_attr_get_ref(entries[0], "nsslapd-port");
+            char *sslport = (char *)slapi_entry_attr_get_ref(entries[0], "nsslapd-secureport");
             if (host == NULL || ((port == NULL && sslport == NULL))) {
                 slapi_log_err(SLAPI_LOG_WARNING, repl_plugin_name,
                               "multimaster_set_local_purl - Invalid server "
@@ -103,11 +103,6 @@ multimaster_set_local_purl()
                     local_purl = slapi_ch_smprintf("ldap://%s:%s", host, port);
                 }
             }
-
-            /* slapi_ch_free acceptS NULL pointer */
-            slapi_ch_free((void **)&host);
-            slapi_ch_free((void **)&port);
-            slapi_ch_free((void **)&sslport);
         }
     }
     slapi_free_search_results_internal(pb);
@@ -199,9 +194,9 @@ multimaster_preop_add(Slapi_PBlock *pb)
                          * same as the one in the entry.
                          */
                         Slapi_Entry *addentry;
-                        char *entry_uuid;
+                        const char *entry_uuid;
                         slapi_pblock_get(pb, SLAPI_ADD_ENTRY, &addentry);
-                        entry_uuid = slapi_entry_attr_get_charptr(addentry, SLAPI_ATTR_UNIQUEID);
+                        entry_uuid = slapi_entry_attr_get_ref(addentry, SLAPI_ATTR_UNIQUEID);
                         if (entry_uuid == NULL) {
                             /* Odd that the entry doesn't have a Unique Identifier. But, we can fix it. */
                             slapi_entry_set_uniqueid(addentry, slapi_ch_strdup(target_uuid)); /* JCMREPL - strdup EVIL! There should be a uuid dup function. */
@@ -211,8 +206,6 @@ multimaster_preop_add(Slapi_PBlock *pb)
                                               "multimaster_preop_add - %s Replicated Add received with Control_UUID=%s and Entry_UUID=%s.\n",
                                               sessionid, target_uuid, entry_uuid);
                             }
-
-                            slapi_ch_free((void **)&entry_uuid);
                         }
                     }
                 }
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index b3f03d5..c150ff9 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -1857,13 +1857,11 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
 
     /* get replica type */
     if (slapi_entry_attr_exists(e, attr_replicaType)) {
-        if ((val = slapi_entry_attr_get_charptr(e, attr_replicaType))) {
-            if (repl_config_valid_num(attr_replicaType, val, 0, REPLICA_TYPE_UPDATABLE, &rc, errormsg, &rtype) != 0) {
-                slapi_ch_free_string(&val);
+        if ((val = (char*)slapi_entry_attr_get_ref(e, attr_replicaType))) {
+            if (repl_config_valid_num(attr_replicaType, (char *)val, 0, REPLICA_TYPE_UPDATABLE, &rc, errormsg, &rtype) != 0) {
                 return LDAP_UNWILLING_TO_PERFORM;
             }
             r->repl_type = rtype;
-            slapi_ch_free_string(&val);
         } else {
             r->repl_type = REPLICA_TYPE_READONLY;
         }
@@ -1873,12 +1871,10 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
 
     /* grab and validate the backoff min retry settings */
     if (slapi_entry_attr_exists(e, type_replicaBackoffMin)) {
-        if ((val = slapi_entry_attr_get_charptr(e, type_replicaBackoffMin))) {
+        if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaBackoffMin))) {
             if (repl_config_valid_num(type_replicaBackoffMin, val, 1, INT_MAX, &rc, errormsg, &backoff_min) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
-            slapi_ch_free_string(&val);
         } else {
             backoff_min = PROTOCOL_BACKOFF_MINIMUM;
         }
@@ -1888,12 +1884,10 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
 
     /* grab and validate the backoff max retry settings */
     if (slapi_entry_attr_exists(e, type_replicaBackoffMax)) {
-        if ((val = slapi_entry_attr_get_charptr(e, type_replicaBackoffMax))) {
+        if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaBackoffMax))) {
             if (repl_config_valid_num(type_replicaBackoffMax, val, 1, INT_MAX, &rc, errormsg, &backoff_max) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
-            slapi_ch_free_string(&val);
         } else {
             backoff_max = PROTOCOL_BACKOFF_MAXIMUM;
         }
@@ -1916,12 +1910,10 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
 
     /* get the protocol timeout */
     if (slapi_entry_attr_exists(e, type_replicaProtocolTimeout)) {
-        if ((val = slapi_entry_attr_get_charptr(e, type_replicaProtocolTimeout))) {
+        if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaProtocolTimeout))) {
             if (repl_config_valid_num(type_replicaProtocolTimeout, val, 0, INT_MAX, &rc, errormsg, &ptimeout) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
-            slapi_ch_free_string(&val);
             slapi_counter_set_value(r->protocol_timeout, ptimeout);
         } else {
             slapi_counter_set_value(r->protocol_timeout, DEFAULT_PROTOCOL_TIMEOUT);
@@ -1932,13 +1924,11 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
 
     /* Get the release timeout */
     if (slapi_entry_attr_exists(e, type_replicaReleaseTimeout)) {
-        if ((val = slapi_entry_attr_get_charptr(e, type_replicaReleaseTimeout))) {
+        if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaReleaseTimeout))) {
             if (repl_config_valid_num(type_replicaReleaseTimeout, val, 0, INT_MAX, &rc, errortext, &release_timeout) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
             slapi_counter_set_value(r->release_timeout, release_timeout);
-            slapi_ch_free_string(&val);
         } else {
             slapi_counter_set_value(r->release_timeout, 0);
         }
@@ -1947,7 +1937,7 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
     }
 
     /* check for precise tombstone purging */
-    precise_purging = slapi_entry_attr_get_charptr(e, type_replicaPrecisePurge);
+    precise_purging = (char*)slapi_entry_attr_get_ref(e, type_replicaPrecisePurge);
     if (precise_purging) {
         if (strcasecmp(precise_purging, "on") == 0) {
             slapi_counter_set_value(r->precise_purging, 1);
@@ -1961,7 +1951,6 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
                           "%s\n", errormsg);
             return LDAP_UNWILLING_TO_PERFORM;
         }
-        slapi_ch_free_string(&precise_purging);
     } else {
         slapi_counter_set_value(r->precise_purging, 0);
     }
@@ -1969,13 +1958,11 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
     /* get replica flags */
     if (slapi_entry_attr_exists(e, attr_flags)) {
         int64_t rflags;
-        if((val = slapi_entry_attr_get_charptr(e, attr_flags))) {
+        if((val = (char*)slapi_entry_attr_get_ref(e, attr_flags))) {
             if (repl_config_valid_num(attr_flags, val, 0, 1, &rc, errortext, &rflags) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
             r->repl_flags = (uint32_t)rflags;
-            slapi_ch_free_string(&val);
         } else {
             r->repl_flags = 0;
         }
@@ -1995,14 +1982,12 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
     /* a replica id is required for updatable and primary replicas */
     else if (r->repl_type == REPLICA_TYPE_UPDATABLE ||
              r->repl_type == REPLICA_TYPE_PRIMARY) {
-        if ((val = slapi_entry_attr_get_charptr(e, attr_replicaId))) {
+        if ((val = (char*)slapi_entry_attr_get_ref(e, attr_replicaId))) {
             int64_t rid;
             if (repl_config_valid_num(attr_replicaId, val, 1, 65534, &rc, errormsg, &rid) != 0) {
-                slapi_ch_free_string(&val);
                 return LDAP_UNWILLING_TO_PERFORM;
             }
             r->repl_rid = (ReplicaId)rid;
-            slapi_ch_free_string(&val);
         } else {
             PR_snprintf(errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
                         "Failed to retrieve required %s attribute from %s",
@@ -2037,13 +2022,11 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
     r->groupdn_list = replica_groupdn_list_new(r->updatedn_groups);
     r->updatedn_group_last_check = 0;
     /* get groupdn check interval */
-    if ((val = slapi_entry_attr_get_charptr(e, attr_replicaBindDnGroupCheckInterval))) {
+    if ((val = (char*)slapi_entry_attr_get_ref(e, attr_replicaBindDnGroupCheckInterval))) {
         if (repl_config_valid_num(attr_replicaBindDnGroupCheckInterval, val, -1, INT_MAX, &rc, errormsg, &interval) != 0) {
-            slapi_ch_free_string(&val);
             return LDAP_UNWILLING_TO_PERFORM;
         }
         r->updatedn_group_check_interval = interval;
-        slapi_ch_free_string(&val);
     } else {
         r->updatedn_group_check_interval = -1;
     }
@@ -2078,24 +2061,20 @@ _replica_init_from_config(Replica *r, Slapi_Entry *e, char *errortext)
      * since we don't know about LCUP replicas, and they can just
      * turn up whenever they want to.
      */
-    if ((val = slapi_entry_attr_get_charptr(e, type_replicaPurgeDelay))) {
+    if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaPurgeDelay))) {
         if (repl_config_valid_num(type_replicaPurgeDelay, val, -1, INT_MAX, &rc, errormsg, &interval) != 0) {
-            slapi_ch_free_string(&val);
             return LDAP_UNWILLING_TO_PERFORM;
         }
         r->repl_purge_delay = interval;
-        slapi_ch_free_string(&val);
     } else {
         r->repl_purge_delay = 60 * 60 * 24 * 7; /* One week, in seconds */
     }
 
-    if ((val = slapi_entry_attr_get_charptr(e, type_replicaTombstonePurgeInterval))) {
+    if ((val = (char*)slapi_entry_attr_get_ref(e, type_replicaTombstonePurgeInterval))) {
         if (repl_config_valid_num(type_replicaTombstonePurgeInterval, val, -1, INT_MAX, &rc, errormsg, &interval) != 0) {
-            slapi_ch_free_string(&val);
             return LDAP_UNWILLING_TO_PERFORM;
         }
         r->tombstone_reap_interval = interval;
-        slapi_ch_free_string(&val);
     } else {
         r->tombstone_reap_interval = 3600 * 24; /* One week, in seconds */
     }
@@ -3073,11 +3052,10 @@ process_reap_entry(Slapi_Entry *entry, void *cb_data)
         /* this might be a tombstone which was directly added, eg a cenotaph
          * check if a tombstonecsn exist and use it
          */
-        char *tombstonecsn_str = slapi_entry_attr_get_charptr(entry, SLAPI_ATTR_TOMBSTONE_CSN);
+        char *tombstonecsn_str = (char*)slapi_entry_attr_get_ref(entry, SLAPI_ATTR_TOMBSTONE_CSN);
         if (tombstonecsn_str) {
             tombstone_csn = csn_new_by_string(tombstonecsn_str);
             deletion_csn = tombstone_csn;
-            slapi_ch_free_string(&tombstonecsn_str);
         }
     }
 
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 749e909..0df2105 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -203,7 +203,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
 {
     Replica *r = NULL;
     multimaster_mtnode_extension *mtnode_ext;
-    char *replica_root = (char *)slapi_entry_attr_get_charptr(e, attr_replicaRoot);
+    char *replica_root = (char *)slapi_entry_attr_get_ref(e, attr_replicaRoot);
     char *errortext = NULL;
     Slapi_RDN *replicardn;
 
@@ -223,7 +223,6 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
               }
               slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICANORMRDN);
               slapi_rdn_free(&replicardn);
-              slapi_ch_free_string(&replica_root);
               *returncode = LDAP_UNWILLING_TO_PERFORM;
               return SLAPI_DSE_CALLBACK_ERROR;
           } else {
@@ -233,7 +232,6 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
                  }
                  slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name,"replica_config_add - "MSG_CNREPLICA, nrdn, REPLICA_RDN);
                  slapi_rdn_free(&replicardn);
-                 slapi_ch_free_string(&replica_root);
                  *returncode = LDAP_UNWILLING_TO_PERFORM;
                  return SLAPI_DSE_CALLBACK_ERROR;
              }
@@ -244,7 +242,6 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
             strcpy(errortext, MSG_NOREPLICARDN);
         }
         slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICARDN);
-        slapi_ch_free_string(&replica_root);
         *returncode = LDAP_UNWILLING_TO_PERFORM;
         return SLAPI_DSE_CALLBACK_ERROR;
     }
@@ -288,8 +285,6 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
 done:
 
     PR_Unlock(s_configLock);
-    /* slapi_ch_free accepts NULL pointer */
-    slapi_ch_free_string(&replica_root);
 
     if (*returncode != LDAP_SUCCESS) {
         if (mtnode_ext->replica)
@@ -334,7 +329,7 @@ replica_config_modify(Slapi_PBlock *pb,
         return SLAPI_DSE_CALLBACK_OK;
     }
 
-    replica_root = (char *)slapi_entry_attr_get_charptr(e, attr_replicaRoot);
+    replica_root = (char *)slapi_entry_attr_get_ref(e, attr_replicaRoot);
 
     PR_Lock(s_configLock);
 
@@ -616,9 +611,6 @@ done:
         object_release(mtnode_ext->replica);
     }
 
-    /* slapi_ch_free accepts NULL pointer */
-    slapi_ch_free_string(&replica_root);
-
     PR_Unlock(s_configLock);
 
     if (*returncode != LDAP_SUCCESS) {
@@ -663,7 +655,7 @@ replica_config_post_modify(Slapi_PBlock *pb,
         return SLAPI_DSE_CALLBACK_OK;
     }
 
-    replica_root = (char *)slapi_entry_attr_get_charptr(e, attr_replicaRoot);
+    replica_root = (char *)slapi_entry_attr_get_ref(e, attr_replicaRoot);
 
     PR_Lock(s_configLock);
 
@@ -735,9 +727,6 @@ replica_config_post_modify(Slapi_PBlock *pb,
 done:
     PR_Unlock(s_configLock);
 
-    /* slapi_ch_free accepts NULL pointer */
-    slapi_ch_free_string(&replica_root);
-
     /* Call replica_cleanup_task after s_configLock is reliesed */
     if (flag_need_cleanup) {
         *returncode = replica_cleanup_task(mtnode_ext->replica,
@@ -1430,7 +1419,7 @@ replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
     /*
      *  Get our task settings
      */
-    if ((rid_str = slapi_fetch_attr(e, "replica-id", 0)) == NULL) {
+    if ((rid_str = slapi_entry_attr_get_ref(e, "replica-id")) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing replica-id attribute");
         cleanruv_log(task, -1, CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
@@ -1438,14 +1427,14 @@ replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
         goto out;
     }
     rid = atoi(rid_str);
-    if ((base_dn = slapi_fetch_attr(e, "replica-base-dn", 0)) == NULL) {
+    if ((base_dn = slapi_entry_attr_get_ref(e, "replica-base-dn")) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing replica-base-dn attribute");
         cleanruv_log(task, (int)rid, CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((force_cleaning = slapi_fetch_attr(e, "replica-force-cleaning", 0)) != NULL) {
+    if ((force_cleaning = slapi_entry_attr_get_ref(e, "replica-force-cleaning")) != NULL) {
         if (strcasecmp(force_cleaning, "yes") != 0 && strcasecmp(force_cleaning, "no") != 0) {
             PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Invalid value for replica-force-cleaning "
                                                                "(%s).  Value must be \"yes\" or \"no\" for task - (%s)",
@@ -1458,7 +1447,7 @@ replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
     } else {
         force_cleaning = "no";
     }
-    if ((orig_val = slapi_fetch_attr(e, "replica-original-task", 0)) != NULL) {
+    if ((orig_val = slapi_entry_attr_get_ref(e, "replica-original-task")) != NULL) {
         if (!strcasecmp(orig_val, "0")) {
             original_task = PR_FALSE;
         }
@@ -2901,14 +2890,14 @@ replica_cleanall_ruv_abort(Slapi_PBlock *pb __attribute__((unused)),
     /*
      *  Get our task settings
      */
-    if ((rid_str = slapi_fetch_attr(e, "replica-id", 0)) == NULL) {
+    if ((rid_str = slapi_entry_attr_get_ref(e, "replica-id")) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing required attr \"replica-id\"");
         cleanruv_log(task, -1, ABORT_CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    certify_all = slapi_fetch_attr(e, "replica-certify-all", 0);
+    certify_all = slapi_entry_attr_get_ref(e, "replica-certify-all");
     /*
      *  Check the rid
      */
@@ -2921,7 +2910,7 @@ replica_cleanall_ruv_abort(Slapi_PBlock *pb __attribute__((unused)),
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((base_dn = slapi_fetch_attr(e, "replica-base-dn", 0)) == NULL) {
+    if ((base_dn = slapi_entry_attr_get_ref(e, "replica-base-dn")) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing required attr \"replica-base-dn\"");
         cleanruv_log(task, rid, ABORT_CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
@@ -3005,7 +2994,7 @@ replica_cleanall_ruv_abort(Slapi_PBlock *pb __attribute__((unused)),
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((orig_val = slapi_fetch_attr(e, "replica-original-task", 0)) != NULL) {
+    if ((orig_val = slapi_entry_attr_get_ref(e, "replica-original-task")) != NULL) {
         if (!strcasecmp(orig_val, "0")) {
             original_task = PR_FALSE;
         }
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index 1dbbe69..9eadb2c 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -307,12 +307,11 @@ check_suffix_entryID(Slapi_Backend *be, Slapi_Entry *suffix)
     }
 
     /* Second retrieve the suffix entryid from the suffix entry itself */
-    entryid_str = slapi_entry_attr_get_charptr(suffix, "entryid");
+    entryid_str = (char*)slapi_entry_attr_get_ref(suffix, "entryid");
     if (entryid_str == NULL) {
         char *dn;
         dn = slapi_entry_get_ndn(suffix);
         slapi_log_err(SLAPI_LOG_ERR, "check_suffix_entryID", "Unable to retrieve entryid of the suffix entry %s\n", dn ? dn : "<unknown>");
-        slapi_ch_free_string(&entryid_str);
         return;
     }
     entryid = (u_int32_t) atoi(entryid_str);
diff --git a/ldap/servers/plugins/replication/replutil.c b/ldap/servers/plugins/replication/replutil.c
index a852f24..de1e778 100644
--- a/ldap/servers/plugins/replication/replutil.c
+++ b/ldap/servers/plugins/replication/replutil.c
@@ -1024,10 +1024,9 @@ is_chain_on_update_setup(const Slapi_DN *replroot)
         slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
         if (entries != NULL && entries[0] != NULL) {
             Slapi_Entry *e = entries[0];
-
             char **backends = slapi_entry_attr_get_charray(e, "nsslapd-backend");
-            char *plg = slapi_entry_attr_get_charptr(e, "nsslapd-distribution-plugin");
-            char *func = slapi_entry_attr_get_charptr(e, "nsslapd-distribution-funct");
+            const char *plg = slapi_entry_attr_get_ref(e, "nsslapd-distribution-plugin");
+            const char *func = slapi_entry_attr_get_ref(e, "nsslapd-distribution-funct");
 
             if (backends && backends[0] && backends[1] && plg && func) {
                 /* all the necessary attrs are present - check to see if we
@@ -1040,8 +1039,6 @@ is_chain_on_update_setup(const Slapi_DN *replroot)
                          !(foundchain0 && foundchain1); /* 1 (but not both) backend is chaining */
             }
             slapi_ch_array_free(backends);
-            slapi_ch_free_string(&plg);
-            slapi_ch_free_string(&func);
         } else /* could not find mapping tree entry - assume not set up */
         {
         }
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index b134409..d0a486d 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -323,17 +323,16 @@ urp_modrdn_operation(Slapi_PBlock *pb)
 
         /* Turn the tombstone to glue before rename it */
         /* check if the delete was after the modrdn */
-        char *del_str = slapi_entry_attr_get_charptr(target_entry, "nstombstonecsn");
+        char *del_str = (char*)slapi_entry_attr_get_ref(target_entry, "nstombstonecsn");
         CSN *del_csn = csn_new_by_string(del_str);
         if (csn_compare(del_csn,opcsn)>0) {
-            char *glue_dn = slapi_entry_attr_get_charptr(target_entry, "nscpentrydn");
+            char *glue_dn = (char*)slapi_entry_attr_get_ref(target_entry, "nscpentrydn");
             Slapi_DN *glue_sdn = slapi_sdn_new_dn_byval(glue_dn);
             op_result = tombstone_to_glue (pb, sessionid, target_entry,
                                            glue_sdn, "renameTombstone", opcsn, NULL);
             slapi_log_err(SLAPI_LOG_REPL, sessionid,
                           "urp_modrdn_operation  - Target_entry %s is a tombstone; Renaming since delete was after rename.\n",
                            slapi_entry_get_dn((Slapi_Entry *)target_entry));
-            slapi_ch_free_string(&glue_dn);
             slapi_sdn_free(&glue_sdn);
         } else {
             op_result = LDAP_NO_SUCH_OBJECT;
@@ -341,7 +340,6 @@ urp_modrdn_operation(Slapi_PBlock *pb)
                           "urp_modrdn_operation  - Target_entry %s is a tombstone; returning LDAP_NO_SUCH_OBJECT.\n",
                           slapi_entry_get_dn((Slapi_Entry *)target_entry));
         }
-        slapi_ch_free_string(&del_str);
         csn_free(&del_csn);
 
         slapi_pblock_set(pb, SLAPI_RESULT_CODE, &op_result);
@@ -1407,17 +1405,16 @@ urp_add_check_tombstone (Slapi_PBlock *pb, char *sessionid, Slapi_Entry *entry, 
         CSN *from_csn = NULL;
         CSN *to_csn = NULL;
         char *to_value = NULL;
-        char *from_value = slapi_entry_attr_get_charptr(entries[i], "cenotaphfrom");
+        char *from_value = (char*)slapi_entry_attr_get_ref(entries[i], "cenotaphfrom");
         if (from_value) {
             is_cenotaph = 1;
             from_csn = csn_new_by_string(from_value);
-            to_value = slapi_entry_attr_get_charptr(entries[i], "cenotaphto");
+            to_value = (char*)slapi_entry_attr_get_ref(entries[i], "cenotaphto");
             to_csn = csn_new_by_string(to_value);
-            slapi_ch_free_string(&from_value);
         } else {
             is_cenotaph = 0;
             from_csn = csn_dup(entry_get_dncsn(entries[i]));
-            to_value = slapi_entry_attr_get_charptr(entries[i], "nstombstonecsn");
+            to_value = (char*)slapi_entry_attr_get_ref(entries[i], "nstombstonecsn");
             to_csn = csn_new_by_string(to_value);
         }
         if (csn_compare(from_csn, opcsn) < 0 &&
@@ -1452,7 +1449,6 @@ urp_add_check_tombstone (Slapi_PBlock *pb, char *sessionid, Slapi_Entry *entry, 
             slapi_sdn_free(&conflict_sdn);
             rc = 2;
         }
-        slapi_ch_free_string(&to_value);
         csn_free(&from_csn);
         csn_free(&to_csn);
 
@@ -1477,7 +1473,7 @@ urp_delete_check_conflict (char *sessionid, Slapi_Entry *tombstone_entry, CSN *o
     Slapi_PBlock *newpb = NULL;
     Slapi_Entry **entries = NULL;
     Slapi_Entry *conflict_e = NULL;
-    char *validdn = slapi_entry_attr_get_charptr(tombstone_entry, "nscpentrydn");
+    char *validdn = (char*)slapi_entry_attr_get_ref(tombstone_entry, "nscpentrydn");
     char *parent_dn = slapi_dn_parent (validdn);
 
     filter = slapi_filter_sprintf("(&(objectclass=ldapsubentry)(%s=%s (ADD) %s%s))", ATTR_NSDS5_REPLCONFLICT, REASON_ANNOTATE_DN,
@@ -1514,7 +1510,6 @@ done:
         PR_smprintf_free(filter);
     }
 
-    slapi_ch_free_string(&validdn);
     slapi_ch_free_string(&parent_dn);
     return rc;
 }
@@ -1573,9 +1568,9 @@ urp_find_tombstone_for_glue (Slapi_PBlock *pb, char *sessionid, const Slapi_Entr
     Slapi_Entry **entries = NULL;
     Slapi_PBlock *newpb;
     const char *basedn = slapi_sdn_get_dn(parentdn);
-    char *conflict_csnstr = slapi_entry_attr_get_charptr(entry, "conflictcsn");
+
+    char *conflict_csnstr = (char*)slapi_entry_attr_get_ref((Slapi_Entry *)entry, "conflictcsn");
     CSN *conflict_csn = csn_new_by_string(conflict_csnstr);
-    slapi_ch_free_string(&conflict_csnstr);
     CSN *tombstone_csn = NULL;
 
     char *filter = slapi_filter_sprintf("(&(objectclass=nstombstone)(nscpentrydn=%s))", basedn);
@@ -1600,11 +1595,10 @@ urp_find_tombstone_for_glue (Slapi_PBlock *pb, char *sessionid, const Slapi_Entr
         goto done;
     }
     for (int i = 0; entries && (entries[i] != NULL); i++) {
-        char *tombstone_csn_value = slapi_entry_attr_get_charptr(entries[i], "nstombstonecsn");
+        char *tombstone_csn_value = (char*)slapi_entry_attr_get_ref(entries[i], "nstombstonecsn");
         if (tombstone_csn_value) {
             csn_free(&tombstone_csn);
             tombstone_csn = csn_new_by_string(tombstone_csn_value);
-            slapi_ch_free_string(&tombstone_csn_value);
             if( csn_compare(tombstone_csn, conflict_csn) > 0 ) {
                 slapi_log_err(SLAPI_LOG_REPL, sessionid,
                                "urp_find_tombstone_for_glue - found tombstone newer than conflict (%s).\n",
@@ -2075,28 +2069,26 @@ static int
 is_deleted_at_csn(const Slapi_Entry *entry, CSN *opcsn)
 {
     int rc = 0;
-    char *tombstone_csnstr = slapi_entry_attr_get_charptr(entry, "nstombstonecsn" );
+    char *tombstone_csnstr = (char*)slapi_entry_attr_get_ref((Slapi_Entry *)entry, "nstombstonecsn");
     CSN *tombstone_csn = csn_new_by_string(tombstone_csnstr);
 
     if (csn_compare (tombstone_csn, opcsn) == 0) rc = 1;
 
-    slapi_ch_free_string(&tombstone_csnstr);
     csn_free(&tombstone_csn);
 
     return rc;
 }
+
 int
 is_conflict_entry(const Slapi_Entry *entry)
 {
     int is_conflict = 0;
-    char *replconflict = slapi_entry_attr_get_charptr(entry,ATTR_NSDS5_REPLCONFLICT );
-    if (replconflict) {
+    if (slapi_entry_attr_get_ref((Slapi_Entry *)entry, ATTR_NSDS5_REPLCONFLICT)) {
         is_conflict = 1;
-        slapi_ch_free_string(&replconflict);
     }
-
     return is_conflict;
 }
+
 static int
 is_renamed_entry(Slapi_PBlock *pb, Slapi_Entry *entry, CSN *opcsn)
 {
diff --git a/ldap/servers/plugins/replication/urp_tombstone.c b/ldap/servers/plugins/replication/urp_tombstone.c
index 4e96275..23b6f49 100644
--- a/ldap/servers/plugins/replication/urp_tombstone.c
+++ b/ldap/servers/plugins/replication/urp_tombstone.c
@@ -54,7 +54,7 @@ get_tombstone_csn(const Slapi_Entry *entry, const CSN **delcsn)
 static Slapi_DN *
 get_valid_parent_for_conflict(Slapi_Entry *entry)
 {
-    char *replconflict = slapi_entry_attr_get_charptr(entry, ATTR_NSDS5_REPLCONFLICT);
+    const char *replconflict = slapi_entry_attr_get_ref(entry, ATTR_NSDS5_REPLCONFLICT);
     char *validdn = NULL;
     Slapi_DN *valid_DN = NULL;
 
@@ -67,7 +67,6 @@ get_valid_parent_for_conflict(Slapi_Entry *entry)
                           "get_valid_parent_for_conflict - valid entry dn: %s\n",
                           validdn);
         }
-        slapi_ch_free_string(&replconflict);
     }
     return valid_DN;
 }
@@ -207,7 +206,7 @@ conflict_to_tombstone(char *sessionid, Slapi_Entry *entry, CSN *opcsn)
     const char *uniqueid = slapi_entry_get_uniqueid(entry);
     const char *newrdn = NULL;
     char *conflictdn = NULL;
-    char *replconflict = slapi_entry_attr_get_charptr(entry, ATTR_NSDS5_REPLCONFLICT);
+    const char *replconflict = slapi_entry_attr_get_ref(entry, ATTR_NSDS5_REPLCONFLICT);
 
     if (replconflict) {
         conflictdn = strstr(replconflict, " (ADD) ");
@@ -237,7 +236,6 @@ conflict_to_tombstone(char *sessionid, Slapi_Entry *entry, CSN *opcsn)
     op_result = urp_fixup_delete_entry(uniqueid, slapi_entry_get_dn_const(entry), opcsn, 0);
 
 done:
-    slapi_ch_free_string(&replconflict);
     slapi_rdn_free(&srdn);
     return op_result;
 }
@@ -258,9 +256,9 @@ tombstone_to_conflict(
     Slapi_Mods smods;
     char csnstr[CSN_STRSIZE + 1];
     char buf[BUFSIZ];
-    char *uniqueid = slapi_entry_attr_get_charptr(tombstoneentry, "nsuiqueid");
-    char *entrydn = slapi_entry_attr_get_charptr(tombstoneentry, "nscpentrydn");
-    char *parentuniqueid = slapi_entry_attr_get_charptr(tombstoneentry, SLAPI_ATTR_VALUE_PARENT_UNIQUEID); /* Allocated */
+
+    const char *uniqueid = slapi_entry_attr_get_ref(tombstoneentry, "nsuiqueid");
+    const char *entrydn = slapi_entry_attr_get_ref(tombstoneentry, "nscpentrydn");
     char *parentdn = slapi_dn_parent(slapi_sdn_get_ndn(conflictdn));
     const CSN *dncsn = entry_get_dncsn(tombstoneentry);
     csn_as_string(dncsn, PR_FALSE, csnstr);
@@ -293,16 +291,9 @@ tombstone_to_conflict(
         /* the objectclass was already present */
         op_result = LDAP_SUCCESS;
     }
-/* this will go to postop
-	if (op_result == LDAP_SUCCESS) {
-		op_result = tombstone_to_conflict_check_parent(sessionid, parentdn, uniqueid, parentuniqueid, opcsn, conflictdn);
-	}
-	*/
+
 done:
-    slapi_ch_free_string(&uniqueid);
-    slapi_ch_free_string(&parentuniqueid);
     slapi_ch_free_string(&parentdn);
-    slapi_ch_free_string(&entrydn);
     return op_result;
 }
 
@@ -320,7 +311,7 @@ tombstone_to_glue(
     Slapi_DN **newparentdn)
 {
     Slapi_DN *parentdn;
-    char *parentuniqueid;
+    const char *parentuniqueid;
     const char *tombstoneuniqueid;
     Slapi_Entry *addingentry = NULL;
     Slapi_Entry *addingentry_bakup = NULL;
@@ -340,7 +331,7 @@ tombstone_to_glue(
      * which won't help us identify the correct backend to search.
      */
     is_suffix_dn_ext(pb, gluedn, &parentdn, 1 /* is_tombstone */);
-    parentuniqueid = slapi_entry_attr_get_charptr(tombstoneentry, SLAPI_ATTR_VALUE_PARENT_UNIQUEID); /* Allocated */
+    parentuniqueid = slapi_entry_attr_get_ref(tombstoneentry, SLAPI_ATTR_VALUE_PARENT_UNIQUEID);
     tombstone_to_glue_resolve_parent(pb, sessionid, parentdn, parentuniqueid, opcsn, newparentdn);
 
     /* Submit an Add operation to turn the tombstone entry into glue. */
@@ -407,7 +398,6 @@ tombstone_to_glue(
         }
     }
     slapi_entry_free(addingentry_bakup);
-    slapi_ch_free_string(&parentuniqueid);
     if (op_result == LDAP_SUCCESS) {
         slapi_log_err(/*slapi_log_urp*/ SLAPI_LOG_ERR, repl_plugin_name,
                       "tombstone_to_glue - %s - Resurrected tombstone %s to glue reason '%s'\n", sessionid, addingdn, reason);
diff --git a/ldap/servers/plugins/replication/windows_private.c b/ldap/servers/plugins/replication/windows_private.c
index 4e05f0b..e5219e0 100644
--- a/ldap/servers/plugins/replication/windows_private.c
+++ b/ldap/servers/plugins/replication/windows_private.c
@@ -116,12 +116,11 @@ check_update_allowed(Repl_Agmt *ra, const char *type, Slapi_Entry *e, int *retva
         int ii = 0;
         while (get_next_disallow_attr_type(&ii, &distype)) {
             if (slapi_attr_types_equivalent(type, distype)) {
-                char *tmpstr = slapi_entry_attr_get_charptr(e, type);
+                const char *tmpstr = slapi_entry_attr_get_ref(e, type);
                 slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name,
                               "windows_parse_config_entry: setting %s to %s will be "
                               "deferred until current update is completed\n",
                               type, tmpstr);
-                slapi_ch_free_string(&tmpstr);
                 rc = 0;
                 break;
             }
@@ -160,13 +159,12 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         retval = 1;
     }
     if (type == NULL || slapi_attr_types_equivalent(type, type_nsds7CreateNewUsers)) {
-        tmpstr = slapi_entry_attr_get_charptr(e, type_nsds7CreateNewUsers);
+        tmpstr = (char *)slapi_entry_attr_get_ref(e, type_nsds7CreateNewUsers);
         if (NULL != tmpstr && true_value_from_string(tmpstr)) {
             windows_private_set_create_users(ra, PR_TRUE);
         } else {
             windows_private_set_create_users(ra, PR_FALSE);
         }
-        slapi_ch_free((void **)&tmpstr);
         /* If protocol is NULL; the agreement is not started yet.
          * So, no need to notify. */
         if (agmt_get_protocol(ra)) {
@@ -175,13 +173,12 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         retval = 1;
     }
     if (type == NULL || slapi_attr_types_equivalent(type, type_nsds7CreateNewGroups)) {
-        tmpstr = slapi_entry_attr_get_charptr(e, type_nsds7CreateNewGroups);
+        tmpstr = (char *)slapi_entry_attr_get_ref(e, type_nsds7CreateNewGroups);
         if (NULL != tmpstr && true_value_from_string(tmpstr)) {
             windows_private_set_create_groups(ra, PR_TRUE);
         } else {
             windows_private_set_create_groups(ra, PR_FALSE);
         }
-        slapi_ch_free((void **)&tmpstr);
         /* If protocol is NULL; the agreement is not started yet.
          * So, no need to notify. */
         if (agmt_get_protocol(ra)) {
@@ -199,7 +196,7 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         retval = 1;
     }
     if (type == NULL || slapi_attr_types_equivalent(type, type_winSyncInterval)) {
-        tmpstr = slapi_entry_attr_get_charptr(e, type_winSyncInterval);
+        tmpstr = (char *)slapi_entry_attr_get_ref(e, type_winSyncInterval);
         if (NULL != tmpstr) {
             windows_private_set_sync_interval(ra, tmpstr);
             /* If protocol is NULL; the agreement is not started yet.
@@ -208,11 +205,10 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
                 prot_notify_agmt_changed(agmt_get_protocol(ra), (char *)agmt_get_long_name(ra));
             }
         }
-        slapi_ch_free_string(&tmpstr);
         retval = 1;
     }
     if (type == NULL || slapi_attr_types_equivalent(type, type_oneWaySync)) {
-        tmpstr = slapi_entry_attr_get_charptr(e, type_oneWaySync);
+        tmpstr = (char *)slapi_entry_attr_get_ref(e, type_oneWaySync);
         if (NULL != tmpstr) {
             if (strcasecmp(tmpstr, "fromWindows") == 0) {
                 windows_private_set_one_way(ra, ONE_WAY_SYNC_FROM_AD);
@@ -229,7 +225,6 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         } else {
             windows_private_set_one_way(ra, ONE_WAY_SYNC_DISABLED);
         }
-        slapi_ch_free((void **)&tmpstr);
         /* If protocol is NULL; the agreement is not started yet.
          * So, no need to notify. */
         if (agmt_get_protocol(ra)) {
@@ -238,7 +233,7 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         retval = 1;
     }
     if (type == NULL || slapi_attr_types_equivalent(type, type_winsyncMoveAction)) {
-        tmpstr = slapi_entry_attr_get_charptr(e, type_winsyncMoveAction);
+        tmpstr = (char *)slapi_entry_attr_get_ref(e, type_winsyncMoveAction);
         if (NULL != tmpstr) {
             if (strcasecmp(tmpstr, "delete") == 0) {
                 windows_private_set_move_action(ra, MOVE_DOES_DELETE);
@@ -257,7 +252,6 @@ windows_parse_config_entry(Repl_Agmt *ra, const char *type, Slapi_Entry *e)
         } else {
             windows_private_set_move_action(ra, MOVE_DOES_NOTHING);
         }
-        slapi_ch_free((void **)&tmpstr);
         /* If protocol is NULL; the agreement is not started yet.
          * So, no need to notify. */
         if (agmt_get_protocol(ra)) {
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index e354372..0ee737f 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -764,7 +764,7 @@ send_password_modify(Slapi_DN *sdn,
                             /* Get the local entry if it exists */
                             rc = windows_get_local_entry(local_sdn, &local_entry);
                             if ((0 == rc) && local_entry) {
-                                expiration_val = (char *)slapi_fetch_attr(local_entry, "passwordExpirationtime", NULL);
+                                expiration_val = (char *)slapi_entry_attr_get_ref(local_entry, "passwordExpirationtime");
                                 if (expiration_val && parse_genTime(expiration_val) != NO_TIME){
                                     /* The user did reset their password */
                                     slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name,
@@ -1129,9 +1129,9 @@ process_replay_add(Private_Repl_Protocol *prp, Slapi_Entry *add_entry, Slapi_Ent
             map_windows_tombstone_dn(local_entry, &tombstone_dn, prp, &tstone_exists);
 
             /* We can't use a GUID DN, so rewrite to the new mapped DN. */
-            cn_string = slapi_entry_attr_get_charptr(local_entry, "cn");
+            cn_string = (char *)slapi_entry_attr_get_ref(local_entry, "cn");
             if (!cn_string) {
-                cn_string = slapi_entry_attr_get_charptr(local_entry, "ntuserdomainid");
+                cn_string = (char *)slapi_entry_attr_get_ref(local_entry, "ntuserdomainid");
             }
 
             if (cn_string) {
@@ -1196,8 +1196,6 @@ process_replay_add(Private_Repl_Protocol *prp, Slapi_Entry *add_entry, Slapi_Ent
                     /* This remote_dn is freed by the caller. */
                     slapi_sdn_set_normdn_passin(remote_dn, new_dn_string);
                 }
-
-                slapi_ch_free_string(&cn_string);
                 slapi_ch_free_string(&container_str);
             }
 
@@ -1404,7 +1402,7 @@ process_replay_rename(Private_Repl_Protocol *prp,
         /* Newrdn remains the same when this function is called,
          * as RDN on AD is CN type. If CN in RDN is modified remotely,
          * is taken care in modify not in modrdn locally. */
-        remote_rdn_val = slapi_entry_attr_get_charptr(local_newentry, "cn");
+        remote_rdn_val = (char *)slapi_entry_attr_get_ref(local_newentry, "cn");
         if (NULL == remote_rdn_val) {
             slapi_log_err(SLAPI_LOG_ERR, windows_repl_plugin_name,
                           "process_replay_rename - local entry \"%s\" has no "
@@ -1484,7 +1482,6 @@ process_replay_rename(Private_Repl_Protocol *prp,
     }
 bail:
     slapi_ch_free_string(&norm_newparent);
-    slapi_ch_free_string(&remote_rdn_val);
     slapi_ch_free_string(&remote_rdn);
     slapi_ch_free_string(&remote_dn);
     slapi_ch_free_string(&local_pndn);
@@ -2694,12 +2691,11 @@ done:
          * new RDN from this operation.  We fetch the first value from the local
          * entry to create the new RDN. */
         if (local_entry) {
-            char *newval = slapi_entry_attr_get_charptr(local_entry, "cn");
+            const char *newval = slapi_entry_attr_get_ref(local_entry, "cn");
             if (newval) {
                 /* Fill in new RDN to return to caller. */
                 slapi_ch_free_string(newrdn);
                 *newrdn = slapi_ch_smprintf("cn=%s", newval);
-                slapi_ch_free_string(&newval);
                 ret = 1;
             }
         }
@@ -3425,7 +3421,7 @@ static int
 map_windows_tombstone_dn(Slapi_Entry *e, Slapi_DN **dn, Private_Repl_Protocol *prp, int *exists)
 {
     int rc = 0;
-    char *cn = NULL;
+    const char *cn = NULL;
     char *guid = NULL;
     const char *suffix = NULL;
     char *tombstone_dn = NULL;
@@ -3441,12 +3437,12 @@ map_windows_tombstone_dn(Slapi_Entry *e, Slapi_DN **dn, Private_Repl_Protocol *p
     *dn = NULL;
     *exists = 0;
 
-    cn = slapi_entry_attr_get_charptr(e, "cn");
+    cn = slapi_entry_attr_get_ref(e, "cn");
     if (!cn) {
-        cn = slapi_entry_attr_get_charptr(e, "ntuserdomainid");
+        cn = slapi_entry_attr_get_ref(e, "ntuserdomainid");
     }
 
-    guid = slapi_entry_attr_get_charptr(e, "ntUniqueId");
+    guid = (char *)slapi_entry_attr_get_ref(e, "ntUniqueId");
     if (guid) {
         /* the GUID is in a different form in the tombstone DN, so
          * we need to transform it from the way we store it. */
@@ -3483,8 +3479,6 @@ map_windows_tombstone_dn(Slapi_Entry *e, Slapi_DN **dn, Private_Repl_Protocol *p
         rc = 1;
     }
 
-    slapi_ch_free_string(&cn);
-    slapi_ch_free_string(&guid);
     return rc;
 }
 
@@ -3679,7 +3673,7 @@ map_entry_dn_outbound(Slapi_Entry *e,
         return -1;
     }
 
-    guid = slapi_entry_attr_get_charptr(e, "ntUniqueId");
+    guid = (char *)slapi_entry_attr_get_ref(e, "ntUniqueId");
     slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name,
                   "map_entry_dn_outbound - %s - Looking for AD entry for DS "
                   "dn=\"%s\" guid=\"%s\"\n",
@@ -3726,12 +3720,12 @@ map_entry_dn_outbound(Slapi_Entry *e,
             *missing_entry = 1;
             if (!windows_private_get_iswin2k3(prp->agmt)) {
                 char *new_dn_string = NULL;
-                char *cn_string = NULL;
+                const char *cn_string = NULL;
 
                 /* We can't use a GUID DN, so rewrite to the mapped DN. */
-                cn_string = slapi_entry_attr_get_charptr(e, "cn");
+                cn_string = slapi_entry_attr_get_ref(e, "cn");
                 if (!cn_string) {
-                    cn_string = slapi_entry_attr_get_charptr(e, "ntuserdomainid");
+                    cn_string = slapi_entry_attr_get_ref(e, "ntuserdomainid");
                 }
 
                 if (cn_string) {
@@ -3751,14 +3745,13 @@ map_entry_dn_outbound(Slapi_Entry *e,
                         slapi_sdn_set_normdn_passin(new_dn, new_dn_string);
                     }
 
-                    slapi_ch_free_string(&cn_string);
                     slapi_ch_free_string(&container_str);
                 }
             }
         }
     } else {
         /* No GUID found, try ntUserDomainId */
-        char *username = slapi_entry_attr_get_charptr(e, "ntUserDomainId");
+        const char *username = (char *)slapi_entry_attr_get_ref(e, "ntuserdomainid");
         slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name,
                       "map_entry_dn_outbound - %s - Looking for AD entry for DS "
                       "dn=\"%s\" username=\"%s\"\n",
@@ -3791,11 +3784,11 @@ map_entry_dn_outbound(Slapi_Entry *e,
                         cn=<ntuserdomainid attribute value>, ... in the case that the local entry doesn't have a CN
                      */
                     if (is_nt4) {
-                        cn_string = slapi_entry_attr_get_charptr(e, "ntuserdomainid");
+                        cn_string = (char *)slapi_entry_attr_get_ref(e, "ntuserdomainid");
                     } else {
-                        cn_string = slapi_entry_attr_get_charptr(e, "cn");
+                        cn_string = (char *)slapi_entry_attr_get_ref(e, "cn");
                         if (!cn_string) {
-                            cn_string = slapi_entry_attr_get_charptr(e, "ntuserdomainid");
+                            cn_string = (char *)slapi_entry_attr_get_ref(e, "ntuserdomainid");
                         }
                     }
                     if (cn_string) {
@@ -3816,7 +3809,6 @@ map_entry_dn_outbound(Slapi_Entry *e,
                             /* new_dn_string is normalized. we could pass it in as normdn. */
                             new_dn = slapi_sdn_new_normdn_passin(new_dn_string);
                         }
-                        slapi_ch_free_string(&cn_string);
                         slapi_ch_free_string(&container_str);
                     }
                 } else {
@@ -3828,7 +3820,6 @@ map_entry_dn_outbound(Slapi_Entry *e,
                     retval = -1;
                 }
             }
-            slapi_ch_free_string(&username);
         }
     }
 done:
@@ -3847,7 +3838,7 @@ done:
     } else {
         slapi_entry_free(remote_entry);
     }
-    slapi_ch_free_string(&guid);
+
     return retval;
 }
 
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
index ab38b7c..4af4d75 100644
--- a/ldap/servers/plugins/retrocl/retrocl.c
+++ b/ldap/servers/plugins/retrocl/retrocl.c
@@ -103,7 +103,7 @@ retrocl_postop_init(Slapi_PBlock *pb)
 {
     int rc = 0; /* OK */
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int postadd = SLAPI_PLUGIN_POST_ADD_FN;
     int postmod = SLAPI_PLUGIN_POST_MODIFY_FN;
     int postmdn = SLAPI_PLUGIN_POST_MODRDN_FN;
@@ -111,14 +111,13 @@ retrocl_postop_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         postadd = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
         postmod = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
         postmdn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
         postdel = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01) != 0 ||
         slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&retroclpostopdesc) != 0 ||
diff --git a/ldap/servers/plugins/roles/roles_cache.c b/ldap/servers/plugins/roles/roles_cache.c
index 4e3b0af..15af6a2 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -1154,7 +1154,7 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
         char *parent = NULL;
 
         /* Get the filter and retrieve the filter attribute */
-        filter_attr_value = slapi_entry_attr_get_charptr(role_entry, ROLE_FILTER_ATTR_NAME);
+        filter_attr_value = (char *)slapi_entry_attr_get_ref(role_entry, ROLE_FILTER_ATTR_NAME);
         if (filter_attr_value == NULL) {
             /* Means probably no attribute or no value there */
             slapi_ch_free((void **)&this_role);
@@ -1196,7 +1196,6 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
                               (char *)slapi_sdn_get_ndn(this_role->dn),
                               ROLE_FILTER_ATTR_NAME, filter_attr_value,
                               ROLE_FILTER_ATTR_NAME);
-                slapi_ch_free_string(&filter_attr_value);
                 slapi_ch_free((void **)&this_role);
                 return SLAPI_ROLE_ERROR_FILTER_BAD;
             }
@@ -1209,7 +1208,6 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
         if (filter == NULL) {
             /* An error has occured */
             slapi_ch_free((void **)&this_role);
-            slapi_ch_free_string(&filter_attr_value);
             return SLAPI_ROLE_ERROR_FILTER_BAD;
         }
         if (roles_check_filter(filter)) {
@@ -1220,12 +1218,10 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
                           filter_attr_value,
                           ROLE_FILTER_ATTR_NAME);
             slapi_ch_free((void **)&this_role);
-            slapi_ch_free_string(&filter_attr_value);
             return SLAPI_ROLE_ERROR_FILTER_BAD;
         }
         /* Store on the object */
         this_role->filter = filter;
-        slapi_ch_free_string(&filter_attr_value);
 
         break;
     }
diff --git a/ldap/servers/plugins/roles/roles_plugin.c b/ldap/servers/plugins/roles/roles_plugin.c
index 2b59fcc..5e9fa08 100644
--- a/ldap/servers/plugins/roles/roles_plugin.c
+++ b/ldap/servers/plugins/roles/roles_plugin.c
@@ -45,7 +45,7 @@ roles_postop_init(Slapi_PBlock *pb)
 {
     int rc = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int postadd = SLAPI_PLUGIN_POST_ADD_FN;
     int postmod = SLAPI_PLUGIN_POST_MODIFY_FN;
     int postmdn = SLAPI_PLUGIN_POST_MODRDN_FN;
@@ -53,14 +53,13 @@ roles_postop_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         postadd = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
         postmod = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
         postmdn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
         postdel = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
                          SLAPI_PLUGIN_VERSION_01) != 0 ||
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 1cb9997..2f84aea 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -212,8 +212,8 @@ rootdn_load_config(Slapi_PBlock *pb)
     char **hosts_to_deny_tmp = NULL;
     char **ips_tmp = NULL;
     char **ips_to_deny_tmp = NULL;
-    char *openTime = NULL;
-    char *closeTime = NULL;
+    const char *openTime = NULL;
+    const char *closeTime = NULL;
     char *token, *iter = NULL, *copy;
     char hour[3], min[3];
     size_t end;
@@ -227,8 +227,8 @@ rootdn_load_config(Slapi_PBlock *pb)
         /*
          *  Grab our plugin settings
          */
-        openTime = slapi_entry_attr_get_charptr(e, "rootdn-open-time");
-        closeTime = slapi_entry_attr_get_charptr(e, "rootdn-close-time");
+        openTime = slapi_entry_attr_get_ref(e, "rootdn-open-time");
+        closeTime = slapi_entry_attr_get_ref(e, "rootdn-close-time");
         daysAllowed_tmp = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
         hosts_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
         hosts_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
@@ -331,8 +331,6 @@ rootdn_load_config(Slapi_PBlock *pb)
             /* If you are using TOD access control, you must have a open and close time */
             slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
                                                                   "There must be a open and a close time.  Ignoring time based settings.\n");
-            slapi_ch_free_string(&closeTime);
-            slapi_ch_free_string(&openTime);
             open_time = 0;
             close_time = 0;
             result = -1;
@@ -444,8 +442,6 @@ free_and_return:
         ips = ips_tmp;
         ips_to_deny = ips_to_deny_tmp;
     }
-    slapi_ch_free_string(&openTime);
-    slapi_ch_free_string(&closeTime);
 
     slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "<-- rootdn_load_config (%d)\n", result);
 
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index 00b7821..847323a 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -226,7 +226,7 @@ schemareload_add(Slapi_PBlock *pb,
     char *bind_dn;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -236,7 +236,7 @@ schemareload_add(Slapi_PBlock *pb,
     slapi_pblock_get(pb, SLAPI_REQUESTOR_DN, &bind_dn);
 
     /* get arg(s) */
-    schemadir = slapi_fetch_attr(e, "schemadir", NULL);
+    schemadir = slapi_entry_attr_get_ref(e, "schemadir");
 
     /* allocate new task now */
     task = slapi_plugin_new_task(slapi_entry_get_ndn(e), arg);
diff --git a/ldap/servers/plugins/statechange/statechange.c b/ldap/servers/plugins/statechange/statechange.c
index f89b394..c6a611d 100644
--- a/ldap/servers/plugins/statechange/statechange.c
+++ b/ldap/servers/plugins/statechange/statechange.c
@@ -79,7 +79,7 @@ statechange_init(Slapi_PBlock *pb)
 {
     int ret = SLAPI_PLUGIN_SUCCESS;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int postadd = SLAPI_PLUGIN_POST_ADD_FN;
     int postmod = SLAPI_PLUGIN_POST_MODIFY_FN;
     int postmdn = SLAPI_PLUGIN_POST_MODRDN_FN;
@@ -89,14 +89,13 @@ statechange_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         postadd = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
         postmod = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
         postmdn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
         postdel = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     head = 0;
 
diff --git a/ldap/servers/plugins/sync/sync_util.c b/ldap/servers/plugins/sync/sync_util.c
index 8c2c42d..0ed7d3c 100644
--- a/ldap/servers/plugins/sync/sync_util.c
+++ b/ldap/servers/plugins/sync/sync_util.c
@@ -365,8 +365,8 @@ sync_cookie_get_server_info(Slapi_PBlock *pb __attribute__((unused)))
     int rc = 0;
     Slapi_Entry **entries;
     Slapi_PBlock *srch_pb = NULL;
-    char *host = NULL;
-    char *port = NULL;
+    const char *host = NULL;
+    const char *port = NULL;
     char *server_attrs[] = {"nsslapd-localhost", "nsslapd-port", NULL};
 
     srch_pb = slapi_pblock_new();
@@ -386,14 +386,12 @@ sync_cookie_get_server_info(Slapi_PBlock *pb __attribute__((unused)))
                                                                 "Server configuration missing\n");
             rc = -1;
         } else {
-            host = slapi_entry_attr_get_charptr(entries[0], "nsslapd-localhost");
-            port = slapi_entry_attr_get_charptr(entries[0], "nsslapd-port");
+            host = slapi_entry_attr_get_ref(entries[0], "nsslapd-localhost");
+            port = slapi_entry_attr_get_ref(entries[0], "nsslapd-port");
         }
     }
     info_enc = slapi_ch_smprintf("%s:%s", host ? host : "nohost", port ? port : "noport");
 
-    slapi_ch_free((void **)&host);
-    slapi_ch_free((void **)&port);
     slapi_free_search_results_internal(srch_pb);
     slapi_pblock_destroy(srch_pb);
     return (info_enc);
diff --git a/ldap/servers/plugins/uiduniq/7bit.c b/ldap/servers/plugins/uiduniq/7bit.c
index 60fcbab..ac9a84e 100644
--- a/ldap/servers/plugins/uiduniq/7bit.c
+++ b/ldap/servers/plugins/uiduniq/7bit.c
@@ -717,7 +717,7 @@ NS7bitAttr_Init(Slapi_PBlock *pb)
 {
     int32_t err = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int32_t preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int32_t premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
     int32_t premdn = SLAPI_PLUGIN_PRE_MODRDN_FN;
@@ -736,13 +736,12 @@ NS7bitAttr_Init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
         premod = SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN;
         premdn = SLAPI_PLUGIN_BE_TXN_PRE_MODRDN_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     /*
      * Get and normalize arguments
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index 3ca5985..d7ccf0e 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -1470,7 +1470,7 @@ NSUniqueAttr_Init(Slapi_PBlock *pb)
 {
     int err = 0;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int preadd = SLAPI_PLUGIN_PRE_ADD_FN;
     int premod = SLAPI_PLUGIN_PRE_MODIFY_FN;
     int premdn = SLAPI_PLUGIN_PRE_MODRDN_FN;
@@ -1493,13 +1493,12 @@ NSUniqueAttr_Init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         preadd = SLAPI_PLUGIN_BE_TXN_PRE_ADD_FN;
         premod = SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN;
         premdn = SLAPI_PLUGIN_BE_TXN_PRE_MODRDN_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     /* Provide descriptive information */
     err = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
diff --git a/ldap/servers/plugins/usn/usn.c b/ldap/servers/plugins/usn/usn.c
index b8f197a..12ba040 100644
--- a/ldap/servers/plugins/usn/usn.c
+++ b/ldap/servers/plugins/usn/usn.c
@@ -172,7 +172,7 @@ usn_bepostop_init(Slapi_PBlock *pb)
 {
     int rc = SLAPI_PLUGIN_SUCCESS;
     Slapi_Entry *plugin_entry = NULL;
-    char *plugin_type = NULL;
+    const char *plugin_type = NULL;
     int postadd = SLAPI_PLUGIN_BE_POST_ADD_FN;
     int postmod = SLAPI_PLUGIN_BE_POST_MODIFY_FN;
     int postmdn = SLAPI_PLUGIN_BE_POST_MODRDN_FN;
@@ -180,15 +180,13 @@ usn_bepostop_init(Slapi_PBlock *pb)
 
     if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
         plugin_entry &&
-        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry,
-                                                    "nsslapd-plugintype")) &&
+        (plugin_type = slapi_entry_attr_get_ref(plugin_entry, "nsslapd-plugintype")) &&
         plugin_type && strstr(plugin_type, "betxn")) {
         postadd = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
         postmod = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
         postmdn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
         postdel = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
     }
-    slapi_ch_free_string(&plugin_type);
 
     if ((slapi_pblock_set(pb, postadd, (void *)usn_bepostop) != 0) ||
         (slapi_pblock_set(pb, postdel, (void *)usn_bepostop_delete) != 0) ||
diff --git a/ldap/servers/plugins/usn/usn_cleanup.c b/ldap/servers/plugins/usn/usn_cleanup.c
index 868dfd0..bdb55e6 100644
--- a/ldap/servers/plugins/usn/usn_cleanup.c
+++ b/ldap/servers/plugins/usn/usn_cleanup.c
@@ -237,7 +237,6 @@ usn_cleanup_add(Slapi_PBlock *pb,
                 void *arg)
 {
     PRThread *thread = NULL;
-    char *cn = NULL;
     char *suffix = NULL;
     char *backend = NULL;
     char *maxusn = NULL;
@@ -256,8 +255,7 @@ usn_cleanup_add(Slapi_PBlock *pb,
     /* get the requestor dn */
     slapi_pblock_get(pb, SLAPI_REQUESTOR_DN, &bind_dn);
 
-    cn = slapi_entry_attr_get_charptr(e, "cn");
-    if (NULL == cn) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto bail;
@@ -265,7 +263,7 @@ usn_cleanup_add(Slapi_PBlock *pb,
 
     /* get args */
     suffix = slapi_entry_attr_get_charptr(e, "suffix");
-    backend = slapi_entry_attr_get_charptr(e, "backend");
+    backend = (char *)slapi_entry_attr_get_ref(e, "backend");
     maxusn = slapi_entry_attr_get_charptr(e, "maxusn_to_delete");
 
     if (!suffix && !backend) {
@@ -344,9 +342,7 @@ usn_cleanup_add(Slapi_PBlock *pb,
         rv = SLAPI_DSE_CALLBACK_OK;
     }
 bail:
-    slapi_ch_free_string(&cn);
     slapi_ch_free_string(&suffix);
-    slapi_ch_free_string(&backend);
     slapi_ch_free_string(&maxusn);
     slapi_log_err(SLAPI_LOG_TRACE, USN_PLUGIN_SUBSYSTEM,
                   "<-- usn_cleanup_add\n");
diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c
index 942f225..6eb69e3 100644
--- a/ldap/servers/slapd/add.c
+++ b/ldap/servers/slapd/add.c
@@ -607,12 +607,10 @@ op_shared_add(Slapi_PBlock *pb)
                 slapi_ch_free_string(&test_str);
             }
 #if defined(USE_OLD_UNHASHED)
-            test_str = slapi_entry_attr_get_charptr(e,
-                                                    PSEUDO_ATTR_UNHASHEDUSERPASSWORD);
+            test_str = (char *)slapi_entry_attr_get_ref(e, PSEUDO_ATTR_UNHASHEDUSERPASSWORD);
             if (test_str) {
                 slapi_log_err(SLAPI_LOG_ERR, "op_shared_add",
                               "Value from attr: %s\n", test_str);
-                slapi_ch_free_string(&test_str);
             }
 #endif /* USE_OLD_UNHASHED */
         }
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index 2a7529b..8dcc675 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -407,10 +407,9 @@ index_addordel_entry(
         /*
          * add the entryusn to the list of indexed attributes, even if it's a tombstone
          */
-        entryusn_str = slapi_entry_attr_get_charptr(e->ep_entry, SLAPI_ATTR_ENTRYUSN);
+        entryusn_str = (char *)slapi_entry_attr_get_ref(e->ep_entry, SLAPI_ATTR_ENTRYUSN);
         if (entryusn_str != NULL) {
             result = index_addordel_string(be, SLAPI_ATTR_ENTRYUSN, entryusn_str, e->ep_id, flags, txn);
-            slapi_ch_free_string(&entryusn_str);
             if (result != 0) {
                 ldbm_nasty("index_addordel_entry", errmsg, 1021, result);
                 return result;
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c
index a258557..93370b7 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c
@@ -573,14 +573,13 @@ ldbm_back_add(Slapi_PBlock *pb)
                 }
 
                 /* And copy the reason from e */
-                reason = slapi_entry_attr_get_charptr(e, "nsds5ReplConflict");
+                reason = (char *)slapi_entry_attr_get_ref(e, "nsds5ReplConflict");
                 if (reason) {
                     if (!slapi_entry_attr_hasvalue(addingentry->ep_entry, "nsds5ReplConflict", reason)) {
                         slapi_entry_add_string(addingentry->ep_entry, "nsds5ReplConflict", reason);
                         slapi_log_err(SLAPI_LOG_REPL, "ldbm_back_add", "Resurrection of %s - Added Conflict reason %s\n",
                                       dn, reason);
                     }
-                    slapi_ch_free((void **)&reason);
                 }
                 /* Clear the Tombstone Flag in the entry */
                 slapi_entry_clear_flag(addingentry->ep_entry, SLAPI_ENTRY_FLAG_TOMBSTONE);
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
index cdf337b..b42ec9e 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
@@ -120,29 +120,25 @@ attrcrypt_get_ssl_cert_name(char **cert_name)
 {
     char *config_entry_dn = "cn=RSA,cn=encryption,cn=config";
     Slapi_Entry *config_entry = NULL;
-    char *personality = NULL;
-    char *token = NULL;
+    const char *personality = NULL;
+    const char *token = NULL;
 
     *cert_name = NULL;
     getConfigEntry(config_entry_dn, &config_entry);
     if (NULL == config_entry) {
         return -1;
     }
-    token = slapi_entry_attr_get_charptr(config_entry, "nsssltoken");
-    personality =
-        slapi_entry_attr_get_charptr(config_entry, "nssslpersonalityssl");
+    token = slapi_entry_attr_get_ref(config_entry, "nsssltoken");
+    personality = slapi_entry_attr_get_ref(config_entry, "nssslpersonalityssl");
     if (token && personality) {
         if (!strcasecmp(token, "internal") ||
             !strcasecmp(token, "internal (software)")) {
-            *cert_name = personality;
-            personality = NULL; /* do not free below */
+            *cert_name = slapi_ch_strdup(personality);
         } else {
             /* external PKCS #11 token - attach token name */
             *cert_name = slapi_ch_smprintf("%s:%s", token, personality);
         }
     }
-    slapi_ch_free_string(&personality);
-    slapi_ch_free_string(&token);
     freeConfigEntry(&config_entry);
     return 0;
 }
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_delete.c b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
index 76e37ae..873b5b0 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_delete.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
@@ -504,7 +504,7 @@ replace_entry:
             slapi_sdn_get_backend_parent_ext(sdnp, &parentsdn, be, is_tombstone_entry);
             if (!slapi_sdn_isempty(&parentsdn)) {
                 struct backentry *parent = NULL;
-                char *pid_str = slapi_entry_attr_get_charptr(e->ep_entry, LDBM_PARENTID_STR);
+                char *pid_str = (char *)slapi_entry_attr_get_ref(e->ep_entry, LDBM_PARENTID_STR);
                 if (pid_str) {
                     /* First, try to get the direct parent. */
                     /*
@@ -518,7 +518,6 @@ replace_entry:
                     int cache_retry = 0;
 
                     pid = (ID)strtol(pid_str, (char **)NULL, 10);
-                    slapi_ch_free_string(&pid_str);
 
                     /*
                      * Its possible that the parent entry retrieved from the cache in id2entry
@@ -907,12 +906,10 @@ replace_entry:
                 goto error_return;
             }
             /* add a new usn to the entryusn index */
-            entryusn_str = slapi_entry_attr_get_charptr(tombstone->ep_entry,
-                                                        SLAPI_ATTR_ENTRYUSN);
+            entryusn_str = (char *)slapi_entry_attr_get_ref(tombstone->ep_entry, SLAPI_ATTR_ENTRYUSN);
             if (entryusn_str) {
                 retval = index_addordel_string(be, SLAPI_ATTR_ENTRYUSN,
                                                entryusn_str, tombstone->ep_id, BE_INDEX_ADD, &txn);
-                slapi_ch_free_string(&entryusn_str);
                 if (DB_LOCK_DEADLOCK == retval) {
                     slapi_log_err(SLAPI_LOG_BACKLDBM,
                                   "ldbm_back_delete", "(adding %s) DB_LOCK_DEADLOCK\n",
@@ -1078,13 +1075,10 @@ replace_entry:
                               LDAP_OPERATIONS_ERROR, retry_count);
                 goto error_return;
             }
-
-            nscpedn = slapi_entry_attr_get_charptr(e->ep_entry,
-                                                   SLAPI_ATTR_NSCP_ENTRYDN);
+            nscpedn = (char *)slapi_entry_attr_get_ref(e->ep_entry, SLAPI_ATTR_NSCP_ENTRYDN);
             if (nscpedn) {
                 retval = index_addordel_string(be, SLAPI_ATTR_NSCP_ENTRYDN,
                                                nscpedn, e->ep_id, BE_INDEX_DEL | BE_INDEX_EQUALITY, &txn);
-                slapi_ch_free((void **)&nscpedn);
                 if (DB_LOCK_DEADLOCK == retval) {
                     slapi_log_err(SLAPI_LOG_BACKLDBM,
                                   "ldbm_back_delete", "(deleting %s) 2 DB_LOCK_DEADLOCK\n",
@@ -1105,13 +1099,11 @@ replace_entry:
                 }
             }
             /* delete usn from the entryusn index */
-            entryusn_str = slapi_entry_attr_get_charptr(e->ep_entry,
-                                                        SLAPI_ATTR_ENTRYUSN);
+            entryusn_str = (char *)slapi_entry_attr_get_ref(e->ep_entry, SLAPI_ATTR_ENTRYUSN);
             if (entryusn_str) {
                 retval = index_addordel_string(be, SLAPI_ATTR_ENTRYUSN,
                                                entryusn_str, e->ep_id,
                                                BE_INDEX_DEL | BE_INDEX_EQUALITY, &txn);
-                slapi_ch_free_string(&entryusn_str);
                 if (DB_LOCK_DEADLOCK == retval) {
                     slapi_log_err(SLAPI_LOG_BACKLDBM,
                                   "ldbm_back_delete", "(deleting %s) 3 DB_LOCK_DEADLOCK\n",
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
index 95e76c8..b535192 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
@@ -358,7 +358,7 @@ ldbm_instance_index_config_enable_index(ldbm_instance *inst, Slapi_Entry *e)
     int rc = LDAP_SUCCESS;
     struct attrinfo *ai = NULL;
 
-    index_name = slapi_entry_attr_get_charptr(e, "cn");
+    index_name = (char *)slapi_entry_attr_get_ref(e, "cn");
     if (index_name) {
         ainfo_get(inst->inst_be, index_name, &ai);
     }
@@ -373,7 +373,6 @@ ldbm_instance_index_config_enable_index(ldbm_instance *inst, Slapi_Entry *e)
         PR_ASSERT(ai != NULL);
         ai->ai_indexmask &= ~INDEX_OFFLINE;
     }
-    slapi_ch_free_string(&index_name);
     return rc;
 }
 
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index fb0fc5d..a684b3e 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -1049,8 +1049,7 @@ export_one_entry(struct ldbminfo *li,
      * If it is not, put "{CLEAR}" in front of the password value.
      */
     {
-        char *pw = slapi_entry_attr_get_charptr(expargs->ep->ep_entry,
-                                                "userpassword");
+        char *pw = (char *)slapi_entry_attr_get_ref(expargs->ep->ep_entry, "userpassword");
         if (pw && !slapi_is_encoded(pw)) {
             /* clear password does not have {CLEAR} storage scheme */
             struct berval *vals[2];
@@ -1068,7 +1067,6 @@ export_one_entry(struct ldbminfo *li,
             }
             slapi_ch_free_string(&val.bv_val);
         }
-        slapi_ch_free_string(&pw);
     }
     data.data = slapi_entry2str_with_options(expargs->ep->ep_entry,
                                              &len, expargs->options);
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index f439182..32030a2 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -89,7 +89,7 @@ vlv_AddIndexEntry(Slapi_PBlock *pb __attribute__((unused)),
     slapi_rwlock_wrlock(be->vlvSearchList_lock);
     parent = vlvSearch_finddn((struct vlvSearch *)be->vlvSearchList, &parentdn);
     if (parent != NULL) {
-        char *name = slapi_entry_attr_get_charptr(entryBefore, type_vlvName);
+        char *name = (char *)slapi_entry_attr_get_ref(entryBefore, type_vlvName);
         if (vlvSearch_findname(parent, name)) {
             /* The vlvindex is already in the vlvSearchList. Skip adding it. */
             slapi_log_err(SLAPI_LOG_BACKLDBM,
@@ -101,7 +101,6 @@ vlv_AddIndexEntry(Slapi_PBlock *pb __attribute__((unused)),
             vlvIndex_init(newVlvIndex, be, parent, entryBefore);
             vlvSearch_addIndex(parent, newVlvIndex);
         }
-        slapi_ch_free_string(&name);
     }
     slapi_rwlock_unlock(be->vlvSearchList_lock);
     slapi_sdn_done(&parentdn);
@@ -257,11 +256,10 @@ vlv_SearchIndexEntry(Slapi_PBlock *pb __attribute__((unused)),
                      char *returntext __attribute__((unused)),
                      void *arg)
 {
-    char *name = slapi_entry_attr_get_charptr(entryBefore, type_vlvName);
+    char *name = (char *)slapi_entry_attr_get_ref(entryBefore, type_vlvName);
     backend *be = ((ldbm_instance *)arg)->inst_be;
     if (name != NULL) {
         struct vlvIndex *p = vlv_find_searchname(name, be); /* lock list */
-        slapi_ch_free((void **)&name);
         if (p != NULL) {
             if (vlvIndex_enabled(p)) {
                 slapi_entry_attr_set_charptr(entryBefore, type_vlvEnabled, "1");
diff --git a/ldap/servers/slapd/configdse.c b/ldap/servers/slapd/configdse.c
index 28160d3..8c10ad7 100644
--- a/ldap/servers/slapd/configdse.c
+++ b/ldap/servers/slapd/configdse.c
@@ -62,7 +62,7 @@ static const char *requires_restart[] = {
 static int
 isASyntaxOrMrPluginOrPss(Slapi_Entry *e)
 {
-    char *ptype = slapi_entry_attr_get_charptr(e, ATTR_PLUGIN_TYPE);
+    char *ptype = (char *)slapi_entry_attr_get_ref(e, ATTR_PLUGIN_TYPE);
     int retval = (ptype && !strcasecmp(ptype, "syntax"));
     if (!retval)
         retval = (ptype && !strcasecmp(ptype, "matchingrule"));
@@ -70,7 +70,6 @@ isASyntaxOrMrPluginOrPss(Slapi_Entry *e)
         retval = (ptype && !strcasecmp(ptype, "pwdstoragescheme"));
     if (!retval)
         retval = (ptype && !strcasecmp(ptype, "reverpwdstoragescheme"));
-    slapi_ch_free_string(&ptype);
     return retval;
 }
 
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 9aed663..52bad1d 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -727,7 +727,7 @@ convert_pbe_des_to_aes(void)
             slapi_search_internal_pb(pb);
             slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
             for (ii = 0; entries && entries[ii]; ii++) {
-                if ((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))) {
+                if ((val = (char *)slapi_entry_attr_get_ref(entries[ii], attrs[i]))) {
                     if (strlen(val) >= 5 && strncmp(val, "{DES}", 5) == 0) {
                         /*
                          * We have a DES encoded password, convert it to AES
@@ -789,7 +789,6 @@ convert_pbe_des_to_aes(void)
                         slapi_ch_free_string(&passwd);
                         slapi_value_free(&sval);
                     }
-                    slapi_ch_free_string(&val);
                 }
             }
             slapi_free_search_results_internal(pb);
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 8f2a14c..4f0f85f 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2067,7 +2067,7 @@ done:
 static int
 dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods)
 {
-    char *enabled = NULL;
+    const char *enabled = NULL;
     int restart_plugin = 1;
     int rc = 0;
     int i;
@@ -2075,7 +2075,7 @@ dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod
     /*
      * Only check the mods if the plugin is enabled - no need to restart a plugin if it's not running.
      */
-    if ((enabled = slapi_entry_attr_get_charptr(entryBefore, ATTR_PLUGIN_ENABLED)) &&
+    if ((enabled = slapi_entry_attr_get_ref(entryBefore, ATTR_PLUGIN_ENABLED)) &&
         !strcasecmp(enabled, "on")) {
         for (i = 0; mods && mods[i]; i++) {
             if (strcasecmp(mods[i]->mod_type, ATTR_PLUGIN_ENABLED) == 0) {
@@ -2093,7 +2093,6 @@ dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod
             }
         }
     }
-    slapi_ch_free_string(&enabled);
     return rc;
 }
 
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index b85e9f5..7697e2b 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -2882,6 +2882,24 @@ slapi_entry_attr_get_bool(const Slapi_Entry *e, const char *type)
     return slapi_entry_attr_get_bool_ext(e, type, PR_FALSE);
 }
 
+/*
+ * Extract a single value from an entry (as a string). You do not need
+ * to free the returned string value.
+ */
+const char *
+slapi_entry_attr_get_ref(Slapi_Entry *e, const char *attrname)
+{
+    Slapi_Attr *attr;
+    Slapi_Value *val = NULL;
+
+    if (slapi_entry_attr_find(e, attrname, &attr) != 0) {
+        return NULL;
+    }
+    slapi_attr_first_value(attr, &val);
+
+    return slapi_value_get_string(val);
+}
+
 void
 slapi_entry_attr_set_charptr(Slapi_Entry *e, const char *type, const char *value)
 {
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 3e49894..6953460 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -2644,7 +2644,7 @@ dont_allow_that(Slapi_PBlock *pb __attribute__((unused)),
 static void
 setEntrySSLVersion(Slapi_Entry *entry, char *sslversion, char *newval)
 {
-    char *v = slapi_entry_attr_get_charptr(entry, sslversion);
+    const char *v = slapi_entry_attr_get_ref(entry, sslversion);
 
     if (v) {
         if (PL_strcasecmp(v, newval)) { /* did not match */
@@ -2656,7 +2656,6 @@ setEntrySSLVersion(Slapi_Entry *entry, char *sslversion, char *newval)
             bv.bv_len = strlen(bv.bv_val);
             slapi_entry_attr_replace(entry, sslversion, bvals);
         }
-        slapi_ch_free_string(&v);
     } else {
         slapi_entry_attr_set_charptr(entry, sslversion, newval);
     }
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 8224cd0..14e8122 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -2067,13 +2067,12 @@ lookup_plugin_by_instance_name(const char *name)
         return NULL;
     }
 
-    cn = slapi_entry_attr_get_charptr(entries[0], "cn");
+    if((cn = (char *)slapi_entry_attr_get_ref(entries[0], "cn"))) {
+        plugin = plugin_get_by_name(cn);
+    }
     slapi_free_search_results_internal(pb);
     slapi_pblock_destroy(pb);
 
-    plugin = plugin_get_by_name(cn);
-    slapi_ch_free((void **)&cn);
-
     return plugin;
 }
 
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index 0b10678..771b59c 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -1188,14 +1188,12 @@ plugin_start(Slapi_Entry *entry, char *returntext)
                  * some processing is necessary even
                  * if it is not
                  */
-                if (NULL != config[plugin_index].e && (value = slapi_entry_attr_get_charptr(config[plugin_index].e,
-                                                                                            ATTR_PLUGIN_ENABLED)) &&
-                    !strcasecmp(value, "on")) {
-                    enabled = 1;
-                } else {
-                    enabled = 0;
+                if (NULL != config[plugin_index].e) {
+                    value = (char *)slapi_entry_attr_get_ref(config[plugin_index].e, ATTR_PLUGIN_ENABLED);
+                    if (value && !strcasecmp(value, "on")) {
+                        enabled = 1;
+                    }
                 }
-                slapi_ch_free_string(&value);
 
                 /*
                  * make sure named dependencies have been satisfied
@@ -1631,14 +1629,12 @@ plugin_dependency_startall(int argc, char **argv, char *errmsg __attribute__((un
                  * some processing is necessary even
                  * if it is not
                  */
-                if (NULL != config[plugin_index].e && (value = slapi_entry_attr_get_charptr(config[plugin_index].e,
-                                                                                            ATTR_PLUGIN_ENABLED)) &&
-                    !strcasecmp(value, "on")) {
-                    enabled = 1;
-                } else
-                    enabled = 0;
-
-                slapi_ch_free((void **)&value);
+                if (NULL != config[plugin_index].e) {
+                    value = (char *)slapi_entry_attr_get_ref(config[plugin_index].e, ATTR_PLUGIN_ENABLED);
+                    if (value && !strcasecmp(value, "on")) {
+                        enabled = 1;
+                    }
+                }
 
                 /*
                  * make sure named dependencies have been satisfied
@@ -1920,11 +1916,10 @@ plugin_dependency_freeall()
     iterp = dep_plugin_entries;
     while (iterp) {
         nextp = iterp->next;
-        if ((value = slapi_entry_attr_get_charptr(iterp->e, ATTR_PLUGIN_ENABLED)) &&
+        if ((value = (char *)slapi_entry_attr_get_ref(iterp->e, ATTR_PLUGIN_ENABLED)) &&
             !strcasecmp(value, "off")) {
                 plugin_free(iterp->plugin);
         }
-        slapi_ch_free_string(&value);
         slapi_entry_free(iterp->e);
         slapi_ch_free((void **)&iterp);
         iterp = nextp;
@@ -2483,41 +2478,34 @@ set_plugin_config_from_entry(
     PRBool target_seen = PR_FALSE;
     PRBool bind_seen = PR_FALSE;
 
-    if ((value = slapi_entry_attr_get_charptr(plugin_entry,
-                                              ATTR_PLUGIN_SCHEMA_CHECK)) != NULL) {
+    if ((value = (char *)slapi_entry_attr_get_ref((Slapi_Entry *)plugin_entry, ATTR_PLUGIN_SCHEMA_CHECK)) != NULL) {
         if (plugin_config_set_action(&config->plgc_schema_check, value)) {
             slapi_log_err(SLAPI_LOG_PLUGIN, "set_plugin_config_from_entry",
                           "Invalid value %s for attribute %s from entry %s\n",
                           value, ATTR_PLUGIN_SCHEMA_CHECK, slapi_entry_get_dn_const(plugin_entry));
             status = 1;
         }
-        slapi_ch_free((void **)&value);
     }
 
-    if ((value = slapi_entry_attr_get_charptr(plugin_entry,
-                                              ATTR_PLUGIN_LOG_ACCESS)) != NULL) {
+    if ((value = (char *)slapi_entry_attr_get_ref((Slapi_Entry *)plugin_entry, ATTR_PLUGIN_LOG_ACCESS)) != NULL) {
         if (plugin_config_set_action(&config->plgc_log_access, value)) {
             slapi_log_err(SLAPI_LOG_PLUGIN, "set_plugin_config_from_entry",
                           "Invalid value %s for attribute %s from entry %s\n",
                           value, ATTR_PLUGIN_LOG_ACCESS, slapi_entry_get_dn_const(plugin_entry));
             status = 1;
         }
-        slapi_ch_free((void **)&value);
     }
 
-    if ((value = slapi_entry_attr_get_charptr(plugin_entry,
-                                              ATTR_PLUGIN_LOG_AUDIT)) != NULL) {
+    if ((value = (char *)slapi_entry_attr_get_ref((Slapi_Entry *)plugin_entry, ATTR_PLUGIN_LOG_AUDIT)) != NULL) {
         if (plugin_config_set_action(&config->plgc_log_audit, value)) {
             slapi_log_err(SLAPI_LOG_PLUGIN, "set_plugin_config_from_entry",
                           "Invalid value %s for attribute %s from entry %s\n",
                           value, ATTR_PLUGIN_LOG_AUDIT, slapi_entry_get_dn_const(plugin_entry));
             status = 1;
         }
-        slapi_ch_free((void **)&value);
     }
 
-    if ((value = slapi_entry_attr_get_charptr(plugin_entry,
-                                              ATTR_PLUGIN_INVOKE_FOR_REPLOP)) != NULL) {
+    if ((value = (char *)slapi_entry_attr_get_ref((Slapi_Entry *)plugin_entry, ATTR_PLUGIN_INVOKE_FOR_REPLOP)) != NULL) {
         if (plugin_config_set_action(&config->plgc_invoke_for_replop, value)) {
             slapi_log_err(SLAPI_LOG_PLUGIN, "set_plugin_config_from_entry",
                           "Invalid value %s for attribute %s from entry %s\n",
@@ -2525,7 +2513,6 @@ set_plugin_config_from_entry(
                           slapi_entry_get_dn_const(plugin_entry));
             status = 1;
         }
-        slapi_ch_free((void **)&value);
     }
 
     values = slapi_entry_attr_get_charray(plugin_entry,
@@ -2809,8 +2796,7 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
     plugin->plg_dn = slapi_ch_strdup(slapi_entry_get_ndn(plugin_entry));
     plugin->plg_closed = 0;
 
-    if (!(value = slapi_entry_attr_get_charptr(plugin_entry,
-                                               ATTR_PLUGIN_TYPE))) {
+    if (!(value = (char *)slapi_entry_attr_get_ref(plugin_entry, ATTR_PLUGIN_TYPE))) {
         /* error: required attribute %s missing */
         slapi_log_err(SLAPI_LOG_ERR, "plugin_setup", "Required attribute %s is missing from entry \"%s\"\n",
                       ATTR_PLUGIN_TYPE, slapi_entry_get_dn_const(plugin_entry));
@@ -2821,7 +2807,6 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
     } else {
         status = plugin_get_type_and_list(value, &plugin->plg_type,
                                           &plugin_list);
-
         if (status != 0) {
             /* error: unknown plugin type */
             slapi_log_err(SLAPI_LOG_ERR, "plugin_setup", "Unknown plugin type \"%s\" in entry \"%s\"\n",
@@ -2831,11 +2816,10 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
             status = -1;
             goto PLUGIN_CLEANUP;
         }
-        slapi_ch_free_string(&value);
     }
 
     if (!status &&
-        !(value = slapi_entry_attr_get_charptr(plugin_entry, "cn"))) {
+        !(value = (char *)slapi_entry_attr_get_ref(plugin_entry, "cn"))) {
         /* error: required attribute %s missing */
         slapi_log_err(SLAPI_LOG_ERR, "plugin_setup", "Required attribute %s is missing from entry \"%s\"\n",
                       "cn", slapi_entry_get_dn_const(plugin_entry));
@@ -2845,10 +2829,9 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
     } else {
         /* plg_name is normalized once here */
         plugin->plg_name = slapi_create_rdn_value("%s", value);
-        slapi_ch_free((void **)&value);
     }
 
-    if (!(value = slapi_entry_attr_get_charptr(plugin_entry, ATTR_PLUGIN_PRECEDENCE))) {
+    if (!(value = (char *)slapi_entry_attr_get_ref(plugin_entry, ATTR_PLUGIN_PRECEDENCE))) {
         /* A precedence isn't set, so just use the default. */
         plugin->plg_precedence = PLUGIN_DEFAULT_PRECEDENCE;
     } else {
@@ -2872,12 +2855,10 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
                         ATTR_PLUGIN_PRECEDENCE,
                         PLUGIN_MIN_PRECEDENCE, PLUGIN_MAX_PRECEDENCE);
             status = -1;
-            slapi_ch_free((void **)&value);
             goto PLUGIN_CLEANUP;
         } else {
             plugin->plg_precedence = precedence;
         }
-        slapi_ch_free((void **)&value);
     }
 
     if (!(value = slapi_entry_attr_get_charptr(plugin_entry, ATTR_PLUGIN_INITFN))) {
@@ -2992,8 +2973,7 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
     slapi_pblock_set(pb, SLAPI_CONFIG_DIRECTORY, configdir);
 
     /* see if the plugin is enabled or not */
-    if ((value = slapi_entry_attr_get_charptr(plugin_entry,
-                                              ATTR_PLUGIN_ENABLED)) &&
+    if ((value = (char *)slapi_entry_attr_get_ref(plugin_entry, ATTR_PLUGIN_ENABLED)) &&
         !strcasecmp(value, "off")) {
         enabled = 0;
     } else {
@@ -3016,7 +2996,6 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
          * it failed - attempt to remove it just in case it was added.
          */
         plugin_remove_plugins(plugin, value);
-        slapi_ch_free((void **)&value);
         goto PLUGIN_CLEANUP;
     }
 
@@ -3026,8 +3005,6 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group, slapi_p
         }
     }
 
-    slapi_ch_free((void **)&value);
-
     if (enabled) {
         /* don't use raw pointer from plugin_entry because it
            will be freed later by the caller */
@@ -3165,13 +3142,11 @@ plugin_delete_check_dependency(struct slapdplugin *plugin_entry, int flag, char 
         /*
          * We are not concerned with disabled plugins
          */
-        value = slapi_entry_attr_get_charptr(ep->e, ATTR_PLUGIN_ENABLED);
+        value = (char *)slapi_entry_attr_get_ref(ep->e, ATTR_PLUGIN_ENABLED);
         if (value) {
             if (strcasecmp(value, "off") == 0) {
-                slapi_ch_free_string(&value);
                 goto next;
             }
-            slapi_ch_free_string(&value);
         } else {
             goto next;
         }
@@ -3450,7 +3425,7 @@ plugin_delete(Slapi_Entry *plugin_entry, char *returntext, int locked)
         goto done;
     }
 
-    if (!(value = slapi_entry_attr_get_charptr(plugin_entry, ATTR_PLUGIN_TYPE))) {
+    if (!(value = (char *)slapi_entry_attr_get_ref(plugin_entry, ATTR_PLUGIN_TYPE))) {
         /* error: required attribute %s missing */
         slapi_log_err(SLAPI_LOG_ERR, "plugin_delete", "Required attribute %s is missing from entry \"%s\"\n",
                       ATTR_PLUGIN_TYPE, slapi_entry_get_dn_const(plugin_entry));
@@ -3472,8 +3447,7 @@ plugin_delete(Slapi_Entry *plugin_entry, char *returntext, int locked)
                 /* error: unknown plugin type */
                 slapi_log_err(SLAPI_LOG_ERR, "plugin_delete", "Unknown plugin type \"%s\" in entry \"%s\"\n",
                               value, slapi_entry_get_dn_const(plugin_entry));
-                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Unknown plugin type "
-                                                                   "\"%s\" in entry.",
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Unknown plugin type \"%s\" in entry.",
                             value);
                 rc = -1;
                 goto unlock;
@@ -3516,7 +3490,6 @@ plugin_delete(Slapi_Entry *plugin_entry, char *returntext, int locked)
     }
 
 done:
-    slapi_ch_free_string(&value);
 
     if (!removed && rc == 0) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Plugin delete failed: could not find plugin "
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 2d2c985..1e63f9e 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -737,7 +737,7 @@ update_pw_info(Slapi_PBlock *pb, char *old_pw)
              * if the password expiry time is SLAPD_END_TIME,
              * don't roll it back
              */
-            prev_exp_date_str = slapi_entry_attr_get_charptr(pse, "passwordExpirationTime");
+            prev_exp_date_str = (char *)slapi_entry_attr_get_ref(pse, "passwordExpirationTime");
             if (prev_exp_date_str) {
                 time_t prev_exp_date;
 
@@ -746,12 +746,10 @@ update_pw_info(Slapi_PBlock *pb, char *old_pw)
                     /* ignore as will replace */
                 } else if (prev_exp_date == SLAPD_END_TIME) {
                     /* Special entries' passwords never expire */
-                    slapi_ch_free((void **)&prev_exp_date_str);
                     pw_apply_mods(sdn, &smods);
                     slapi_mods_done(&smods);
                     return 0;
                 }
-                slapi_ch_free((void **)&prev_exp_date_str);
             }
         } /* post op entry */
     } else if (pwpolicy->pw_must_change) {
@@ -804,14 +802,12 @@ check_pw_minage(Slapi_PBlock *pb, const Slapi_DN *sdn, struct berval **vals __at
             return (-1);
         }
         /* get passwordAllowChangeTime attribute */
-        passwordAllowChangeTime = slapi_entry_attr_get_charptr(e, "passwordAllowChangeTime");
-
+        passwordAllowChangeTime = (char *)slapi_entry_attr_get_ref(e, "passwordAllowChangeTime");
         if (passwordAllowChangeTime != NULL) {
             time_t pw_allowchange_date;
             char *cur_time_str = NULL;
 
             pw_allowchange_date = parse_genTime(passwordAllowChangeTime);
-            slapi_ch_free((void **)&passwordAllowChangeTime);
 
             /* check if allow to change the password */
             cur_time_str = format_genTime(slapi_current_utc_time());
@@ -2629,10 +2625,9 @@ slapi_check_account_lock(Slapi_PBlock *pb, Slapi_Entry *bind_target_entry, int p
     }
 
     /* locked but maybe it's time to unlock it */
-    accountUnlockTime = slapi_entry_attr_get_charptr(bind_target_entry, "accountUnlockTime");
+    accountUnlockTime = (char *)slapi_entry_attr_get_ref(bind_target_entry, "accountUnlockTime");
     if (accountUnlockTime != NULL) {
         unlock_time = parse_genTime(accountUnlockTime);
-        slapi_ch_free((void **)&accountUnlockTime);
 
         if (pwpolicy->pw_unlock == 0 &&
             unlock_time == NO_TIME) {
@@ -2815,7 +2810,7 @@ slapi_pwpolicy_is_reset(Slapi_PWPolicy *pwpolicy, Slapi_Entry *e)
             char *expiration_val = 0;
             time_t expire_time = (time_t)0;
 
-            expiration_val = slapi_entry_attr_get_charptr(e, "passwordExpirationTime");
+            expiration_val = (char *)slapi_entry_attr_get_ref(e, "passwordExpirationTime");
             if (expiration_val) {
                 expire_time = parse_genTime(expiration_val);
                 if (expire_time == NO_TIME) {
@@ -3153,11 +3148,10 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
         }
     }
     if (shadowval > 0) {
-        shmin = slapi_entry_attr_get_charptr(*e, "shadowMin");
+        shmin = (char *)slapi_entry_attr_get_ref(*e, "shadowMin");
         if (shmin) {
             sval = strtoll(shmin, NULL, 0);
             if (sval != shadowval) {
-                slapi_ch_free_string(&shmin);
                 shmin = slapi_ch_smprintf("%lld", shadowval);
                 mod_num++;
             }
@@ -3176,11 +3170,10 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
         }
     }
     if (shadowval > 0) {
-        shmax = slapi_entry_attr_get_charptr(*e, "shadowMax");
+        shmax = (char *)slapi_entry_attr_get_ref(*e, "shadowMax");
         if (shmax) {
             sval = strtoll(shmax, NULL, 0);
             if (sval != shadowval) {
-                slapi_ch_free_string(&shmax);
                 shmax = slapi_ch_smprintf("%lld", shadowval);
                 mod_num++;
             }
@@ -3199,11 +3192,10 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
         }
     }
     if (shadowval >= 0) {
-        shwarn = slapi_entry_attr_get_charptr(*e, "shadowWarning");
+        shwarn = (char *)slapi_entry_attr_get_ref(*e, "shadowWarningMax");
         if (shwarn) {
             sval = strtoll(shwarn, NULL, 0);
             if (sval != shadowval) {
-                slapi_ch_free_string(&shwarn);
                 shwarn = slapi_ch_smprintf("%lld", shadowval);
                 mod_num++;
             }
diff --git a/ldap/servers/slapd/pw_mgmt.c b/ldap/servers/slapd/pw_mgmt.c
index befac50..dd32c31 100644
--- a/ldap/servers/slapd/pw_mgmt.c
+++ b/ldap/servers/slapd/pw_mgmt.c
@@ -34,9 +34,8 @@ check_must_change_pw(Slapi_PBlock *pb, Slapi_Entry *e)
     time_t pw_exp_date;
     char *passwordExpirationTime = NULL;
 
-    if ((passwordExpirationTime = slapi_entry_attr_get_charptr(e, "passwordExpirationTime"))) {
+    if ((passwordExpirationTime = (char *)slapi_entry_attr_get_ref(e, "passwordExpirationTime"))) {
         pw_exp_date = parse_genTime(passwordExpirationTime);
-        slapi_ch_free_string(&passwordExpirationTime);
 
         /* Check if password has been reset */
         if (pw_exp_date == NO_TIME) {
@@ -97,7 +96,7 @@ need_new_pw(Slapi_PBlock *pb, Slapi_Entry *e, int pwresponse_req)
     cur_time = slapi_current_utc_time();
 
     /* get passwordExpirationTime attribute */
-    passwordExpirationTime = slapi_entry_attr_get_charptr(e, "passwordExpirationTime");
+    passwordExpirationTime = (char *)slapi_entry_attr_get_ref(e, "passwordExpirationTime");
 
     if (passwordExpirationTime == NULL) {
         /* password expiration date is not set.
@@ -122,8 +121,6 @@ need_new_pw(Slapi_PBlock *pb, Slapi_Entry *e, int pwresponse_req)
 
     pw_exp_date = parse_genTime(passwordExpirationTime);
 
-    slapi_ch_free_string(&passwordExpirationTime);
-
     slapi_pblock_get(pb, SLAPI_CONNECTION, &pb_conn);
     if (pb_conn) {
         needpw = pb_conn->c_needpw;
diff --git a/ldap/servers/slapd/pw_retry.c b/ldap/servers/slapd/pw_retry.c
index 87928d4..da8f01f 100644
--- a/ldap/servers/slapd/pw_retry.c
+++ b/ldap/servers/slapd/pw_retry.c
@@ -55,11 +55,9 @@ update_pw_retry(Slapi_PBlock *pb)
     cur_time = slapi_current_utc_time();
 
     /* check if the retry count can be reset. */
-    retryCountResetTime = slapi_entry_attr_get_charptr(e, "retryCountResetTime");
+    retryCountResetTime = (char *)slapi_entry_attr_get_ref(e, "retryCountResetTime");
     if (retryCountResetTime != NULL) {
         reset_time = parse_genTime(retryCountResetTime);
-        slapi_ch_free((void **)&retryCountResetTime);
-
         cur_time_str = format_genTime(cur_time);
         if (difftime(parse_genTime(cur_time_str), reset_time) >= 0) {
             /* set passwordRetryCount to 1 */
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index 9593fd0..9a561b3 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -480,7 +480,7 @@ sasl_map_config_modify(Slapi_PBlock *pb __attribute__((unused)),
     char *map_name = NULL;
     int ret = SLAPI_DSE_CALLBACK_ERROR;
 
-    if ((map_name = slapi_entry_attr_get_charptr(entryBefore, "cn")) == NULL) {
+    if ((map_name = (char *)slapi_entry_attr_get_ref(entryBefore, "cn")) == NULL) {
         slapi_log_err(SLAPI_LOG_TRACE, "sasl_map_config_modify", "Could not find name of map\n");
         return ret;
     }
@@ -496,7 +496,6 @@ sasl_map_config_modify(Slapi_PBlock *pb __attribute__((unused)),
     if (ret == SLAPI_DSE_CALLBACK_ERROR) {
         slapi_log_err(SLAPI_LOG_TRACE, "sasl_map_config_modify", "Failed to update map(%s)\n", map_name);
     }
-    slapi_ch_free_string(&map_name);
 
     return ret;
 }
@@ -514,11 +513,10 @@ sasl_map_config_delete(Slapi_PBlock *pb __attribute__((unused)),
     char *entry_name = NULL;
 
     slapi_log_err(SLAPI_LOG_TRACE, "sasl_map_config_delete", "=>\n");
-    entry_name = slapi_entry_attr_get_charptr(entryBefore, "cn");
+    entry_name = (char *)slapi_entry_attr_get_ref(entryBefore, "cn");
     if (entry_name) {
         /* remove this entry from the list */
         ret = sasl_map_remove_list_entry(priv, entry_name);
-        slapi_ch_free((void **)&entry_name);
     }
     if (ret) {
         ret = SLAPI_DSE_CALLBACK_ERROR;
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index c54bb98..fca75b4 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -1719,6 +1719,16 @@ char **slapi_entry_attr_get_charray_ext(const Slapi_Entry *e, const char *type, 
 char *slapi_entry_attr_get_charptr(const Slapi_Entry *e, const char *type);
 
 /**
+ * Gets the first value of an attribute of an entry as a string.
+ *
+ * \param e Entry from which you want to get the string value.
+ * \param attrname - Attribute type from which you want to get the value.
+ * \return A reference of the first value in the attribute.
+ * \return \c NULL if the entry does not contain the attribute.
+ */
+const char *slapi_entry_attr_get_ref(Slapi_Entry *e, const char *attrname);
+
+/**
  * Gets the first value of an attribute in an entry as an integer.
  *
  * \param e Entry from which you want to get the integer value.
diff --git a/ldap/servers/slapd/snmp_collator.c b/ldap/servers/slapd/snmp_collator.c
index 1da7ccb..3dd3af6 100644
--- a/ldap/servers/slapd/snmp_collator.c
+++ b/ldap/servers/slapd/snmp_collator.c
@@ -769,12 +769,11 @@ loadConfigStats(void)
     /* Read attributes from SNMP config entry */
     getConfigEntry(&entry);
     if (entry != NULL) {
-        name = slapi_entry_attr_get_charptr(entry, SNMP_NAME_ATTR);
-        desc = slapi_entry_attr_get_charptr(entry, SNMP_DESC_ATTR);
-        org = slapi_entry_attr_get_charptr(entry, SNMP_ORG_ATTR);
-        loc = slapi_entry_attr_get_charptr(entry, SNMP_LOC_ATTR);
-        contact = slapi_entry_attr_get_charptr(entry, SNMP_CONTACT_ATTR);
-        freeConfigEntry(&entry);
+        name = (char *)slapi_entry_attr_get_ref(entry, SNMP_NAME_ATTR);
+        desc = (char *)slapi_entry_attr_get_ref(entry, SNMP_DESC_ATTR);
+        org = (char *)slapi_entry_attr_get_ref(entry, SNMP_ORG_ATTR);
+        loc = (char *)slapi_entry_attr_get_ref(entry, SNMP_LOC_ATTR);
+        contact = (char *)slapi_entry_attr_get_ref(entry, SNMP_CONTACT_ATTR);
     }
 
     /* Load stats into table */
@@ -798,12 +797,9 @@ loadConfigStats(void)
         PL_strncpyz(stats->hdr_stats.dsContact, contact, SNMP_FIELD_LENGTH);
     }
 
-    /* Free strings */
-    slapi_ch_free((void **)&name);
-    slapi_ch_free((void **)&desc);
-    slapi_ch_free((void **)&org);
-    slapi_ch_free((void **)&loc);
-    slapi_ch_free((void **)&contact);
+    if (entry) {
+        freeConfigEntry(&entry);
+    }
 }
 
 static Slapi_Entry *
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index eef853a..6a07f1a 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -1460,7 +1460,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
         slapd_SSL_error("Failed get config entry %s", configDN);
         return 1;
     }
-    val = slapi_fetch_attr(e, "allowWeakCipher", NULL);
+    val = slapi_entry_attr_get_ref(e, "allowWeakCipher");
     if (val) {
         if (!PL_strcasecmp(val, "off") || !PL_strcasecmp(val, "false") ||
             !PL_strcmp(val, "0") || !PL_strcasecmp(val, "no")) {
@@ -1731,7 +1731,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
     /* Set a default value if no value found */
     getConfigEntry(configDN, &e);
     if (e != NULL) {
-        clientauth_val = (char *)slapi_fetch_attr(e, "nssslclientauth", NULL);
+        clientauth_val = (char *)slapi_entry_attr_get_ref(e, "nssslclientauth");
     }
 
     if (!clientauth_val) {
@@ -1766,23 +1766,23 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
     }
 
     if (e != NULL) {
-        val = slapi_fetch_attr(e, "nsSSL3", NULL);
+        val = slapi_entry_attr_get_ref(e, "nsSSL3");
         if (val) {
             if (!PL_strcasecmp(val, "on")) {
                 slapd_SSL_warn("NSS no longer support SSL3, the nsSSL3 setting will be ignored");
             }
         }
-        val = slapi_fetch_attr(e, "nsTLS1", NULL);
+        val = slapi_entry_attr_get_ref(e, "nsTLS1");
         if (val) {
             if (!PL_strcasecmp(val, "off")) {
                 slapd_SSL_warn("NSS only supports TLS, the nsTLS1 setting of \"off\" will be ignored");
             }
         }
-        val = slapi_fetch_attr(e, "sslVersionMin", NULL);
+        val = slapi_entry_attr_get_ref(e, "sslVersionMin");
         if (val) {
             (void)set_NSS_version((char *)val, &NSSVersionMin, 1);
         }
-        val = slapi_fetch_attr(e, "sslVersionMax", NULL);
+        val = slapi_entry_attr_get_ref(e, "sslVersionMax");
         if (val) {
             (void)set_NSS_version((char *)val, &NSSVersionMax, 0);
         }
@@ -1852,7 +1852,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
 
     val = NULL;
     if (e != NULL) {
-        val = slapi_fetch_attr(e, "nsTLSAllowClientRenegotiation", NULL);
+        val = slapi_entry_attr_get_ref(e, "nsTLSAllowClientRenegotiation");
     }
     if (val) {
         /* We default to allowing reneg.  If the option is "no",
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index 025ffcb..a2191e9 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -882,13 +882,13 @@ task_import_add(Slapi_PBlock *pb __attribute__((unused)),
     char *nameFrombe_name = NULL;
     const char *encrypt_on_import = NULL;
 
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         return SLAPI_DSE_CALLBACK_ERROR;
     }
-    instance_name = slapi_fetch_attr(e, "nsInstance", NULL);
+    instance_name = slapi_entry_attr_get_ref(e, "nsInstance");
 
-    encrypt_on_import = slapi_fetch_attr(e, "nsImportEncrypt", NULL);
+    encrypt_on_import = slapi_entry_attr_get_ref(e, "nsImportEncrypt");
 
     /* include/exclude suffixes */
     if (slapi_entry_attr_find(e, "nsIncludeSuffix", &attr) == 0) {
@@ -1002,7 +1002,7 @@ task_import_add(Slapi_PBlock *pb __attribute__((unused)),
     }
 
     do_attr_indexes = slapi_fetch_attr(e, "nsImportIndexAttrs", "true");
-    uniqueid_kind_str = slapi_fetch_attr(e, "nsUniqueIdGenerator", NULL);
+    uniqueid_kind_str = slapi_entry_attr_get_ref(e, "nsUniqueIdGenerator");
     if (uniqueid_kind_str != NULL) {
         if (strcasecmp(uniqueid_kind_str, "none") == 0) {
             uniqueid_kind = SLAPI_UNIQUEID_GENERATE_NONE;
@@ -1035,7 +1035,7 @@ task_import_add(Slapi_PBlock *pb __attribute__((unused)),
 
     slapi_pblock_set(mypb, SLAPI_LDIF2DB_GENERATE_UNIQUEID, &uniqueid_kind);
 
-    char *namespaceid = (char *)slapi_fetch_attr(e, "nsUniqueIdGeneratorNamespace", NULL);
+    char *namespaceid = (char *)slapi_entry_attr_get_ref(e, "nsUniqueIdGeneratorNamespace");
     slapi_pblock_set(mypb, SLAPI_LDIF2DB_NAMESPACEID, namespaceid);
 
     slapi_pblock_set(mypb, SLAPI_BACKEND_INSTANCE_NAME, (void *)instance_name);
@@ -1223,13 +1223,13 @@ task_export_add(Slapi_PBlock *pb __attribute__((unused)),
     const char *decrypt_on_export = NULL;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
-    decrypt_on_export = slapi_fetch_attr(e, "nsExportDecrypt", NULL);
+    decrypt_on_export = slapi_entry_attr_get_ref(e, "nsExportDecrypt");
 
     /* nsInstances -- from here on, memory has been allocated */
     if (slapi_entry_attr_find(e, "nsInstance", &attr) == 0) {
@@ -1301,7 +1301,7 @@ task_export_add(Slapi_PBlock *pb __attribute__((unused)),
     }
 
     /* ldif file name */
-    if ((my_ldif_file = slapi_fetch_attr(e, "nsFilename", NULL)) == NULL) {
+    if ((my_ldif_file = slapi_entry_attr_get_ref(e, "nsFilename")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -1503,21 +1503,21 @@ task_backup_add(Slapi_PBlock *pb __attribute__((unused)),
     Slapi_Task *task = NULL;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* archive dir name */
-    if ((archive_dir = slapi_fetch_attr(e, "nsArchiveDir", NULL)) == NULL) {
+    if ((archive_dir = slapi_entry_attr_get_ref(e, "nsArchiveDir")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* database type */
-    my_database_type = slapi_fetch_attr(e, "nsDatabaseType", NULL);
+    my_database_type = slapi_entry_attr_get_ref(e, "nsDatabaseType");
     if (NULL != my_database_type)
         database_type = my_database_type;
 
@@ -1661,25 +1661,25 @@ task_restore_add(Slapi_PBlock *pb,
     PRThread *thread = NULL;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* archive dir name */
-    if ((archive_dir = slapi_fetch_attr(e, "nsArchiveDir", NULL)) == NULL) {
+    if ((archive_dir = slapi_entry_attr_get_ref(e, "nsArchiveDir")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* database type */
-    my_database_type = slapi_fetch_attr(e, "nsDatabaseType", NULL);
+    my_database_type = slapi_entry_attr_get_ref(e, "nsDatabaseType");
     if (NULL != my_database_type)
         database_type = my_database_type;
 
-    instance_name = slapi_fetch_attr(e, "nsInstance", NULL);
+    instance_name = slapi_entry_attr_get_ref(e, "nsInstance");
 
     /* get backend that has archive2db and the database type matches.  */
     be = slapi_get_first_backend(&cookie);
@@ -1818,12 +1818,12 @@ task_index_add(Slapi_PBlock *pb __attribute__((unused)),
     PRThread *thread = NULL;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((instance_name = slapi_fetch_attr(e, "nsInstance", NULL)) == NULL) {
+    if ((instance_name = slapi_entry_attr_get_ref(e, "nsInstance")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -1946,26 +1946,26 @@ task_upgradedb_add(Slapi_PBlock *pb __attribute__((unused)),
     char *cookie = NULL;
 
     *returncode = LDAP_SUCCESS;
-    if (slapi_fetch_attr(e, "cn", NULL) == NULL) {
+    if (slapi_entry_attr_get_ref(e, "cn") == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* archive dir name */
-    if ((archive_dir = slapi_fetch_attr(e, "nsArchiveDir", NULL)) == NULL) {
+    if ((archive_dir = slapi_entry_attr_get_ref(e, "nsArchiveDir")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* database type */
-    my_database_type = slapi_fetch_attr(e, "nsDatabaseType", NULL);
+    my_database_type = slapi_entry_attr_get_ref(e, "nsDatabaseType");
     if (NULL != my_database_type)
         database_type = my_database_type;
 
     /* force to reindex? */
-    force = slapi_fetch_attr(e, "nsForceToReindex", NULL);
+    force = slapi_entry_attr_get_ref(e, "nsForceToReindex");
 
     /* get backend that has db2archive and the database type matches.  */
     be = slapi_get_first_backend(&cookie);
@@ -2074,7 +2074,7 @@ task_sysconfig_reload_add(Slapi_PBlock *pb __attribute__((unused)),
 
     *returncode = LDAP_SUCCESS;
 
-    if ((filename = slapi_entry_attr_get_charptr(e, TASK_SYSCONFIG_FILE_ATTR))) {
+    if ((filename = (char *)slapi_entry_attr_get_ref(e, TASK_SYSCONFIG_FILE_ATTR))) {
         file = fopen(filename, "r");
     } else {
         *returncode = LDAP_OPERATIONS_ERROR;
@@ -2225,7 +2225,6 @@ task_sysconfig_reload_add(Slapi_PBlock *pb __attribute__((unused)),
     }
 
 done:
-    slapi_ch_free_string(&filename);
 
     return rc;
 }
@@ -2454,7 +2453,7 @@ task_fixup_tombstones_add(Slapi_PBlock *pb,
     char **backend = NULL;
     char **suffix = NULL;
     char **base = NULL;
-    char *stripcsn = NULL;
+    const char *stripcsn = NULL;
     int i;
 
     /*
@@ -2526,11 +2525,11 @@ task_fixup_tombstones_add(Slapi_PBlock *pb,
     task_data = (struct task_tombstone_data *)slapi_ch_calloc(1, sizeof(struct task_tombstone_data));
     task_data->base = base;
     task_data->task = task;
-    if ((stripcsn = slapi_entry_attr_get_charptr(e, TASK_TOMBSTONE_FIXUP_STRIPCSN))) {
+
+    if ((stripcsn = slapi_entry_attr_get_ref(e, TASK_TOMBSTONE_FIXUP_STRIPCSN))) {
         if (strcasecmp(stripcsn, "yes") == 0 || strcasecmp(stripcsn, "on") == 0) {
             task_data->stripcsn = 1;
         }
-        slapi_ch_free_string(&stripcsn);
     }
 
     /* start the db2index as a separate thread */
@@ -2783,7 +2782,7 @@ task_des2aes_thread(void *arg)
                 }
                 slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
                 for (ii = 0; entries && entries[ii]; ii++) {
-                    if ((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))) {
+                    if ((val = (char *)slapi_entry_attr_get_ref(entries[ii], attrs[i]))) {
                         if (strlen(val) >= 5 && strncmp(val, "{DES}", 5) == 0) {
                             /*
                              * We have a DES encoded password, convert it AES
@@ -2858,7 +2857,6 @@ task_des2aes_thread(void *arg)
                             slapi_value_free(&sval);
                             slapi_pblock_destroy(mod_pb);
                         }
-                        slapi_ch_free_string(&val);
                     }
                 }
                 slapi_free_search_results_internal(pb);
diff --git a/ldap/servers/slapd/test-plugins/sampletask.c b/ldap/servers/slapd/test-plugins/sampletask.c
index 772b224..1734e29 100644
--- a/ldap/servers/slapd/test-plugins/sampletask.c
+++ b/ldap/servers/slapd/test-plugins/sampletask.c
@@ -143,14 +143,14 @@ task_sampletask_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *
     const char *myarg;
 
     *returncode = LDAP_SUCCESS;
-    if ((cn = slapi_fetch_attr(e, "cn", NULL)) == NULL) {
+    if ((cn = slapi_entry_attr_get_ref(e, "cn")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
     /* get arg(s) */
-    if ((myarg = slapi_fetch_attr(e, "myarg", NULL)) == NULL) {
+    if ((myarg = slapi_entry_attr_get_ref(e, "myarg")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index 87ca174..fe7f2a5 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -362,8 +362,7 @@ slapd_config(const char *configdir, const char *givenconfigfile)
                     }
                 } else if (slapi_sdn_compare(&config_dn, slapi_entry_get_sdn_const(e)) == 0) {
                     /* Get the root scheme out and initialise it (if it exists) */
-                    slapi_ch_free_string(&rootschemename);
-                    rootschemename = slapi_entry_attr_get_charptr(e, CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE);
+                    rootschemename = (char *)slapi_entry_attr_get_ref(e, CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE);
                 }
 
                 slapi_entry_free(e);
@@ -383,7 +382,6 @@ slapd_config(const char *configdir, const char *givenconfigfile)
 
         if (rootschemename != NULL) {
             config_set_rootpwstoragescheme(CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE, rootschemename, NULL, 1);
-            free(rootschemename);
         }
 
         slapi_ch_free_string(&buf);