diff --git a/lib/hdb/common.c b/lib/hdb/common.c
index d68aab4a9..87e753fe5 100644
--- a/lib/hdb/common.c
+++ b/lib/hdb/common.c
@@ -50,6 +50,7 @@ hdb_principal2key(krb5_context context, krb5_principal p, krb5_data *key)
     len = length_Principal(&new);
     buf  = malloc(len);
     if(buf == NULL){
+	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }
@@ -80,8 +81,10 @@ hdb_entry2value(krb5_context context, hdb_entry *ent, krb5_data *value)
 
     len = length_hdb_entry(ent);
     buf = malloc(len);
-    if(buf == NULL)
+    if(buf == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     ret = encode_hdb_entry(buf + len - 1, len, ent, &len);
     if(ret){
 	free(buf);
@@ -128,8 +131,10 @@ _hdb_store(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry)
     if(entry->generation == NULL) {
 	struct timeval t;
 	entry->generation = malloc(sizeof(*entry->generation));
-	if(entry->generation == NULL)
+	if(entry->generation == NULL) {
+	    krb5_set_error_string(context, "malloc: out of memory");
 	    return ENOMEM;
+	}
 	gettimeofday(&t, NULL);
 	entry->generation->time = t.tv_sec;
 	entry->generation->usec = t.tv_usec;
diff --git a/lib/hdb/db.c b/lib/hdb/db.c
index 40613f6a6..c4ac81d19 100644
--- a/lib/hdb/db.c
+++ b/lib/hdb/db.c
@@ -110,6 +110,7 @@ DB_seq(krb5_context context, HDB *db,
     if (code == 0 && entry->principal == NULL) {
 	entry->principal = malloc(sizeof(*entry->principal));
 	if (entry->principal == NULL) {
+	    krb5_set_error_string(context, "malloc: out of memory");
 	    code = ENOMEM;
 	    hdb_free_entry (context, entry);
 	} else {
@@ -226,21 +227,29 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
     krb5_error_code ret;
 
     asprintf(&fn, "%s.db", db->name);
-    if (fn == NULL)
+    if (fn == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     db->db = dbopen(fn, flags, mode, DB_BTREE, NULL);
     free(fn);
     /* try to open without .db extension */
     if(db->db == NULL && errno == ENOENT)
 	db->db = dbopen(db->name, flags, mode, DB_BTREE, NULL);
-    if(db->db == NULL)
-	return errno;
+    if(db->db == NULL) {
+	ret = errno;
+	krb5_set_error_string(context, "dbopen (%s): %s",
+			      db->name, strerror(ret));
+	return ret;
+    }
     if((flags & O_ACCMODE) == O_RDONLY)
 	ret = hdb_check_db_format(context, db);
     else
 	ret = hdb_init_db(context, db);
-    if(ret == HDB_ERR_NOENTRY)
+    if(ret == HDB_ERR_NOENTRY) {
+	krb5_clear_error_string(context);
 	return 0;
+    }
     return ret;
 }
 
@@ -249,11 +258,19 @@ hdb_db_create(krb5_context context, HDB **db,
 	      const char *filename)
 {
     *db = malloc(sizeof(**db));
-    if (*db == NULL)
+    if (*db == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
 
     (*db)->db = NULL;
     (*db)->name = strdup(filename);
+    if ((*db)->name == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
+	free(*db);
+	*db = NULL;
+	return ENOMEM;
+    }
     (*db)->master_key_set = 0;
     (*db)->openp = 0;
     (*db)->open  = DB_open;
diff --git a/lib/hdb/db3.c b/lib/hdb/db3.c
index ac9e90592..9a084b014 100644
--- a/lib/hdb/db3.c
+++ b/lib/hdb/db3.c
@@ -115,8 +115,9 @@ DB_seq(krb5_context context, HDB *db,
     if (entry->principal == NULL) {
 	entry->principal = malloc(sizeof(*entry->principal));
 	if (entry->principal == NULL) {
-	    code = ENOMEM;
 	    hdb_free_entry (context, entry);
+	    krb5_set_error_string(context, "malloc: out of memory");
+	    return ENOMEM;
 	} else {
 	    hdb_key2principal(context, &key_data, entry->principal);
 	}
@@ -252,8 +253,10 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
       myflags |= DB_TRUNCATE;
 
     asprintf(&fn, "%s.db", db->name);
-    if (fn == NULL)
+    if (fn == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     db_create(&d, NULL, 0);
     db->db = d;
     if ((ret = d->open(db->db, fn, NULL, DB_BTREE, myflags, mode))) {
@@ -261,14 +264,18 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 	/* try to open without .db extension */
 	if (d->open(db->db, db->name, NULL, DB_BTREE, myflags, mode)) {
 	  free(fn);
+	  krb5_set_error_string(context, "opening %s: %s",
+				db->name, strerror(ret));
 	  return ret;
 	}
     }
     free(fn);
 
     ret = d->cursor(d, NULL, (DBC **)&db->dbc, 0);
-    if (ret)
+    if (ret) {
+	krb5_set_error_string(context, "d->cursor: %s", strerror(ret));
         return ret;
+    }
 
     if((flags & O_ACCMODE) == O_RDONLY)
 	ret = hdb_check_db_format(context, db);
@@ -284,11 +291,19 @@ hdb_db_create(krb5_context context, HDB **db,
 	      const char *filename)
 {
     *db = malloc(sizeof(**db));
-    if (*db == NULL)
+    if (*db == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
 
     (*db)->db = NULL;
     (*db)->name = strdup(filename);
+    if ((*db)->name == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
+	free(*db);
+	*db = NULL;
+	return ENOMEM;
+    }
     (*db)->master_key_set = 0;
     (*db)->openp = 0;
     (*db)->open  = DB_open;
diff --git a/lib/hdb/keytab.c b/lib/hdb/keytab.c
index 89c17b20e..3caddb8f6 100644
--- a/lib/hdb/keytab.c
+++ b/lib/hdb/keytab.c
@@ -54,8 +54,10 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
     const char *db, *mkey;
 
     d = malloc(sizeof(*d));
-    if(d == NULL)
+    if(d == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     db = name;
     mkey = strchr(name, ':');
     if(mkey == NULL || mkey[1] == '\0') {
@@ -65,6 +67,7 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
 	    d->dbname = strdup(name);
 	    if(d->dbname == NULL) {
 		free(d);
+		krb5_set_error_string(context, "malloc: out of memory");
 		return ENOMEM;
 	    }
 	}
@@ -76,6 +79,7 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
 	    d->dbname = malloc(mkey - db);
 	    if(d->dbname == NULL) {
 		free(d);
+		krb5_set_error_string(context, "malloc: out of memory");
 		return ENOMEM;
 	    }
 	    memmove(d->dbname, db, mkey - db);
@@ -85,6 +89,7 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
 	if(d->mkey == NULL) {
 	    free(d->dbname);
 	    free(d);
+	    krb5_set_error_string(context, "malloc: out of memory");
 	    return ENOMEM;
 	}
     }
diff --git a/lib/hdb/mkey.c b/lib/hdb/mkey.c
index 868c5bf6e..4fb0f668b 100644
--- a/lib/hdb/mkey.c
+++ b/lib/hdb/mkey.c
@@ -63,26 +63,29 @@ hdb_process_master_key(krb5_context context,
 		       hdb_master_key *mkey)
 {
     krb5_error_code ret;
+
     *mkey = calloc(1, sizeof(**mkey));
-    if(*mkey == NULL)
+    if(*mkey == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     (*mkey)->keytab.vno = kvno;
     ret = krb5_parse_name(context, "K/M", &(*mkey)->keytab.principal);
+    if(ret)
+	goto fail;
     ret = krb5_copy_keyblock_contents(context, key, &(*mkey)->keytab.keyblock);
-    if(ret) {
-	free(*mkey);
-	*mkey = NULL;
-	return ret;
-    }
+    if(ret)
+	goto fail;
     if(etype != 0)
 	(*mkey)->keytab.keyblock.keytype = etype;
     (*mkey)->keytab.timestamp = time(NULL);
     ret = krb5_crypto_init(context, key, etype, &(*mkey)->crypto);
-    if(ret) {
-	krb5_free_keyblock_contents(context, &(*mkey)->keytab.keyblock);
-	free(*mkey);
-	*mkey = NULL;
-    }
+    if(ret)
+	goto fail;
+    return 0;
+ fail:
+    hdb_free_master_key(context, *mkey);
+    *mkey = NULL;
     return ret;
 }
 
@@ -151,7 +154,7 @@ read_master_mit(krb5_context context, const char *filename,
     if(fd < 0) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "failed to open %s: %s", filename,
-			      strerror(save_errno)));
+			      strerror(save_errno));
 	return save_errno;
     }
     sp = krb5_storage_from_fd(fd);
@@ -200,7 +203,7 @@ read_master_encryptionkey(krb5_context context, const char *filename,
     if(fd < 0) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "failed to open %s: %s", 
-			      filename, streror(save_errno));
+			      filename, strerror(save_errno));
 	return save_errno;
     }
     
@@ -209,7 +212,7 @@ read_master_encryptionkey(krb5_context context, const char *filename,
     if(len < 0) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "error reading %s: %s", 
-			      filename, streror(save_errno));
+			      filename, strerror(save_errno));
 	return save_errno;
     }
 
@@ -246,7 +249,7 @@ read_master_krb4(krb5_context context, const char *filename,
     if(fd < 0) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "failed to open %s: %s", 
-			      filename, streror(save_errno));
+			      filename, strerror(save_errno));
 	return save_errno;
     }
     
@@ -255,7 +258,7 @@ read_master_krb4(krb5_context context, const char *filename,
     if(len < 0) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "error reading %s: %s", 
-			      filename, streror(save_errno));
+			      filename, strerror(save_errno));
 	return save_errno;
     }
     if(len != 8) {
@@ -294,7 +297,7 @@ hdb_read_master_key(krb5_context context, const char *filename,
     if(f == NULL) {
 	int save_errno = errno;
 	krb5_set_error_string(context, "failed to open %s: %s", 
-			      filename, streror(save_errno));
+			      filename, strerror(save_errno));
 	return save_errno;
     }
     
diff --git a/lib/hdb/ndbm.c b/lib/hdb/ndbm.c
index 325cb3010..a86009af8 100644
--- a/lib/hdb/ndbm.c
+++ b/lib/hdb/ndbm.c
@@ -103,6 +103,7 @@ NDBM_seq(krb5_context context, HDB *db,
 	if (entry->principal == NULL) {
 	    ret = ENOMEM;
 	    hdb_free_entry (context, entry);
+	    krb5_set_error_string(context, "malloc: out of memory");
 	} else {
 	    hdb_key2principal (context, &key_data, entry->principal);
 	}
@@ -137,15 +138,24 @@ NDBM_rename(krb5_context context, HDB *db, const char *new_name)
 
     /* lock old and new databases */
     ret = db->lock(context, db, HDB_WLOCK);
-    if(ret) return ret;
+    if(ret)
+	return ret;
     asprintf(&new_lock, "%s.lock", new_name);
+    if(new_lock == NULL) {
+	db->unlock(context, db);
+	krb5_set_error_string(context, "malloc: out of memory");
+	return ENOMEM;
+    }
     lock_fd = open(new_lock, O_RDWR | O_CREAT, 0600);
-    free(new_lock);
     if(lock_fd < 0) {
 	ret = errno;
 	db->unlock(context, db);
+	krb5_set_error_string(context, "open(%s): %s", new_lock,
+			      strerror(ret));
+	free(new_lock);
 	return ret;
     }
+    free(new_lock);
     ret = hdb_lock(lock_fd, HDB_WLOCK);
     if(ret) {
 	db->unlock(context, db);
@@ -167,8 +177,10 @@ NDBM_rename(krb5_context context, HDB *db, const char *new_name)
     db->unlock(context, db);
 
     if(ret) {
+	ret = errno;
 	close(lock_fd);
-	return errno;
+	krb5_set_error_string(context, "rename: %s", strerror(ret));
+	return ret;
     }
 
     close(d->lock_fd);
@@ -251,26 +263,36 @@ NDBM_open(krb5_context context, HDB *db, int flags, mode_t mode)
     struct ndbm_db *d = malloc(sizeof(*d));
     char *lock_file;
 
-    if(d == NULL)
+    if(d == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     asprintf(&lock_file, "%s.lock", (char*)db->name);
     if(lock_file == NULL) {
 	free(d);
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
     }
     d->db = dbm_open((char*)db->name, flags, mode);
     if(d->db == NULL){
+	ret = errno;
 	free(d);
 	free(lock_file);
-	return errno;
+	krb5_set_error_string(context, "dbm_open(%s): %s", db->name,
+			      strerror(ret));
+	return ret;
     }
     d->lock_fd = open(lock_file, O_RDWR | O_CREAT, 0600);
-    free(lock_file);
     if(d->lock_fd < 0){
+	ret = errno;
 	dbm_close(d->db);
 	free(d);
-	return errno;
+	krb5_set_error_string(context, "open(%s): %s", lock_file,
+			      strerror(ret));
+	free(lock_file);
+	return ret;
     }
+    free(lock_file);
     db->db = d;
     if((flags & O_ACCMODE) == O_RDONLY)
 	ret = hdb_check_db_format(context, db);
@@ -296,11 +318,19 @@ hdb_ndbm_create(krb5_context context, HDB **db,
 		const char *filename)
 {
     *db = malloc(sizeof(**db));
-    if (*db == NULL)
+    if (*db == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
 
     (*db)->db = NULL;
     (*db)->name = strdup(filename);
+    if ((*db)->name == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
+	free(*db);
+	*db = NULL;
+	return ENOMEM;
+    }
     (*db)->master_key_set = 0;
     (*db)->openp = 0;
     (*db)->open = NDBM_open;
diff --git a/lib/hdb/print.c b/lib/hdb/print.c
index 559c83929..2cb661e8d 100644
--- a/lib/hdb/print.c
+++ b/lib/hdb/print.c
@@ -59,7 +59,7 @@ RCSID("$Id$");
   */
 
 static krb5_error_code
-append_string(krb5_storage *sp, const char *fmt, ...)
+append_string(krb5_context context, krb5_storage *sp, const char *fmt, ...)
 {
     krb5_error_code ret;
     char *s;
@@ -67,15 +67,17 @@ append_string(krb5_storage *sp, const char *fmt, ...)
     va_start(ap, fmt);
     vasprintf(&s, fmt, ap);
     va_end(ap);
-    if(s == NULL)
+    if(s == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     ret = sp->store(sp, s, strlen(s));
     free(s);
     return ret;
 }
 
 static krb5_error_code
-append_hex(krb5_storage *sp, krb5_data *data)
+append_hex(krb5_context context, krb5_storage *sp, krb5_data *data)
 {
     int i, printable = 1;
     char *p;
@@ -87,9 +89,10 @@ append_hex(krb5_storage *sp, krb5_data *data)
 	    break;
 	}
     if(printable)
-	return append_string(sp, "\"%.*s\"", data->length, data->data);
+	return append_string(context, sp, "\"%.*s\"",
+			     data->length, data->data);
     for(i = 0; i < data->length; i++) 
-	append_string(sp, "%02x", ((unsigned char*)data->data)[i]);
+	append_string(context, sp, "%02x", ((unsigned char*)data->data)[i]);
     return 0;
 }
 
@@ -107,13 +110,14 @@ append_event(krb5_context context, krb5_storage *sp, Event *ev)
     char *pr = NULL;
     krb5_error_code ret;
     if(ev == NULL)
-	return append_string(sp, "- ");
+	return append_string(context, sp, "- ");
     if (ev->principal != NULL) {
        ret = krb5_unparse_name(context, ev->principal, &pr);
        if(ret)
            return ret;
     }
-    ret = append_string(sp, "%s:%s ", time2str(ev->time), pr ? pr : "UNKNOWN");
+    ret = append_string(context, sp, "%s:%s ",
+			time2str(ev->time), pr ? pr : "UNKNOWN");
     free(pr);
     return ret;
 }
@@ -129,31 +133,31 @@ entry2string_int (krb5_context context, krb5_storage *sp, hdb_entry *ent)
     ret = krb5_unparse_name(context, ent->principal, &p);
     if(ret)
 	return ret;
-    append_string(sp, "%s ", p);
+    append_string(context, sp, "%s ", p);
     free(p);
     /* --- kvno */
-    append_string(sp, "%d", ent->kvno);
+    append_string(context, sp, "%d", ent->kvno);
     /* --- keys */
     for(i = 0; i < ent->keys.len; i++){
 	/* --- mkvno, keytype */
 	if(ent->keys.val[i].mkvno)
-	    append_string(sp, ":%d:%d:", 
+	    append_string(context, sp, ":%d:%d:", 
 			  *ent->keys.val[i].mkvno, 
 			  ent->keys.val[i].key.keytype);
 	else
-	    append_string(sp, "::%d:", 
+	    append_string(context, sp, "::%d:", 
 			  ent->keys.val[i].key.keytype);
 	/* --- keydata */
-	append_hex(sp, &ent->keys.val[i].key.keyvalue);
-	append_string(sp, ":");
+	append_hex(context, sp, &ent->keys.val[i].key.keyvalue);
+	append_string(context, sp, ":");
 	/* --- salt */
 	if(ent->keys.val[i].salt){
-	    append_string(sp, "%u/", ent->keys.val[i].salt->type);
-	    append_hex(sp, &ent->keys.val[i].salt->salt);
+	    append_string(context, sp, "%u/", ent->keys.val[i].salt->type);
+	    append_hex(context, sp, &ent->keys.val[i].salt->salt);
 	}else
-	    append_string(sp, "-");
+	    append_string(context, sp, "-");
     }
-    append_string(sp, " ");
+    append_string(context, sp, " ");
     /* --- created by */
     append_event(context, sp, &ent->created_by);
     /* --- modified by */
@@ -161,44 +165,44 @@ entry2string_int (krb5_context context, krb5_storage *sp, hdb_entry *ent)
 
     /* --- valid start */
     if(ent->valid_start)
-	append_string(sp, "%s ", time2str(*ent->valid_start));
+	append_string(context, sp, "%s ", time2str(*ent->valid_start));
     else
-	append_string(sp, "- ");
+	append_string(context, sp, "- ");
 
     /* --- valid end */
     if(ent->valid_end)
-	append_string(sp, "%s ", time2str(*ent->valid_end));
+	append_string(context, sp, "%s ", time2str(*ent->valid_end));
     else
-	append_string(sp, "- ");
+	append_string(context, sp, "- ");
     
     /* --- password ends */
     if(ent->pw_end)
-	append_string(sp, "%s ", time2str(*ent->pw_end));
+	append_string(context, sp, "%s ", time2str(*ent->pw_end));
     else
-	append_string(sp, "- ");
+	append_string(context, sp, "- ");
 
     /* --- max life */
     if(ent->max_life)
-	append_string(sp, "%d ", *ent->max_life);
+	append_string(context, sp, "%d ", *ent->max_life);
     else
-	append_string(sp, "- ");
+	append_string(context, sp, "- ");
 
     /* --- max renewable life */
     if(ent->max_renew)
-	append_string(sp, "%d ", *ent->max_renew);
+	append_string(context, sp, "%d ", *ent->max_renew);
     else
-	append_string(sp, "- ");
+	append_string(context, sp, "- ");
     
     /* --- flags */
-    append_string(sp, "%d ", HDBFlags2int(ent->flags));
+    append_string(context, sp, "%d ", HDBFlags2int(ent->flags));
 
     /* --- generation number */
     if(ent->generation) {
-	append_string(sp, "%s:%d:%d", time2str(ent->generation->time),
+	append_string(context, sp, "%s:%d:%d", time2str(ent->generation->time),
 		      ent->generation->usec,
 		      ent->generation->gen);
     } else
-	append_string(sp, "-");
+	append_string(context, sp, "-");
     
     return 0;
 }
@@ -211,8 +215,10 @@ hdb_entry2string (krb5_context context, hdb_entry *ent, char **str)
     krb5_storage *sp;
 
     sp = krb5_storage_emem();
-    if(sp == NULL)
+    if(sp == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     
     ret = entry2string_int(context, sp, ent);
     if(ret) {
@@ -239,8 +245,10 @@ hdb_print_entry(krb5_context context, HDB *db, hdb_entry *entry, void *data)
 
     fflush(f);
     sp = krb5_storage_from_fd(fileno(f));
-    if(sp == NULL)
+    if(sp == NULL) {
+	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
+    }
     
     ret = entry2string_int(context, sp, entry);
     if(ret) {