Index: libabac/abac.c
===================================================================
--- libabac/abac.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -14,5 +14,5 @@
 #include "abac_verifier.h"
 
-int debug=0;
+static int debug=0;
 abac_id_cert_t **abac_context_principals(abac_context_t *ctx);
 void abac_context_id_credentials_free(abac_id_cert_t **id_credentials);
@@ -300,4 +300,5 @@
     abac_list_free(cred_list);
 
+/* EXTRA: list of principal stored within the context.. */
     if(debug) {
         abac_id_cert_t **ilist=abac_context_principals(ctx);
Index: libabac/abac_attribute.c
===================================================================
--- libabac/abac_attribute.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_attribute.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -19,6 +19,4 @@
 
 #define DEFAULT_OUTPUT_FORMAT "GENIv1.1"
-
-static int debug=0;
 
 // a GENI XML attribute chunk might contain multiple 
@@ -106,6 +104,5 @@
 
     // NULL until baked
-    attr->cert.ptr=NULL;
-    attr->cert.len=0;
+    attr->cert=abac_chunk_new(NULL,0);
 
     *ret = attr;
@@ -130,5 +127,4 @@
     gmtime_r(&etime, not_after);
 
-    if(debug) fprintf(stderr,"validity from the xml blob is %ld\n",validity);
     if(validity == 0)
         return ABAC_FAILURE;
@@ -281,6 +277,5 @@
         return 0;
 
-    attr->cert.ptr = (unsigned char *)attr_cert;
-    attr->cert.len = strlen(attr_cert);
+    attr->cert=abac_chunk_new(attr_cert,strlen(attr_cert));
 
     return 1;
@@ -297,10 +292,9 @@
     abac_chunk_t chunk= {NULL,0};
 
-    if (attr->cert.ptr == NULL)
+    if (abac_chunk_null(attr->cert))
         return chunk;
 
     /* return the xml chunk */
-    chunk.ptr= (unsigned char *)abac_xstrdup((char *)attr->cert.ptr);
-    chunk.len=attr->cert.len;
+    chunk= abac_chunk_dup(attr->cert.ptr, attr->cert.len);
     return chunk;
 }
@@ -315,6 +309,4 @@
     /* make a copy of rle_string */
     char *role_string=abac_xstrdup(rstring);
-
-    if(debug) fprintf(stderr,"loading -> %s \n", role_string);
 
     char *head_tail[2];
@@ -353,6 +345,6 @@
     attr->role =abac_xstrdup(tmp+1);
 
-    attr->cert.ptr=(unsigned char *)abac_xstrdup(xml);
-    attr->cert.len=strlen(xml);
+    attr->cert=abac_chunk_dup(xml,strlen(xml));
+
     attr->output_format = NULL;
 
@@ -437,5 +429,5 @@
     assert(attr != NULL);
 
-    if (attr->cert.ptr == NULL)
+    if (abac_chunk_null(attr->cert))
         return ABAC_FAILURE;
 
@@ -448,5 +440,5 @@
 // returns ABAC_FAILURE if the cert hasn't been baked
 int abac_attribute_write_file(abac_attribute_t *attr, const char *fname) {
-    if (attr->cert.ptr == NULL)
+    if (abac_chunk_null(attr->cert))
         return ABAC_FAILURE;
 
@@ -472,5 +464,4 @@
 void abac_attribute_free(abac_attribute_t *attr) {
 
-if(debug) fprintf(stderr,"calling abac_attribute_free on %s\n", attr->head_string);
     int i = 0;
 
@@ -490,5 +481,5 @@
     if ( attr->keymap ) abac_keyid_map_free(attr->keymap);
 
-    free(attr->cert.ptr);
+    abac_chunk_free(attr->cert);
 
     free(attr);
Index: libabac/abac_id.c
===================================================================
--- libabac/abac_id.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_id.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -131,11 +131,9 @@
     char *new_naked_pem=abac_xstrdup(naked_pem);
     char *pem=make_pem_from_naked_pem(new_naked_pem);
-    chunk.ptr=(unsigned char *)pem;
-    chunk.len=strlen(pem);
+    chunk=abac_chunk_new(pem,strlen(pem));
     X509 *cert=abac_load_id_from_chunk(chunk.ptr,chunk.len);
     *sha1=NULL;
     if(cert) {
         *sha1 = abac_get_keyid(cert);
-        if(debug) fprintf(stderr,"sha1 found is %s\n", *sha1);
         } else {
             *sha1=NULL;
@@ -144,5 +142,5 @@
     X509_free(cert);
     free(new_naked_pem);
-    free(pem);
+    abac_chunk_free(chunk);
 }
 
@@ -378,5 +376,4 @@
     if(id->key)
         kptr=abac_string_privkey(id->key);
-    int len=0;
     
     char *tmp=NULL;
@@ -388,8 +385,11 @@
             tmp=(char *)ptr;
     }
-    len=strlen(tmp);
-
+
+/*
     chunk->ptr=(unsigned char *)tmp;
     chunk->len=len;
+*/
+    *chunk=abac_chunk_new(tmp,strlen(tmp));
+
     return ABAC_CERT_SUCCESS;
 }
@@ -401,5 +401,5 @@
     if(ptr)
         len=strlen((char *)ptr);
-    abac_chunk_t ret = {ptr, len };
+    abac_chunk_t ret = abac_chunk_new(ptr,len);
     return ret;
 }
@@ -481,5 +481,5 @@
     if(ptr) len=strlen( (char *)ptr);
 
-    abac_chunk_t ret = { ptr, len };
+    abac_chunk_t ret = abac_chunk_new(ptr,len);
     return ret;
 }
@@ -495,5 +495,5 @@
     if(ptr) len=strlen( (char *)ptr);
 
-    abac_chunk_t ret = { ptr, len };
+    abac_chunk_t ret = abac_chunk_new(ptr,len);
     return ret;
 }
Index: libabac/abac_openssl.c
===================================================================
--- libabac/abac_openssl.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_openssl.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -532,4 +532,6 @@
         goto error;
 
+    if(serial) free(serial);
+    if(bn) BN_free(bn);
     return cert;
 
Index: libabac/abac_util.c
===================================================================
--- libabac/abac_util.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_util.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -29,4 +29,36 @@
    chunk.len=0;
    chunk.ptr=NULL;
+}
+
+abac_chunk_t abac_chunk_dup(char *ptr, int len)
+{
+    abac_chunk_t chunk;                                       
+    if(len!=0) {                                              
+       chunk.ptr=(unsigned char *) abac_xstrdup(ptr);         
+       chunk.len=len;
+       } else {                                               
+           chunk.ptr=NULL;                                    
+           chunk.len=0;                                       
+    }                                                         
+    return chunk;                                             
+}                
+
+abac_chunk_t abac_chunk_new(char *ptr, int len)
+{
+    abac_chunk_t chunk;                                       
+    if(len!=0) {                                              
+       chunk.ptr=(unsigned char *) ptr;
+       chunk.len=len;
+       } else {                                               
+           chunk.ptr=NULL;                                    
+           chunk.len=0;                                       
+    }                                                         
+    return chunk;                                             
+}                
+
+int abac_chunk_null(abac_chunk_t chunk)
+{
+    if(chunk.ptr==NULL) return 1;
+    return 0;
 }
 
Index: libabac/abac_util.h
===================================================================
--- libabac/abac_util.h	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_util.h	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -14,4 +14,9 @@
 
 void abac_chunk_free(abac_chunk_t);
+abac_chunk_t abac_chunk_dup(char *, int);
+abac_chunk_t abac_chunk_new(char *, int);
+int abac_chunk_null(abac_chunk_t);
+
+
 void *abac_xmalloc(size_t);
 char *abac_xstrdup(char *);
Index: libabac/abac_xml.c
===================================================================
--- libabac/abac_xml.c	(revision 3f21704b89dc68f3aeddd38f408b77caae37dcb5)
+++ libabac/abac_xml.c	(revision 52ce99549462f6d24ed51cfb15919a028041c3e4)
@@ -35,5 +35,4 @@
 extern void abac_get_sha_from_nake_pem(char *npem, char **sha1);
 extern void abac_split(char *string, char *delim, char **ret, int *num);
-static int debug=0;
 
 /* from Ted's reader */
@@ -452,9 +451,7 @@
 static void extract_owner_sha1(xmlChar *pem, xmlChar **sha1) {
     abac_get_sha_from_nake_pem((char *) pem, (char **)sha1); 
-    if(debug) fprintf(stderr,"owner sha1 is (%s)..\n", *sha1);
 }
 static void extract_target_sha1(xmlChar *pem, xmlChar **sha1) {
     abac_get_sha_from_nake_pem((char *) pem,(char **)sha1); 
-    if(debug) fprintf(stderr,"group sha1 is (%s)..\n", *sha1);
 }
 
