--- servers/slapd/sets.c.its4873-nocvs	2007-01-02 23:43:58.000000000 +0200
+++ servers/slapd/sets.c	2007-03-15 16:46:31.000000000 +0200
@@ -181,6 +181,12 @@
 				}
 			}
 			BER_BVZERO( &set[ last ] );
+
+			/* We have already copied, duplicated or freed
+			 * the values in lset and rset, so don't free
+			 * them again!
+			 */
+			op_flags |= SLAP_SET_LREFVAL|SLAP_SET_RREFVAL;
 		}
 		break;
 
@@ -264,17 +270,10 @@
 	}
 
 done:;
-	if ( !( op_flags & SLAP_SET_LREFARR ) && lset != NULL ) {
-		if ( !( op_flags & SLAP_SET_LREFVAL ))
-			cp->set_op->o_tmpfree( lset->bv_val, cp->set_op->o_tmpmemctx );
-		cp->set_op->o_tmpfree( lset, cp->set_op->o_tmpmemctx );
-	}
-
-	if ( !( op_flags & SLAP_SET_RREFARR ) && rset != NULL ) {
-		if ( !( op_flags & SLAP_SET_RREFVAL ))
-			cp->set_op->o_tmpfree( rset->bv_val, cp->set_op->o_tmpmemctx );
-		cp->set_op->o_tmpfree( rset, cp->set_op->o_tmpmemctx );
-	}
+	if ( lset != NULL )
+		slap_set_dispose( cp, lset, SLAP_SET_LREF2REF( op_flags ));
+	if ( rset != NULL )
+		slap_set_dispose( cp, rset, SLAP_SET_RREF2REF( op_flags ));
 
 	return set;
 }