diff --git a/checkin_notes b/checkin_notes
index 2a856cb49f..bf37e7ee90 100755
--- a/checkin_notes
+++ b/checkin_notes
@@ -3138,3 +3138,15 @@ David  Feb 10 2003
     client/
         client_types.C
         net_xfer.C
+    
+David  Feb 10 2003
+    - attempt to fix bugs by eliminating dynamic allocation
+
+    client/
+        client_state.C
+        client_types.C,h
+        cs_scheduler.C
+        scheduler_op.C
+        test_file_xfer.C
+    lib/
+        parse.C,h
diff --git a/client/app.C b/client/app.C
index 57bb6345df..3326ed473d 100644
--- a/client/app.C
+++ b/client/app.C
@@ -513,7 +513,7 @@ bool ACTIVE_TASK::read_stderr_file() {
     sprintf(path, "%s%s%s", slot_dir, PATH_SEPARATOR, STDERR_FILE);
     FILE* f = fopen(path, "r");
     if (f) {
-        n = fread(result->stderr_out, 1, STDERR_MAX_LEN, f);
+        n = fread(result->stderr_out, 1, sizeof(result->stderr_out), f);
         result->stderr_out[n] = 0;
         fclose(f);
             return true;
diff --git a/client/client_state.C b/client/client_state.C
index 751364f981..9faa62736f 100644
--- a/client/client_state.C
+++ b/client/client_state.C
@@ -1219,7 +1219,7 @@ void CLIENT_STATE::set_client_state_dirty(char* source) {
 int CLIENT_STATE::report_project_error(
     RESULT& res, int err_num, char *err_msg
     ) {
-    char total_err[STDERR_MAX_LEN];
+    char total_err[MAX_BLOB_LEN];
     unsigned int i;
     int failnum;
     
@@ -1244,13 +1244,13 @@ int CLIENT_STATE::report_project_error(
         res.signal
     );
     
-    if (strlen(res.stderr_out)+strlen(total_err) < STDERR_MAX_LEN) {
+    if (strlen(res.stderr_out)+strlen(total_err) < MAX_BLOB_LEN) {
         strcat(res.stderr_out, total_err );
     }
     
     if ((res.state == RESULT_FILES_DOWNLOADED) && err_num) {            
         sprintf(total_err,"<couldnt_start>%d</couldnt_start>\n", err_num);
-        if (strlen(res.stderr_out)+strlen(total_err) < STDERR_MAX_LEN) {
+        if (strlen(res.stderr_out)+strlen(total_err) < MAX_BLOB_LEN) {
             strcat(res.stderr_out, total_err );
         }
     }
@@ -1266,7 +1266,7 @@ int CLIENT_STATE::report_project_error(
                     "</download_error>\n",
                     res.wup->input_files[i].file_info->name, failnum
                 );
-                if (strlen(res.stderr_out)+strlen(total_err) < STDERR_MAX_LEN ) {
+                if (strlen(res.stderr_out)+strlen(total_err) < MAX_BLOB_LEN ) {
                     strcat( res.stderr_out, total_err );
                 }
             }
@@ -1283,7 +1283,7 @@ int CLIENT_STATE::report_project_error(
                     "</upload_error>\n",
                     res.output_files[i].file_info->name, failnum
                 );
-                if (strlen(res.stderr_out)+strlen(total_err) < STDERR_MAX_LEN ) {
+                if (strlen(res.stderr_out)+strlen(total_err) < MAX_BLOB_LEN ) {
                     strcat( res.stderr_out, total_err );
                 }
             }
diff --git a/client/client_types.C b/client/client_types.C
index 58003ebd1f..f8727ed580 100644
--- a/client/client_types.C
+++ b/client/client_types.C
@@ -33,7 +33,7 @@
 PROJECT::PROJECT() {
     strcpy(master_url,"");
     strcpy(authenticator,"");
-    project_specific_prefs = NULL;
+    strcpy(project_specific_prefs, "");
     resource_share = 0;
     strcpy(project_name,"");
     strcpy(user_name,"");
@@ -47,7 +47,7 @@ PROJECT::PROJECT() {
     host_create_time = 0;
     exp_avg_cpu = 0;
     exp_avg_mod_time = 0;
-    code_sign_key = NULL;
+    strcpy(code_sign_key, "");
     nrpc_failures = 0;
     min_rpc_time = 0;
     master_fetch_failures = 0;
@@ -57,8 +57,6 @@ PROJECT::PROJECT() {
 }
 
 PROJECT::~PROJECT() {
-    if (project_specific_prefs) free(project_specific_prefs);
-    if (code_sign_key) free(code_sign_key);
 }
 
 // parse project fields from account_*.xml
@@ -69,7 +67,6 @@ int PROJECT::parse_account(FILE* in) {
 
     strcpy(master_url, "");
     strcpy(authenticator, "");
-    if (project_specific_prefs) free(project_specific_prefs);
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "<account>")) continue;
         if (match_tag(buf, "</account>")) return 0;
@@ -77,9 +74,13 @@ int PROJECT::parse_account(FILE* in) {
         else if (parse_str(buf, "<authenticator>", authenticator, sizeof(authenticator))) continue;
         else if (parse_double(buf, "<resource_share>", resource_share)) continue;
         else if (match_tag(buf, "<project_specific>")) {
-            retval = dup_element_contents(in, "</project_specific>", &p);
+            retval = copy_element_contents(
+                in,
+                "</project_specific>",
+                project_specific_prefs,
+                sizeof(project_specific_prefs)
+            );
             if (retval) return ERR_XML_PARSE;
-            project_specific_prefs = p;
             continue;
         }
         else fprintf(stderr, "PROJECT::parse_account(): unrecognized: %s\n", buf);
@@ -120,7 +121,12 @@ int PROJECT::parse_state(FILE* in) {
         else if (parse_double(buf, "<exp_avg_cpu>", exp_avg_cpu)) continue;
         else if (parse_int(buf, "<exp_avg_mod_time>", exp_avg_mod_time)) continue;
         else if (match_tag(buf, "<code_sign_key>")) {
-            dup_element_contents(in, "</code_sign_key>", &code_sign_key);
+            copy_element_contents(
+                in,
+                "</code_sign_key>",
+                code_sign_key,
+                sizeof(code_sign_key)
+            );
             //fprintf(stderr, "code_sign_key: %s\n", code_sign_key);
         }
         else if (parse_int(buf, "<nrpc_failures>", nrpc_failures)) continue;
@@ -203,9 +209,7 @@ void PROJECT::copy_state_fields(PROJECT& p) {
     host_create_time = p.host_create_time;
     exp_avg_cpu = p.exp_avg_cpu;
     exp_avg_mod_time = p.exp_avg_mod_time;
-    if (p.code_sign_key) {
-        code_sign_key = strdup(p.code_sign_key);
-    }
+    strcpy(code_sign_key, p.code_sign_key);
     nrpc_failures = p.nrpc_failures;
     min_rpc_time = p.min_rpc_time;
 }
@@ -237,9 +241,6 @@ FILE_INFO::FILE_INFO() {
 }
 
 FILE_INFO::~FILE_INFO() {
-    if (xml_signature) free(xml_signature);
-    if (file_signature) free(file_signature);
-    if (signed_xml) free(signed_xml);
 }
 
 // Set the appropriate permissions depending on whether
@@ -289,21 +290,22 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
     urls.clear();
     start_url = -1;
     current_url = -1;
-    if (from_server) {
-        signed_xml = strdup("");
-    } else {
-        signed_xml = NULL;
-    }
-    xml_signature = NULL;
-    file_signature = NULL;
+    strcpy(signed_xml, "");
+    strcpy(xml_signature, "");
+    strcpy(file_signature, "");
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "</file_info>")) return 0;
         else if (match_tag(buf, "<xml_signature>")) {
-            dup_element_contents(in, "</xml_signature>", &xml_signature);
+            copy_element_contents(
+                in,
+                "</xml_signature>",
+                xml_signature,
+                sizeof(xml_signature)
+            );
             continue;
         }
         if (from_server) {
-            strcatdup(signed_xml, buf);
+            strcat(signed_xml, buf);
         }
         if (parse_str(buf, "<name>", name, sizeof(name))) continue;
         else if (parse_str(buf, "<url>", url.text, sizeof(url.text))) {
@@ -311,7 +313,12 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
             continue;
         }
         else if (match_tag(buf, "<file_signature>")) {
-            dup_element_contents(in, "</file_signature>", &file_signature);
+            copy_element_contents(
+                in,
+                "</file_signature>",
+                file_signature,
+                sizeof(file_signature)
+            );
             continue;
         }
         else if (parse_str(buf, "<md5_cksum>", md5_cksum, sizeof(md5_cksum))) continue;
@@ -334,7 +341,12 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
             }
         }
         else if (!from_server && match_tag(buf, "<signed_xml>")) {
-            dup_element_contents(in, "</signed_xml>", &signed_xml);
+            copy_element_contents(
+                in,
+                "</signed_xml>",
+                signed_xml,
+                sizeof(signed_xml)
+            );
             continue;
         }
         else fprintf(stderr, "FILE_INFO::parse(): unrecognized: %s\n", buf);
diff --git a/client/client_types.h b/client/client_types.h
index 4d4715b7d6..d0c7bffff3 100644
--- a/client/client_types.h
+++ b/client/client_types.h
@@ -34,7 +34,7 @@
 
 #include "hostinfo.h"
 
-#define STDERR_MAX_LEN 4096
+#define MAX_BLOB_LEN 4096
 #define DEFAULT_MAX_PROCESSING  1e10
 #define DEFAULT_MAX_DISK        1e10
 
@@ -53,7 +53,7 @@ public:
     char master_url[256];       // url of site that contains scheduler tags
                                 // for this project
     char authenticator[256];    // user's authenticator on this project
-    char* project_specific_prefs;   // without enclosing tags
+    char project_specific_prefs[MAX_BLOB_LEN];   // without enclosing tags
     double resource_share;      // project's resource share
                                 // relative to other projects.  Arbitrary scale.
 
@@ -73,7 +73,7 @@ public:
     unsigned int host_create_time; // as reported by server 
     double exp_avg_cpu;         // exponentially weighted CPU time
     int exp_avg_mod_time;       // last time average was changed
-    char* code_sign_key;
+    char code_sign_key[MAX_BLOB_LEN];
     int nrpc_failures;          // # of consecutive times we've failed to
                                 // contact all scheduling servers
     int min_rpc_time;           // earliest time to contact any server
@@ -128,9 +128,9 @@ public:
     vector<STRING256> urls;
     int start_url;
     int current_url;
-    char* signed_xml;
-    char* xml_signature;
-    char* file_signature;
+    char signed_xml[MAX_BLOB_LEN];
+    char xml_signature[MAX_BLOB_LEN];
+    char file_signature[MAX_BLOB_LEN];
 
     FILE_INFO();
     ~FILE_INFO();
@@ -220,7 +220,7 @@ struct RESULT {
     int signal;             // the signal caught by the active_task,
                 // defined only if active_task_state is PROCESS_SIGNALED
     int active_task_state; // the state of the active task corresponding to this result
-    char stderr_out[STDERR_MAX_LEN];
+    char stderr_out[MAX_BLOB_LEN];
     
     APP* app;
     WORKUNIT* wup;
diff --git a/client/cs_scheduler.C b/client/cs_scheduler.C
index c4c438d8cb..39091b94a4 100644
--- a/client/cs_scheduler.C
+++ b/client/cs_scheduler.C
@@ -387,8 +387,8 @@ int CLIENT_STATE::handle_scheduler_reply(
     //
 
     if (sr.code_sign_key) {
-        if (!project->code_sign_key) {
-            project->code_sign_key = strdup(sr.code_sign_key);
+        if (!strlen(project->code_sign_key)) {
+            strcpy(project->code_sign_key, sr.code_sign_key);
         } else {
             if (sr.code_sign_key_signature) {
                 retval = verify_string2(
@@ -396,8 +396,7 @@ int CLIENT_STATE::handle_scheduler_reply(
                     project->code_sign_key, signature_valid
                 );
                 if (!retval && signature_valid) {
-                    free(project->code_sign_key);
-                    project->code_sign_key = strdup(sr.code_sign_key);
+                    strcpy(project->code_sign_key, sr.code_sign_key);
                 } else {
                     fprintf(stdout,
                         "New code signing key from %s doesn't validate\n",
diff --git a/client/scheduler_op.C b/client/scheduler_op.C
index 57d8b6814f..1c2e55286a 100644
--- a/client/scheduler_op.C
+++ b/client/scheduler_op.C
@@ -533,20 +533,40 @@ int SCHEDULER_REPLY::parse(FILE* in) {
         } else if (parse_int(buf, "<request_delay>", request_delay)) {
             continue;
         } else if (match_tag(buf, "<global_preferences>")) {
-            retval = dup_element_contents(in, "</global_preferences>", &global_prefs_xml);
+            retval = copy_element_contents(
+                in,
+                "</global_preferences>",
+                global_prefs_xml,
+                sizeof(global_prefs_xml)
+            );
             if (retval) return ERR_XML_PARSE;
         } else if (match_tag(buf, "<project_preferences>")) {
-            retval = dup_element_contents(in, "</project_preferences>", &project_prefs_xml);
+            retval = copy_element_contents(
+                in,
+                "</project_preferences>",
+                project_prefs_xml,
+                sizeof(project_prefs_xml)
+            );
             if (retval) return ERR_XML_PARSE;
         } else if (match_tag(buf, "<code_sign_key>")) {
-            retval = dup_element_contents(in, "</code_sign_key>", &code_sign_key);
+            retval = copy_element_contents(
+                in,
+                "</code_sign_key>",
+                code_sign_key,
+                sizeof(code_sign_key)
+            );
             //fprintf(stderr, "code_sign_key: %s\n", code_sign_key);
             if (retval) {
                 fprintf(stderr, "error: SCHEDULER_REPLY.parse: xml parsing error\n");
                 return ERR_XML_PARSE;
             }
         } else if (match_tag(buf, "<code_sign_key_signature>")) {
-            retval = dup_element_contents(in, "</code_sign_key_signature>", &code_sign_key_signature);
+            retval = copy_element_contents(
+                in,
+                "</code_sign_key_signature>",
+                code_sign_key_signature,
+                sizeof(code_sign_key_signature)
+            );
             if (retval) return ERR_XML_PARSE;
         } else if (match_tag(buf, "<app>")) {
             APP app;
diff --git a/client/test_file_xfer.C b/client/test_file_xfer.C
index 9c1ca8524d..3091fa39f3 100644
--- a/client/test_file_xfer.C
+++ b/client/test_file_xfer.C
@@ -75,18 +75,20 @@ int main() {
         strcpy(fi2.name, "test_fx_in");
         strcpy(str.text, UPLOAD_URL);
         fi2.urls.push_back(str);
-        fi2.signed_xml = \
+        strcpy(fi2.signed_xml,
             "    <name>uc_wu_1_0</name>\n"
             "    <generated_locally/>\n"
             "    <upload_when_present/>\n"
             "    <max_nbytes>10000</max_nbytes>\n"
-            "    <url>http://localhost/upload/uc_wu_1_0</url>\n";
-        fi2.xml_signature = \
+            "    <url>http://localhost/upload/uc_wu_1_0</url>\n"
+        );
+        strcpy(fi2.xml_signature,
             "9d1f8152371c67af1d26b25db104014dbf7e9ad3b61fc8334ee06e01c7529b1a\n"
             "7681c3e7c7828525361a01040d1197147286085231ee5d2554e59ecb40b3e6a5\n"
             "afbaf00ff15bc5b1acf5aa6318bc84f2671a9502ada9c2ce37a9c45480a0e3b7\n"
             "b3dcb6c3bf09feaebc81b76063ef12b0031cf041eaef811166839533067b74f6\n"
-            ".\n";
+            ".\n"
+        );
         retval = fx2->init_upload(fi2);
         if (retval) {
             printf("init_upload failed\n");
diff --git a/lib/parse.C b/lib/parse.C
index 518ba8e936..051931c3f6 100644
--- a/lib/parse.C
+++ b/lib/parse.C
@@ -131,6 +131,22 @@ int dup_element_contents(FILE* in, char* end_tag, char** pp) {
     return 1;
 }
 
+// copy from a file to static buffer
+//
+int copy_element_contents(FILE* in, char* end_tag, char* p, int len) {
+    char buf[256];
+
+    strcpy(p, "");
+    while (fgets(buf, 256, in)) {
+        if (strstr(buf, end_tag)) {
+            return 0;
+        }
+        strcat(p, buf);
+    }
+    fprintf(stderr, "copy_element_contents(): no end tag\n");
+    return 1;
+}
+
 // read a file into a malloc'd string
 //
 int read_file_malloc(char* pathname, char*& str) {
diff --git a/lib/parse.h b/lib/parse.h
index 3280e69224..80f1e751a3 100644
--- a/lib/parse.h
+++ b/lib/parse.h
@@ -28,5 +28,6 @@ extern bool match_tag(char*, char*);
 extern void copy_stream(FILE* in, FILE* out);
 extern void strcatdup(char*& p, char* buf);
 extern int dup_element_contents(FILE* in, char* end_tag, char** pp);
+extern int copy_element_contents(FILE* in, char* end_tag, char* p, int len);
 extern int read_file_malloc(char* pathname, char*& str);
 extern void replace_element(char* buf, char* start, char* end, char* replacement);