diff -Nru db-4.5.20.orig/rep/rep_method.c db-4.5.20/rep/rep_method.c
--- db-4.5.20.orig/rep/rep_method.c	2006-11-18 10:37:10.000000000 +0100
+++ db-4.5.20/rep/rep_method.c	2006-11-18 10:47:38.000000000 +0100
@@ -526,10 +526,12 @@
 		 * will allow the client to either perform recovery or
 		 * simply join in.
 		 */
-		if (announce)
+		if (announce) {
+			if ((ret = __dbt_usercopy(dbenv, dbt)) != 0)
+				goto err;
 			(void)__rep_send_message(dbenv,
 			    DB_EID_BROADCAST, REP_NEWCLIENT, NULL, dbt, 0, 0);
-		else
+		} else
 			(void)__rep_send_message(dbenv,
 			    DB_EID_BROADCAST, REP_ALIVE_REQ, NULL, NULL, 0, 0);
 	}
@@ -553,6 +555,7 @@
 	}
 	if (pending_event != DB_EVENT_NO_SUCH_EVENT)
 		DB_EVENT(dbenv, pending_event, NULL);
+	__dbt_userfree(dbenv, dbt, NULL, NULL);
 	return (ret);
 }
 
diff -Nru db-4.5.20.orig/rep/rep_record.c db-4.5.20/rep/rep_record.c
--- db-4.5.20.orig/rep/rep_record.c	2006-11-18 10:37:10.000000000 +0100
+++ db-4.5.20/rep/rep_record.c	2006-11-18 10:47:38.000000000 +0100
@@ -163,6 +163,14 @@
 		return (EINVAL);
 	}
 
+	if ((ret = __dbt_usercopy(dbenv, control)) != 0 ||
+ 	    (ret = __dbt_usercopy(dbenv, rec)) != 0) {
+ 		__dbt_userfree(dbenv, control, rec, NULL);
+ 		__db_errx(dbenv,
+ 	"DB_ENV->rep_process_message: error retrieving DBT contents");
+ 		return ret;
+ 	}
+
 	ret = 0;
 	db_rep = dbenv->rep_handle;
 	rep = db_rep->region;
@@ -621,6 +629,7 @@
 			*ret_lsnp = rp->lsn;
 		ret = DB_REP_NOTPERM;
 	}
+	__dbt_userfree(dbenv, control, rec, NULL);
 	return (ret);
 }