9.9.5rc1

130 files changed, 1614 insertions, 685 deletions

diff --git a/lib/bind9/api b/lib/bind9/api
index 1a861f8b..0adc934e 100644
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -5,5 +5,5 @@
 # 9.9: 90-109
 # 9.9-sub: 130-139
 LIBINTERFACE = 90
-LIBREVISION = 8
+LIBREVISION = 9
 LIBAGE = 0
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 61574e81..af1b87ae 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -25,6 +25,7 @@
 
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/file.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
@@ -1145,7 +1146,7 @@ validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
 				void *ptr;
 
 				DE_CONST(stack, ptr);
-				memcpy(new, stack, oldsize);
+				memmove(new, stack, oldsize);
 				isc_mem_put(mctx, ptr, oldsize);
 			}
 			stack = new;
@@ -1776,6 +1777,35 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
+	 * Warn if key-directory doesn't exist
+	 */
+	obj = NULL;
+	tresult = cfg_map_get(zoptions, "key-directory", &obj);
+	if (tresult == ISC_R_SUCCESS) {
+		const char *dir = cfg_obj_asstring(obj);
+		tresult = isc_file_isdirectory(dir);
+		switch (tresult) {
+		case ISC_R_SUCCESS:
+			break;
+		case ISC_R_FILENOTFOUND:
+			cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+				    "key-directory: '%s' does not exist",
+				    dir);
+			break;
+		case ISC_R_INVALIDFILE:
+			cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+				    "key-directory: '%s' is not a directory",
+				    dir);
+			break;
+		default:
+			cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+				    "key-directory: '%s' %s",
+				    dir, isc_result_totext(tresult));
+			result = tresult;
+		}
+	}
+
+	/*
 	 * Check various options.
 	 */
 	tresult = check_options(zoptions, logctx, mctx, optlevel_zone);
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 3221d30c..dbc6f9cb 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -291,8 +291,8 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
 			return (ISC_R_NOMEMORY);
 
 		/* Copy in the original elements */
-		memcpy(newmem, dest->elements,
-		       dest->length * sizeof(dns_aclelement_t));
+		memmove(newmem, dest->elements,
+			dest->length * sizeof(dns_aclelement_t));
 
 		/* Release the memory for the old elements array */
 		isc_mem_put(dest->mctx, dest->elements,
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index ef7875dc..10d51bc4 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -852,12 +852,12 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		dns_rdataset_current(rdataset, &rdata);
 		if (rdtype == dns_rdatatype_a) {
 			INSIST(rdata.length == 4);
-			memcpy(&ina.s_addr, rdata.data, 4);
+			memmove(&ina.s_addr, rdata.data, 4);
 			isc_sockaddr_fromin(&sockaddr, &ina, 0);
 			hookhead = &adbname->v4;
 		} else {
 			INSIST(rdata.length == 16);
-			memcpy(in6a.s6_addr, rdata.data, 16);
+			memmove(in6a.s6_addr, rdata.data, 16);
 			isc_sockaddr_fromin6(&sockaddr, &in6a, 0);
 			hookhead = &adbname->v6;
 		}
diff --git a/lib/dns/api b/lib/dns/api
index d43a04be..1bf8d3fa 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -5,5 +5,5 @@
 # 9.9: 90-109
 # 9.9-sub: 130-139
 LIBINTERFACE = 102
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 2
diff --git a/lib/dns/diff.c b/lib/dns/diff.c
index 20f8e3c0..4517dade 100644
--- a/lib/dns/diff.c
+++ b/lib/dns/diff.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -79,7 +79,7 @@ dns_difftuple_create(isc_mem_t *mctx,
 
 	datap = (unsigned char *)(t + 1);
 
-	memcpy(datap, name->ndata, name->length);
+	memmove(datap, name->ndata, name->length);
 	dns_name_init(&t->name, NULL);
 	dns_name_clone(name, &t->name);
 	t->name.ndata = datap;
@@ -87,7 +87,7 @@ dns_difftuple_create(isc_mem_t *mctx,
 
 	t->ttl = ttl;
 
-	memcpy(datap, rdata->data, rdata->length);
+	memmove(datap, rdata->data, rdata->length);
 	dns_rdata_init(&t->rdata);
 	dns_rdata_clone(rdata, &t->rdata);
 	t->rdata.data = datap;
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 5063914a..77010414 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -706,8 +706,8 @@ destroy_disp_ok(dns_dispatch_t *disp)
 /*
  * Called when refcount reaches 0 (and safe to destroy).
  *
- * The dispatcher must not be locked.
- * The manager must be locked.
+ * The dispatcher must be locked.
+ * The manager must not be locked.
  */
 static void
 destroy_disp(isc_task_t *task, isc_event_t *event) {
@@ -832,6 +832,7 @@ socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port,
 {
 	dispsocket_t *dispsock;
 
+	REQUIRE(VALID_QID(qid));
 	REQUIRE(bucket < qid->qid_nbuckets);
 
 	dispsock = ISC_LIST_HEAD(qid->sock_table[bucket]);
@@ -1076,6 +1077,7 @@ entry_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
 {
 	dns_dispentry_t *res;
 
+	REQUIRE(VALID_QID(qid));
 	REQUIRE(bucket < qid->qid_nbuckets);
 
 	res = ISC_LIST_HEAD(qid->qid_table[bucket]);
@@ -1428,8 +1430,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 		}
 
 		/*
-		 * If both dispatches are bound to an address then fail as
-		 * the addresses can't be equal (enforced by the IP stack).
+		 * If each dispatch is bound to a different address
+		 * then fail.
 		 *
 		 * Note under Linux a packet can be sent out via IPv4 socket
 		 * and the response be received via a IPv6 socket.
@@ -1444,7 +1446,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 		}
 		isc_sockaddr_anyofpf(&a1, isc_sockaddr_pf(&resp->disp->local));
 		isc_sockaddr_anyofpf(&a2, isc_sockaddr_pf(&disp->local));
-		if (!isc_sockaddr_eqaddr(&a1, &resp->disp->local) &&
+		if (!isc_sockaddr_eqaddr(&disp->local, &resp->disp->local) &&
+		    !isc_sockaddr_eqaddr(&a1, &resp->disp->local) &&
 		    !isc_sockaddr_eqaddr(&a2, &disp->local)) {
 			free_buffer(disp, ev->region.base, ev->region.length);
 			goto unlock;
@@ -2647,8 +2650,7 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
  * MUST be unlocked, and not used by anything.
  */
 static void
-dispatch_free(dns_dispatch_t **dispp)
-{
+dispatch_free(dns_dispatch_t **dispp) {
 	dns_dispatch_t *disp;
 	dns_dispatchmgr_t *mgr;
 	int i;
@@ -3311,17 +3313,17 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	 */
 	LOCK(&qid->lock);
 	id = (dns_messageid_t)dispatch_random(DISP_ARC4CTX(disp));
-	bucket = dns_hash(qid, dest, id, localport);
 	ok = ISC_FALSE;
-	for (i = 0; i < 64; i++) {
+	i = 0;
+	do {
+		bucket = dns_hash(qid, dest, id, localport);
 		if (entry_search(qid, dest, id, localport, bucket) == NULL) {
 			ok = ISC_TRUE;
 			break;
 		}
 		id += qid->qid_increment;
 		id &= 0x0000ffff;
-		bucket = dns_hash(qid, dest, id, localport);
-	}
+	} while (i++ < 64);
 	UNLOCK(&qid->lock);
 
 	if (!ok) {
@@ -3331,9 +3333,9 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 
 	res = isc_mempool_get(disp->mgr->rpool);
 	if (res == NULL) {
-		UNLOCK(&disp->lock);
 		if (dispsocket != NULL)
 			destroy_dispsocket(disp, &dispsocket);
+		UNLOCK(&disp->lock);
 		return (ISC_R_NOMEMORY);
 	}
 
@@ -3708,7 +3710,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 		isc_event_free(ISC_EVENT_PTR(&newsevent));
 		return;
 	}
-	memcpy(buf, sevent->region.base, sevent->n);
+	memmove(buf, sevent->region.base, sevent->n);
 	newsevent->region.base = buf;
 	newsevent->region.length = disp->mgr->buffersize;
 	newsevent->n = sevent->n;
diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c
index 78eff579..7d47c669 100644
--- a/lib/dns/dns64.c
+++ b/lib/dns/dns64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2010, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -83,10 +83,10 @@ dns_dns64_create(isc_mem_t *mctx, isc_netaddr_t *prefix,
 	if (new == NULL)
 		return (ISC_R_NOMEMORY);
 	memset(new->bits, 0, sizeof(new->bits));
-	memcpy(new->bits, prefix->type.in6.s6_addr, prefixlen / 8);
+	memmove(new->bits, prefix->type.in6.s6_addr, prefixlen / 8);
 	if (suffix != NULL)
-		memcpy(new->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
-		       16 - nbytes);
+		memmove(new->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
+			16 - nbytes);
 	new->clients = NULL;
 	if (clients != NULL)
 		dns_acl_attach(clients, &new->clients);
@@ -155,7 +155,7 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 		struct in_addr ina;
 		isc_netaddr_t netaddr;
 
-		memcpy(&ina.s_addr, a, 4);
+		memmove(&ina.s_addr, a, 4);
 		isc_netaddr_fromin(&netaddr, &ina);
 		result = dns_acl_match(&netaddr, NULL, dns64->mapped, env,
 				       &match, NULL);
@@ -168,7 +168,7 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 	nbytes = dns64->prefixlen / 8;
 	INSIST(nbytes <= 12);
 	/* Copy prefix. */
-	memcpy(aaaa, dns64->bits, nbytes);
+	memmove(aaaa, dns64->bits, nbytes);
 	/* Bits 64-71 are zeros. draft-ietf-behave-address-format-04 */
 	if (nbytes == 8)
 		aaaa[nbytes++] = 0;
@@ -180,7 +180,7 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 			aaaa[nbytes++] = 0;
 	}
 	/* Copy suffix. */
-	memcpy(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
+	memmove(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
 	return (ISC_R_SUCCESS);
 }
 
@@ -268,7 +268,7 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 			if (aaaaok == NULL || !aaaaok[i]) {
 
 				dns_rdataset_current(rdataset, &rdata);
-				memcpy(&in6.s6_addr, rdata.data, 16);
+				memmove(&in6.s6_addr, rdata.data, 16);
 				isc_netaddr_fromin6(&netaddr, &in6);
 
 				result = dns_acl_match(&netaddr, NULL,
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 2a4ab4f6..d7addc68 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -295,7 +295,7 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Create an envelope for each rdata: <name|type|class|ttl>.
 	 */
 	isc_buffer_init(&envbuf, data, sizeof(data));
-	memcpy(data, r.base, r.length);
+	memmove(data, r.base, r.length);
 	isc_buffer_add(&envbuf, r.length);
 	isc_buffer_putuint16(&envbuf, set->type);
 	isc_buffer_putuint16(&envbuf, set->rdclass);
@@ -501,10 +501,10 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	if (labels - sig.labels > 0) {
 		isc_buffer_putuint8(&envbuf, 1);
 		isc_buffer_putuint8(&envbuf, '*');
-		memcpy(data + 2, r.base, r.length);
+		memmove(data + 2, r.base, r.length);
 	}
 	else
-		memcpy(data, r.base, r.length);
+		memmove(data, r.base, r.length);
 	isc_buffer_add(&envbuf, r.length);
 	isc_buffer_putuint16(&envbuf, set->type);
 	isc_buffer_putuint16(&envbuf, set->rdclass);
@@ -1040,14 +1040,14 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 	/*
 	 * Extract the header.
 	 */
-	memcpy(header, source_r.base, DNS_MESSAGE_HEADERLEN);
+	memmove(header, source_r.base, DNS_MESSAGE_HEADERLEN);
 
 	/*
 	 * Decrement the additional field counter.
 	 */
-	memcpy(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
+	memmove(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
 	addcount = htons((isc_uint16_t)(ntohs(addcount) - 1));
-	memcpy(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
+	memmove(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
 
 	/*
 	 * Digest the modified header.
diff --git a/lib/dns/gssapi_link.c b/lib/dns/gssapi_link.c
index fab12153..2927b676 100644
--- a/lib/dns/gssapi_link.c
+++ b/lib/dns/gssapi_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -216,7 +216,7 @@ gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	buf = isc_mem_allocate(dst__memory_pool, sig->length);
 	if (buf == NULL)
 		return (ISC_R_FAILURE);
-	memcpy(buf, sig->base, sig->length);
+	memmove(buf, sig->base, sig->length);
 	r.base = buf;
 	r.length = sig->length;
 	REGION_TO_GBUFFER(r, gsig);
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index 1f1a0ca6..d99c5fb0 100644
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -228,9 +228,8 @@ hmacmd5_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_md5_update(&md5ctx, r.base, r.length);
 		isc_md5_final(&md5ctx, hkey->key);
 		keylen = ISC_MD5_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
@@ -505,9 +504,8 @@ hmacsha1_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_sha1_update(&sha1ctx, r.base, r.length);
 		isc_sha1_final(&sha1ctx, hkey->key);
 		keylen = ISC_SHA1_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
@@ -784,9 +782,8 @@ hmacsha224_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_sha224_update(&sha224ctx, r.base, r.length);
 		isc_sha224_final(hkey->key, &sha224ctx);
 		keylen = ISC_SHA224_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
@@ -1063,9 +1060,8 @@ hmacsha256_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_sha256_update(&sha256ctx, r.base, r.length);
 		isc_sha256_final(hkey->key, &sha256ctx);
 		keylen = ISC_SHA256_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
@@ -1342,9 +1338,8 @@ hmacsha384_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_sha384_update(&sha384ctx, r.base, r.length);
 		isc_sha384_final(hkey->key, &sha384ctx);
 		keylen = ISC_SHA384_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
@@ -1621,9 +1616,8 @@ hmacsha512_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		isc_sha512_update(&sha512ctx, r.base, r.length);
 		isc_sha512_final(hkey->key, &sha512ctx);
 		keylen = ISC_SHA512_DIGESTLENGTH;
-	}
-	else {
-		memcpy(hkey->key, r.base, r.length);
+	} else {
+		memmove(hkey->key, r.base, r.length);
 		keylen = r.length;
 	}
 
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 47b64922..2d0b3f5f 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -357,7 +357,7 @@ journal_pos_encode(journal_rawpos_t *raw, journal_pos_t *cooked) {
 static void
 journal_header_decode(journal_rawheader_t *raw, journal_header_t *cooked) {
 	INSIST(sizeof(cooked->format) == sizeof(raw->h.format));
-	memcpy(cooked->format, raw->h.format, sizeof(cooked->format));
+	memmove(cooked->format, raw->h.format, sizeof(cooked->format));
 	journal_pos_decode(&raw->h.begin, &cooked->begin);
 	journal_pos_decode(&raw->h.end, &cooked->end);
 	cooked->index_size = decode_uint32(raw->h.index_size);
@@ -371,7 +371,7 @@ journal_header_encode(journal_header_t *cooked, journal_rawheader_t *raw) {
 
 	INSIST(sizeof(cooked->format) == sizeof(raw->h.format));
 	memset(raw->pad, 0, sizeof(raw->pad));
-	memcpy(raw->h.format, cooked->format, sizeof(raw->h.format));
+	memmove(raw->h.format, cooked->format, sizeof(raw->h.format));
 	journal_pos_encode(&raw->h.begin, &cooked->begin);
 	journal_pos_encode(&raw->h.end, &cooked->end);
 	encode_uint32(cooked->index_size, raw->h.index_size);
@@ -528,7 +528,7 @@ journal_file_create(isc_mem_t *mctx, const char *filename) {
 		return (ISC_R_NOMEMORY);
 	}
 	memset(mem, 0, size);
-	memcpy(mem, &rawheader, sizeof(rawheader));
+	memmove(mem, &rawheader, sizeof(rawheader));
 
 	result = isc_stdio_write(mem, 1, (size_t) size, fp, NULL);
 	if (result != ISC_R_SUCCESS) {
diff --git a/lib/dns/keydata.c b/lib/dns/keydata.c
index 822bd467..cb1ed38d 100644
--- a/lib/dns/keydata.c
+++ b/lib/dns/keydata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -51,7 +51,7 @@ dns_keydata_todnskey(dns_rdata_keydata_t *keydata,
 		dnskey->data = isc_mem_allocate(mctx, dnskey->datalen);
 		if (dnskey->data == NULL)
 			return (ISC_R_NOMEMORY);
-		memcpy(dnskey->data, keydata->data, dnskey->datalen);
+		memmove(dnskey->data, keydata->data, dnskey->datalen);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -82,7 +82,7 @@ dns_keydata_fromdnskey(dns_rdata_keydata_t *keydata,
 		keydata->data = isc_mem_allocate(mctx, keydata->datalen);
 		if (keydata->data == NULL)
 			return (ISC_R_NOMEMORY);
-		memcpy(keydata->data, dnskey->data, keydata->datalen);
+		memmove(keydata->data, dnskey->data, keydata->datalen);
 	}
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 9d2f0a38..01f797cb 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -247,7 +247,7 @@ indent(unsigned int *current, unsigned int to, int tabwidth,
 			int n = t;
 			if (n > N_TABS)
 				n = N_TABS;
-			memcpy(p, tabs, n);
+			memmove(p, tabs, n);
 			p += n;
 			t -= n;
 		}
@@ -268,7 +268,7 @@ indent(unsigned int *current, unsigned int to, int tabwidth,
 		int n = t;
 		if (n > N_SPACES)
 			n = N_SPACES;
-		memcpy(p, spaces, n);
+		memmove(p, spaces, n);
 		p += n;
 		t -= n;
 	}
@@ -358,7 +358,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
@@ -475,7 +475,7 @@ rdataset_totext(dns_rdataset_t *rdataset,
 			isc_buffer_availableregion(target, &r);
 			if (r.length < length)
 				return (ISC_R_NOSPACE);
-			memcpy(r.base, ttlbuf, length);
+			memmove(r.base, ttlbuf, length);
 			isc_buffer_add(target, length);
 			column += length;
 
diff --git a/lib/dns/message.c b/lib/dns/message.c
index e58ec186..901c6b6d 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1675,8 +1675,8 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 		msg->saved.base = isc_mem_get(msg->mctx, msg->saved.length);
 		if (msg->saved.base == NULL)
 			return (ISC_R_NOMEMORY);
-		memcpy(msg->saved.base, isc_buffer_base(&origsource),
-		       msg->saved.length);
+		memmove(msg->saved.base, isc_buffer_base(&origsource),
+			msg->saved.length);
 		msg->free_saved = 1;
 	}
 
@@ -1748,7 +1748,7 @@ dns_message_renderchangebuffer(dns_message_t *msg, isc_buffer_t *buffer) {
 	 * Copy the contents from the old to the new buffer.
 	 */
 	isc_buffer_add(buffer, r.length);
-	memcpy(rn.base, r.base, r.length);
+	memmove(rn.base, r.base, r.length);
 
 	msg->buffer = buffer;
 
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 4fcabb11..fd768d0f 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -971,8 +971,8 @@ dns_name_clone(const dns_name_t *source, dns_name_t *target) {
 				DNS_NAMEATTR_DYNOFFSETS);
 	if (target->offsets != NULL && source->labels > 0) {
 		if (source->offsets != NULL)
-			memcpy(target->offsets, source->offsets,
-			       source->labels);
+			memmove(target->offsets, source->offsets,
+				source->labels);
 		else
 			set_offsets(target, target->offsets, NULL);
 	}
@@ -1001,7 +1001,7 @@ dns_name_fromregion(dns_name_t *name, const isc_region_t *r) {
 		len = (r->length < r2.length) ? r->length : r2.length;
 		if (len > DNS_NAME_MAXWIRE)
 			len = DNS_NAME_MAXWIRE;
-		memcpy(r2.base, r->base, len);
+		memmove(r2.base, r->base, len);
 		name->ndata = r2.base;
 		name->length = len;
 	} else {
@@ -1985,8 +1985,8 @@ dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
 	if (gf) {
 		if (target->length - target->used < gp.length)
 			return (ISC_R_NOSPACE);
-		(void)memcpy((unsigned char *)target->base + target->used,
-			     gp.ndata, (size_t)gp.length);
+		(void)memmove((unsigned char *)target->base + target->used,
+			      gp.ndata, (size_t)gp.length);
 		isc_buffer_add(target, gp.length);
 		go |= 0xc000;
 		if (target->length - target->used < 2)
@@ -1997,8 +1997,8 @@ dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
 	} else {
 		if (target->length - target->used < name->length)
 			return (ISC_R_NOSPACE);
-		(void)memcpy((unsigned char *)target->base + target->used,
-			     name->ndata, (size_t)name->length);
+		(void)memmove((unsigned char *)target->base + target->used,
+			      name->ndata, (size_t)name->length);
 		isc_buffer_add(target, name->length);
 		dns_compress_add(cctx, name, name, offset);
 	}
@@ -2082,8 +2082,8 @@ dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix, dns_name_t *name,
 			memmove(ndata + prefix_length, suffix->ndata,
 				suffix->length);
 		else
-			memcpy(ndata + prefix_length, suffix->ndata,
-			       suffix->length);
+			memmove(ndata + prefix_length, suffix->ndata,
+				suffix->length);
 	}
 
 	/*
@@ -2092,7 +2092,7 @@ dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix, dns_name_t *name,
 	 * copy anything.
 	 */
 	if (copy_prefix && (prefix != name || prefix->buffer != target))
-		memcpy(ndata, prefix->ndata, prefix_length);
+		memmove(ndata, prefix->ndata, prefix_length);
 
 	name->ndata = ndata;
 	name->labels = labels;
@@ -2166,7 +2166,7 @@ dns_name_dup(const dns_name_t *source, isc_mem_t *mctx,
 	if (target->ndata == NULL)
 		return (ISC_R_NOMEMORY);
 
-	memcpy(target->ndata, source->ndata, source->length);
+	memmove(target->ndata, source->ndata, source->length);
 
 	target->length = source->length;
 	target->labels = source->labels;
@@ -2175,8 +2175,8 @@ dns_name_dup(const dns_name_t *source, isc_mem_t *mctx,
 		target->attributes |= DNS_NAMEATTR_ABSOLUTE;
 	if (target->offsets != NULL) {
 		if (source->offsets != NULL)
-			memcpy(target->offsets, source->offsets,
-			       source->labels);
+			memmove(target->offsets, source->offsets,
+				source->labels);
 		else
 			set_offsets(target, target->offsets, NULL);
 	}
@@ -2208,7 +2208,7 @@ dns_name_dupwithoffsets(dns_name_t *source, isc_mem_t *mctx,
 	if (target->ndata == NULL)
 		return (ISC_R_NOMEMORY);
 
-	memcpy(target->ndata, source->ndata, source->length);
+	memmove(target->ndata, source->ndata, source->length);
 
 	target->length = source->length;
 	target->labels = source->labels;
@@ -2218,7 +2218,7 @@ dns_name_dupwithoffsets(dns_name_t *source, isc_mem_t *mctx,
 		target->attributes |= DNS_NAMEATTR_ABSOLUTE;
 	target->offsets = target->ndata + source->length;
 	if (source->offsets != NULL)
-		memcpy(target->offsets, source->offsets, source->labels);
+		memmove(target->offsets, source->offsets, source->labels);
 	else
 		set_offsets(target, target->offsets, NULL);
 
@@ -2398,7 +2398,7 @@ dns_name_tostring(dns_name_t *name, char **target, isc_mem_t *mctx) {
 
 	isc_buffer_usedregion(&buf, &reg);
 	p = isc_mem_allocate(mctx, reg.length + 1);
-	memcpy(p, (char *) reg.base, (int) reg.length);
+	memmove(p, (char *) reg.base, (int) reg.length);
 	p[reg.length] = '\0';
 
 	*target = p;
@@ -2474,7 +2474,7 @@ dns_name_copy(dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
 	ndata = (unsigned char *)target->base + target->used;
 	dest->ndata = target->base;
 
-	memcpy(ndata, source->ndata, source->length);
+	memmove(ndata, source->ndata, source->length);
 
 	dest->ndata = ndata;
 	dest->labels = source->labels;
@@ -2486,7 +2486,7 @@ dns_name_copy(dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
 
 	if (dest->labels > 0 && dest->offsets != NULL) {
 		if (source->offsets != NULL)
-			memcpy(dest->offsets, source->offsets, source->labels);
+			memmove(dest->offsets, source->offsets, source->labels);
 		else
 			set_offsets(dest, dest->offsets, NULL);
 	}
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 8821311f..5d1197d0 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -115,7 +115,7 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 
 	memset(buffer, 0, DNS_NSEC_BUFFERSIZE);
 	dns_name_toregion(target, &r);
-	memcpy(buffer, r.base, r.length);
+	memmove(buffer, r.base, r.length);
 	r.base = buffer;
 	/*
 	 * Use the end of the space for a raw bitmap leaving enough
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 2e25729c..3724118c 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2008-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -98,11 +98,11 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 	*p++ = iterations;
 
 	*p++ = (unsigned char)salt_length;
-	memcpy(p, salt, salt_length);
+	memmove(p, salt, salt_length);
 	p += salt_length;
 
 	*p++ = (unsigned char)hash_length;
-	memcpy(p, nexthash, hash_length);
+	memmove(p, nexthash, hash_length);
 	p += hash_length;
 
 	r.length = (unsigned int)(p - buffer);
@@ -591,7 +591,7 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
 				flags = nsec3.flags;
 			next_length = nsec3.next_length;
 			INSIST(next_length <= sizeof(nexthash));
-			memcpy(nexthash, nsec3.next, next_length);
+			memmove(nexthash, nsec3.next, next_length);
 			dns_rdataset_disassociate(&rdataset);
 			/*
 			 * If the NSEC3 is not for a unsecure delegation then
@@ -688,7 +688,7 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
 					   rdataset.ttl, &rdata, &tuple));
 		CHECK(do_one_tuple(&tuple, db, version, diff));
 		INSIST(old_length <= sizeof(nexthash));
-		memcpy(nexthash, old_next, old_length);
+		memmove(nexthash, old_next, old_length);
 		if (!CREATE(nsec3param->flags))
 			flags = nsec3.flags;
 		dns_rdata_reset(&rdata);
@@ -809,7 +809,7 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
 						   &tuple));
 			CHECK(do_one_tuple(&tuple, db, version, diff));
 			INSIST(old_length <= sizeof(nexthash));
-			memcpy(nexthash, old_next, old_length);
+			memmove(nexthash, old_next, old_length);
 			if (!CREATE(nsec3param->flags))
 				flags = nsec3.flags;
 			dns_rdata_reset(&rdata);
@@ -958,7 +958,7 @@ dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,
 
 	REQUIRE(DNS_RDATA_INITIALIZED(target));
 
-	memcpy(buf + 1, src->data, src->length);
+	memmove(buf + 1, src->data, src->length);
 	buf[0] = 0;
 	target->data = buf;
 	target->length = src->length + 1;
@@ -1097,7 +1097,7 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(&rdataset, &rdata);
 		INSIST(rdata.length <= sizeof(buf));
-		memcpy(buf, rdata.data, rdata.length);
+		memmove(buf, rdata.data, rdata.length);
 
 		/*
 		 * Private NSEC3 record length >= 6.
@@ -1361,7 +1361,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 	if (result == ISC_R_SUCCESS) {
 		next_length = nsec3.next_length;
 		INSIST(next_length <= sizeof(nexthash));
-		memcpy(nexthash, nsec3.next, next_length);
+		memmove(nexthash, nsec3.next, next_length);
 	}
 	dns_rdataset_disassociate(&rdataset);
 	if (result == ISC_R_NOMORE)
@@ -1464,7 +1464,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 		if (result == ISC_R_SUCCESS) {
 			next_length = nsec3.next_length;
 			INSIST(next_length <= sizeof(nexthash));
-			memcpy(nexthash, nsec3.next, next_length);
+			memmove(nexthash, nsec3.next, next_length);
 		}
 		dns_rdataset_disassociate(&rdataset);
 		if (result == ISC_R_NOMORE)
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
index 2a76c852..40081c2d 100644
--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -371,7 +371,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 	cp = buf;
 	if (!i2o_ECPublicKey(eckey, &cp))
 		DST_RET (dst__openssl_toresult(ISC_R_FAILURE));
-	memcpy(r.base, buf + 1, len);
+	memmove(r.base, buf + 1, len);
 	isc_buffer_add(data, len);
 	ret = ISC_R_SUCCESS;
 
@@ -414,7 +414,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 
 	buf[0] = POINT_CONVERSION_UNCOMPRESSED;
-	memcpy(buf + 1, r.base, len);
+	memmove(buf + 1, r.base, len);
 	cp = buf;
 	if (o2i_ECPublicKey(&eckey,
 			    (const unsigned char **) &cp,
diff --git a/lib/dns/opensslgost_link.c b/lib/dns/opensslgost_link.c
index 74d86464..b0578661 100644
--- a/lib/dns/opensslgost_link.c
+++ b/lib/dns/opensslgost_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2010-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -253,7 +253,7 @@ opensslgost_todns(const dst_key_t *key, isc_buffer_t *data) {
 	len = i2d_PUBKEY(pkey, &p);
 	INSIST(len == sizeof(der));
 	INSIST(memcmp(gost_prefix, der, 37) == 0);
-	memcpy(r.base, der + 37, 64);
+	memmove(r.base, der + 37, 64);
 	isc_buffer_add(data, 64);
 
 	return (ISC_R_SUCCESS);
@@ -272,8 +272,8 @@ opensslgost_fromdns(dst_key_t *key, isc_buffer_t *data) {
 
 	if (r.length != 64)
 		return (DST_R_INVALIDPUBLICKEY);
-	memcpy(der, gost_prefix, 37);
-	memcpy(der + 37, r.base, 64);
+	memmove(der, gost_prefix, 37);
+	memmove(der + 37, r.base, 64);
 	isc_buffer_forward(data, 64);
 
 	p = der;
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index d3454a5e..8421c640 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -481,7 +481,7 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		INSIST(prefixlen + digestlen <= sizeof(digest));
 
 		memmove(digest + prefixlen, digest, digestlen);
-		memcpy(digest, prefix, prefixlen);
+		memmove(digest, prefix, prefixlen);
 		status = RSA_private_encrypt(digestlen + prefixlen,
 					     digest, r.base, rsa,
 					     RSA_PKCS1_PADDING);
diff --git a/lib/dns/portlist.c b/lib/dns/portlist.c
index 5bc89f48..754eef66 100644
--- a/lib/dns/portlist.c
+++ b/lib/dns/portlist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -80,7 +80,7 @@ dns_portlist_create(isc_mem_t *mctx, dns_portlist_t **portlistp) {
 	portlist = isc_mem_get(mctx, sizeof(*portlist));
 	if (portlist == NULL)
 		return (ISC_R_NOMEMORY);
-        result = isc_mutex_init(&portlist->lock);
+	result = isc_mutex_init(&portlist->lock);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, portlist, sizeof(*portlist));
 		return (result);
@@ -111,7 +111,7 @@ find_port(dns_element_t *list, unsigned int len, in_port_t port) {
 	for (;;) {
 		if (list[xtry].port == port)
 			return (&list[xtry]);
-	        if (port > list[xtry].port) {
+		if (port > list[xtry].port) {
 			if (xtry == max)
 				break;
 			min = xtry;
@@ -164,8 +164,8 @@ dns_portlist_add(dns_portlist_t *portlist, int af, in_port_t port) {
 			goto unlock;
 		}
 		if (portlist->list != NULL) {
-			memcpy(el, portlist->list,
-			       portlist->allocated * sizeof(*el)); 
+			memmove(el, portlist->list,
+				portlist->allocated * sizeof(*el));
 			isc_mem_put(portlist->mctx, portlist->list,
 				    portlist->allocated * sizeof(*el));
 		}
@@ -215,7 +215,7 @@ isc_boolean_t
 dns_portlist_match(dns_portlist_t *portlist, int af, in_port_t port) {
 	dns_element_t *el;
 	isc_boolean_t result = ISC_FALSE;
-	
+
 	REQUIRE(DNS_VALID_PORTLIST(portlist));
 	REQUIRE(af == AF_INET || af == AF_INET6);
 	LOCK(&portlist->lock);
@@ -227,7 +227,7 @@ dns_portlist_match(dns_portlist_t *portlist, int af, in_port_t port) {
 			if (af == AF_INET6 && (el->flags & DNS_PL_INET6) != 0)
 				result = ISC_TRUE;
 		}
-	}	
+	}
 	UNLOCK(&portlist->lock);
 	return (result);
 }
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 7381b4a3..d97fcce2 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1479,8 +1479,8 @@ create_node(isc_mem_t *mctx, dns_name_t *name, dns_rbtnode_t **nodep) {
 	OLDOFFSETLEN(node) = OFFSETLEN(node) = labels;
 	ATTRS(node) = name->attributes;
 
-	memcpy(NAME(node), region.base, region.length);
-	memcpy(OFFSETS(node), name->offsets, labels);
+	memmove(NAME(node), region.base, region.length);
+	memmove(OFFSETS(node), name->offsets, labels);
 
 #if DNS_RBT_USEMAGIC
 	node->magic = DNS_RBTNODE_MAGIC;
@@ -1841,7 +1841,7 @@ dns_rbt_deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp) {
 		 * information, which will be needed when linking up
 		 * delete to the successor's old location.
 		 */
-		memcpy(tmp, successor, sizeof(dns_rbtnode_t));
+		memmove(tmp, successor, sizeof(dns_rbtnode_t));
 
 		if (IS_ROOT(delete)) {
 			*rootp = successor;
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index ebf04050..013bf34a 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1121,8 +1121,8 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 			version->hash = rbtdb->current_version->hash;
 			version->salt_length =
 				rbtdb->current_version->salt_length;
-			memcpy(version->salt, rbtdb->current_version->salt,
-			       version->salt_length);
+			memmove(version->salt, rbtdb->current_version->salt,
+				version->salt_length);
 		} else {
 			version->flags = 0;
 			version->iterations = 0;
@@ -1706,8 +1706,11 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 
 	nodelock = &rbtdb->node_locks[bucket];
 
+#define KEEP_NODE(n, r) \
+	((n)->data != NULL || (n)->down != NULL || (n) == (r)->origin_node)
+
 	/* Handle easy and typical case first. */
-	if (!node->dirty && (node->data != NULL || node->down != NULL)) {
+	if (!node->dirty && KEEP_NODE(node, rbtdb)) {
 		dns_rbtnode_refdecrement(node, &nrefs);
 		INSIST((int)nrefs >= 0);
 		if (nrefs == 0) {
@@ -1776,12 +1779,11 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	isc_refcount_decrement(&nodelock->references, &refs);
 	INSIST((int)refs >= 0);
 
-	/*
-	 * XXXDCL should this only be done for cache zones?
-	 */
-	if (node->data != NULL || node->down != NULL)
+	if (KEEP_NODE(node, rbtdb))
 		goto restore_locks;
 
+#undef KEEP_NODE
+
 	if (write_locked) {
 		/*
 		 * We can now delete the node.
@@ -2127,8 +2129,8 @@ setnsec3parameters(dns_db_t *db, rbtdb_version_t *version) {
 				if (nsec3param.flags != 0)
 					continue;
 
-				memcpy(version->salt, nsec3param.salt,
-				       nsec3param.salt_length);
+				memmove(version->salt, nsec3param.salt,
+					nsec3param.salt_length);
 				version->hash = nsec3param.hash;
 				version->salt_length = nsec3param.salt_length;
 				version->iterations = nsec3param.iterations;
@@ -4626,12 +4628,12 @@ rpz_findips(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 		switch (rdata.type) {
 		case dns_rdatatype_a:
 			INSIST(rdata.length == 4);
-			memcpy(&ina.s_addr, rdata.data, 4);
+			memmove(&ina.s_addr, rdata.data, 4);
 			isc_netaddr_fromin(&netaddr, &ina);
 			break;
 		case dns_rdatatype_aaaa:
 			INSIST(rdata.length == 16);
-			memcpy(in6a.s6_addr, rdata.data, 16);
+			memmove(in6a.s6_addr, rdata.data, 16);
 			isc_netaddr_fromin6(&netaddr, &in6a);
 			break;
 		default:
@@ -7278,7 +7280,8 @@ getnsec3parameters(dns_db_t *db, dns_dbversion_t *version, dns_hash_t *hash,
 			*hash = rbtversion->hash;
 		if (salt != NULL && salt_length != NULL) {
 			REQUIRE(*salt_length >= rbtversion->salt_length);
-			memcpy(salt, rbtversion->salt, rbtversion->salt_length);
+			memmove(salt, rbtversion->salt,
+				rbtversion->salt_length);
 		}
 		if (salt_length != NULL)
 			*salt_length = rbtversion->salt_length;
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 9dc80d50..69007f88 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -194,7 +194,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index f3ed6259..5bdd1255 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -281,7 +281,7 @@ locator_pton(const char *src, unsigned char *dst) {
 	}
 	if (tp != endp)
 		return (0);
-	memcpy(dst, tmp, NS_LOCATORSZ);
+	memmove(dst, tmp, NS_LOCATORSZ);
 	return (1);
 }
 
@@ -322,7 +322,7 @@ mem_maybedup(isc_mem_t *mctx, void *source, size_t length) {
 		return (source);
 	new = isc_mem_allocate(mctx, length);
 	if (new != NULL)
-		memcpy(new, source, length);
+		memmove(new, source, length);
 
 	return (new);
 }
@@ -589,7 +589,7 @@ dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
 		isc_buffer_availableregion(target, &tr);
 		if (tr.length < rdata->length)
 			return (ISC_R_NOSPACE);
-		memcpy(tr.base, rdata->data, rdata->length);
+		memmove(tr.base, rdata->data, rdata->length);
 		isc_buffer_add(target, rdata->length);
 		return (ISC_R_SUCCESS);
 	}
@@ -1268,7 +1268,7 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 		return (ISC_R_NOSPACE);
 
 	if (tregion.base != sregion.base)
-		memcpy(tregion.base, sregion.base, n);
+		memmove(tregion.base, sregion.base, n);
 	isc_buffer_forward(source, n);
 	isc_buffer_add(target, n);
 	return (ISC_R_SUCCESS);
@@ -1418,7 +1418,7 @@ multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 			return (ISC_R_NOSPACE);
 
 		if (tregion.base != sregion.base)
-			memcpy(tregion.base, sregion.base, n);
+			memmove(tregion.base, sregion.base, n);
 		isc_buffer_forward(source, n);
 		isc_buffer_add(target, n);
 		isc_buffer_activeregion(source, &sregion);
@@ -1469,7 +1469,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
@@ -1595,7 +1595,7 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 	if (length > tr.length)
 		return (ISC_R_NOSPACE);
 	if (tr.base != base)
-		memcpy(tr.base, base, length);
+		memmove(tr.base, base, length);
 	isc_buffer_add(target, length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/ch_3/a_1.c b/lib/dns/rdata/ch_3/a_1.c
index e3f98106..d25fcb50 100644
--- a/lib/dns/rdata/ch_3/a_1.c
+++ b/lib/dns/rdata/ch_3/a_1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -117,7 +117,7 @@ fromwire_ch_a(ARGS_FROMWIRE) {
 	if (tregion.length < 2)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 2);
+	memmove(tregion.base, sregion.base, 2);
 	isc_buffer_forward(source, 2);
 	isc_buffer_add(target, 2);
 
@@ -149,7 +149,7 @@ towire_ch_a(ARGS_TOWIRE) {
 	if (tregion.length < 2)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 2);
+	memmove(tregion.base, sregion.base, 2);
 	isc_buffer_add(target, 2);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/afsdb_18.c b/lib/dns/rdata/generic/afsdb_18.c
index 279f86c6..af95fa12 100644
--- a/lib/dns/rdata/generic/afsdb_18.c
+++ b/lib/dns/rdata/generic/afsdb_18.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -113,7 +113,7 @@ fromwire_afsdb(ARGS_FROMWIRE) {
 		return (ISC_R_NOSPACE);
 	if (sr.length < 2)
 		return (ISC_R_UNEXPECTEDEND);
-	memcpy(tr.base, sr.base, 2);
+	memmove(tr.base, sr.base, 2);
 	isc_buffer_forward(source, 2);
 	isc_buffer_add(target, 2);
 	return (dns_name_fromwire(&name, source, dctx, options, target));
@@ -134,7 +134,7 @@ towire_afsdb(ARGS_TOWIRE) {
 	dns_rdata_toregion(rdata, &sr);
 	if (tr.length < 2)
 		return (ISC_R_NOSPACE);
-	memcpy(tr.base, sr.base, 2);
+	memmove(tr.base, sr.base, 2);
 	isc_region_consume(&sr, 2);
 	isc_buffer_add(target, 2);
 
diff --git a/lib/dns/rdata/generic/eui48_108.c b/lib/dns/rdata/generic/eui48_108.c
index 3e52fec0..b25a7b7e 100644
--- a/lib/dns/rdata/generic/eui48_108.c
+++ b/lib/dns/rdata/generic/eui48_108.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -142,7 +142,7 @@ tostruct_eui48(ARGS_TOSTRUCT) {
 	eui48->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&eui48->common, link);
 
-	memcpy(eui48->eui48, rdata->data, rdata->length);
+	memmove(eui48->eui48, rdata->data, rdata->length);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/rdata/generic/eui64_109.c b/lib/dns/rdata/generic/eui64_109.c
index 245994fd..33d2f637 100644
--- a/lib/dns/rdata/generic/eui64_109.c
+++ b/lib/dns/rdata/generic/eui64_109.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -147,7 +147,7 @@ tostruct_eui64(ARGS_TOSTRUCT) {
 	eui64->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&eui64->common, link);
 
-	memcpy(eui64->eui64, rdata->data, rdata->length);
+	memmove(eui64->eui64, rdata->data, rdata->length);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/rdata/generic/ipseckey_45.c b/lib/dns/rdata/generic/ipseckey_45.c
index 1d2508c4..230d0d1e 100644
--- a/lib/dns/rdata/generic/ipseckey_45.c
+++ b/lib/dns/rdata/generic/ipseckey_45.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2009, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -87,7 +87,7 @@ fromtext_ipseckey(ARGS_FROMTEXT) {
 		isc_buffer_availableregion(target, &region);
 		if (region.length < 4)
 			return (ISC_R_NOSPACE);
-		memcpy(region.base, &addr, 4);
+		memmove(region.base, &addr, 4);
 		isc_buffer_add(target, 4);
 		break;
 
@@ -97,7 +97,7 @@ fromtext_ipseckey(ARGS_FROMTEXT) {
 		isc_buffer_availableregion(target, &region);
 		if (region.length < 16)
 			return (ISC_R_NOSPACE);
-		memcpy(region.base, addr6, 16);
+		memmove(region.base, addr6, 16);
 		isc_buffer_add(target, 16);
 		break;
 
@@ -364,7 +364,7 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 		break;
 
 	case 2:
-		memcpy(ipseckey->in6_addr.s6_addr, region.base, 16);
+		memmove(ipseckey->in6_addr.s6_addr, region.base, 16);
 		isc_region_consume(&region, 16);
 		break;
 
diff --git a/lib/dns/rdata/generic/l32_105.c b/lib/dns/rdata/generic/l32_105.c
index 763ddb95..d191624e 100644
--- a/lib/dns/rdata/generic/l32_105.c
+++ b/lib/dns/rdata/generic/l32_105.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -51,7 +51,7 @@ fromtext_l32(ARGS_FROMTEXT) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < 4)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, &addr, 4);
+	memmove(region.base, &addr, 4);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/l64_106.c b/lib/dns/rdata/generic/l64_106.c
index ff206633..d811d29a 100644
--- a/lib/dns/rdata/generic/l64_106.c
+++ b/lib/dns/rdata/generic/l64_106.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -155,7 +155,7 @@ tostruct_l64(ARGS_TOSTRUCT) {
 
 	dns_rdata_toregion(rdata, &region);
 	l64->pref = uint16_fromregion(&region);
-	memcpy(l64->l64, region.base, region.length);
+	memmove(l64->l64, region.base, region.length);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/rdata/generic/nid_104.c b/lib/dns/rdata/generic/nid_104.c
index c96b0bf9..39f16ed6 100644
--- a/lib/dns/rdata/generic/nid_104.c
+++ b/lib/dns/rdata/generic/nid_104.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -155,7 +155,7 @@ tostruct_nid(ARGS_TOSTRUCT) {
 
 	dns_rdata_toregion(rdata, &region);
 	nid->pref = uint16_fromregion(&region);
-	memcpy(nid->nid, region.base, region.length);
+	memmove(nid->nid, region.base, region.length);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index b64a6234..bd2adb5f 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -162,7 +162,7 @@ fromwire_opt(ARGS_FROMWIRE) {
 	isc_buffer_availableregion(target, &tregion);
 	if (tregion.length < total)
 		return (ISC_R_NOSPACE);
-	memcpy(tregion.base, sregion.base, total);
+	memmove(tregion.base, sregion.base, total);
 	isc_buffer_forward(source, total);
 	isc_buffer_add(target, total);
 
diff --git a/lib/dns/rdata/generic/rt_21.c b/lib/dns/rdata/generic/rt_21.c
index 8f71a2af..86fe2480 100644
--- a/lib/dns/rdata/generic/rt_21.c
+++ b/lib/dns/rdata/generic/rt_21.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -109,7 +109,7 @@ fromwire_rt(ARGS_FROMWIRE) {
 		return (ISC_R_NOSPACE);
 	if (sregion.length < 2)
 		return (ISC_R_UNEXPECTEDEND);
-	memcpy(tregion.base, sregion.base, 2);
+	memmove(tregion.base, sregion.base, 2);
 	isc_buffer_forward(source, 2);
 	isc_buffer_add(target, 2);
 	return (dns_name_fromwire(&name, source, dctx, options, target));
@@ -130,7 +130,7 @@ towire_rt(ARGS_TOWIRE) {
 	dns_rdata_toregion(rdata, &region);
 	if (tr.length < 2)
 		return (ISC_R_NOSPACE);
-	memcpy(tr.base, region.base, 2);
+	memmove(tr.base, region.base, 2);
 	isc_region_consume(&region, 2);
 	isc_buffer_add(target, 2);
 
diff --git a/lib/dns/rdata/generic/soa_6.c b/lib/dns/rdata/generic/soa_6.c
index ac0a38f7..fe67d76f 100644
--- a/lib/dns/rdata/generic/soa_6.c
+++ b/lib/dns/rdata/generic/soa_6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -186,7 +186,7 @@ fromwire_soa(ARGS_FROMWIRE) {
 	if (tregion.length < 20)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 20);
+	memmove(tregion.base, sregion.base, 20);
 	isc_buffer_forward(source, 20);
 	isc_buffer_add(target, 20);
 
@@ -224,7 +224,7 @@ towire_soa(ARGS_TOWIRE) {
 	if (tregion.length < 20)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 20);
+	memmove(tregion.base, sregion.base, 20);
 	isc_buffer_add(target, 20);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/spf_99.c b/lib/dns/rdata/generic/spf_99.c
index 492e315d..c7cdfc9f 100644
--- a/lib/dns/rdata/generic/spf_99.c
+++ b/lib/dns/rdata/generic/spf_99.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -103,7 +103,7 @@ towire_spf(ARGS_TOWIRE) {
 	if (region.length < rdata->length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, rdata->data, rdata->length);
+	memmove(region.base, rdata->data, rdata->length);
 	isc_buffer_add(target, rdata->length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/txt_16.c b/lib/dns/rdata/generic/txt_16.c
index e1bce6a0..76109251 100644
--- a/lib/dns/rdata/generic/txt_16.c
+++ b/lib/dns/rdata/generic/txt_16.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -110,7 +110,7 @@ towire_txt(ARGS_TOWIRE) {
 	if (region.length < rdata->length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, rdata->data, rdata->length);
+	memmove(region.base, rdata->data, rdata->length);
 	isc_buffer_add(target, rdata->length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/hs_4/a_1.c b/lib/dns/rdata/hs_4/a_1.c
index 50ae25d5..5f8a8750 100644
--- a/lib/dns/rdata/hs_4/a_1.c
+++ b/lib/dns/rdata/hs_4/a_1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -48,7 +48,7 @@ fromtext_hs_a(ARGS_FROMTEXT) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < 4)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, &addr, 4);
+	memmove(region.base, &addr, 4);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
 }
@@ -87,7 +87,7 @@ fromwire_hs_a(ARGS_FROMWIRE) {
 	if (tregion.length < 4)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 4);
+	memmove(tregion.base, sregion.base, 4);
 	isc_buffer_forward(source, 4);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
@@ -106,7 +106,7 @@ towire_hs_a(ARGS_TOWIRE) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < rdata->length)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, rdata->data, rdata->length);
+	memmove(region.base, rdata->data, rdata->length);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/in_1/a6_38.c b/lib/dns/rdata/in_1/a6_38.c
index 8619f8a2..b6ef6887 100644
--- a/lib/dns/rdata/in_1/a6_38.c
+++ b/lib/dns/rdata/in_1/a6_38.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -122,7 +122,7 @@ totext_in_a6(ARGS_TOTEXT) {
 	if (prefixlen != 128) {
 		octets = prefixlen/8;
 		memset(addr, 0, sizeof(addr));
-		memcpy(&addr[octets], sr.base, 16 - octets);
+		memmove(&addr[octets], sr.base, 16 - octets);
 		mask = 0xff >> (prefixlen % 8);
 		addr[octets] &= mask;
 		ar.base = addr;
@@ -347,7 +347,7 @@ tostruct_in_a6(ARGS_TOSTRUCT) {
 	if (a6->prefixlen != 128) {
 		octets = 16 - a6->prefixlen / 8;
 		INSIST(r.length >= octets);
-		memcpy(a6->in6_addr.s6_addr + 16 - octets, r.base, octets);
+		memmove(a6->in6_addr.s6_addr + 16 - octets, r.base, octets);
 		isc_region_consume(&r, octets);
 	}
 
diff --git a/lib/dns/rdata/in_1/a_1.c b/lib/dns/rdata/in_1/a_1.c
index 902932e0..fcdcaae0 100644
--- a/lib/dns/rdata/in_1/a_1.c
+++ b/lib/dns/rdata/in_1/a_1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -50,7 +50,7 @@ fromtext_in_a(ARGS_FROMTEXT) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < 4)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, &addr, 4);
+	memmove(region.base, &addr, 4);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
 }
@@ -89,7 +89,7 @@ fromwire_in_a(ARGS_FROMWIRE) {
 	if (tregion.length < 4)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 4);
+	memmove(tregion.base, sregion.base, 4);
 	isc_buffer_forward(source, 4);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
@@ -108,7 +108,7 @@ towire_in_a(ARGS_TOWIRE) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < rdata->length)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, rdata->data, rdata->length);
+	memmove(region.base, rdata->data, rdata->length);
 	isc_buffer_add(target, 4);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/in_1/aaaa_28.c b/lib/dns/rdata/in_1/aaaa_28.c
index 5aa59b2c..3f88c4db 100644
--- a/lib/dns/rdata/in_1/aaaa_28.c
+++ b/lib/dns/rdata/in_1/aaaa_28.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -51,7 +51,7 @@ fromtext_in_aaaa(ARGS_FROMTEXT) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < 16)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, addr, 16);
+	memmove(region.base, addr, 16);
 	isc_buffer_add(target, 16);
 	return (ISC_R_SUCCESS);
 }
@@ -90,7 +90,7 @@ fromwire_in_aaaa(ARGS_FROMWIRE) {
 	if (tregion.length < 16)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tregion.base, sregion.base, 16);
+	memmove(tregion.base, sregion.base, 16);
 	isc_buffer_forward(source, 16);
 	isc_buffer_add(target, 16);
 	return (ISC_R_SUCCESS);
@@ -109,7 +109,7 @@ towire_in_aaaa(ARGS_TOWIRE) {
 	isc_buffer_availableregion(target, &region);
 	if (region.length < rdata->length)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, rdata->data, rdata->length);
+	memmove(region.base, rdata->data, rdata->length);
 	isc_buffer_add(target, 16);
 	return (ISC_R_SUCCESS);
 }
@@ -165,7 +165,7 @@ tostruct_in_aaaa(ARGS_TOSTRUCT) {
 
 	dns_rdata_toregion(rdata, &r);
 	INSIST(r.length == 16);
-	memcpy(aaaa->in6_addr.s6_addr, r.base, 16);
+	memmove(aaaa->in6_addr.s6_addr, r.base, 16);
 
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index eb927b92..94133bae 100644
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -148,7 +148,7 @@ totext_in_apl(ARGS_TOTEXT) {
 			INSIST(len <= 4);
 			INSIST(prefix <= 32);
 			memset(buf, 0, sizeof(buf));
-			memcpy(buf, sr.base, len);
+			memmove(buf, sr.base, len);
 			RETERR(inet_totext(AF_INET, &ir, target));
 			break;
 
@@ -156,7 +156,7 @@ totext_in_apl(ARGS_TOTEXT) {
 			INSIST(len <= 16);
 			INSIST(prefix <= 128);
 			memset(buf, 0, sizeof(buf));
-			memcpy(buf, sr.base, len);
+			memmove(buf, sr.base, len);
 			RETERR(inet_totext(AF_INET6, &ir, target));
 			break;
 
diff --git a/lib/dns/rdata/in_1/wks_11.c b/lib/dns/rdata/in_1/wks_11.c
index 12cd4a13..4587c813 100644
--- a/lib/dns/rdata/in_1/wks_11.c
+++ b/lib/dns/rdata/in_1/wks_11.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -98,7 +98,7 @@ fromtext_in_wks(ARGS_FROMTEXT) {
 		RETTOK(DNS_R_BADDOTTEDQUAD);
 	if (region.length < 4)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, &addr, 4);
+	memmove(region.base, &addr, 4);
 	isc_buffer_add(target, 4);
 
 	/*
@@ -222,7 +222,7 @@ fromwire_in_wks(ARGS_FROMWIRE) {
 	if (tr.length < sr.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(tr.base, sr.base, sr.length);
+	memmove(tr.base, sr.base, sr.length);
 	isc_buffer_add(target, sr.length);
 	isc_buffer_forward(source, sr.length);
 
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index c53c24c2..1c02b602 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -318,7 +318,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			*rawbuf++ |= (x[i].rdata.flags & DNS_RDATA_OFFLINE) ?
 					    DNS_RDATASLAB_OFFLINE : 0;
 		}
-		memcpy(rawbuf, x[i].rdata.data, x[i].rdata.length);
+		memmove(rawbuf, x[i].rdata.data, x[i].rdata.length);
 		rawbuf += x[i].rdata.length;
 	}
 
@@ -711,7 +711,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	tstart = isc_mem_get(mctx, tlength);
 	if (tstart == NULL)
 		return (ISC_R_NOMEMORY);
-	memcpy(tstart, nslab, reservelen);
+	memmove(tstart, nslab, reservelen);
 	tcurrent = tstart + reservelen;
 #if DNS_RDATASET_FIXED
 	offsetbase = tcurrent;
@@ -790,7 +790,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #if DNS_RDATASET_FIXED
 			tcurrent += 2;	/* fill in later */
 #endif
-			memcpy(tcurrent, data, length);
+			memmove(tcurrent, data, length);
 			tcurrent += length;
 			oadded++;
 			if (oadded < ocount) {
@@ -817,7 +817,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #if DNS_RDATASET_FIXED
 			tcurrent += 2;	/* fill in later */
 #endif
-			memcpy(tcurrent, data, length);
+			memmove(tcurrent, data, length);
 			tcurrent += length;
 			nadded++;
 			if (nadded < ncount) {
@@ -949,7 +949,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	tstart = isc_mem_get(mctx, tlength);
 	if (tstart == NULL)
 		return (ISC_R_NOMEMORY);
-	memcpy(tstart, mslab, reservelen);
+	memmove(tstart, mslab, reservelen);
 	tcurrent = tstart + reservelen;
 #if DNS_RDATASET_FIXED
 	offsetbase = tcurrent;
@@ -1005,7 +1005,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 #if DNS_RDATASET_FIXED
 			offsettable[order] = tcurrent - offsetbase;
 #endif
-			memcpy(tcurrent, mrdatabegin, length);
+			memmove(tcurrent, mrdatabegin, length);
 			tcurrent += length;
 		}
 		dns_rdata_reset(&mrdata);
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 8aae371e..2e60cd84 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -3615,12 +3615,14 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 			 */
 			if (dns_rdatatype_atparent(fctx->type))
 				findoptions |= DNS_DBFIND_NOEXACT;
-			result = dns_view_findzonecut(res->view, name, domain,
-						      0, findoptions, ISC_TRUE,
+			result = dns_view_findzonecut(res->view, fwdname,
+						      domain, 0, findoptions,
+						      ISC_TRUE,
 						      &fctx->nameservers,
 						      NULL);
 			if (result != ISC_R_SUCCESS)
 				goto cleanup_name;
+
 			result = dns_name_dup(domain, mctx, &fctx->domain);
 			if (result != ISC_R_SUCCESS) {
 				dns_rdataset_disassociate(&fctx->nameservers);
@@ -5444,11 +5446,11 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 		dns_rdataset_current(rdataset, &rdata);
 		if (rdataset->type == dns_rdatatype_a) {
 			INSIST(rdata.length == sizeof(ina.s_addr));
-			memcpy(&ina.s_addr, rdata.data, sizeof(ina.s_addr));
+			memmove(&ina.s_addr, rdata.data, sizeof(ina.s_addr));
 			isc_netaddr_fromin(&netaddr, &ina);
 		} else {
 			INSIST(rdata.length == sizeof(in6a.s6_addr));
-			memcpy(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr));
+			memmove(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr));
 			isc_netaddr_fromin6(&netaddr, &in6a);
 		}
 
@@ -7312,9 +7314,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 * NXDOMAIN, NXRDATASET, or referral.
 		 */
 		result = noanswer_response(fctx, NULL, 0);
-		if (result == DNS_R_CHASEDSSERVERS) {
-		} else if (result == DNS_R_DELEGATION) {
-		force_referral:
+		switch (result) {
+		case ISC_R_SUCCESS:
+		case DNS_R_CHASEDSSERVERS:
+			break;
+		case DNS_R_DELEGATION:
+ force_referral:
 			/*
 			 * We don't have the answer, but we know a better
 			 * place to look.
@@ -7339,7 +7344,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			fctx->adberr = 0;
 
 			result = ISC_R_SUCCESS;
-		} else if (result != ISC_R_SUCCESS) {
+			break;
+		default:
 			/*
 			 * Something has gone wrong.
 			 */
@@ -8849,7 +8855,7 @@ dns_resolver_disable_algorithm(dns_resolver_t *resolver, dns_name_t *name,
 			}
 			memset(new, 0, len);
 			if (algorithms != NULL)
-				memcpy(new, algorithms, *algorithms);
+				memmove(new, algorithms, *algorithms);
 			new[len-1] |= mask;
 			*new = len;
 			node->data = new;
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 2d689e7b..f617fe7b 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1115,7 +1115,7 @@ dns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr,
 		 * one could cast netaddr->type.in6 to dns_rpz_cidr_key_t *,
 		 * but there are objections.
 		 */
-		memcpy(src_ip6.w, &netaddr->type.in6, sizeof(src_ip6.w));
+		memmove(src_ip6.w, &netaddr->type.in6, sizeof(src_ip6.w));
 		for (i = 0; i < 4; i++) {
 			tgt_ip.w[i] = ntohl(src_ip6.w[i]);
 		}
diff --git a/lib/dns/rrl.c b/lib/dns/rrl.c
index 96c55fef..02554e9a 100644
--- a/lib/dns/rrl.c
+++ b/lib/dns/rrl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -439,8 +439,8 @@ make_key(const dns_rrl_t *rrl, dns_rrl_key_t *key,
 		break;
 	case AF_INET6:
 		key->s.ipv6 = ISC_TRUE;
-		memcpy(key->s.ip, &client_addr->type.sin6.sin6_addr,
-		       sizeof(key->s.ip));
+		memmove(key->s.ip, &client_addr->type.sin6.sin6_addr,
+			sizeof(key->s.ip));
 		for (i = 0; i < DNS_RRL_MAX_PREFIX/32; ++i)
 			key->s.ip[i] &= rrl->ipv6_mask[i];
 		break;
@@ -776,7 +776,7 @@ add_log_str(isc_buffer_t *lb, const char *str, unsigned int str_len) {
 			return;
 		str_len = region.length;
 	}
-	memcpy(region.base, str, str_len);
+	memmove(region.base, str, str_len);
 	isc_buffer_add(lb, str_len);
 }
 
@@ -863,7 +863,7 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e,
 		snprintf(strbuf, sizeof(strbuf), "/%d", rrl->ipv6_prefixlen);
 		cidr.family = AF_INET6;
 		memset(&cidr.type.in6, 0,  sizeof(cidr.type.in6));
-		memcpy(&cidr.type.in6, e->key.s.ip, sizeof(e->key.s.ip));
+		memmove(&cidr.type.in6, e->key.s.ip, sizeof(e->key.s.ip));
 	} else {
 		snprintf(strbuf, sizeof(strbuf), "/%d", rrl->ipv4_prefixlen);
 		cidr.family = AF_INET;
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
index b6c9e2a3..2da79f8b 100644
--- a/lib/dns/spnego.c
+++ b/lib/dns/spnego.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -463,7 +463,7 @@ code_NegTokenArg(OM_uint32 * minor_status,
 		free(buf);
 		return (GSS_S_FAILURE);
 	}
-	memcpy(*outbuf, buf + buf_size - buf_len, buf_len);
+	memmove(*outbuf, buf + buf_size - buf_len, buf_len);
 	*outbuf_size = buf_len;
 
 	free(buf);
@@ -856,7 +856,7 @@ der_get_octet_string(const unsigned char *p, size_t len,
 		data->data = malloc(len);
 		if (data->data == NULL)
 			return (ENOMEM);
-		memcpy(data->data, p, len);
+		memmove(data->data, p, len);
 	} else
 		data->data = NULL;
 	if (size)
@@ -1217,7 +1217,7 @@ der_put_octet_string(unsigned char *p, size_t len,
 	p -= data->length;
 	len -= data->length;
 	POST(len);
-	memcpy(p + 1, data->data, data->length);
+	memmove(p + 1, data->data, data->length);
 	*size = data->length;
 	return (0);
 }
@@ -1397,7 +1397,7 @@ gssapi_mech_make_header(u_char *p,
 	p += len_len;
 	*p++ = 0x06;
 	*p++ = mech->length;
-	memcpy(p, mech->elements, mech->length);
+	memmove(p, mech->elements, mech->length);
 	p += mech->length;
 	return (p);
 }
@@ -1430,7 +1430,7 @@ gssapi_spnego_encapsulate(OM_uint32 * minor_status,
 			gss_release_buffer(minor_status, output_token);
 		return (GSS_S_FAILURE);
 	}
-	memcpy(p, buf, buf_size);
+	memmove(p, buf, buf_size);
 	return (GSS_S_COMPLETE);
 }
 
diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index 49a777a6..7adb769c 100644
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2010, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2010, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -217,7 +217,7 @@ dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
 			result = ISC_R_NOMEMORY;
 			goto failure;
 		}
-		memcpy(rule->types, types, ntypes * sizeof(dns_rdatatype_t));
+		memmove(rule->types, types, ntypes * sizeof(dns_rdatatype_t));
 	} else
 		rule->types = NULL;
 
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index db474763..fb4452af 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -37,17 +37,36 @@ DNSDEPLIBS =	../libdns.@A@
 LIBS =		@LIBS@ @ATFLIBS@
 
 OBJS =		dnstest.@O@
-SRCS =		dnstest.c master_test.c dbiterator_test.c time_test.c \
-		private_test.c update_test.c zonemgr_test.c zt_test.c \
-		dbdiff_test.c dispatch_test.c nsec3_test.c \
-		rdataset_test.c rdata_test.c
+SRCS =		db_test.c \
+		dbdiff_test.c \
+		dbiterator_test.c \
+		dispatch_test.c \
+		dnstest.c \
+		master_test.c \
+		nsec3_test.c \
+		private_test.c \
+		rdata_test.c \
+		rdataset_test.c \
+		time_test.c \
+		update_test.c \
+		zonemgr_test.c \
+		zt_test.c
 
 SUBDIRS =
-TARGETS =	master_test@EXEEXT@ dbiterator_test@EXEEXT@ time_test@EXEEXT@ \
-		private_test@EXEEXT@ update_test@EXEEXT@ zonemgr_test@EXEEXT@ \
-		zt_test@EXEEXT@ dbversion_test@EXEEXT@ dbdiff_test@EXEEXT@ \
-		dispatch_test@EXEEXT@ nsec3_test@EXEEXT@ \
-		rdataset_test@EXEEXT@ rdata_test@EXEEXT@
+TARGETS =	db_test@EXEEXT@ \
+		dbdiff_test@EXEEXT@ \
+		dbiterator_test@EXEEXT@ \
+		dbversion_test@EXEEXT@ \
+		dispatch_test@EXEEXT@ \
+		master_test@EXEEXT@ \
+		nsec3_test@EXEEXT@ \
+		private_test@EXEEXT@ \
+		rdata_test@EXEEXT@ \
+		rdataset_test@EXEEXT@ \
+		time_test@EXEEXT@ \
+		update_test@EXEEXT@ \
+		zonemgr_test@EXEEXT@ \
+		zt_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -123,6 +142,11 @@ dispatch_test@EXEEXT@: dispatch_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 			dispatch_test.@O@ dnstest.@O@ ${DNSLIBS} \
 				${ISCLIBS} ${LIBS}
 
+db_test@EXEEXT@: db_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			db_test.@O@ ${DNSLIBS} \
+			${ISCLIBS} ${LIBS}
+
 unit::
 	sh ${top_srcdir}/unit/unittest.sh
 
diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
new file mode 100644
index 00000000..fc4b3c87
--- /dev/null
+++ b/lib/dns/tests/db_test.c
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id$ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/name.h>
+#include <dns/journal.h>
+
+#include "dnstest.h"
+
+/*
+ * Helper functions
+ */
+
+#define	BUFLEN		255
+#define	BIGBUFLEN	(64 * 1024)
+#define TEST_ORIGIN	"test"
+
+/*
+ * Individual unit tests
+ */
+
+ATF_TC(getoriginnode);
+ATF_TC_HEAD(getoriginnode, tc) {
+	atf_tc_set_md_var(tc, "descr",
+			  "test multiple calls to dns_db_getoriginnode");
+}
+ATF_TC_BODY(getoriginnode, tc) {
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
+	isc_mem_t *mctx = NULL;
+	isc_result_t result;
+
+	result = isc_mem_create(0, 0, &mctx);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_hash_create(mctx, NULL, 256);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			    dns_rdataclass_in, 0, NULL, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_getoriginnode(db, &node);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	dns_db_detachnode(db, &node);
+
+	result = dns_db_getoriginnode(db, &node);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	dns_db_detachnode(db, &node);
+
+	dns_db_detach(&db);
+	isc_mem_detach(&mctx);
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, getoriginnode);
+	return (atf_no_error());
+}
diff --git a/lib/dns/time.c b/lib/dns/time.c
index 0f245a24..d331ca3b 100644
--- a/lib/dns/time.c
+++ b/lib/dns/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -98,7 +98,7 @@ dns_time64_totext(isc_int64_t t, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, buf, l);
+	memmove(region.base, buf, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 161c1880..11b4f49e 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -152,7 +152,7 @@ add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 	dns_rdata_toregion(rdata, &r);
 	RETERR(isc_buffer_allocate(msg->mctx, &tmprdatabuf, r.length));
 	isc_buffer_availableregion(tmprdatabuf, &newr);
-	memcpy(newr.base, r.base, r.length);
+	memmove(newr.base, r.base, r.length);
 	dns_rdata_fromregion(newrdata, rdata->rdclass, rdata->type, &newr);
 	dns_message_takebuffer(msg, &tmprdatabuf);
 
@@ -252,12 +252,12 @@ compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
 	if (r.length < sizeof(digests) || r.length < r2.length)
 		return (ISC_R_NOSPACE);
 	if (r2.length > sizeof(digests)) {
-		memcpy(r.base, r2.base, r2.length);
+		memmove(r.base, r2.base, r2.length);
 		for (i = 0; i < sizeof(digests); i++)
 			r.base[i] ^= digests[i];
 		isc_buffer_add(secret, r2.length);
 	} else {
-		memcpy(r.base, digests, sizeof(digests));
+		memmove(r.base, digests, sizeof(digests));
 		for (i = 0; i < r2.length; i++)
 			r.base[i] ^= r2.base[i];
 		isc_buffer_add(secret, sizeof(digests));
@@ -534,7 +534,7 @@ process_gsstkey(dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 			goto failure;
 		}
 		tkeyout->keylen = isc_buffer_usedlength(outtoken);
-		memcpy(tkeyout->key, isc_buffer_base(outtoken),
+		memmove(tkeyout->key, isc_buffer_base(outtoken),
 		       isc_buffer_usedlength(outtoken));
 		isc_buffer_free(&outtoken);
 	} else {
@@ -544,7 +544,7 @@ process_gsstkey(dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 			goto failure;
 		}
 		tkeyout->keylen = tkeyin->keylen;
-		memcpy(tkeyout->key, tkeyin->key, tkeyin->keylen);
+		memmove(tkeyout->key, tkeyin->key, tkeyin->keylen);
 	}
 
 	tkeyout->error = dns_rcode_noerror;
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index c7768f4c..00ab570d 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1370,21 +1370,21 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		 * Extract the header.
 		 */
 		isc_buffer_usedregion(source, &r);
-		memcpy(header, r.base, DNS_MESSAGE_HEADERLEN);
+		memmove(header, r.base, DNS_MESSAGE_HEADERLEN);
 		isc_region_consume(&r, DNS_MESSAGE_HEADERLEN);
 
 		/*
 		 * Decrement the additional field counter.
 		 */
-		memcpy(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
+		memmove(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
 		addcount = htons((isc_uint16_t)(ntohs(addcount) - 1));
-		memcpy(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
+		memmove(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
 
 		/*
 		 * Put in the original id.
 		 */
 		id = htons(tsig.originalid);
-		memcpy(&header[0], &id, 2);
+		memmove(&header[0], &id, 2);
 
 		/*
 		 * Digest the modified header.
@@ -1609,16 +1609,16 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	 * Extract the header.
 	 */
 	isc_buffer_usedregion(source, &r);
-	memcpy(header, r.base, DNS_MESSAGE_HEADERLEN);
+	memmove(header, r.base, DNS_MESSAGE_HEADERLEN);
 	isc_region_consume(&r, DNS_MESSAGE_HEADERLEN);
 
 	/*
 	 * Decrement the additional field counter if necessary.
 	 */
 	if (has_tsig) {
-		memcpy(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
+		memmove(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
 		addcount = htons((isc_uint16_t)(ntohs(addcount) - 1));
-		memcpy(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
+		memmove(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
 	}
 
 	/*
@@ -1627,7 +1627,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	/* XXX Can TCP transfers be forwarded?  How would that work? */
 	if (has_tsig) {
 		id = htons(tsig.originalid);
-		memcpy(&header[0], &id, 2);
+		memmove(&header[0], &id, 2);
 	}
 
 	/*
diff --git a/lib/dns/ttl.c b/lib/dns/ttl.c
index d33f0b4d..c7948590 100644
--- a/lib/dns/ttl.c
+++ b/lib/dns/ttl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -68,7 +68,7 @@ ttlfmt(unsigned int t, const char *s, isc_boolean_t verbose,
 	isc_buffer_availableregion(target, &region);
 	if (len > region.length)
 		return (ISC_R_NOSPACE);
-	memcpy(region.base, tmp, len);
+	memmove(region.base, tmp, len);
 	isc_buffer_add(target, len);
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f4dd2a3d..01ff97b1 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -2517,7 +2517,7 @@ isspf(const dns_rdata_t *rdata) {
 		INSIST(tl <= rdl);
 		if (len > sizeof(buf) - i - 1)
 			len = sizeof(buf) - i - 1;
-		memcpy(buf + i, data, len);
+		memmove(buf + i, data, len);
 		i += len;
 		data += tl;
 		rdl -= tl;
@@ -2874,7 +2874,7 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 	nsec3chain->nsec3param.iterations = nsec3param->iterations;
 	nsec3chain->nsec3param.flags = nsec3param->flags;
 	nsec3chain->nsec3param.salt_length = nsec3param->salt_length;
-	memcpy(nsec3chain->salt, nsec3param->salt, nsec3param->salt_length);
+	memmove(nsec3chain->salt, nsec3param->salt, nsec3param->salt_length);
 	nsec3chain->nsec3param.salt = nsec3chain->salt;
 	nsec3chain->seen_nsec = ISC_FALSE;
 	nsec3chain->delete_nsec = ISC_FALSE;
@@ -4979,7 +4979,7 @@ set_addrkeylist(unsigned int count,
 	newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs));
 	if (newaddrs == NULL)
 		return (ISC_R_NOMEMORY);
-	memcpy(newaddrs, addrs, count * sizeof(*newaddrs));
+	memmove(newaddrs, addrs, count * sizeof(*newaddrs));
 
 	newnames = NULL;
 	if (names != NULL) {
diff --git a/lib/export/samples/nsprobe.c b/lib/export/samples/nsprobe.c
index 1d7ed3b4..795b1ca4 100644
--- a/lib/export/samples/nsprobe.c
+++ b/lib/export/samples/nsprobe.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1101,7 +1101,7 @@ main(int argc, char *argv[]) {
 			(long)res->ai_addrlen);
 		exit(1);
 	}
-	memcpy(&sa.type.sa, res->ai_addr, res->ai_addrlen);
+	memmove(&sa.type.sa, res->ai_addr, res->ai_addrlen);
 	sa.length = res->ai_addrlen;
 	freeaddrinfo(res);
 	ISC_LINK_INIT(&sa, link);
diff --git a/lib/export/samples/sample-request.c b/lib/export/samples/sample-request.c
index 07baf395..8d36a2ce 100644
--- a/lib/export/samples/sample-request.c
+++ b/lib/export/samples/sample-request.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -221,7 +221,7 @@ main(int argc, char *argv[]) {
 		exit(1);
 	}
 	INSIST(res->ai_addrlen <= sizeof(sa.type));
-	memcpy(&sa.type, res->ai_addr, res->ai_addrlen);
+	memmove(&sa.type, res->ai_addr, res->ai_addrlen);
 	freeaddrinfo(res);
 	sa.length = res->ai_addrlen;
 	ISC_LINK_INIT(&sa, link);
diff --git a/lib/export/samples/sample-update.c b/lib/export/samples/sample-update.c
index 2c35baa6..758e02eb 100644
--- a/lib/export/samples/sample-update.c
+++ b/lib/export/samples/sample-update.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2010, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -188,7 +188,7 @@ main(int argc, char *argv[]) {
 			exit(1);
 		}
 		INSIST(res->ai_addrlen <= sizeof(sa_auth.type));
-		memcpy(&sa_auth.type, res->ai_addr, res->ai_addrlen);
+		memmove(&sa_auth.type, res->ai_addr, res->ai_addrlen);
 		freeaddrinfo(res);
 		sa_auth.length = res->ai_addrlen;
 		ISC_LINK_INIT(&sa_auth, link);
@@ -210,7 +210,7 @@ main(int argc, char *argv[]) {
 			exit(1);
 		}
 		INSIST(res->ai_addrlen <= sizeof(sa_recursive.type));
-		memcpy(&sa_recursive.type, res->ai_addr, res->ai_addrlen);
+		memmove(&sa_recursive.type, res->ai_addr, res->ai_addrlen);
 		freeaddrinfo(res);
 		sa_recursive.length = res->ai_addrlen;
 		ISC_LINK_INIT(&sa_recursive, link);
diff --git a/lib/export/samples/sample.c b/lib/export/samples/sample.c
index b121a0db..7de9a8f1 100644
--- a/lib/export/samples/sample.c
+++ b/lib/export/samples/sample.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -197,7 +197,7 @@ addserver(dns_client_t *client, const char *addrstr, const char *port,
 		exit(1);
 	}
 	INSIST(res->ai_addrlen <= sizeof(sa.type));
-	memcpy(&sa.type, res->ai_addr, res->ai_addrlen);
+	memmove(&sa.type, res->ai_addr, res->ai_addrlen);
 	sa.length = res->ai_addrlen;
 	freeaddrinfo(res);
 	ISC_LINK_INIT(&sa, link);
diff --git a/lib/irs/api b/lib/irs/api
index 298e96a8..343e4aaf 100644
--- a/lib/irs/api
+++ b/lib/irs/api
@@ -5,5 +5,5 @@
 # 9.9: 90-109
 # 9.9-sub: 130-139
 LIBINTERFACE = 90
-LIBREVISION = 1
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/lib/irs/getaddrinfo.c b/lib/irs/getaddrinfo.c
index 1de540f2..24d35bf6 100644
--- a/lib/irs/getaddrinfo.c
+++ b/lib/irs/getaddrinfo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -409,7 +409,7 @@ getaddrinfo(const char *hostname, const char *servname,
 				 * Convert to a V4 mapped address.
 				 */
 				struct in6_addr *a6 = (struct in6_addr *)abuf;
-				memcpy(&a6->s6_addr[12], &a6->s6_addr[0], 4);
+				memmove(&a6->s6_addr[12], &a6->s6_addr[0], 4);
 				memset(&a6->s6_addr[10], 0xff, 2);
 				memset(&a6->s6_addr[0], 0, 10);
 				goto inet6_addr;
@@ -446,7 +446,7 @@ getaddrinfo(const char *hostname, const char *servname,
 			ai_list = ai;
 			ai->ai_socktype = socktype;
 			SIN(ai->ai_addr)->sin_port = port;
-			memcpy((char *)ai->ai_addr + addroff, abuf, addrsize);
+			memmove((char *)ai->ai_addr + addroff, abuf, addrsize);
 			if ((flags & AI_CANONNAME) != 0) {
 #ifdef IRS_HAVE_SIN6_SCOPE_ID
 				if (ai->ai_family == AF_INET6)
@@ -789,8 +789,8 @@ process_answer(isc_task_t *task, isc_event_t *event) {
 					RUNTIME_CHECK(result == ISC_R_SUCCESS);
 					SIN(ai->ai_addr)->sin_port =
 						resstate->head->ai_port;
-					memcpy(&SIN(ai->ai_addr)->sin_addr,
-					       &rdata_a.in_addr, 4);
+					memmove(&SIN(ai->ai_addr)->sin_addr,
+						&rdata_a.in_addr, 4);
 					dns_rdata_freestruct(&rdata_a);
 					break;
 				case AF_INET6:
@@ -800,8 +800,8 @@ process_answer(isc_task_t *task, isc_event_t *event) {
 					RUNTIME_CHECK(result == ISC_R_SUCCESS);
 					SIN6(ai->ai_addr)->sin6_port =
 						resstate->head->ai_port;
-					memcpy(&SIN6(ai->ai_addr)->sin6_addr,
-					       &rdata_aaaa.in6_addr, 16);
+					memmove(&SIN6(ai->ai_addr)->sin6_addr,
+						&rdata_aaaa.in6_addr, 16);
 					dns_rdata_freestruct(&rdata_aaaa);
 					break;
 				}
@@ -1130,7 +1130,7 @@ add_ipv4(const char *hostname, int flags, struct addrinfo **aip,
 	*aip = ai;
 	ai->ai_socktype = socktype;
 	SIN(ai->ai_addr)->sin_port = port;
-	memcpy(&SIN(ai->ai_addr)->sin_addr, v4_loop, 4);
+	memmove(&SIN(ai->ai_addr)->sin_addr, v4_loop, 4);
 
 	return (0);
 }
@@ -1153,7 +1153,7 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 	*aip = ai;
 	ai->ai_socktype = socktype;
 	SIN6(ai->ai_addr)->sin6_port = port;
-	memcpy(&SIN6(ai->ai_addr)->sin6_addr, v6_loop, 16);
+	memmove(&SIN6(ai->ai_addr)->sin6_addr, v6_loop, 16);
 
 	return (0);
 }
diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
index 88bdac16..15a46baf 100644
--- a/lib/irs/resconf.c
+++ b/lib/irs/resconf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -224,7 +224,7 @@ add_server(isc_mem_t *mctx, const char *address_str,
 
 		v4 = &((struct sockaddr_in *)res->ai_addr)->sin_addr;
 		if (memcmp(v4, zeroaddress, 4) == 0)
-			memcpy(v4, loopaddress, 4);
+			memmove(v4, loopaddress, 4);
 	}
 
 	address = isc_mem_get(mctx, sizeof(*address));
@@ -238,7 +238,7 @@ add_server(isc_mem_t *mctx, const char *address_str,
 		goto cleanup;
 	}
 	address->length = res->ai_addrlen;
-	memcpy(&address->type.ss, res->ai_addr, res->ai_addrlen);
+	memmove(&address->type.ss, res->ai_addr, res->ai_addrlen);
 	ISC_LINK_INIT(address, link);
 	ISC_LIST_APPEND(*nameservers, address, link);
 
@@ -258,14 +258,14 @@ create_addr(const char *buffer, isc_netaddr_t *addr, int convert_zero) {
 			unsigned char zeroaddress[] = {0, 0, 0, 0};
 			unsigned char loopaddress[] = {127, 0, 0, 1};
 			if (memcmp(&v4, zeroaddress, 4) == 0)
-				memcpy(&v4, loopaddress, 4);
+				memmove(&v4, loopaddress, 4);
 		}
 		addr->family = AF_INET;
-		memcpy(&addr->type.in, &v4, NS_INADDRSZ);
+		memmove(&addr->type.in, &v4, NS_INADDRSZ);
 		addr->zone = 0;
 	} else if (inet_pton(AF_INET6, buffer, &v6) == 1) {
 		addr->family = AF_INET6;
-		memcpy(&addr->type.in6, &v6, NS_IN6ADDRSZ);
+		memmove(&addr->type.in6, &v6, NS_IN6ADDRSZ);
 		addr->zone = 0;
 	} else
 		return (ISC_R_BADADDRESSFORM); /* Unrecognised format. */
diff --git a/lib/isc/api b/lib/isc/api
index a161d8d0..07c646d6 100644
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -4,6 +4,6 @@
 # 9.8: 80-89, 120-129
 # 9.9: 90-109
 # 9.9-sub: 130-139
-LIBINTERFACE = 98
+LIBINTERFACE = 99
 LIBREVISION = 0
-LIBAGE = 3
+LIBAGE = 4
diff --git a/lib/isc/base32.c b/lib/isc/base32.c
index f595cf14..ad0b0da5 100644
--- a/lib/isc/base32.c
+++ b/lib/isc/base32.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -355,7 +355,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
@@ -367,7 +367,7 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 	isc_buffer_availableregion(target, &tr);
 	if (length > tr.length)
 		return (ISC_R_NOSPACE);
-	memcpy(tr.base, base, length);
+	memmove(tr.base, base, length);
 	isc_buffer_add(target, length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isc/base64.c b/lib/isc/base64.c
index 00d00d4b..6b4cb1bf 100644
--- a/lib/isc/base64.c
+++ b/lib/isc/base64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -234,7 +234,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
@@ -246,7 +246,7 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 	isc_buffer_availableregion(target, &tr);
 	if (length > tr.length)
 		return (ISC_R_NOSPACE);
-	memcpy(tr.base, base, length);
+	memmove(tr.base, base, length);
 	isc_buffer_add(target, length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isc/buffer.c b/lib/isc/buffer.c
index e37af159..2d15e248 100644
--- a/lib/isc/buffer.c
+++ b/lib/isc/buffer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -420,7 +420,7 @@ isc__buffer_putstr(isc_buffer_t *b, const char *source) {
 	REQUIRE(l <= isc_buffer_availablelength(b));
 
 	cp = isc_buffer_used(b);
-	memcpy(cp, source, l);
+	memmove(cp, source, l);
 	b->used += l;
 }
 
@@ -439,7 +439,7 @@ isc_buffer_copyregion(isc_buffer_t *b, const isc_region_t *r) {
 	available = isc_buffer_availablelength(b);
 	if (r->length > available)
 		return (ISC_R_NOSPACE);
-	memcpy(base, r->base, r->length);
+	memmove(base, r->base, r->length);
 	b->used += r->length;
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/isc/hash.c b/lib/isc/hash.c
index fc4e4f33..f70e7943 100644
--- a/lib/isc/hash.c
+++ b/lib/isc/hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -270,7 +270,7 @@ isc_hash_ctxinit(isc_hash_t *hctx) {
 			else
 				copylen = hctx->vectorlen - i;
 
-			memcpy(p, &pr, copylen);
+			memmove(p, &pr, copylen);
 		}
 		INSIST(p == (unsigned char *)hctx->rndvector +
 		       hctx->vectorlen);
@@ -324,9 +324,9 @@ destroy(isc_hash_t **hctxp) {
 
 	DESTROYLOCK(&hctx->lock);
 
-	memcpy(canary0, hctx + 1, sizeof(canary0));
+	memmove(canary0, hctx + 1, sizeof(canary0));
 	memset(hctx, 0, sizeof(isc_hash_t));
-	memcpy(canary1, hctx + 1, sizeof(canary1));
+	memmove(canary1, hctx + 1, sizeof(canary1));
 	INSIST(memcmp(canary0, canary1, sizeof(canary0)) == 0);
 	isc_mem_put(mctx, hctx, sizeof(isc_hash_t));
 	isc_mem_detach(&mctx);
diff --git a/lib/isc/heap.c b/lib/isc/heap.c
index 4edaface..9d4fd28a 100644
--- a/lib/isc/heap.c
+++ b/lib/isc/heap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2010-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -32,7 +32,7 @@
 #include <isc/heap.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/string.h>		/* Required for memcpy. */
+#include <isc/string.h>		/* Required for memmove. */
 #include <isc/util.h>
 
 /*@{*/
@@ -132,7 +132,7 @@ resize(isc_heap_t *heap) {
 	if (new_array == NULL)
 		return (ISC_FALSE);
 	if (heap->array != NULL) {
-		memcpy(new_array, heap->array, heap->size * sizeof(void *));
+		memmove(new_array, heap->array, heap->size * sizeof(void *));
 		isc_mem_put(heap->mctx, heap->array,
 			    heap->size * sizeof(void *));
 	}
diff --git a/lib/isc/hex.c b/lib/isc/hex.c
index 60addf5c..00903c73 100644
--- a/lib/isc/hex.c
+++ b/lib/isc/hex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -183,7 +183,7 @@ str_totext(const char *source, isc_buffer_t *target) {
 	if (l > region.length)
 		return (ISC_R_NOSPACE);
 
-	memcpy(region.base, source, l);
+	memmove(region.base, source, l);
 	isc_buffer_add(target, l);
 	return (ISC_R_SUCCESS);
 }
@@ -195,7 +195,7 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 	isc_buffer_availableregion(target, &tr);
 	if (length > tr.length)
 		return (ISC_R_NOSPACE);
-	memcpy(tr.base, base, length);
+	memmove(tr.base, base, length);
 	isc_buffer_add(target, length);
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isc/hmacmd5.c b/lib/isc/hmacmd5.c
index 4c4046df..b26a336e 100644
--- a/lib/isc/hmacmd5.c
+++ b/lib/isc/hmacmd5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -83,7 +83,7 @@ isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
 		isc_md5_update(&md5ctx, key, len);
 		isc_md5_final(&md5ctx, ctx->key);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_md5_init(&ctx->md5ctx);
 	memset(ipad, IPAD, sizeof(ipad));
diff --git a/lib/isc/hmacsha.c b/lib/isc/hmacsha.c
index 38709637..ac2b70c5 100644
--- a/lib/isc/hmacsha.c
+++ b/lib/isc/hmacsha.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005-2007, 2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -63,7 +63,7 @@ isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) {
 
 	HMAC_Final(ctx, newdigest, NULL);
 	HMAC_CTX_cleanup(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -94,7 +94,7 @@ isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len) {
 
 	HMAC_Final(ctx, newdigest, NULL);
 	HMAC_CTX_cleanup(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -125,7 +125,7 @@ isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len) {
 
 	HMAC_Final(ctx, newdigest, NULL);
 	HMAC_CTX_cleanup(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -156,7 +156,7 @@ isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len) {
 
 	HMAC_Final(ctx, newdigest, NULL);
 	HMAC_CTX_cleanup(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -187,7 +187,7 @@ isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len) {
 
 	HMAC_Final(ctx, newdigest, NULL);
 	HMAC_CTX_cleanup(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -213,7 +213,7 @@ isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key,
 		isc_sha1_update(&sha1ctx, key, len);
 		isc_sha1_final(&sha1ctx, ctx->key);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_sha1_init(&ctx->sha1ctx);
 	memset(ipad, IPAD, sizeof(ipad));
@@ -260,7 +260,7 @@ isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) {
 	isc_sha1_update(&ctx->sha1ctx, newdigest, ISC_SHA1_DIGESTLENGTH);
 	isc_sha1_final(&ctx->sha1ctx, newdigest);
 	isc_hmacsha1_invalidate(ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -281,7 +281,7 @@ isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key,
 		isc_sha224_update(&sha224ctx, key, len);
 		isc_sha224_final(ctx->key, &sha224ctx);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_sha224_init(&ctx->sha224ctx);
 	memset(ipad, IPAD, sizeof(ipad));
@@ -326,7 +326,7 @@ isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len) {
 	isc_sha224_update(&ctx->sha224ctx, opad, sizeof(opad));
 	isc_sha224_update(&ctx->sha224ctx, newdigest, ISC_SHA224_DIGESTLENGTH);
 	isc_sha224_final(newdigest, &ctx->sha224ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -347,7 +347,7 @@ isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key,
 		isc_sha256_update(&sha256ctx, key, len);
 		isc_sha256_final(ctx->key, &sha256ctx);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_sha256_init(&ctx->sha256ctx);
 	memset(ipad, IPAD, sizeof(ipad));
@@ -392,7 +392,7 @@ isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len) {
 	isc_sha256_update(&ctx->sha256ctx, opad, sizeof(opad));
 	isc_sha256_update(&ctx->sha256ctx, newdigest, ISC_SHA256_DIGESTLENGTH);
 	isc_sha256_final(newdigest, &ctx->sha256ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -413,7 +413,7 @@ isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key,
 		isc_sha384_update(&sha384ctx, key, len);
 		isc_sha384_final(ctx->key, &sha384ctx);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_sha384_init(&ctx->sha384ctx);
 	memset(ipad, IPAD, sizeof(ipad));
@@ -458,7 +458,7 @@ isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len) {
 	isc_sha384_update(&ctx->sha384ctx, opad, sizeof(opad));
 	isc_sha384_update(&ctx->sha384ctx, newdigest, ISC_SHA384_DIGESTLENGTH);
 	isc_sha384_final(newdigest, &ctx->sha384ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 
@@ -479,7 +479,7 @@ isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key,
 		isc_sha512_update(&sha512ctx, key, len);
 		isc_sha512_final(ctx->key, &sha512ctx);
 	} else
-		memcpy(ctx->key, key, len);
+		memmove(ctx->key, key, len);
 
 	isc_sha512_init(&ctx->sha512ctx);
 	memset(ipad, IPAD, sizeof(ipad));
@@ -524,7 +524,7 @@ isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len) {
 	isc_sha512_update(&ctx->sha512ctx, opad, sizeof(opad));
 	isc_sha512_update(&ctx->sha512ctx, newdigest, ISC_SHA512_DIGESTLENGTH);
 	isc_sha512_final(newdigest, &ctx->sha512ctx);
-	memcpy(digest, newdigest, len);
+	memmove(digest, newdigest, len);
 	memset(newdigest, 0, sizeof(newdigest));
 }
 #endif /* !ISC_PLATFORM_OPENSSLHASH */
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 16a8c9fe..46dab296 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2008, 2010-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2008, 2010-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -26,6 +26,7 @@
 #include <isc/socket.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
 #include <string.h>
@@ -58,20 +59,6 @@
 #define HTTP_SENDGROW			1024
 #define HTTP_SEND_MAXLEN		10240
 
-/*%
- * HTTP urls.  These are the URLs we manage, and the function to call to
- * provide the data for it.  We pass in the base url (so the same function
- * can handle multiple requests), and a structure to fill in to return a
- * result to the client.  We also pass in a pointer to be filled in for
- * the data cleanup function.
- */
-struct isc_httpdurl {
-	char			       *url;
-	isc_httpdaction_t	       *action;
-	void			       *action_arg;
-	ISC_LINK(isc_httpdurl_t)	link;
-};
-
 #define HTTPD_CLOSE		0x0001 /* Got a Connection: close header */
 #define HTTPD_FOUNDHOST		0x0002 /* Got a Host: header */
 
@@ -87,6 +74,7 @@ struct isc_httpd {
 	 */
 	char			recvbuf[HTTP_RECVLEN]; /*%< receive buffer */
 	isc_uint32_t		recvlen;	/*%< length recv'd */
+	char		       *headers;	/*%< set in process_request() */
 	unsigned int		method;
 	char		       *url;
 	char		       *querystring;
@@ -217,20 +205,12 @@ static isc_result_t process_request(isc_httpd_t *, int);
 static void httpdmgr_destroy(isc_httpdmgr_t *);
 static isc_result_t grow_headerspace(isc_httpd_t *);
 static void reset_client(isc_httpd_t *httpd);
-static isc_result_t render_404(const char *, const char *,
-			       void *,
-			       unsigned int *, const char **,
-			       const char **, isc_buffer_t *,
-			       isc_httpdfree_t **, void **);
-static isc_result_t render_500(const char *, const char *,
-			       void *,
-			       unsigned int *, const char **,
-			       const char **, isc_buffer_t *,
-			       isc_httpdfree_t **, void **);
+
+static isc_httpdaction_t render_404;
+static isc_httpdaction_t render_500;
 
 static void
-destroy_client(isc_httpd_t **httpdp)
-{
+destroy_client(isc_httpd_t **httpdp) {
 	isc_httpd_t *httpd = *httpdp;
 	isc_httpdmgr_t *httpdmgr = httpd->mgr;
 
@@ -321,8 +301,7 @@ isc_httpdmgr_create(isc_mem_t *mctx, isc_socket_t *sock, isc_task_t *task,
 }
 
 static void
-httpdmgr_destroy(isc_httpdmgr_t *httpdmgr)
-{
+httpdmgr_destroy(isc_httpdmgr_t *httpdmgr) {
 	isc_mem_t *mctx;
 	isc_httpdurl_t *url;
 
@@ -379,8 +358,7 @@ httpdmgr_destroy(isc_httpdmgr_t *httpdmgr)
 #define BUFLENOK(s) (httpd->recvbuf - (s) < HTTP_RECVLEN)
 
 static isc_result_t
-process_request(isc_httpd_t *httpd, int length)
-{
+process_request(isc_httpd_t *httpd, int length) {
 	char *s;
 	char *p;
 	int delim;
@@ -390,6 +368,7 @@ process_request(isc_httpd_t *httpd, int length)
 	httpd->recvlen += length;
 
 	httpd->recvbuf[httpd->recvlen] = 0;
+	httpd->headers = NULL;
 
 	/*
 	 * If we don't find a blank line in our buffer, return that we need
@@ -494,6 +473,8 @@ process_request(isc_httpd_t *httpd, int length)
 	p = s + 1;
 	s = p;
 
+	httpd->headers = s;
+
 	if (strstr(s, "Connection: close") != NULL)
 		httpd->flags |= HTTPD_CLOSE;
 
@@ -513,8 +494,7 @@ process_request(isc_httpd_t *httpd, int length)
 }
 
 static void
-isc_httpd_accept(isc_task_t *task, isc_event_t *ev)
-{
+isc_httpd_accept(isc_task_t *task, isc_event_t *ev) {
 	isc_result_t result;
 	isc_httpdmgr_t *httpdmgr = ev->ev_arg;
 	isc_httpd_t *httpd;
@@ -609,8 +589,8 @@ isc_httpd_accept(isc_task_t *task, isc_event_t *ev)
 }
 
 static isc_result_t
-render_404(const char *url, const char *querystring,
-	   void *arg,
+render_404(const char *url, isc_httpdurl_t *urlinfo,
+	   const char *querystring, const char *headers, void *arg,
 	   unsigned int *retcode, const char **retmsg,
 	   const char **mimetype, isc_buffer_t *b,
 	   isc_httpdfree_t **freecb, void **freecb_args)
@@ -618,7 +598,9 @@ render_404(const char *url, const char *querystring,
 	static char msg[] = "No such URL.";
 
 	UNUSED(url);
+	UNUSED(urlinfo);
 	UNUSED(querystring);
+	UNUSED(headers);
 	UNUSED(arg);
 
 	*retcode = 404;
@@ -633,8 +615,8 @@ render_404(const char *url, const char *querystring,
 }
 
 static isc_result_t
-render_500(const char *url, const char *querystring,
-	   void *arg,
+render_500(const char *url, isc_httpdurl_t *urlinfo,
+	   const char *querystring, const char *headers, void *arg,
 	   unsigned int *retcode, const char **retmsg,
 	   const char **mimetype, isc_buffer_t *b,
 	   isc_httpdfree_t **freecb, void **freecb_args)
@@ -642,7 +624,9 @@ render_500(const char *url, const char *querystring,
 	static char msg[] = "Internal server failure.";
 
 	UNUSED(url);
+	UNUSED(urlinfo);
 	UNUSED(querystring);
+	UNUSED(headers);
 	UNUSED(arg);
 
 	*retcode = 500;
@@ -657,8 +641,7 @@ render_500(const char *url, const char *querystring,
 }
 
 static void
-isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
-{
+isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev) {
 	isc_region_t r;
 	isc_result_t result;
 	isc_httpd_t *httpd = ev->ev_arg;
@@ -710,8 +693,9 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 		url = ISC_LIST_NEXT(url, link);
 	}
 	if (url == NULL)
-		result = httpd->mgr->render_404(httpd->url, httpd->querystring,
-						NULL,
+		result = httpd->mgr->render_404(httpd->url, NULL,
+						httpd->querystring,
+						NULL, NULL,
 						&httpd->retcode,
 						&httpd->retmsg,
 						&httpd->mimetype,
@@ -719,14 +703,18 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 						&httpd->freecb,
 						&httpd->freecb_arg);
 	else
-		result = url->action(httpd->url, httpd->querystring,
+		result = url->action(httpd->url, url,
+				     httpd->querystring,
+				     httpd->headers,
 				     url->action_arg,
 				     &httpd->retcode, &httpd->retmsg,
 				     &httpd->mimetype, &httpd->bodybuffer,
 				     &httpd->freecb, &httpd->freecb_arg);
 	if (result != ISC_R_SUCCESS) {
-		result = httpd->mgr->render_500(httpd->url, httpd->querystring,
-						NULL, &httpd->retcode,
+		result = httpd->mgr->render_500(httpd->url, url,
+						httpd->querystring,
+						NULL, NULL,
+						&httpd->retcode,
 						&httpd->retmsg,
 						&httpd->mimetype,
 						&httpd->bodybuffer,
@@ -739,9 +727,19 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 	isc_httpd_addheader(httpd, "Content-Type", httpd->mimetype);
 	isc_httpd_addheader(httpd, "Date", datebuf);
 	isc_httpd_addheader(httpd, "Expires", datebuf);
-	isc_httpd_addheader(httpd, "Last-Modified", datebuf);
-	isc_httpd_addheader(httpd, "Pragma: no-cache", NULL);
-	isc_httpd_addheader(httpd, "Cache-Control: no-cache", NULL);
+
+	if (url != NULL && url->isstatic) {
+		char loadbuf[32];
+		isc_time_formathttptimestamp(&url->loadtime,
+					     loadbuf, sizeof(loadbuf));
+		isc_httpd_addheader(httpd, "Last-Modified", loadbuf);
+		isc_httpd_addheader(httpd, "Cache-Control: public", NULL);
+	} else {
+		isc_httpd_addheader(httpd, "Last-Modified", datebuf);
+		isc_httpd_addheader(httpd, "Pragma: no-cache", NULL);
+		isc_httpd_addheader(httpd, "Cache-Control: no-cache", NULL);
+	}
+
 	isc_httpd_addheader(httpd, "Server: libisc", NULL);
 	isc_httpd_addheaderuint(httpd, "Content-Length",
 				isc_buffer_usedlength(&httpd->bodybuffer));
@@ -766,8 +764,7 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 }
 
 void
-isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp)
-{
+isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp) {
 	isc_httpdmgr_t *httpdmgr;
 	isc_httpd_t *httpd;
 	httpdmgr = *httpdmgrp;
@@ -794,8 +791,7 @@ isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp)
 }
 
 static isc_result_t
-grow_headerspace(isc_httpd_t *httpd)
-{
+grow_headerspace(isc_httpd_t *httpd) {
 	char *newspace;
 	unsigned int newlen;
 	isc_region_t r;
@@ -816,8 +812,7 @@ grow_headerspace(isc_httpd_t *httpd)
 }
 
 isc_result_t
-isc_httpd_response(isc_httpd_t *httpd)
-{
+isc_httpd_response(isc_httpd_t *httpd) {
 	isc_result_t result;
 	unsigned int needlen;
 
@@ -869,8 +864,7 @@ isc_httpd_addheader(isc_httpd_t *httpd, const char *name,
 }
 
 isc_result_t
-isc_httpd_endheaders(isc_httpd_t *httpd)
-{
+isc_httpd_endheaders(isc_httpd_t *httpd) {
 	isc_result_t result;
 
 	while (isc_buffer_availablelength(&httpd->headerbuffer) < 2) {
@@ -912,8 +906,7 @@ isc_httpd_addheaderuint(isc_httpd_t *httpd, const char *name, int val) {
 }
 
 static void
-isc_httpd_senddone(isc_task_t *task, isc_event_t *ev)
-{
+isc_httpd_senddone(isc_task_t *task, isc_event_t *ev) {
 	isc_httpd_t *httpd = ev->ev_arg;
 	isc_region_t r;
 	isc_socketevent_t *sev = (isc_socketevent_t *)ev;
@@ -976,8 +969,7 @@ out:
 }
 
 static void
-reset_client(isc_httpd_t *httpd)
-{
+reset_client(isc_httpd_t *httpd) {
 	/*
 	 * Catch errors here.  We MUST be in RECV mode, and we MUST NOT have
 	 * any outstanding buffers.  If we have buffers, we have a leak.
@@ -988,6 +980,7 @@ reset_client(isc_httpd_t *httpd)
 
 	httpd->recvbuf[0] = 0;
 	httpd->recvlen = 0;
+	httpd->headers = NULL;
 	httpd->method = ISC_HTTPD_METHODUNKNOWN;
 	httpd->url = NULL;
 	httpd->querystring = NULL;
@@ -1002,6 +995,14 @@ isc_result_t
 isc_httpdmgr_addurl(isc_httpdmgr_t *httpdmgr, const char *url,
 		    isc_httpdaction_t *func, void *arg)
 {
+	return (isc_httpdmgr_addurl2(httpdmgr, url, ISC_FALSE, func, arg));
+}
+
+isc_result_t
+isc_httpdmgr_addurl2(isc_httpdmgr_t *httpdmgr, const char *url,
+		     isc_boolean_t isstatic,
+		     isc_httpdaction_t *func, void *arg)
+{
 	isc_httpdurl_t *item;
 
 	if (url == NULL) {
@@ -1021,6 +1022,9 @@ isc_httpdmgr_addurl(isc_httpdmgr_t *httpdmgr, const char *url,
 
 	item->action = func;
 	item->action_arg = arg;
+	item->isstatic = isstatic;
+	isc_time_now(&item->loadtime);
+
 	ISC_LINK_INIT(item, link);
 	ISC_LIST_APPEND(httpdmgr->urls, item, link);
 
diff --git a/lib/isc/include/isc/buffer.h b/lib/isc/include/isc/buffer.h
index 72b85605..5aff01c2 100644
--- a/lib/isc/include/isc/buffer.h
+++ b/lib/isc/include/isc/buffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2010, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -787,7 +787,7 @@ ISC_LANG_ENDDECLS
 
 #define ISC__BUFFER_PUTMEM(_b, _base, _length) \
 	do { \
-		memcpy(isc_buffer_used(_b), (_base), (_length)); \
+		memmove(isc_buffer_used(_b), (_base), (_length)); \
 		(_b)->used += (_length); \
 	} while (0)
 
@@ -797,7 +797,7 @@ ISC_LANG_ENDDECLS
 		unsigned char *_cp; \
 		_length = strlen(_source); \
 		_cp = isc_buffer_used(_b); \
-		memcpy(_cp, (_source), _length); \
+		memmove(_cp, (_source), _length); \
 		(_b)->used += (_length); \
 	} while (0)
 
diff --git a/lib/isc/include/isc/httpd.h b/lib/isc/include/isc/httpd.h
index ba7f9001..06ce90f3 100644
--- a/lib/isc/include/isc/httpd.h
+++ b/lib/isc/include/isc/httpd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2008, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -26,6 +26,23 @@
 #include <isc/types.h>
 #include <isc/mutex.h>
 #include <isc/task.h>
+#include <isc/time.h>
+
+/*%
+ * HTTP urls.  These are the URLs we manage, and the function to call to
+ * provide the data for it.  We pass in the base url (so the same function
+ * can handle multiple requests), and a structure to fill in to return a
+ * result to the client.  We also pass in a pointer to be filled in for
+ * the data cleanup function.
+ */
+struct isc_httpdurl {
+	char			       *url;
+	isc_httpdaction_t	       *action;
+	void			       *action_arg;
+	isc_boolean_t			isstatic;
+	isc_time_t			loadtime;
+	ISC_LINK(isc_httpdurl_t)	link;
+};
 
 #define HTTPD_EVENTCLASS		ISC_EVENTCLASS(4300)
 #define HTTPD_SHUTDOWN			(HTTPD_EVENTCLASS + 0x0001)
@@ -50,6 +67,11 @@ isc_httpdmgr_addurl(isc_httpdmgr_t *httpdmgr, const char *url,
 		    isc_httpdaction_t *func, void *arg);
 
 isc_result_t
+isc_httpdmgr_addurl2(isc_httpdmgr_t *httpdmgr, const char *url,
+		     isc_boolean_t isstatic,
+		     isc_httpdaction_t *func, void *arg);
+
+isc_result_t
 isc_httpd_response(isc_httpd_t *httpd);
 
 isc_result_t
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
index 8c5bd1d8..07553e36 100644
--- a/lib/isc/include/isc/platform.h.in
+++ b/lib/isc/include/isc/platform.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -199,6 +199,11 @@
  */
 @ISC_PLATFORM_NEEDMEMMOVE@
 
+/*
+ * Define if this system needs strcasestr.
+ */
+@ISC_PLATFORM_NEEDSTRCASESTR@
+
 /***
  *** Miscellaneous.
  ***/
diff --git a/lib/isc/include/isc/radix.h b/lib/isc/include/isc/radix.h
index 47512c72..1c1887f1 100644
--- a/lib/isc/include/isc/radix.h
+++ b/lib/isc/include/isc/radix.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007, 2008, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -41,10 +41,10 @@
 			(pt).family = (na)->family; \
 			(pt).bitlen = (bits); \
 			if ((pt).family == AF_INET6) { \
-				memcpy(&(pt).add.sin6, &(na)->type.in6, \
+				memmove(&(pt).add.sin6, &(na)->type.in6, \
 				       ((bits)+7)/8); \
 			} else \
-				memcpy(&(pt).add.sin, &(na)->type.in, \
+				memmove(&(pt).add.sin, &(na)->type.in, \
 				       ((bits)+7)/8); \
 		} else { \
 			(pt).family = AF_UNSPEC; \
diff --git a/lib/isc/include/isc/string.h b/lib/isc/include/isc/string.h
index b49fdbc3..585ef928 100644
--- a/lib/isc/include/isc/string.h
+++ b/lib/isc/include/isc/string.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -226,6 +226,13 @@ isc_string_strlcat(char *dst, const char *src, size_t size);
 #define strlcat isc_string_strlcat
 #endif
 
+char *
+isc_string_strcasestr(const char *big, const char *little);
+
+#ifdef ISC_PLATFORM_NEEDSTRCASESTR
+#define strcasestr isc_string_strcasestr
+#endif
+
 ISC_LANG_ENDDECLS
 
 #endif /* ISC_STRING_H */
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
index 8dbf67ed..a1edadd1 100644
--- a/lib/isc/include/isc/types.h
+++ b/lib/isc/include/isc/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -103,7 +103,9 @@ typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
 
 /* The following cannot be listed alphabetically due to forward reference */
 typedef isc_result_t (isc_httpdaction_t)(const char *url,
+					 isc_httpdurl_t *urlinfo,
 					 const char *querystring,
+					 const char *headers,
 					 void *arg,
 					 unsigned int *retcode,
 					 const char **retmsg,
diff --git a/lib/isc/inet_pton.c b/lib/isc/inet_pton.c
index ac4defde..4c60f825 100644
--- a/lib/isc/inet_pton.c
+++ b/lib/isc/inet_pton.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1996-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -114,7 +114,7 @@ inet_pton4(const char *src, unsigned char *dst) {
 	}
 	if (octets < 4)
 		return (0);
-	memcpy(dst, tmp, NS_INADDRSZ);
+	memmove(dst, tmp, NS_INADDRSZ);
 	return (1);
 }
 
@@ -210,6 +210,6 @@ inet_pton6(const char *src, unsigned char *dst) {
 	}
 	if (tp != endp)
 		return (0);
-	memcpy(dst, tmp, NS_IN6ADDRSZ);
+	memmove(dst, tmp, NS_IN6ADDRSZ);
 	return (1);
 }
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index a4bfcd1e..aa3a6c9f 100644
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -75,7 +75,7 @@ grow_data(isc_lex_t *lex, size_t *remainingp, char **currp, char **prevp) {
 	new = isc_mem_get(lex->mctx, lex->max_token * 2 + 1);
 	if (new == NULL)
 		return (ISC_R_NOMEMORY);
-	memcpy(new, lex->data, lex->max_token + 1);
+	memmove(new, lex->data, lex->max_token + 1);
 	*currp = new + (*currp - lex->data);
 	if (*prevp != NULL)
 		*prevp = new + (*prevp - lex->data);
@@ -173,7 +173,7 @@ isc_lex_getspecials(isc_lex_t *lex, isc_lexspecials_t specials) {
 
 	REQUIRE(VALID_LEX(lex));
 
-	memcpy(specials, lex->specials, 256);
+	memmove(specials, lex->specials, 256);
 }
 
 void
@@ -185,7 +185,7 @@ isc_lex_setspecials(isc_lex_t *lex, isc_lexspecials_t specials) {
 
 	REQUIRE(VALID_LEX(lex));
 
-	memcpy(lex->specials, specials, 256);
+	memmove(lex->specials, specials, 256);
 }
 
 static inline isc_result_t
diff --git a/lib/isc/log.c b/lib/isc/log.c
index d8262fb9..2cf584b4 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1130,7 +1130,7 @@ sync_channellist(isc_logconfig_t *lcfg) {
 	if (lcfg->channellist_count != 0) {
 		bytes = lcfg->channellist_count *
 			sizeof(ISC_LIST(isc_logchannellist_t));
-		memcpy(lists, lcfg->channellists, bytes);
+		memmove(lists, lcfg->channellists, bytes);
 		isc_mem_put(lctx->mctx, lcfg->channellists, bytes);
 	}
 
diff --git a/lib/isc/md5.c b/lib/isc/md5.c
index 7c6419b2..5d212502 100644
--- a/lib/isc/md5.c
+++ b/lib/isc/md5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -217,11 +217,11 @@ isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
 
 	t = 64 - (t & 0x3f);	/* Space available in ctx->in (at least 1) */
 	if (t > len) {
-		memcpy((unsigned char *)ctx->in + 64 - t, buf, len);
+		memmove((unsigned char *)ctx->in + 64 - t, buf, len);
 		return;
 	}
 	/* First chunk is an odd size */
-	memcpy((unsigned char *)ctx->in + 64 - t, buf, t);
+	memmove((unsigned char *)ctx->in + 64 - t, buf, t);
 	byteSwap(ctx->in, 16);
 	transform(ctx->buf, ctx->in);
 	buf += t;
@@ -229,7 +229,7 @@ isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
 
 	/* Process data in 64-byte chunks */
 	while (len >= 64) {
-		memcpy(ctx->in, buf, 64);
+		memmove(ctx->in, buf, 64);
 		byteSwap(ctx->in, 16);
 		transform(ctx->buf, ctx->in);
 		buf += 64;
@@ -237,7 +237,7 @@ isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
 	}
 
 	/* Handle any remaining bytes of data. */
-	memcpy(ctx->in, buf, len);
+	memmove(ctx->in, buf, len);
 }
 
 /*!
@@ -271,7 +271,7 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 	transform(ctx->buf, ctx->in);
 
 	byteSwap(ctx->buf, 4);
-	memcpy(digest, ctx->buf, 16);
+	memmove(digest, ctx->buf, 16);
 	memset(ctx, 0, sizeof(isc_md5_t));	/* In case it's sensitive */
 }
 #endif
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index f2a3adba..f45a077e 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -553,9 +553,9 @@ more_basic_blocks(isc__mem_t *ctx) {
 			return (ISC_FALSE);
 		}
 		if (ctx->basic_table_size != 0) {
-			memcpy(table, ctx->basic_table,
-			       ctx->basic_table_size *
-			       sizeof(unsigned char *));
+			memmove(table, ctx->basic_table,
+				ctx->basic_table_size *
+				  sizeof(unsigned char *));
 			(ctx->memfree)(ctx->arg, ctx->basic_table);
 		}
 		ctx->basic_table = table;
@@ -1603,7 +1603,7 @@ isc___mem_reallocate(isc_mem_t *ctx0, void *ptr, size_t size FLARG) {
 				oldsize -= ALIGNMENT_SIZE;
 			}
 			copysize = (oldsize > size) ? size : oldsize;
-			memcpy(new_ptr, ptr, copysize);
+			memmove(new_ptr, ptr, copysize);
 			isc__mem_free(ctx0, ptr FLARG_PASS);
 		}
 	} else if (ptr != NULL)
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
index 5cce1bc1..0940df17 100644
--- a/lib/isc/netaddr.c
+++ b/lib/isc/netaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2010-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2010-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -340,7 +340,7 @@ isc_netaddr_fromsockaddr(isc_netaddr_t *t, const isc_sockaddr_t *s) {
 		t->zone = 0;
 		break;
 	case AF_INET6:
-		memcpy(&t->type.in6, &s->type.sin6.sin6_addr, 16);
+		memmove(&t->type.in6, &s->type.sin6.sin6_addr, 16);
 #ifdef ISC_PLATFORM_HAVESCOPEID
 		t->zone = s->type.sin6.sin6_scope_id;
 #else
@@ -349,7 +349,7 @@ isc_netaddr_fromsockaddr(isc_netaddr_t *t, const isc_sockaddr_t *s) {
 		break;
 #ifdef ISC_PLATFORM_HAVESYSUNH
 	case AF_UNIX:
-		memcpy(t->type.un, s->type.sunix.sun_path, sizeof(t->type.un));
+		memmove(t->type.un, s->type.sunix.sun_path, sizeof(t->type.un));
 		t->zone = 0;
 		break;
 #endif
@@ -429,6 +429,6 @@ isc_netaddr_fromv4mapped(isc_netaddr_t *t, const isc_netaddr_t *s) {
 
 	memset(t, 0, sizeof(*t));
 	t->family = AF_INET;
-	memcpy(&t->type.in, (char *)&src->type.in6 + 12, 4);
+	memmove(&t->type.in, (char *)&src->type.in6 + 12, 4);
 	return;
 }
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index 35088788..82090d1f 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -62,11 +62,11 @@ _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest,
 
 	if (family == AF_INET6) {
 		prefix->bitlen = (bitlen >= 0) ? bitlen : 128;
-		memcpy(&prefix->add.sin6, dest, 16);
+		memmove(&prefix->add.sin6, dest, 16);
 	} else {
 		/* AF_UNSPEC is "any" or "none"--treat it as AF_INET */
 		prefix->bitlen = (bitlen >= 0) ? bitlen : 32;
-		memcpy(&prefix->add.sin, dest, 4);
+		memmove(&prefix->add.sin, dest, 4);
 	}
 
 	prefix->family = family;
diff --git a/lib/isc/sha1.c b/lib/isc/sha1.c
index cce96036..aca90b43 100644
--- a/lib/isc/sha1.c
+++ b/lib/isc/sha1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -209,7 +209,7 @@ transform(isc_uint32_t state[5], const unsigned char buffer[64]) {
 	INSIST(state != NULL);
 
 	block = &workspace;
-	(void)memcpy(block, buffer, 64);
+	(void)memmove(block, buffer, 64);
 
 	/* Copy context->state[] to working vars */
 	a = state[0];
@@ -301,7 +301,7 @@ isc_sha1_update(isc_sha1_t *context, const unsigned char *data,
 		context->count[1] += (len >> 29) + 1;
 	j = (j >> 3) & 63;
 	if ((j + len) > 63) {
-		(void)memcpy(&context->buffer[j], data, (i = 64 - j));
+		(void)memmove(&context->buffer[j], data, (i = 64 - j));
 		transform(context->state, context->buffer);
 		for (; i + 63 < len; i += 64)
 			transform(context->state, &data[i]);
@@ -310,7 +310,7 @@ isc_sha1_update(isc_sha1_t *context, const unsigned char *data,
 		i = 0;
 	}
 
-	(void)memcpy(&context->buffer[j], &data[i], len - i);
+	(void)memmove(&context->buffer[j], &data[i], len - i);
 }
 
 
diff --git a/lib/isc/sha2.c b/lib/isc/sha2.c
index db2e3496..5f3554fa 100644
--- a/lib/isc/sha2.c
+++ b/lib/isc/sha2.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005-2007, 2009, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -560,8 +560,8 @@ isc_sha224_init(isc_sha224_t *context) {
 	if (context == (isc_sha256_t *)0) {
 		return;
 	}
-	memcpy(context->state, sha224_initial_hash_value,
-	       ISC_SHA256_DIGESTLENGTH);
+	memmove(context->state, sha224_initial_hash_value,
+		ISC_SHA256_DIGESTLENGTH);
 	memset(context->buffer, 0, ISC_SHA256_BLOCK_LENGTH);
 	context->bitcount = 0;
 }
@@ -580,7 +580,7 @@ void
 isc_sha224_final(isc_uint8_t digest[], isc_sha224_t *context) {
 	isc_uint8_t sha256_digest[ISC_SHA256_DIGESTLENGTH];
 	isc_sha256_final(sha256_digest, (isc_sha256_t *)context);
-	memcpy(digest, sha256_digest, ISC_SHA224_DIGESTLENGTH);
+	memmove(digest, sha256_digest, ISC_SHA224_DIGESTLENGTH);
 	memset(sha256_digest, 0, ISC_SHA256_DIGESTLENGTH);
 }
 
@@ -590,7 +590,7 @@ isc_sha256_init(isc_sha256_t *context) {
 	if (context == (isc_sha256_t *)0) {
 		return;
 	}
-	memcpy(context->state, sha256_initial_hash_value,
+	memmove(context->state, sha256_initial_hash_value,
 	       ISC_SHA256_DIGESTLENGTH);
 	memset(context->buffer, 0, ISC_SHA256_BLOCK_LENGTH);
 	context->bitcount = 0;
@@ -803,7 +803,7 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
 
 		if (len >= freespace) {
 			/* Fill the buffer completely and process it */
-			memcpy(&context->buffer[usedspace], data, freespace);
+			memmove(&context->buffer[usedspace], data, freespace);
 			context->bitcount += freespace << 3;
 			len -= freespace;
 			data += freespace;
@@ -811,7 +811,7 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
 					     (isc_uint32_t*)context->buffer);
 		} else {
 			/* The buffer is not yet full */
-			memcpy(&context->buffer[usedspace], data, len);
+			memmove(&context->buffer[usedspace], data, len);
 			context->bitcount += len << 3;
 			/* Clean up: */
 			usedspace = freespace = 0;
@@ -822,7 +822,7 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
 	}
 	while (len >= ISC_SHA256_BLOCK_LENGTH) {
 		/* Process as many complete blocks as we can */
-		memcpy(context->buffer, data, ISC_SHA256_BLOCK_LENGTH);
+		memmove(context->buffer, data, ISC_SHA256_BLOCK_LENGTH);
 		isc_sha256_transform(context, (isc_uint32_t*)context->buffer);
 		context->bitcount += ISC_SHA256_BLOCK_LENGTH << 3;
 		len -= ISC_SHA256_BLOCK_LENGTH;
@@ -830,7 +830,7 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
 	}
 	if (len > 0U) {
 		/* There's left-overs, so save 'em */
-		memcpy(context->buffer, data, len);
+		memmove(context->buffer, data, len);
 		context->bitcount += len << 3;
 	}
 	/* Clean up: */
@@ -900,7 +900,7 @@ isc_sha256_final(isc_uint8_t digest[], isc_sha256_t *context) {
 			}
 		}
 #else
-		memcpy(d, context->state, ISC_SHA256_DIGESTLENGTH);
+		memmove(d, context->state, ISC_SHA256_DIGESTLENGTH);
 #endif
 	}
 
@@ -916,8 +916,8 @@ isc_sha512_init(isc_sha512_t *context) {
 	if (context == (isc_sha512_t *)0) {
 		return;
 	}
-	memcpy(context->state, sha512_initial_hash_value,
-	       ISC_SHA512_DIGESTLENGTH);
+	memmove(context->state, sha512_initial_hash_value,
+		ISC_SHA512_DIGESTLENGTH);
 	memset(context->buffer, 0, ISC_SHA512_BLOCK_LENGTH);
 	context->bitcount[0] = context->bitcount[1] =  0;
 }
@@ -1122,7 +1122,7 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
 
 		if (len >= freespace) {
 			/* Fill the buffer completely and process it */
-			memcpy(&context->buffer[usedspace], data, freespace);
+			memmove(&context->buffer[usedspace], data, freespace);
 			ADDINC128(context->bitcount, freespace << 3);
 			len -= freespace;
 			data += freespace;
@@ -1130,7 +1130,7 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
 					     (isc_uint64_t*)context->buffer);
 		} else {
 			/* The buffer is not yet full */
-			memcpy(&context->buffer[usedspace], data, len);
+			memmove(&context->buffer[usedspace], data, len);
 			ADDINC128(context->bitcount, len << 3);
 			/* Clean up: */
 			usedspace = freespace = 0;
@@ -1141,7 +1141,7 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
 	}
 	while (len >= ISC_SHA512_BLOCK_LENGTH) {
 		/* Process as many complete blocks as we can */
-		memcpy(context->buffer, data, ISC_SHA512_BLOCK_LENGTH);
+		memmove(context->buffer, data, ISC_SHA512_BLOCK_LENGTH);
 		isc_sha512_transform(context, (isc_uint64_t*)context->buffer);
 		ADDINC128(context->bitcount, ISC_SHA512_BLOCK_LENGTH << 3);
 		len -= ISC_SHA512_BLOCK_LENGTH;
@@ -1149,7 +1149,7 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
 	}
 	if (len > 0U) {
 		/* There's left-overs, so save 'em */
-		memcpy(context->buffer, data, len);
+		memmove(context->buffer, data, len);
 		ADDINC128(context->bitcount, len << 3);
 	}
 	/* Clean up: */
@@ -1224,7 +1224,7 @@ void isc_sha512_final(isc_uint8_t digest[], isc_sha512_t *context) {
 			}
 		}
 #else
-		memcpy(d, context->state, ISC_SHA512_DIGESTLENGTH);
+		memmove(d, context->state, ISC_SHA512_DIGESTLENGTH);
 #endif
 	}
 
@@ -1239,8 +1239,8 @@ isc_sha384_init(isc_sha384_t *context) {
 	if (context == (isc_sha384_t *)0) {
 		return;
 	}
-	memcpy(context->state, sha384_initial_hash_value,
-	       ISC_SHA512_DIGESTLENGTH);
+	memmove(context->state, sha384_initial_hash_value,
+		ISC_SHA512_DIGESTLENGTH);
 	memset(context->buffer, 0, ISC_SHA384_BLOCK_LENGTH);
 	context->bitcount[0] = context->bitcount[1] = 0;
 }
@@ -1277,7 +1277,7 @@ isc_sha384_final(isc_uint8_t digest[], isc_sha384_t *context) {
 			}
 		}
 #else
-		memcpy(d, context->state, ISC_SHA384_DIGESTLENGTH);
+		memmove(d, context->state, ISC_SHA384_DIGESTLENGTH);
 #endif
 	}
 
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index 91a949b6..cee6d700 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2010-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -332,7 +332,7 @@ isc_sockaddr_v6fromin(isc_sockaddr_t *sockaddr, const struct in_addr *ina,
 #endif
 	sockaddr->type.sin6.sin6_addr.s6_addr[10] = 0xff;
 	sockaddr->type.sin6.sin6_addr.s6_addr[11] = 0xff;
-	memcpy(&sockaddr->type.sin6.sin6_addr.s6_addr[12], ina, 4);
+	memmove(&sockaddr->type.sin6.sin6_addr.s6_addr[12], ina, 4);
 	sockaddr->type.sin6.sin6_port = htons(port);
 	sockaddr->length = sizeof(sockaddr->type.sin6);
 	ISC_LINK_INIT(sockaddr, link);
@@ -386,7 +386,7 @@ isc_sockaddr_fromnetaddr(isc_sockaddr_t *sockaddr, const isc_netaddr_t *na,
 #ifdef ISC_PLATFORM_HAVESALEN
 		sockaddr->type.sin6.sin6_len = sizeof(sockaddr->type.sin6);
 #endif
-		memcpy(&sockaddr->type.sin6.sin6_addr, &na->type.in6, 16);
+		memmove(&sockaddr->type.sin6.sin6_addr, &na->type.in6, 16);
 #ifdef ISC_PLATFORM_HAVESCOPEID
 		sockaddr->type.sin6.sin6_scope_id = isc_netaddr_getzone(na);
 #endif
diff --git a/lib/isc/stats.c b/lib/isc/stats.c
index 8b624b2d..89e34b37 100644
--- a/lib/isc/stats.c
+++ b/lib/isc/stats.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -275,8 +275,8 @@ copy_counters(isc_stats_t *stats) {
 	}
 #else
 	UNUSED(i);
-	memcpy(stats->copiedcounters, stats->counters,
-	       stats->ncounters * sizeof(isc_stat_t));
+	memmove(stats->copiedcounters, stats->counters,
+		stats->ncounters * sizeof(isc_stat_t));
 #endif
 
 #ifdef ISC_RWLOCK_USEATOMIC
diff --git a/lib/isc/string.c b/lib/isc/string.c
index cba517c5..aa49e32f 100644
--- a/lib/isc/string.c
+++ b/lib/isc/string.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,38 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
+/*
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
 
 /*! \file */
 
@@ -188,7 +219,7 @@ isc_string_regiondup(isc_mem_t *mctx, const isc_region_t *source) {
 
 	target = (char *) isc_mem_allocate(mctx, source->length + 1);
 	if (target != NULL) {
-		memcpy(source->base, target, source->length);
+		memmove(source->base, target, source->length);
 		target[source->length] = '\0';
 	}
 
@@ -269,3 +300,24 @@ isc_string_strlcat(char *dst, const char *src, size_t size)
 
 	return(dlen + (s - src));	/* count does not include NUL */
 }
+
+char *
+isc_string_strcasestr(const char *str, const char *search) {
+	char c, sc, *s;
+	size_t len;
+
+	if ((c = *search++) != 0) {
+		c = tolower((unsigned char) c);
+		len = strlen(search);
+		do {
+			do {
+				if ((sc = *str++) == 0)
+					return (NULL);
+			} while ((char) tolower((unsigned char) sc) != c);
+		} while (strncasecmp(str, search, len) != 0);
+		str--;
+	}
+	DE_CONST(str, s);
+	return (s);
+
+}
diff --git a/lib/isc/tests/Makefile.in b/lib/isc/tests/Makefile.in
index 66d0b152..a3121601 100644
--- a/lib/isc/tests/Makefile.in
+++ b/lib/isc/tests/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -38,14 +38,16 @@ OBJS =		isctest.@O@
 SRCS =		isctest.c taskpool_test.c socket_test.c hash_test.c \
 		lex_test.c \
 		sockaddr_test.c symtab_test.c task_test.c queue_test.c \
-		parse_test.c pool_test.c regex_test.c safe_test.c
+		parse_test.c pool_test.c regex_test.c safe_test.c \
+		time_test.c
 
 SUBDIRS =
 TARGETS =	taskpool_test@EXEEXT@ socket_test@EXEEXT@ hash_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
 		sockaddr_test@EXEEXT@ symtab_test@EXEEXT@ task_test@EXEEXT@ \
 		queue_test@EXEEXT@ parse_test@EXEEXT@ pool_test@EXEEXT@ \
-		regex_test@EXEEXT@ safe_test@EXEEXT@
+		regex_test@EXEEXT@ safe_test@EXEEXT@ \
+		time_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -97,6 +99,10 @@ safe_test@EXEEXT@: safe_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 			safe_test.@O@ ${ISCLIBS} ${LIBS}
 
+time_test@EXEEXT@: time_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			time_test.@O@ ${ISCLIBS} ${LIBS}
+
 unit::
 	sh ${top_srcdir}/unit/unittest.sh
 
diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
index 836d7b67..84548081 100644
--- a/lib/isc/tests/hash_test.c
+++ b/lib/isc/tests/hash_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -963,7 +963,7 @@ ATF_TC_BODY(isc_hmacsha1, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
 		isc_hmacsha1_update(&hmacsha1,
 				    (const isc_uint8_t *) testcase->input,
@@ -1126,7 +1126,7 @@ ATF_TC_BODY(isc_hmacsha224, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
 		isc_hmacsha224_update(&hmacsha224,
 				      (const isc_uint8_t *) testcase->input,
@@ -1289,7 +1289,7 @@ ATF_TC_BODY(isc_hmacsha256, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
 		isc_hmacsha256_update(&hmacsha256,
 				      (const isc_uint8_t *) testcase->input,
@@ -1458,7 +1458,7 @@ ATF_TC_BODY(isc_hmacsha384, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
 		isc_hmacsha384_update(&hmacsha384,
 				      (const isc_uint8_t *) testcase->input,
@@ -1627,7 +1627,7 @@ ATF_TC_BODY(isc_hmacsha512, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
 		isc_hmacsha512_update(&hmacsha512,
 				      (const isc_uint8_t *) testcase->input,
@@ -1770,7 +1770,7 @@ ATF_TC_BODY(isc_hmacmd5, tc) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
-		memcpy(buffer, test_key->key, test_key->len);
+		memmove(buffer, test_key->key, test_key->len);
 		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
 		isc_hmacmd5_update(&hmacmd5,
 				   (const isc_uint8_t *) testcase->input,
diff --git a/lib/isc/tests/time_test.c b/lib/isc/tests/time_test.c
new file mode 100644
index 00000000..caddec2b
--- /dev/null
+++ b/lib/isc/tests/time_test.c
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <config.h>
+#include <stdlib.h>
+
+#include <atf-c.h>
+
+#include <isc/time.h>
+#include <isc/result.h>
+
+ATF_TC(isc_time_parsehttptimestamp);
+ATF_TC_HEAD(isc_time_parsehttptimestamp, tc) {
+	atf_tc_set_md_var(tc, "descr", "parse http time stamp");
+}
+ATF_TC_BODY(isc_time_parsehttptimestamp, tc) {
+	isc_result_t result;
+	isc_time_t t, x;
+	char buf[100];
+
+	setenv("TZ", "PST8PDT", 1);
+	result = isc_time_now(&t);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	isc_time_formathttptimestamp(&t, buf, sizeof(buf));
+	result = isc_time_parsehttptimestamp(buf, &x);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(isc_time_seconds(&t), isc_time_seconds(&x));
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, isc_time_parsehttptimestamp);
+	return (atf_no_error());
+}
+
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index d88ca29a..c6b9a29e 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -489,7 +489,7 @@ isc_file_progname(const char *filename, char *buf, size_t buflen) {
 
 	if (len > buflen)
 		return (ISC_R_NOSPACE);
-	memcpy(buf, base, len);
+	memmove(buf, base, len);
 
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isc/unix/ifiter_getifaddrs.c b/lib/isc/unix/ifiter_getifaddrs.c
index 637450aa..cf1c0c18 100644
--- a/lib/isc/unix/ifiter_getifaddrs.c
+++ b/lib/isc/unix/ifiter_getifaddrs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -159,7 +159,7 @@ internal_current(isc_interfaceiter_t *iter) {
 		namelen = sizeof(iter->current.name) - 1;
 
 	memset(iter->current.name, 0, sizeof(iter->current.name));
-	memcpy(iter->current.name, ifa->ifa_name, namelen);
+	memmove(iter->current.name, ifa->ifa_name, namelen);
 
 	iter->current.flags = 0;
 
diff --git a/lib/isc/unix/ifiter_ioctl.c b/lib/isc/unix/ifiter_ioctl.c
index 38c34fd6..f0026c28 100644
--- a/lib/isc/unix/ifiter_ioctl.c
+++ b/lib/isc/unix/ifiter_ioctl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -398,7 +398,7 @@ isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) {
 static void
 get_inaddr(isc_netaddr_t *dst, struct in_addr *src) {
 	dst->family = AF_INET;
-	memcpy(&dst->type.in, src, sizeof(struct in_addr));
+	memmove(&dst->type.in, src, sizeof(struct in_addr));
 }
 
 static isc_result_t
@@ -454,7 +454,7 @@ internal_current4(isc_interfaceiter_t *iter) {
 	ifrp = (struct ifreq *)((char *) iter->ifc.ifc_req + iter->pos);
 
 	memset(&ifreq, 0, sizeof(ifreq));
-	memcpy(&ifreq, ifrp, sizeof(ifreq));
+	memmove(&ifreq, ifrp, sizeof(ifreq));
 
 	family = ifreq.ifr_addr.sa_family;
 #if defined(ISC_PLATFORM_HAVEIPV6)
@@ -469,7 +469,7 @@ internal_current4(isc_interfaceiter_t *iter) {
 
 	INSIST(sizeof(ifreq.ifr_name) <= sizeof(iter->current.name));
 	memset(iter->current.name, 0, sizeof(iter->current.name));
-	memcpy(iter->current.name, ifreq.ifr_name, sizeof(ifreq.ifr_name));
+	memmove(iter->current.name, ifreq.ifr_name, sizeof(ifreq.ifr_name));
 
 	get_addr(family, &iter->current.address,
 		 (struct sockaddr *)&ifrp->ifr_addr, ifreq.ifr_name);
@@ -524,8 +524,8 @@ internal_current4(isc_interfaceiter_t *iter) {
 
 #if !defined(ISC_PLATFORM_HAVEIF_LADDRREQ) && defined(SIOCGLIFADDR)
 	memset(&lifreq, 0, sizeof(lifreq));
-	memcpy(lifreq.lifr_name, iter->current.name, sizeof(lifreq.lifr_name));
-	memcpy(&lifreq.lifr_addr, &iter->current.address.type.in6,
+	memmove(lifreq.lifr_name, iter->current.name, sizeof(lifreq.lifr_name));
+	memmove(&lifreq.lifr_addr, &iter->current.address.type.in6,
 	       sizeof(iter->current.address.type.in6));
 
 	if (ioctl(iter->socket, SIOCGLIFADDR, &lifreq) < 0) {
@@ -599,7 +599,7 @@ internal_current4(isc_interfaceiter_t *iter) {
 	 * Get the network mask.
 	 */
 	memset(&ifreq, 0, sizeof(ifreq));
-	memcpy(&ifreq, ifrp, sizeof(ifreq));
+	memmove(&ifreq, ifrp, sizeof(ifreq));
 	/*
 	 * Ignore the HP/UX warning about "integer overflow during
 	 * conversion.  It comes from its own macro definition,
@@ -637,7 +637,7 @@ internal_current6(isc_interfaceiter_t *iter) {
 	ifrp = (struct LIFREQ *)((char *) iter->lifc.lifc_req + iter->pos6);
 
 	memset(&lifreq, 0, sizeof(lifreq));
-	memcpy(&lifreq, ifrp, sizeof(lifreq));
+	memmove(&lifreq, ifrp, sizeof(lifreq));
 
 	family = lifreq.lifr_addr.ss_family;
 #ifdef ISC_PLATFORM_HAVEIPV6
@@ -652,7 +652,7 @@ internal_current6(isc_interfaceiter_t *iter) {
 
 	INSIST(sizeof(lifreq.lifr_name) <= sizeof(iter->current.name));
 	memset(iter->current.name, 0, sizeof(iter->current.name));
-	memcpy(iter->current.name, lifreq.lifr_name, sizeof(lifreq.lifr_name));
+	memmove(iter->current.name, lifreq.lifr_name, sizeof(lifreq.lifr_name));
 
 	get_addr(family, &iter->current.address,
 		 (struct sockaddr *)&lifreq.lifr_addr, lifreq.lifr_name);
@@ -739,7 +739,7 @@ internal_current6(isc_interfaceiter_t *iter) {
 	 * Get the network mask.  Netmask already zeroed.
 	 */
 	memset(&lifreq, 0, sizeof(lifreq));
-	memcpy(&lifreq, ifrp, sizeof(lifreq));
+	memmove(&lifreq, ifrp, sizeof(lifreq));
 
 #ifdef lifr_addrlen
 	/*
diff --git a/lib/isc/unix/ifiter_sysctl.c b/lib/isc/unix/ifiter_sysctl.c
index 9d5bf6d9..102ecc1f 100644
--- a/lib/isc/unix/ifiter_sysctl.c
+++ b/lib/isc/unix/ifiter_sysctl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -37,7 +37,7 @@
 		sizeof(__uint64_t))
 #else
 #define ROUNDUP(a) ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) \
-                    : sizeof(long))
+		    : sizeof(long))
 #endif
 
 #define IFITER_MAGIC		ISC_MAGIC('I', 'F', 'I', 'S')
@@ -58,9 +58,9 @@ struct isc_interfaceiter {
 static int mib[6] = {
 	CTL_NET,
 	PF_ROUTE,
-        0,
+	0,
 	0, 			/* Any address family. */
-        NET_RT_IFLIST,
+	NET_RT_IFLIST,
 	0 			/* Flags. */
 };
 
@@ -171,7 +171,7 @@ internal_current(isc_interfaceiter_t *iter) {
 			namelen = sizeof(iter->current.name) - 1;
 
 		memset(iter->current.name, 0, sizeof(iter->current.name));
-		memcpy(iter->current.name, sdl->sdl_data, namelen);
+		memmove(iter->current.name, sdl->sdl_data, namelen);
 
 		iter->current.flags = 0;
 
diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
index d81d854a..2a83f099 100644
--- a/lib/isc/unix/include/isc/time.h
+++ b/lib/isc/unix/include/isc/time.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -315,6 +315,16 @@ isc_time_formathttptimestamp(const isc_time_t *t, char *buf, unsigned int len);
  *
  */
 
+isc_result_t
+isc_time_parsehttptimestamp(char *input, isc_time_t *t);
+/*%<
+ * Parse the time in 'input' into the isc_time_t pointed to by 't',
+ * expecting a format like "Mon, 30 Aug 2000 04:06:47 GMT"
+ *
+ *  Requires:
+ *\li      'buf' and 't' are not NULL.
+ */
+
 void
 isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len);
 /*%<
diff --git a/lib/isc/unix/interfaceiter.c b/lib/isc/unix/interfaceiter.c
index af2b06d0..7272f718 100644
--- a/lib/isc/unix/interfaceiter.c
+++ b/lib/isc/unix/interfaceiter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -79,14 +79,14 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src,
 	dst->family = family;
 	switch (family) {
 	case AF_INET:
-		memcpy(&dst->type.in,
-		       &((struct sockaddr_in *) src)->sin_addr,
-		       sizeof(struct in_addr));
+		memmove(&dst->type.in,
+			&((struct sockaddr_in *) src)->sin_addr,
+			sizeof(struct in_addr));
 		break;
 	case AF_INET6:
 		sa6 = (struct sockaddr_in6 *)src;
-		memcpy(&dst->type.in6, &sa6->sin6_addr,
-		       sizeof(struct in6_addr));
+		memmove(&dst->type.in6, &sa6->sin6_addr,
+			sizeof(struct in6_addr));
 #ifdef ISC_PLATFORM_HAVESCOPEID
 		if (sa6->sin6_scope_id != 0)
 			isc_netaddr_setzone(dst, sa6->sin6_scope_id);
@@ -105,8 +105,8 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src,
 			if (IN6_IS_ADDR_LINKLOCAL(&sa6->sin6_addr)) {
 				isc_uint16_t zone16;
 
-				memcpy(&zone16, &sa6->sin6_addr.s6_addr[2],
-				       sizeof(zone16));
+				memmove(&zone16, &sa6->sin6_addr.s6_addr[2],
+					sizeof(zone16));
 				zone16 = ntohs(zone16);
 				if (zone16 != 0) {
 					/* the zone ID is embedded */
@@ -252,7 +252,7 @@ isc_interfaceiter_current(isc_interfaceiter_t *iter,
 			  isc_interface_t *ifdata)
 {
 	REQUIRE(iter->result == ISC_R_SUCCESS);
-	memcpy(ifdata, &iter->current, sizeof(*ifdata));
+	memmove(ifdata, &iter->current, sizeof(*ifdata));
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 4237af40..d1ac96f5 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -1261,8 +1261,8 @@ process_cmsg(isc__socket_t *sock, struct msghdr *msg, isc_socketevent_t *dev) {
 		    && cmsgp->cmsg_type == IPV6_PKTINFO) {
 
 			pktinfop = (struct in6_pktinfo *)CMSG_DATA(cmsgp);
-			memcpy(&dev->pktinfo, pktinfop,
-			       sizeof(struct in6_pktinfo));
+			memmove(&dev->pktinfo, pktinfop,
+				sizeof(struct in6_pktinfo));
 			dev->attributes |= ISC_SOCKEVENTATTR_PKTINFO;
 			socket_log(sock, NULL, TRACE,
 				   isc_msgcat, ISC_MSGSET_SOCKET,
@@ -1280,7 +1280,7 @@ process_cmsg(isc__socket_t *sock, struct msghdr *msg, isc_socketevent_t *dev) {
 		    && cmsgp->cmsg_type == SCM_TIMESTAMP) {
 			struct timeval tv;
 			timevalp = CMSG_DATA(cmsgp);
-			memcpy(&tv, timevalp, sizeof(tv));
+			memmove(&tv, timevalp, sizeof(tv));
 			dev->timestamp.seconds = tv.tv_sec;
 			dev->timestamp.nanoseconds = tv.tv_usec * 1000;
 			dev->attributes |= ISC_SOCKEVENTATTR_TIMESTAMP;
@@ -1406,7 +1406,7 @@ build_msghdr_send(isc__socket_t *sock, isc_socketevent_t *dev,
 		cmsgp->cmsg_type = IPV6_PKTINFO;
 		cmsgp->cmsg_len = cmsg_len(sizeof(struct in6_pktinfo));
 		pktinfop = (struct in6_pktinfo *)CMSG_DATA(cmsgp);
-		memcpy(pktinfop, &dev->pktinfo, sizeof(struct in6_pktinfo));
+		memmove(pktinfop, &dev->pktinfo, sizeof(struct in6_pktinfo));
 #if defined(IPV6_USE_MIN_MTU)
 		/*
 		 * Set IPV6_USE_MIN_MTU as a per packet option as FreeBSD
@@ -1421,7 +1421,7 @@ build_msghdr_send(isc__socket_t *sock, isc_socketevent_t *dev,
 		cmsgp->cmsg_level = IPPROTO_IPV6;
 		cmsgp->cmsg_type = IPV6_USE_MIN_MTU;
 		cmsgp->cmsg_len = cmsg_len(sizeof(use_min_mtu));
-		memcpy(CMSG_DATA(cmsgp), &use_min_mtu, sizeof(use_min_mtu));
+		memmove(CMSG_DATA(cmsgp), &use_min_mtu, sizeof(use_min_mtu));
 #endif
 	}
 #endif /* USE_CMSG && ISC_PLATFORM_HAVEIPV6 */
@@ -3863,10 +3863,10 @@ watcher(void *uap) {
 			cc = ioctl(manager->devpoll_fd, DP_POLL, &dvp);
 #elif defined(USE_SELECT)
 			LOCK(&manager->lock);
-			memcpy(manager->read_fds_copy, manager->read_fds,
-			       manager->fd_bufsize);
-			memcpy(manager->write_fds_copy, manager->write_fds,
-			       manager->fd_bufsize);
+			memmove(manager->read_fds_copy, manager->read_fds,
+				manager->fd_bufsize);
+			memmove(manager->write_fds_copy, manager->write_fds,
+				manager->fd_bufsize);
 			maxfd = manager->maxfd + 1;
 			UNLOCK(&manager->lock);
 
@@ -5849,9 +5849,9 @@ isc__socketmgr_waitevents(isc_socketmgr_t *manager0, struct timeval *tvp,
 	swait_private.nevents = ioctl(manager->devpoll_fd, DP_POLL, &dvp);
 	n = swait_private.nevents;
 #elif defined(USE_SELECT)
-	memcpy(manager->read_fds_copy, manager->read_fds,  manager->fd_bufsize);
-	memcpy(manager->write_fds_copy, manager->write_fds,
-	       manager->fd_bufsize);
+	memmove(manager->read_fds_copy, manager->read_fds, manager->fd_bufsize);
+	memmove(manager->write_fds_copy, manager->write_fds,
+		manager->fd_bufsize);
 
 	swait_private.readset = manager->read_fds_copy;
 	swait_private.writeset = manager->write_fds_copy;
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
index e820afb1..9039b06a 100644
--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -23,6 +23,7 @@
 
 #include <errno.h>
 #include <limits.h>
+#include <stdlib.h>
 #include <syslog.h>
 #include <time.h>
 
@@ -407,6 +408,49 @@ isc_time_formathttptimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 	INSIST(flen < len);
 }
 
+static time_t
+timetfromtm(struct tm *tm) {
+	time_t ret;
+	int i, yday = 0, leapday;
+	int mdays[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30 };
+
+	leapday = ((((tm->tm_year + 1900 ) % 4) == 0 &&
+		    ((tm->tm_year + 1900 ) % 100) != 0) ||
+		   ((tm->tm_year + 1900 ) % 400) == 0) ? 1 : 0;
+	mdays[1] += leapday;
+
+	yday = tm->tm_mday - 1;
+	for (i = 1; i <= tm->tm_mon; i++)
+		yday += mdays[i - 1];
+	ret = tm->tm_sec +
+	      (60 * tm->tm_min) +
+	      (3600 * tm->tm_hour) +
+	      (86400 * (yday +
+		       ((tm->tm_year - 70) * 365) +
+		       ((tm->tm_year - 69) / 4) -
+		       ((tm->tm_year - 1) / 100) +
+		       ((tm->tm_year + 299) / 400)));
+	return (ret);
+}
+
+isc_result_t
+isc_time_parsehttptimestamp(char *buf, isc_time_t *t) {
+	struct tm t_tm;
+	time_t when;
+	char *p;
+
+	REQUIRE(buf != NULL);
+	REQUIRE(t != NULL);
+	p = strptime(buf, "%a, %d %b %Y %H:%M:%S", &t_tm);
+	if (p == NULL)
+		return (ISC_R_UNEXPECTED);
+	when = timetfromtm(&t_tm);
+	if (when == -1)
+		return (ISC_R_UNEXPECTED);
+	isc_time_set(t, when, 0);
+	return (ISC_R_SUCCESS);
+}
+
 void
 isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len) {
 	time_t now;
diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
index cb33d0e4..1abbbc01 100644
--- a/lib/isc/win32/include/isc/platform.h.in
+++ b/lib/isc/win32/include/isc/platform.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -104,6 +104,12 @@
 @ISC_PLATFORM_HAVECMPXCHG@
 
 /*
+ * If the strcasestr() operation is not available on this platform,
+ * ISC_PLATFORM_NEEDSTRCASESTR will be defined.
+ */
+@ISC_PLATFORM_NEEDSTRCASESTR@
+
+/*
  * Set up a macro for importing and exporting from the DLL
  */
 
diff --git a/lib/isc/win32/include/isc/time.h b/lib/isc/win32/include/isc/time.h
index 7db1da38..fe842ab9 100644
--- a/lib/isc/win32/include/isc/time.h
+++ b/lib/isc/win32/include/isc/time.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006-2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -224,6 +224,16 @@ isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2);
  *	The difference of t1 - t2, or 0 if t1 <= t2.
  */
 
+isc_result_t
+isc_time_parsehttptimestamp(char *input, isc_time_t *t);
+/*%<
+ * Parse the time in 'input' into the isc_time_t pointed to by 't',
+ * expecting a format like "Mon, 30 Aug 2000 04:06:47 GMT"
+ *
+ *  Requires:
+ *\li      'buf' and 't' are not NULL.
+ */
+
 isc_uint32_t
 isc_time_nanoseconds(const isc_time_t *t);
 /*
@@ -269,6 +279,16 @@ isc_time_formathttptimestamp(const isc_time_t *t, char *buf, unsigned int len);
  *
  */
 
+isc_result_t
+isc_time_parsehttptimestamp(char *input, isc_time_t *t);
+/*%<
+ * Parse the time in 'input' into the isc_time_t pointed to by 't',
+ * expecting a format like "Mon, 30 Aug 2000 04:06:47 GMT"
+ *
+ *  Requires:
+ *\li      'buf' and 't' are not NULL.
+ */
+
 void
 isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len);
 /*%<
@@ -285,6 +305,36 @@ isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len);
 
 isc_uint32_t
 isc_time_seconds(const isc_time_t *t);
+/*%<
+ * Return the number of seconds since the epoch stored in a time structure.
+ *
+ * Requires:
+ *
+ *\li	't' is a valid pointer.
+ */
+
+isc_result_t
+isc_time_secondsastimet(const isc_time_t *t, time_t *secondsp);
+/*%<
+ * Ensure the number of seconds in an isc_time_t is representable by a time_t.
+ *
+ * Notes:
+ *\li	The number of seconds stored in an isc_time_t might be larger
+ *	than the number of seconds a time_t is able to handle.  Since
+ *	time_t is mostly opaque according to the ANSI/ISO standard
+ *	(essentially, all you can be sure of is that it is an arithmetic type,
+ *	not even necessarily integral), it can be tricky to ensure that
+ *	the isc_time_t is in the range a time_t can handle.  Use this
+ *	function in place of isc_time_seconds() any time you need to set a
+ *	time_t from an isc_time_t.
+ *
+ * Requires:
+ *\li	't' is a valid pointer.
+ *
+ * Returns:
+ *\li	Success
+ *\li	Out of range
+ */
 
 ISC_LANG_ENDDECLS
 
diff --git a/lib/isc/win32/interfaceiter.c b/lib/isc/win32/interfaceiter.c
index c7a9cbb2..7d1dc1b9 100644
--- a/lib/isc/win32/interfaceiter.c
+++ b/lib/isc/win32/interfaceiter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007-2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -88,14 +88,14 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src) {
 	dst->family = family;
 	switch (family) {
 	case AF_INET:
-		memcpy(&dst->type.in,
-		       &((struct sockaddr_in *) src)->sin_addr,
-		       sizeof(struct in_addr));
+		memmove(&dst->type.in,
+			&((struct sockaddr_in *) src)->sin_addr,
+			sizeof(struct in_addr));
 		break;
 	case	AF_INET6:
-		memcpy(&dst->type.in6,
-		       &((struct sockaddr_in6 *) src)->sin6_addr,
-		       sizeof(struct in6_addr));
+		memmove(&dst->type.in6,
+			&((struct sockaddr_in6 *) src)->sin6_addr,
+			sizeof(struct in6_addr));
 		dst->zone = ((struct sockaddr_in6 *) src)->sin6_scope_id;
 		break;
 	default:
@@ -425,7 +425,7 @@ internal_next(isc_interfaceiter_t *iter) {
 		return (ISC_R_NOMORE);
 
 	memset(&(iter->IFData), 0, sizeof(INTERFACE_INFO));
-	memcpy(&(iter->IFData), iter->pos4, sizeof(INTERFACE_INFO));
+	memmove(&(iter->IFData), iter->pos4, sizeof(INTERFACE_INFO));
 	iter->numIF++;
 
 	return (ISC_R_SUCCESS);
@@ -443,7 +443,7 @@ isc_result_t
 isc_interfaceiter_current(isc_interfaceiter_t *iter,
 			  isc_interface_t *ifdata) {
 	REQUIRE(iter->result == ISC_R_SUCCESS);
-	memcpy(ifdata, &iter->current, sizeof(*ifdata));
+	memmove(ifdata, &iter->current, sizeof(*ifdata));
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/isc/win32/libisc.def.in b/lib/isc/win32/libisc.def.in
index 56c4c254..f03fd879 100644
--- a/lib/isc/win32/libisc.def.in
+++ b/lib/isc/win32/libisc.def.in
@@ -302,6 +302,7 @@ isc_hmacsha512_sign
 isc_hmacsha512_update
 isc_hmacsha512_verify
 isc_httpdmgr_addurl
+isc_httpdmgr_addurl2
 isc_httpdmgr_create
 isc_httpdmgr_shutdown
 isc_interfaceiter_create
@@ -546,6 +547,7 @@ isc_string_printf
 isc_string_printf_truncate
 isc_string_regiondup
 isc_string_separate
+isc_string_strcasestr
 isc_string_strlcat
 isc_string_strlcpy
 isc_string_touint64
@@ -580,6 +582,8 @@ isc_time_microdiff
 isc_time_nanoseconds
 isc_time_now
 isc_time_nowplusinterval
+isc_time_parsehttptimestamp
+isc_time_secondsastimet
 isc_time_seconds
 isc_time_set
 isc_time_settoepoch
diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index 40ba86a4..d1bee78c 100644
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -955,7 +955,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 
 	memset(msg, 0, sizeof(*msg));
 
-	memcpy(&msg->to_addr, &dev->address.type, dev->address.length);
+	memmove(&msg->to_addr, &dev->address.type, dev->address.length);
 	msg->to_addr_len = dev->address.length;
 
 	buffer = ISC_LIST_HEAD(dev->bufferlist);
@@ -977,7 +977,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 		   "alloc_buffer %p %d %p %d", cpbuffer, sizeof(buflist_t),
 		   cpbuffer->buf, write_count);
 
-		memcpy(cpbuffer->buf,(dev->region.base + dev->n), write_count);
+		memmove(cpbuffer->buf,(dev->region.base + dev->n), write_count);
 		cpbuffer->buflen = (unsigned int)write_count;
 		ISC_LIST_ENQUEUE(lpo->bufferlist, cpbuffer, link);
 		iov[0].buf = cpbuffer->buf;
@@ -1017,7 +1017,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 			   "alloc_buffer %p %d %p %d", cpbuffer, sizeof(buflist_t),
 			   cpbuffer->buf, write_count);
 
-			memcpy(cpbuffer->buf,(used.base + skip_count), uselen);
+			memmove(cpbuffer->buf,(used.base + skip_count), uselen);
 			cpbuffer->buflen = uselen;
 			iov[iovcount].buf = cpbuffer->buf;
 			iov[iovcount].len = (u_long)(used.length - skip_count);
@@ -1220,8 +1220,8 @@ fill_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 
 	if (sock->type == isc_sockettype_udp) {
 		dev->address.length = sock->recvbuf.from_addr_len;
-		memcpy(&dev->address.type, &sock->recvbuf.from_addr,
-		    sock->recvbuf.from_addr_len);
+		memmove(&dev->address.type, &sock->recvbuf.from_addr,
+			sock->recvbuf.from_addr_len);
 		if (isc_sockaddr_getport(&dev->address) == 0) {
 			if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) {
 				socket_log(__LINE__, sock, &dev->address, IOEVENT,
@@ -1247,8 +1247,10 @@ fill_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 			REQUIRE(ISC_BUFFER_VALID(buffer));
 			if (isc_buffer_availablelength(buffer) > 0) {
 				isc_buffer_availableregion(buffer, &r);
-				copylen = min(r.length, sock->recvbuf.remaining);
-				memcpy(r.base, sock->recvbuf.consume_position, copylen);
+				copylen = min(r.length,
+					      sock->recvbuf.remaining);
+				memmove(r.base, sock->recvbuf.consume_position,
+					copylen);
 				sock->recvbuf.consume_position += copylen;
 				sock->recvbuf.remaining -= copylen;
 				isc_buffer_add(buffer, copylen);
@@ -1258,7 +1260,8 @@ fill_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 		}
 	} else { // Single-buffer receive
 		copylen = min(dev->region.length - dev->n, sock->recvbuf.remaining);
-		memcpy(dev->region.base + dev->n, sock->recvbuf.consume_position, copylen);
+		memmove(dev->region.base + dev->n,
+			sock->recvbuf.consume_position, copylen);
 		sock->recvbuf.consume_position += copylen;
 		sock->recvbuf.remaining -= copylen;
 		dev->n += copylen;
@@ -2061,7 +2064,7 @@ internal_accept(isc_socket_t *sock, IoCompletionInfo *lpo, int accept_errno) {
 		sizeof(SOCKADDR_STORAGE) + 16, sizeof(SOCKADDR_STORAGE) + 16,
 		(LPSOCKADDR *)&localaddr, &localaddr_len,
 		(LPSOCKADDR *)&remoteaddr, &remoteaddr_len);
-	memcpy(&adev->address.type, remoteaddr, remoteaddr_len);
+	memmove(&adev->address.type, remoteaddr, remoteaddr_len);
 	adev->address.length = remoteaddr_len;
 	nsock->address = adev->address;
 	nsock->pf = adev->address.type.sa.sa_family;
diff --git a/lib/isc/win32/strptime.c b/lib/isc/win32/strptime.c
new file mode 100644
index 00000000..10dcec1e
--- /dev/null
+++ b/lib/isc/win32/strptime.c
@@ -0,0 +1,392 @@
+/*-
+ * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code was contributed to The NetBSD Foundation by Klaus Klein.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *        This product includes software developed by the NetBSD
+ *        Foundation, Inc. and its contributors.
+ * 4. Neither the name of The NetBSD Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+/*
+ * We do not implement alternate representations. However, we always
+ * check whether a given modifier is allowed for a certain conversion.
+ */
+#define ALT_E			0x01
+#define ALT_O			0x02
+#define	LEGAL_ALT(x)		{ if (alt_format & ~(x)) return (0); }
+
+#ifndef TM_YEAR_BASE
+#define TM_YEAR_BASE 1900
+#endif
+
+static	int conv_num(const char **, int *, int, int);
+
+static const char *day[7] = {
+	"Sunday", "Monday", "Tuesday", "Wednesday", "Thursday",
+	"Friday", "Saturday"
+};
+static const char *abday[7] = {
+	"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
+};
+static const char *mon[12] = {
+	"January", "February", "March", "April", "May", "June", "July",
+	"August", "September", "October", "November", "December"
+};
+static const char *abmon[12] = {
+	"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+};
+static const char *am_pm[2] = {
+	"AM", "PM"
+};
+
+static char *
+strptime(const char *buf, const char *fmt, struct tm *tm) {
+	char c;
+	const char *bp;
+	size_t len = 0;
+	int alt_format, i, split_year = 0;
+
+	bp = buf;
+
+	while ((c = *fmt) != '\0') {
+		/* Clear `alternate' modifier prior to new conversion. */
+		alt_format = 0;
+
+		/* Eat up white-space. */
+		if (isspace(c)) {
+			while (isspace(*bp))
+				bp++;
+
+			fmt++;
+			continue;
+		}
+
+		if ((c = *fmt++) != '%')
+			goto literal;
+
+
+again:		switch (c = *fmt++) {
+		case '%':	/* "%%" is converted to "%". */
+literal:
+			if (c != *bp++)
+				return (0);
+			break;
+
+		/*
+		 * "Alternative" modifiers. Just set the appropriate flag
+		 * and start over again.
+		 */
+		case 'E':	/* "%E?" alternative conversion modifier. */
+			LEGAL_ALT(0);
+			alt_format |= ALT_E;
+			goto again;
+
+		case 'O':	/* "%O?" alternative conversion modifier. */
+			LEGAL_ALT(0);
+			alt_format |= ALT_O;
+			goto again;
+
+		/*
+		 * "Complex" conversion rules, implemented through recursion.
+		 */
+		case 'c':	/* Date and time, using the locale's format. */
+			LEGAL_ALT(ALT_E);
+			if (!(bp = strptime(bp, "%x %X", tm)))
+				return (0);
+			break;
+
+		case 'D':	/* The date as "%m/%d/%y". */
+			LEGAL_ALT(0);
+			if (!(bp = strptime(bp, "%m/%d/%y", tm)))
+				return (0);
+			break;
+
+		case 'R':	/* The time as "%H:%M". */
+			LEGAL_ALT(0);
+			if (!(bp = strptime(bp, "%H:%M", tm)))
+				return (0);
+			break;
+
+		case 'r':	/* The time in 12-hour clock representation. */
+			LEGAL_ALT(0);
+			if (!(bp = strptime(bp, "%I:%M:%S %p", tm)))
+				return (0);
+			break;
+
+		case 'T':	/* The time as "%H:%M:%S". */
+			LEGAL_ALT(0);
+			if (!(bp = strptime(bp, "%H:%M:%S", tm)))
+				return (0);
+			break;
+
+		case 'X':	/* The time, using the locale's format. */
+			LEGAL_ALT(ALT_E);
+			if (!(bp = strptime(bp, "%H:%M:%S", tm)))
+				return (0);
+			break;
+
+		case 'x':	/* The date, using the locale's format. */
+			LEGAL_ALT(ALT_E);
+			if (!(bp = strptime(bp, "%m/%d/%y", tm)))
+				return (0);
+			break;
+
+		/*
+		 * "Elementary" conversion rules.
+		 */
+		case 'A':	/* The day of week, using the locale's form. */
+		case 'a':
+			LEGAL_ALT(0);
+			for (i = 0; i < 7; i++) {
+				/* Full name. */
+				len = strlen(day[i]);
+				if (strncasecmp(day[i], bp, len) == 0)
+					break;
+
+				/* Abbreviated name. */
+				len = strlen(abday[i]);
+				if (strncasecmp(abday[i], bp, len) == 0)
+					break;
+			}
+
+			/* Nothing matched. */
+			if (i == 7)
+				return (0);
+
+			tm->tm_wday = i;
+			bp += len;
+			break;
+
+		case 'B':	/* The month, using the locale's form. */
+		case 'b':
+		case 'h':
+			LEGAL_ALT(0);
+			for (i = 0; i < 12; i++) {
+				/* Full name. */
+				len = strlen(mon[i]);
+				if (strncasecmp(mon[i], bp, len) == 0)
+					break;
+
+				/* Abbreviated name. */
+				len = strlen(abmon[i]);
+				if (strncasecmp(abmon[i], bp, len) == 0)
+					break;
+			}
+
+			/* Nothing matched. */
+			if (i == 12)
+				return (0);
+
+			tm->tm_mon = i;
+			bp += len;
+			break;
+
+		case 'C':	/* The century number. */
+			LEGAL_ALT(ALT_E);
+			if (!(conv_num(&bp, &i, 0, 99)))
+				return (0);
+
+			if (split_year) {
+				tm->tm_year = (tm->tm_year % 100) + (i * 100);
+			} else {
+				tm->tm_year = i * 100;
+				split_year = 1;
+			}
+			break;
+
+		case 'd':	/* The day of month. */
+		case 'e':
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_mday, 1, 31)))
+				return (0);
+			break;
+
+		case 'k':	/* The hour (24-hour clock representation). */
+			LEGAL_ALT(0);
+			/* FALLTHROUGH */
+		case 'H':
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_hour, 0, 23)))
+				return (0);
+			break;
+
+		case 'l':	/* The hour (12-hour clock representation). */
+			LEGAL_ALT(0);
+			/* FALLTHROUGH */
+		case 'I':
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_hour, 1, 12)))
+				return (0);
+			if (tm->tm_hour == 12)
+				tm->tm_hour = 0;
+			break;
+
+		case 'j':	/* The day of year. */
+			LEGAL_ALT(0);
+			if (!(conv_num(&bp, &i, 1, 366)))
+				return (0);
+			tm->tm_yday = i - 1;
+			break;
+
+		case 'M':	/* The minute. */
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_min, 0, 59)))
+				return (0);
+			break;
+
+		case 'm':	/* The month. */
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &i, 1, 12)))
+				return (0);
+			tm->tm_mon = i - 1;
+			break;
+
+		case 'p':	/* The locale's equivalent of AM/PM. */
+			LEGAL_ALT(0);
+			/* AM? */
+			if (strcasecmp(am_pm[0], bp) == 0) {
+				if (tm->tm_hour > 11)
+					return (0);
+
+				bp += strlen(am_pm[0]);
+				break;
+			}
+			/* PM? */
+			else if (strcasecmp(am_pm[1], bp) == 0) {
+				if (tm->tm_hour > 11)
+					return (0);
+
+				tm->tm_hour += 12;
+				bp += strlen(am_pm[1]);
+				break;
+			}
+
+			/* Nothing matched. */
+			return (0);
+
+		case 'S':	/* The seconds. */
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_sec, 0, 61)))
+				return (0);
+			break;
+
+		case 'U':	/* The week of year, beginning on sunday. */
+		case 'W':	/* The week of year, beginning on monday. */
+			LEGAL_ALT(ALT_O);
+			/*
+			 * XXX This is bogus, as we can not assume any valid
+			 * information present in the tm structure at this
+			 * point to calculate a real value, so just check the
+			 * range for now.
+			 */
+			 if (!(conv_num(&bp, &i, 0, 53)))
+				return (0);
+			 break;
+
+		case 'w':	/* The day of week, beginning on sunday. */
+			LEGAL_ALT(ALT_O);
+			if (!(conv_num(&bp, &tm->tm_wday, 0, 6)))
+				return (0);
+			break;
+
+		case 'Y':	/* The year. */
+			LEGAL_ALT(ALT_E);
+			if (!(conv_num(&bp, &i, 0, 9999)))
+				return (0);
+
+			tm->tm_year = i - TM_YEAR_BASE;
+			break;
+
+		case 'y':	/* The year within 100 years of the epoch. */
+			LEGAL_ALT(ALT_E | ALT_O);
+			if (!(conv_num(&bp, &i, 0, 99)))
+				return (0);
+
+			if (split_year) {
+				tm->tm_year = ((tm->tm_year / 100) * 100) + i;
+				break;
+			}
+			split_year = 1;
+			if (i <= 68)
+				tm->tm_year = i + 2000 - TM_YEAR_BASE;
+			else
+				tm->tm_year = i + 1900 - TM_YEAR_BASE;
+			break;
+
+		/*
+		 * Miscellaneous conversions.
+		 */
+		case 'n':	/* Any kind of white-space. */
+		case 't':
+			LEGAL_ALT(0);
+			while (isspace(*bp))
+				bp++;
+			break;
+
+
+		default:	/* Unknown/unsupported conversion. */
+			return (0);
+		}
+
+
+	}
+
+	/* LINTED functional specification */
+	return ((char *)bp);
+}
+
+static int
+conv_num(const char **buf, int *dest, int llim, int ulim) {
+	int result = 0;
+
+	/* The limit also determines the number of valid digits. */
+	int rulim = ulim;
+
+	if (**buf < '0' || **buf > '9')
+		return (0);
+
+	do {
+		result *= 10;
+		result += *(*buf)++ - '0';
+		rulim /= 10;
+	} while ((result * 10 <= ulim) &&
+		 rulim && **buf >= '0' && **buf <= '9');
+
+	if (result < llim || result > ulim)
+		return (0);
+
+	*dest = result;
+	return (1);
+}
diff --git a/lib/isc/win32/time.c b/lib/isc/win32/time.c
index ff25c4d3..6c38e25a 100644
--- a/lib/isc/win32/time.c
+++ b/lib/isc/win32/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006-2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006-2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -91,8 +91,8 @@ isc_time_set(isc_time_t *t, unsigned int seconds, unsigned int nanoseconds) {
 
 	SystemTimeToFileTime(&epoch, &temp);
 
-	i1.LowPart = t->absolute.dwLowDateTime;
-	i1.HighPart = t->absolute.dwHighDateTime;
+	i1.LowPart = temp.dwLowDateTime;
+	i1.HighPart = temp.dwHighDateTime;
 
 	i1.QuadPart += (unsigned __int64)nanoseconds/100;
 	i1.QuadPart += (unsigned __int64)seconds*10000000;
@@ -243,6 +243,26 @@ isc_time_seconds(const isc_time_t *t) {
 	return ((isc_uint32_t)i3);
 }
 
+isc_result_t
+isc_time_secondsastimet(const isc_time_t *t, time_t *secondsp) {
+	time_t seconds;
+
+	REQUIRE(t != NULL);
+
+	seconds = (time_t)isc_time_seconds(t);
+
+	INSIST(sizeof(unsigned int) == sizeof(isc_uint32_t));
+	INSIST(sizeof(time_t) >= sizeof(isc_uint32_t));
+
+	if (isc_time_seconds(t) > (~0U>>1) && seconds <= (time_t)(~0U>>1))
+		return (ISC_R_RANGE);
+
+	*secondsp = seconds;
+
+	return (ISC_R_SUCCESS);
+}
+
+
 isc_uint32_t
 isc_time_nanoseconds(const isc_time_t *t) {
 	ULARGE_INTEGER i;
@@ -298,6 +318,50 @@ isc_time_formathttptimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 	}
 }
 
+static time_t
+timetfromtm(struct tm *tm) {
+	time_t ret;
+	int i, yday = 0, leapday;
+	int mdays[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30 };
+
+	leapday = ((((tm->tm_year + 1900 ) % 4) == 0 &&
+		    ((tm->tm_year + 1900 ) % 100) != 0) ||
+		   ((tm->tm_year + 1900 ) % 400) == 0) ? 1 : 0;
+	mdays[1] += leapday;
+
+	yday = tm->tm_mday - 1;
+	for (i = 1; i <= tm->tm_mon; i++)
+		yday += mdays[i - 1];
+	ret = tm->tm_sec +
+	      (60 * tm->tm_min) +
+	      (3600 * tm->tm_hour) +
+	      (86400 * (yday +
+		       ((tm->tm_year - 70) * 365) +
+		       ((tm->tm_year - 69) / 4) -
+		       ((tm->tm_year - 1) / 100) +
+		       ((tm->tm_year + 299) / 400)));
+	return (ret);
+}
+
+#include "strptime.c"
+isc_result_t
+isc_time_parsehttptimestamp(char *buf, isc_time_t *t) {
+	struct tm t_tm;
+	time_t when;
+	char *p;
+
+	REQUIRE(buf != NULL);
+	REQUIRE(t != NULL);
+	p = strptime(buf, "%a, %d %b %Y %H:%M:%S", &t_tm);
+	if (p == NULL)
+		return (ISC_R_UNEXPECTED);
+	when = timetfromtm(&t_tm);
+	if (when == -1)
+		return (ISC_R_UNEXPECTED);
+	isc_time_set(t, when, 0);
+	return (ISC_R_SUCCESS);
+}
+
 void
 isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len) {
 	SYSTEMTIME st;
diff --git a/lib/isccc/api b/lib/isccc/api
index 51898234..864bdc90 100644
--- a/lib/isccc/api
+++ b/lib/isccc/api
@@ -5,5 +5,5 @@
 # 9.9: 90-109
 # 9.9-sub: 130-139
 LIBINTERFACE = 90
-LIBREVISION = 5
+LIBREVISION = 6
 LIBAGE = 0
diff --git a/lib/isccc/include/isccc/util.h b/lib/isccc/include/isccc/util.h
index 2e36b6e3..4b8c7ad9 100644
--- a/lib/isccc/include/isccc/util.h
+++ b/lib/isccc/include/isccc/util.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -52,37 +52,37 @@
 #define GET16(v, w) \
 	do { \
 		v = (unsigned int)w[0] << 8; \
- 		v |= (unsigned int)w[1]; \
+		v |= (unsigned int)w[1]; \
 		w += 2; \
 	} while (0)
 
 #define GET24(v, w) \
 	do { \
- 		v = (unsigned int)w[0] << 16; \
- 		v |= (unsigned int)w[1] << 8; \
- 		v |= (unsigned int)w[2]; \
+		v = (unsigned int)w[0] << 16; \
+		v |= (unsigned int)w[1] << 8; \
+		v |= (unsigned int)w[2]; \
 		w += 3; \
 	} while (0)
 
 #define GET32(v, w) \
 	do { \
 		v = (unsigned int)w[0] << 24; \
- 		v |= (unsigned int)w[1] << 16; \
- 		v |= (unsigned int)w[2] << 8; \
- 		v |= (unsigned int)w[3]; \
+		v |= (unsigned int)w[1] << 16; \
+		v |= (unsigned int)w[2] << 8; \
+		v |= (unsigned int)w[3]; \
 		w += 4; \
 	} while (0)
 
 #define GET64(v, w) \
 	do { \
 		v = (isc_uint64_t)w[0] << 56; \
- 		v |= (isc_uint64_t)w[1] << 48; \
- 		v |= (isc_uint64_t)w[2] << 40; \
- 		v |= (isc_uint64_t)w[3] << 32; \
- 		v |= (isc_uint64_t)w[4] << 24; \
- 		v |= (isc_uint64_t)w[5] << 16; \
- 		v |= (isc_uint64_t)w[6] << 8; \
- 		v |= (isc_uint64_t)w[7]; \
+		v |= (isc_uint64_t)w[1] << 48; \
+		v |= (isc_uint64_t)w[2] << 40; \
+		v |= (isc_uint64_t)w[3] << 32; \
+		v |= (isc_uint64_t)w[4] << 24; \
+		v |= (isc_uint64_t)w[5] << 16; \
+		v |= (isc_uint64_t)w[6] << 8; \
+		v |= (isc_uint64_t)w[7]; \
 		w += 8; \
 	} while (0)
 
@@ -91,7 +91,7 @@
 		GET8(v, w); \
 		if (v == 0) \
 			d = ISCCC_TRUE; \
- 		else { \
+		else { \
 			d = ISCCC_FALSE; \
 			if (v == 255) \
 				GET16(v, w); \
@@ -101,7 +101,7 @@
 #define GETC32(v, w) \
 	do { \
 		GET24(v, w); \
- 		if (v == 0xffffffu) \
+		if (v == 0xffffffu) \
 			GET32(v, w); \
 	} while (0)
 
@@ -109,7 +109,7 @@
 
 #define GET_MEM(v, c, w) \
 	do { \
-		memcpy(v, w, c); \
+		memmove(v, w, c); \
 		w += c; \
 	} while (0)
 
@@ -193,7 +193,7 @@
 
 #define PUT_MEM(s, c, w) \
 	do { \
-		memcpy(w, s, c); \
+		memmove(w, s, c); \
 		w += c; \
 	} while (0)
 
diff --git a/lib/isccc/sexpr.c b/lib/isccc/sexpr.c
index e96536df..df11a930 100644
--- a/lib/isccc/sexpr.c
+++ b/lib/isccc/sexpr.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005, 2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -112,7 +112,7 @@ isccc_sexpr_frombinary(const isccc_region_t *region)
 	}
 	sexpr->value.as_region.rend = sexpr->value.as_region.rstart +
 		region_size;
-	memcpy(sexpr->value.as_region.rstart, region->rstart, region_size);
+	memmove(sexpr->value.as_region.rstart, region->rstart, region_size);
 	/*
 	 * NUL terminate.
 	 */
@@ -311,7 +311,7 @@ isccc_sexpr_tostring(isccc_sexpr_t *sexpr)
 	REQUIRE(sexpr != NULL &&
 		(sexpr->type == ISCCC_SEXPRTYPE_STRING ||
 		 sexpr->type == ISCCC_SEXPRTYPE_BINARY));
-	
+
 	if (sexpr->type == ISCCC_SEXPRTYPE_BINARY)
 		return ((char *)sexpr->value.as_region.rstart);
 	return (sexpr->value.as_string);
diff --git a/lib/isccfg/api b/lib/isccfg/api
index a27437f4..7e580435 100644
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -4,6 +4,6 @@
 # 9.8: 80-89, 120-129
 # 9.9: 90-109
 # 9.9-sub: 130-139
-LIBINTERFACE = 90
-LIBREVISION = 7
-LIBAGE = 0
+LIBINTERFACE = 91
+LIBREVISION = 0
+LIBAGE = 1
diff --git a/lib/isccfg/include/isccfg/cfg.h b/lib/isccfg/include/isccfg/cfg.h
index b21a3d86..a99c7637 100644
--- a/lib/isccfg/include/isccfg/cfg.h
+++ b/lib/isccfg/include/isccfg/cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2010, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -380,10 +380,20 @@ void
 cfg_print(const cfg_obj_t *obj,
 	  void (*f)(void *closure, const char *text, int textlen),
 	  void *closure);
+void
+cfg_printx(const cfg_obj_t *obj, unsigned int flags,
+	   void (*f)(void *closure, const char *text, int textlen),
+	   void *closure);
+
+#define CFG_PRINTER_XKEY        0x1     /* '?' out shared keys. */
+
 /*%<
  * Print the configuration object 'obj' by repeatedly calling the
  * function 'f', passing 'closure' and a region of text starting
  * at 'text' and comprising 'textlen' characters.
+ *
+ * If CFG_PRINTER_XKEY the contents of shared keys will be obscured
+ * by replacing them with question marks ('?')
  */
 
 void
diff --git a/lib/isccfg/include/isccfg/grammar.h b/lib/isccfg/include/isccfg/grammar.h
index 2d7080c2..ee76ff29 100644
--- a/lib/isccfg/include/isccfg/grammar.h
+++ b/lib/isccfg/include/isccfg/grammar.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -86,6 +86,7 @@ struct cfg_printer {
 	void (*f)(void *closure, const char *text, int textlen);
 	void *closure;
 	int indent;
+	int flags;
 };
 
 /*% A clause definition. */
@@ -266,6 +267,7 @@ LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_uint64;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_qstring;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_astring;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_ustring;
+LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sstring;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sockaddr;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr4;
@@ -314,6 +316,9 @@ isc_result_t
 cfg_parse_astring(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
 
 isc_result_t
+cfg_parse_sstring(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
+
+isc_result_t
 cfg_parse_rawaddr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na);
 
 void
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index be28ea71..f11e2938 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -370,7 +370,7 @@ parse_updatepolicy(cfg_parser_t *pctx, const cfg_type_t *type,
 			isc_mem_put(pctx->mctx, obj, sizeof(*obj));
 			return (ISC_R_NOMEMORY);
 		}
-		memcpy(obj->value.string.base, "local", 5);
+		memmove(obj->value.string.base, "local", 5);
 		obj->value.string.base[5] = '\0';
 		*ret = obj;
 		return (ISC_R_SUCCESS);
@@ -1709,7 +1709,7 @@ static cfg_type_t cfg_type_dynamically_loadable_zones_opts = {
 static cfg_clausedef_t
 key_clauses[] = {
 	{ "algorithm", &cfg_type_astring, 0 },
-	{ "secret", &cfg_type_astring, 0 },
+	{ "secret", &cfg_type_sstring, 0 },
 	{ NULL, NULL, 0 }
 };
 
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index de0fa31e..1708344e 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -183,14 +183,22 @@ cfg_print(const cfg_obj_t *obj,
 	  void (*f)(void *closure, const char *text, int textlen),
 	  void *closure)
 {
+	cfg_printx(obj, 0, f, closure);
+}
+
+void
+cfg_printx(const cfg_obj_t *obj, unsigned int flags,
+	     void (*f)(void *closure, const char *text, int textlen),
+	     void *closure)
+{
 	cfg_printer_t pctx;
 	pctx.f = f;
 	pctx.closure = closure;
 	pctx.indent = 0;
+	pctx.flags = flags;
 	obj->type->print(&pctx, obj);
 }
 
-
 /* Tuples. */
 
 isc_result_t
@@ -702,7 +710,7 @@ create_string(cfg_parser_t *pctx, const char *contents, const cfg_type_t *type,
 		isc_mem_put(pctx->mctx, obj, sizeof(*obj));
 		return (ISC_R_NOMEMORY);
 	}
-	memcpy(obj->value.string.base, contents, len);
+	memmove(obj->value.string.base, contents, len);
 	obj->value.string.base[len] = '\0';
 
 	*ret = obj;
@@ -762,6 +770,22 @@ cfg_parse_astring(cfg_parser_t *pctx, const cfg_type_t *type,
 	return (result);
 }
 
+isc_result_t
+cfg_parse_sstring(cfg_parser_t *pctx, const cfg_type_t *type,
+		  cfg_obj_t **ret)
+{
+	isc_result_t result;
+	UNUSED(type);
+
+	CHECK(cfg_getstringtoken(pctx));
+	return (create_string(pctx,
+			      TOKEN_STRING(pctx),
+			      &cfg_type_sstring,
+			      ret));
+ cleanup:
+	return (result);
+}
+
 isc_boolean_t
 cfg_is_enum(const char *s, const char *const *enums) {
 	const char * const *p;
@@ -819,6 +843,18 @@ print_qstring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 }
 
 static void
+print_sstring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
+	cfg_print_chars(pctx, "\"", 1);
+	if ((pctx->flags & CFG_PRINTER_XKEY) != 0) {
+		unsigned int len = obj->value.string.length;
+		while (len-- > 0)
+			cfg_print_chars(pctx, "?", 1);
+	} else
+		cfg_print_ustring(pctx, obj);
+	cfg_print_chars(pctx, "\"", 1);
+}
+
+static void
 free_string(cfg_parser_t *pctx, cfg_obj_t *obj) {
 	isc_mem_put(pctx->mctx, obj->value.string.base,
 		    obj->value.string.length + 1);
@@ -855,6 +891,15 @@ cfg_type_t cfg_type_astring = {
 };
 
 /*
+ * Any string (quoted or unquoted); printed with quotes.
+ * If CFG_PRINTER_XKEY is set when printing the string will be '?' out.
+ */
+cfg_type_t cfg_type_sstring = {
+	"string", cfg_parse_sstring, print_sstring, cfg_doc_terminal,
+	&cfg_rep_string, NULL
+};
+
+/*
  * Booleans
  */
 
@@ -1631,7 +1676,7 @@ parse_token(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		goto cleanup;
 	}
 	obj->value.string.length = r.length;
-	memcpy(obj->value.string.base, r.base, r.length);
+	memmove(obj->value.string.base, r.base, r.length);
 	obj->value.string.base[r.length] = '\0';
 	*ret = obj;
 	return (result);
@@ -2480,5 +2525,6 @@ cfg_print_grammar(const cfg_type_t *type,
 	pctx.f = f;
 	pctx.closure = closure;
 	pctx.indent = 0;
+	pctx.flags = 0;
 	cfg_doc_obj(&pctx, type);
 }
diff --git a/lib/isccfg/win32/libisccfg.def b/lib/isccfg/win32/libisccfg.def
index 98abbcf8..95cdcc78 100644
--- a/lib/isccfg/win32/libisccfg.def
+++ b/lib/isccfg/win32/libisccfg.def
@@ -42,6 +42,7 @@ cfg_parser_create
 cfg_parser_destroy
 cfg_parser_setcallback
 cfg_print
+cfg_printx
 cfg_tuple_get
 
 ; Exported Data
diff --git a/lib/lwres/api b/lib/lwres/api
index 864bdc90..a27437f4 100644
--- a/lib/lwres/api
+++ b/lib/lwres/api
@@ -5,5 +5,5 @@
 # 9.9: 90-109
 # 9.9-sub: 130-139
 LIBINTERFACE = 90
-LIBREVISION = 6
+LIBREVISION = 7
 LIBAGE = 0
diff --git a/lib/lwres/context.c b/lib/lwres/context.c
index e16bc0aa..0dc5199b 100644
--- a/lib/lwres/context.c
+++ b/lib/lwres/context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -303,8 +303,8 @@ context_connect(lwres_context_t *ctx) {
 	int domain;
 
 	if (ctx->confdata.lwnext != 0) {
-		memcpy(&ctx->address, &ctx->confdata.lwservers[0],
-		       sizeof(lwres_addr_t));
+		memmove(&ctx->address, &ctx->confdata.lwservers[0],
+			sizeof(lwres_addr_t));
 		LWRES_LINK_INIT(&ctx->address, link);
 	} else {
 		/* The default is the IPv4 loopback address 127.0.0.1. */
@@ -318,16 +318,16 @@ context_connect(lwres_context_t *ctx) {
 	}
 
 	if (ctx->address.family == LWRES_ADDRTYPE_V4) {
-		memcpy(&sin.sin_addr, ctx->address.address,
-		       sizeof(sin.sin_addr));
+		memmove(&sin.sin_addr, ctx->address.address,
+			sizeof(sin.sin_addr));
 		sin.sin_port = htons(lwres_udp_port);
 		sin.sin_family = AF_INET;
 		sa = (struct sockaddr *)&sin;
 		salen = sizeof(sin);
 		domain = PF_INET;
 	} else if (ctx->address.family == LWRES_ADDRTYPE_V6) {
-		memcpy(&sin6.sin6_addr, ctx->address.address,
-		       sizeof(sin6.sin6_addr));
+		memmove(&sin6.sin6_addr, ctx->address.address,
+			sizeof(sin6.sin6_addr));
 		sin6.sin6_port = htons(lwres_udp_port);
 		sin6.sin6_family = AF_INET6;
 		sa = (struct sockaddr *)&sin6;
diff --git a/lib/lwres/getaddrinfo.c b/lib/lwres/getaddrinfo.c
index 7d5f2fb0..1ebafd85 100644
--- a/lib/lwres/getaddrinfo.c
+++ b/lib/lwres/getaddrinfo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * This code is derived from software contributed to ISC by
@@ -392,7 +392,7 @@ lwres_getaddrinfo(const char *hostname, const char *servname,
 				 * Convert to a V4 mapped address.
 				 */
 				struct in6_addr *a6 = (struct in6_addr *)abuf;
-				memcpy(&a6->s6_addr[12], &a6->s6_addr[0], 4);
+				memmove(&a6->s6_addr[12], &a6->s6_addr[0], 4);
 				memset(&a6->s6_addr[10], 0xff, 2);
 				memset(&a6->s6_addr[0], 0, 10);
 				goto inet6_addr;
@@ -427,7 +427,7 @@ lwres_getaddrinfo(const char *hostname, const char *servname,
 			ai_list = ai;
 			ai->ai_socktype = socktype;
 			SIN(ai->ai_addr)->sin_port = port;
-			memcpy((char *)ai->ai_addr + addroff, abuf, addrsize);
+			memmove((char *)ai->ai_addr + addroff, abuf, addrsize);
 			if (flags & AI_CANONNAME) {
 #if defined(LWRES_HAVE_SIN6_SCOPE_ID)
 				if (ai->ai_family == AF_INET6)
@@ -579,7 +579,7 @@ add_ipv4(const char *hostname, int flags, struct addrinfo **aip,
 		*aip = ai;
 		ai->ai_socktype = socktype;
 		SIN(ai->ai_addr)->sin_port = port;
-		memcpy(&SIN(ai->ai_addr)->sin_addr, v4_loop, 4);
+		memmove(&SIN(ai->ai_addr)->sin_addr, v4_loop, 4);
 	} else {
 		lwres = lwres_getaddrsbyname(lwrctx, hostname,
 					     LWRES_ADDRTYPE_V4, &by);
@@ -597,8 +597,8 @@ add_ipv4(const char *hostname, int flags, struct addrinfo **aip,
 			*aip = ai;
 			ai->ai_socktype = socktype;
 			SIN(ai->ai_addr)->sin_port = port;
-			memcpy(&SIN(ai->ai_addr)->sin_addr,
-			       addr->address, 4);
+			memmove(&SIN(ai->ai_addr)->sin_addr,
+				addr->address, 4);
 			if (flags & AI_CANONNAME) {
 				ai->ai_canonname = strdup(by->realname);
 				if (ai->ai_canonname == NULL)
@@ -643,7 +643,7 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 		*aip = ai;
 		ai->ai_socktype = socktype;
 		SIN6(ai->ai_addr)->sin6_port = port;
-		memcpy(&SIN6(ai->ai_addr)->sin6_addr, v6_loop, 16);
+		memmove(&SIN6(ai->ai_addr)->sin6_addr, v6_loop, 16);
 	} else {
 		lwres = lwres_getaddrsbyname(lwrctx, hostname,
 					     LWRES_ADDRTYPE_V6, &by);
@@ -661,8 +661,8 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 			*aip = ai;
 			ai->ai_socktype = socktype;
 			SIN6(ai->ai_addr)->sin6_port = port;
-			memcpy(&SIN6(ai->ai_addr)->sin6_addr,
-			       addr->address, 16);
+			memmove(&SIN6(ai->ai_addr)->sin6_addr,
+				addr->address, 16);
 			if (flags & AI_CANONNAME) {
 				ai->ai_canonname = strdup(by->realname);
 				if (ai->ai_canonname == NULL)
diff --git a/lib/lwres/gethost.c b/lib/lwres/gethost.c
index 60d9d5ee..e36fc188 100644
--- a/lib/lwres/gethost.c
+++ b/lib/lwres/gethost.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -331,7 +331,7 @@ copytobuf(struct hostent *he, struct hostent *hptr, char *buf, int buflen) {
 	 */
 	hptr->h_addr_list = ptr;
 	for (i = 0; he->h_addr_list[i]; i++, ptr++) {
-		memcpy(cp, he->h_addr_list[i], n);
+		memmove(cp, he->h_addr_list[i], n);
 		hptr->h_addr_list[i] = cp;
 		cp += n;
 	}
diff --git a/lib/lwres/getipnode.c b/lib/lwres/getipnode.c
index 300376ef..85c396df 100644
--- a/lib/lwres/getipnode.c
+++ b/lib/lwres/getipnode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -420,7 +420,7 @@ lwres_getipnodebyaddr(const void *src, size_t len, int af, int *error_num) {
 		/*
 		 * Restore original address.
 		 */
-		memcpy(he2->h_addr, src, len);
+		memmove(he2->h_addr, src, len);
 		return (he2);
 	}
 
@@ -595,7 +595,7 @@ scan_interfaces6(int *have_v4, int *have_v6) {
 	for (cp = buf;
 	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
 	     cp += cpsize) {
-		memcpy(&lifreq, cp, sizeof(lifreq));
+		memmove(&lifreq, cp, sizeof(lifreq));
 #ifdef LWRES_PLATFORM_HAVESALEN
 #ifdef FIX_ZERO_SA_LEN
 		if (lifreq.lifr_addr.sa_len == 0)
@@ -620,10 +620,10 @@ scan_interfaces6(int *have_v4, int *have_v6) {
 		switch (lifreq.lifr_addr.ss_family) {
 		case AF_INET:
 			if (*have_v4 == 0) {
-				memcpy(&in4,
-				       &((struct sockaddr_in *)
-				       &lifreq.lifr_addr)->sin_addr,
-				       sizeof(in4));
+				memmove(&in4,
+					&((struct sockaddr_in *)
+					  &lifreq.lifr_addr)->sin_addr,
+					sizeof(in4));
 				if (in4.s_addr == INADDR_ANY)
 					break;
 				n = ioctl(s, SIOCGLIFFLAGS, (char *)&lifreq);
@@ -636,10 +636,10 @@ scan_interfaces6(int *have_v4, int *have_v6) {
 			break;
 		case AF_INET6:
 			if (*have_v6 == 0) {
-				memcpy(&in6,
-				       &((struct sockaddr_in6 *)
-				       &lifreq.lifr_addr)->sin6_addr,
-				       sizeof(in6));
+				memmove(&in6,
+					&((struct sockaddr_in6 *)
+					  &lifreq.lifr_addr)->sin6_addr,
+					sizeof(in6));
 				if (memcmp(&in6, &in6addr_any,
 					   sizeof(in6)) == 0)
 					break;
@@ -760,7 +760,7 @@ scan_interfaces(int *have_v4, int *have_v6) {
 	for (cp = buf;
 	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
 	     cp += cpsize) {
-		memcpy(&u.ifreq, cp, sizeof(u.ifreq));
+		memmove(&u.ifreq, cp, sizeof(u.ifreq));
 #ifdef LWRES_PLATFORM_HAVESALEN
 #ifdef FIX_ZERO_SA_LEN
 		if (u.ifreq.ifr_addr.sa_len == 0)
@@ -775,7 +775,7 @@ scan_interfaces(int *have_v4, int *have_v6) {
 		cpsize = sizeof(u.ifreq.ifr_name) + u.ifreq.ifr_addr.sa_len;
 #endif /* HAVE_MINIMUM_IFREQ */
 		if (cpsize > sizeof(u.ifreq) && cpsize <= sizeof(u))
-			memcpy(&u.ifreq, cp, cpsize);
+			memmove(&u.ifreq, cp, cpsize);
 #elif defined SIOCGIFCONF_ADDR
 		cpsize = sizeof(u.ifreq);
 #else
@@ -787,10 +787,10 @@ scan_interfaces(int *have_v4, int *have_v6) {
 		switch (u.ifreq.ifr_addr.sa_family) {
 		case AF_INET:
 			if (*have_v4 == 0) {
-				memcpy(&in4,
-				       &((struct sockaddr_in *)
-				       &u.ifreq.ifr_addr)->sin_addr,
-				       sizeof(in4));
+				memmove(&in4,
+					&((struct sockaddr_in *)
+					  &u.ifreq.ifr_addr)->sin_addr,
+					sizeof(in4));
 				if (in4.s_addr == INADDR_ANY)
 					break;
 				n = ioctl(s, SIOCGIFFLAGS, (char *)&u.ifreq);
@@ -803,10 +803,10 @@ scan_interfaces(int *have_v4, int *have_v6) {
 			break;
 		case AF_INET6:
 			if (*have_v6 == 0) {
-				memcpy(&in6,
-				       &((struct sockaddr_in6 *)
-				       &u.ifreq.ifr_addr)->sin6_addr,
-				       sizeof(in6));
+				memmove(&in6,
+					&((struct sockaddr_in6 *)
+					  &u.ifreq.ifr_addr)->sin6_addr,
+					sizeof(in6));
 				if (memcmp(&in6, &in6addr_any,
 					   sizeof(in6)) == 0)
 					break;
@@ -908,13 +908,13 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 			 * Convert to mapped if required.
 			 */
 			if (af == AF_INET6 && he1->h_addrtype == AF_INET) {
-				memcpy(*npp, in6addr_mapped,
-				       sizeof(in6addr_mapped));
-				memcpy(*npp + sizeof(in6addr_mapped), *cpp,
-				       INADDRSZ);
+				memmove(*npp, in6addr_mapped,
+					sizeof(in6addr_mapped));
+				memmove(*npp + sizeof(in6addr_mapped), *cpp,
+					INADDRSZ);
 			} else {
-				memcpy(*npp, *cpp,
-				       (af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+				memmove(*npp, *cpp,
+					(af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
 			}
 			cpp++;
 			npp++;
@@ -931,13 +931,13 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 			 * Convert to mapped if required.
 			 */
 			if (af == AF_INET6 && he2->h_addrtype == AF_INET) {
-				memcpy(*npp, in6addr_mapped,
-				       sizeof(in6addr_mapped));
-				memcpy(*npp + sizeof(in6addr_mapped), *cpp,
-				       INADDRSZ);
+				memmove(*npp, in6addr_mapped,
+					sizeof(in6addr_mapped));
+				memmove(*npp + sizeof(in6addr_mapped), *cpp,
+					INADDRSZ);
 			} else {
-				memcpy(*npp, *cpp,
-				       (af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+				memmove(*npp, *cpp,
+					(af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
 			}
 			cpp++;
 			npp++;
@@ -1060,7 +1060,7 @@ hostfromaddr(lwres_gnbaresponse_t *addr, int af, const void *src) {
 	he->h_addr_list[0] = malloc(he->h_length);
 	if (he->h_addr_list[0] == NULL)
 		goto cleanup;
-	memcpy(he->h_addr_list[0], src, he->h_length);
+	memmove(he->h_addr_list[0], src, he->h_length);
 	he->h_addr_list[1] = NULL;
 	return (he);
 
@@ -1140,7 +1140,7 @@ hostfromname(lwres_gabnresponse_t *name, int af) {
 		he->h_addr_list[i] = malloc(he->h_length);
 		if (he->h_addr_list[i] == NULL)
 			goto cleanup;
-		memcpy(he->h_addr_list[i], addr->address, he->h_length);
+		memmove(he->h_addr_list[i], addr->address, he->h_length);
 		addr = LWRES_LIST_NEXT(addr, link);
 		i++;
 	}
diff --git a/lib/lwres/getrrset.c b/lib/lwres/getrrset.c
index 16af741d..cd37abcd 100644
--- a/lib/lwres/getrrset.c
+++ b/lib/lwres/getrrset.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -228,8 +228,8 @@ lwres_getrrsetbyname(const char *hostname, unsigned int rdclass,
 			result = ERRSET_NOMEMORY;
 			goto fail;
 		}
-		memcpy(rrset->rri_rdatas[i].rdi_data, response->rdatas[i],
-		       rrset->rri_rdatas[i].rdi_length);
+		memmove(rrset->rri_rdatas[i].rdi_data, response->rdatas[i],
+			rrset->rri_rdatas[i].rdi_length);
 	}
 	rrset->rri_nsigs = response->nsigs;
 	rrset->rri_sigs = sane_calloc(rrset->rri_nsigs,
@@ -246,8 +246,8 @@ lwres_getrrsetbyname(const char *hostname, unsigned int rdclass,
 			result = ERRSET_NOMEMORY;
 			goto fail;
 		}
-		memcpy(rrset->rri_sigs[i].rdi_data, response->sigs[i],
-		       rrset->rri_sigs[i].rdi_length);
+		memmove(rrset->rri_sigs[i].rdi_data, response->sigs[i],
+			rrset->rri_sigs[i].rdi_length);
 	}
 
 	lwres_grbnresponse_free(lwrctx, &response);
diff --git a/lib/lwres/lwbuffer.c b/lib/lwres/lwbuffer.c
index 49aaeb7b..787bc3c9 100644
--- a/lib/lwres/lwbuffer.c
+++ b/lib/lwres/lwbuffer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -23,7 +23,7 @@
  *    These functions provide bounds checked access to a region of memory
  *    where data is being read or written. They are based on, and similar
  *    to, the isc_buffer_ functions in the ISC library.
- * 
+ *
  *    A buffer is a region of memory, together with a set of related
  *    subregions. The used region and the available region are disjoint, and
  *    their union is the buffer's region. The used region extends from the
@@ -31,7 +31,7 @@
  *    region extends from one byte greater than the last used byte to the
  *    end of the buffer's region. The size of the used region can be changed
  *    using various buffer commands. Initially, the used region is empty.
- * 
+ *
  *    The used region is further subdivided into two disjoint regions: the
  *    consumed region and the remaining region. The union of these two
  *    regions is the used region. The consumed region extends from the
@@ -39,14 +39,14 @@
  *    any). The remaining region the current pointer to the end of the used
  *    region. The size of the consumed region can be changed using various
  *    buffer commands. Initially, the consumed region is empty.
- * 
+ *
  *    The active region is an (optional) subregion of the remaining region.
  *    It extends from the current offset to an offset in the remaining
  *    region. Initially, the active region is empty. If the current offset
  *    advances beyond the chosen offset, the active region will also be
  *    empty.
- * 
- * 
+ *
+ *
  * \verbatim
  *    /------------entire length---------------\\
  *    /----- used region -----\\/-- available --\\
@@ -54,54 +54,54 @@
  *    | consumed  | remaining |                |
  *    +----------------------------------------+
  *    a           b     c     d                e
- * 
+ *
  *   a == base of buffer.
  *   b == current pointer.  Can be anywhere between a and d.
  *   c == active pointer.  Meaningful between b and d.
  *   d == used pointer.
  *   e == length of buffer.
- * 
+ *
  *   a-e == entire length of buffer.
  *   a-d == used region.
  *   a-b == consumed region.
  *   b-d == remaining region.
  *   b-c == optional active region.
  * \endverbatim
- * 
+ *
  *    lwres_buffer_init() initializes the lwres_buffer_t *b and assocates it
  *    with the memory region of size length bytes starting at location base.
- * 
+ *
  *    lwres_buffer_invalidate() marks the buffer *b as invalid. Invalidating
  *    a buffer after use is not required, but makes it possible to catch its
  *    possible accidental use.
- * 
+ *
  *    The functions lwres_buffer_add() and lwres_buffer_subtract()
  *    respectively increase and decrease the used space in buffer *b by n
  *    bytes. lwres_buffer_add() checks for buffer overflow and
  *    lwres_buffer_subtract() checks for underflow. These functions do not
  *    allocate or deallocate memory. They just change the value of used.
- * 
+ *
  *    A buffer is re-initialised by lwres_buffer_clear(). The function sets
  *    used , current and active to zero.
- * 
+ *
  *    lwres_buffer_first() makes the consumed region of buffer *p empty by
  *    setting current to zero (the start of the buffer).
- * 
+ *
  *    lwres_buffer_forward() increases the consumed region of buffer *b by n
  *    bytes, checking for overflow. Similarly, lwres_buffer_back() decreases
  *    buffer b's consumed region by n bytes and checks for underflow.
- * 
+ *
  *    lwres_buffer_getuint8() reads an unsigned 8-bit integer from *b and
  *    returns it. lwres_buffer_putuint8() writes the unsigned 8-bit integer
  *    val to buffer *b.
- * 
+ *
  *    lwres_buffer_getuint16() and lwres_buffer_getuint32() are identical to
  *    lwres_buffer_putuint8() except that they respectively read an unsigned
  *    16-bit or 32-bit integer in network byte order from b. Similarly,
  *    lwres_buffer_putuint16() and lwres_buffer_putuint32() writes the
  *    unsigned 16-bit or 32-bit integer val to buffer b, in network byte
  *    order.
- * 
+ *
  *    Arbitrary amounts of data are read or written from a lightweight
  *    resolver buffer with lwres_buffer_getmem() and lwres_buffer_putmem()
  *    respectively. lwres_buffer_putmem() copies length bytes of memory at
@@ -339,7 +339,7 @@ lwres_buffer_putmem(lwres_buffer_t *b, const unsigned char *base,
 	REQUIRE(b->used + length <= b->length);
 
 	cp = (unsigned char *)b->base + b->used;
-	memcpy(cp, base, length);
+	memmove(cp, base, length);
 	b->used += length;
 }
 
@@ -357,5 +357,5 @@ lwres_buffer_getmem(lwres_buffer_t *b, unsigned char *base,
 	cp += b->current;
 	b->current += length;
 
-	memcpy(base, cp, length);
+	memmove(base, cp, length);
 }
diff --git a/lib/lwres/lwconfig.c b/lib/lwres/lwconfig.c
index e9a86710..62630238 100644
--- a/lib/lwres/lwconfig.c
+++ b/lib/lwres/lwconfig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -455,16 +455,16 @@ lwres_create_addr(const char *buffer, lwres_addr_t *addr, int convert_zero) {
 			unsigned char zeroaddress[] = {0, 0, 0, 0};
 			unsigned char loopaddress[] = {127, 0, 0, 1};
 			if (memcmp(&v4, zeroaddress, 4) == 0)
-				memcpy(&v4, loopaddress, 4);
+				memmove(&v4, loopaddress, 4);
 		}
 		addr->family = LWRES_ADDRTYPE_V4;
 		addr->length = NS_INADDRSZ;
-		memcpy((void *)addr->address, &v4, NS_INADDRSZ);
+		memmove((void *)addr->address, &v4, NS_INADDRSZ);
 
 	} else if (lwres_net_pton(AF_INET6, buffer, &v6) == 1) {
 		addr->family = LWRES_ADDRTYPE_V6;
 		addr->length = NS_IN6ADDRSZ;
-		memcpy((void *)addr->address, &v6, NS_IN6ADDRSZ);
+		memmove((void *)addr->address, &v6, NS_IN6ADDRSZ);
 	} else {
 		return (LWRES_R_FAILURE); /* Unrecognised format. */
 	}
diff --git a/lib/lwres/lwinetpton.c b/lib/lwres/lwinetpton.c
index 65a8998c..efeb21b7 100644
--- a/lib/lwres/lwinetpton.c
+++ b/lib/lwres/lwinetpton.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1996-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -116,7 +116,7 @@ inet_pton4(const char *src, unsigned char *dst) {
 	}
 	if (octets < 4)
 		return (0);
-	memcpy(dst, tmp, NS_INADDRSZ);
+	memmove(dst, tmp, NS_INADDRSZ);
 	return (1);
 }
 
@@ -210,6 +210,6 @@ inet_pton6(const char *src, unsigned char *dst) {
 	}
 	if (tp != endp)
 		return (0);
-	memcpy(dst, tmp, NS_IN6ADDRSZ);
+	memmove(dst, tmp, NS_IN6ADDRSZ);
 	return (1);
 }
diff --git a/lib/lwres/lwresutil.c b/lib/lwres/lwresutil.c
index 3bf5660f..0d1e5aaf 100644
--- a/lib/lwres/lwresutil.c
+++ b/lib/lwres/lwresutil.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -27,7 +27,7 @@
  *    given by *len. The buffer's current pointer is advanced to point at
  *    the character following the string length, the encoded string, and
  *    the trailing NULL character.
- * 
+ *
  *    lwres_addr_parse() extracts an address from the buffer b. The
  *    buffer's current pointer b->current is presumed to point at an
  *    encoded address: the address preceded by a 32-bit protocol family
@@ -36,10 +36,10 @@
  *    the address that was copied. b->current is advanced to point at the
  *  next byte of available data in the buffer following the encoded
  *    address.
- * 
+ *
  *    lwres_getaddrsbyname() and lwres_getnamebyaddr() use the
  *    lwres_gnbaresponse_t structure defined below:
- * 
+ *
  * \code
  * typedef struct {
  *         lwres_uint32_t          flags;
@@ -54,45 +54,45 @@
  *         size_t                  baselen;
  * } lwres_gabnresponse_t;
  * \endcode
- * 
+ *
  *    The contents of this structure are not manipulated directly but
- *    they are controlled through the \link lwres_gabn.c lwres_gabn*\endlink functions.  
- * 
+ *    they are controlled through the \link lwres_gabn.c lwres_gabn*\endlink functions.
+ *
  *    The lightweight resolver uses lwres_getaddrsbyname() to perform
  *    foward lookups. Hostname name is looked up using the resolver
- *    context ctx for memory allocation. addrtypes is a bitmask      
+ *    context ctx for memory allocation. addrtypes is a bitmask
  *    indicating which type of addresses are to be looked up. Current
  *    values for this bitmask are #LWRES_ADDRTYPE_V4 for IPv4 addresses
  *    and #LWRES_ADDRTYPE_V6 for IPv6 addresses. Results of the lookup are
  *    returned in *structp.
- * 
- *    lwres_getnamebyaddr() performs reverse lookups. Resolver context  
+ *
+ *    lwres_getnamebyaddr() performs reverse lookups. Resolver context
  *    ctx is used for memory allocation. The address type is indicated by
  *    addrtype: #LWRES_ADDRTYPE_V4 or #LWRES_ADDRTYPE_V6. The address to be
- *    looked up is given by addr and its length is addrlen bytes. The    
- *    result of the function call is made available through *structp.   
- * 
+ *    looked up is given by addr and its length is addrlen bytes. The
+ *    result of the function call is made available through *structp.
+ *
  * \section lwresutil_return Return Values
- * 
+ *
  *    Successful calls to lwres_string_parse() and lwres_addr_parse()
- *    return #LWRES_R_SUCCESS. Both functions return #LWRES_R_FAILURE if 
- *    the buffer is corrupt or #LWRES_R_UNEXPECTEDEND if the buffer has   
+ *    return #LWRES_R_SUCCESS. Both functions return #LWRES_R_FAILURE if
+ *    the buffer is corrupt or #LWRES_R_UNEXPECTEDEND if the buffer has
  *    less space than expected for the components of the encoded string
  *    or address.
- * 
+ *
  * lwres_getaddrsbyname() returns #LWRES_R_SUCCESS on success and it
  *    returns #LWRES_R_NOTFOUND if the hostname name could not be found.
- * 
+ *
  *    #LWRES_R_SUCCESS is returned by a successful call to
  *    lwres_getnamebyaddr().
- * 
+ *
  *    Both lwres_getaddrsbyname() and lwres_getnamebyaddr() return
  *    #LWRES_R_NOMEMORY when memory allocation requests fail and
  *    #LWRES_R_UNEXPECTEDEND if the buffers used for sending queries and
- *    receiving replies are too small.     
- * 
+ *    receiving replies are too small.
+ *
  * \section lwresutil_see See Also
- * 
+ *
  *    lwbuffer.c, lwres_gabn.c
  */
 
@@ -390,7 +390,7 @@ lwres_getnamebyaddr(lwres_context_t *ctx, lwres_uint32_t addrtype,
 	request.flags = 0;
 	request.addr.family = addrtype;
 	request.addr.length = addrlen;
-	memcpy(request.addr.address, addr, addrlen);
+	memmove(request.addr.address, addr, addrlen);
 	pkt.pktflags = 0;
 	pkt.serial = serial;
 	pkt.result = 0;