diff --git a/source3/libads/ads_struct.c b/source3/libads/ads_struct.c
index 7480fb7d1c4..c7734442699 100644
--- a/source3/libads/ads_struct.c
+++ b/source3/libads/ads_struct.c
@@ -130,7 +130,6 @@ static void ads_destroy(ADS_STRUCT **ads)
 #ifdef HAVE_LDAP
 		ads_disconnect(*ads);
 #endif
-		SAFE_FREE((*ads)->server.workgroup);
 		SAFE_FREE((*ads)->server.ldap_server);
 
 		SAFE_FREE((*ads)->auth.realm);
@@ -184,7 +183,13 @@ ADS_STRUCT *ads_init(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	ads->server.workgroup = workgroup ? SMB_STRDUP(workgroup) : NULL;
+	ads->server.workgroup = talloc_strdup(ads, workgroup);
+	if (workgroup != NULL && ads->server.workgroup == NULL) {
+		DBG_WARNING("Out of memory\n");
+		TALLOC_FREE(ads);
+		return NULL;
+	}
+
 	ads->server.ldap_server = ldap_server? SMB_STRDUP(ldap_server) : NULL;
 
 	wrap_flags = lp_client_ldap_sasl_wrapping();
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index acec42be166..9a838756598 100755
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -296,7 +296,7 @@ static bool ads_try_connect(ADS_STRUCT *ads, bool gc,
 	SAFE_FREE(ads->config.ldap_server_name);
 	SAFE_FREE(ads->config.server_site_name);
 	SAFE_FREE(ads->config.client_site_name);
-	SAFE_FREE(ads->server.workgroup);
+	TALLOC_FREE(ads->server.workgroup);
 
 	if (!check_cldap_reply_required_flags(cldap_reply.server_type,
 					      ads->config.flags)) {
@@ -320,7 +320,13 @@ static bool ads_try_connect(ADS_STRUCT *ads, bool gc,
 		ads->config.client_site_name =
 			SMB_STRDUP(cldap_reply.client_site);
 	}
-	ads->server.workgroup          = SMB_STRDUP(cldap_reply.domain_name);
+
+	ads->server.workgroup = talloc_strdup(ads, cldap_reply.domain_name);
+	if (ads->server.workgroup == NULL) {
+		DBG_WARNING("Out of memory\n");
+		ret = false;
+		goto out;
+	}
 
 	ads->ldap.port = gc ? LDAP_GC_PORT : LDAP_PORT;
 	ads->ldap.ss = *ss;