diff --git a/Makefile b/Makefile
index 9c785a1..c27edf1 100644
--- a/Makefile
+++ b/Makefile
@@ -39,7 +39,7 @@ CC=gcc
 CFLAGS=-pipe -I. -Wall -W
 ifneq ($(DEBUG),)
 DIET=/opt/diet/bin/diet
-CFLAGS=-pipe -I. -Wall -W -g
+CFLAGS=-pipe -I. -Wall -W -g -fstack-protector
 endif
 ifeq ($(COVERAGE),1)
 DIET=
diff --git a/ldapclient.c b/ldapclient.c
index d0e802c..2def27e 100644
--- a/ldapclient.c
+++ b/ldapclient.c
@@ -18,8 +18,11 @@
 
 static void buffer_putescaped(buffer* b,const char* x,size_t l) {
   size_t needed=fmt_ldapescape2(0,x,l,"");
-  char* buf=alloca(needed);
-  fmt_ldapescape(buf,x,l);
+  char* buf;
+  if (needed>100000)
+    buf=0;
+  buf=alloca(needed);
+  fmt_ldapescape2(buf,x,l,"");
   buffer_put(b,buf,needed);
 }