diff --git a/Makefile b/Makefile
index 200ca62..a981c1c 100644
--- a/Makefile
+++ b/Makefile
@@ -229,11 +229,11 @@ WITH_UNITTEST = $(shell grep -l UNITTEST *.c)
 UNITTEST_BIN = $(patsubst %.c, test/%, $(WITH_UNITTEST))
 
 test/%: %.c
-	$(CC) $(CFLAGS) --coverage -DUNITTEST -o $@ $^ -I. $(LDFLAGS)
+	$(CC) $(CFLAGS) --coverage -DUNITTEST -o $@ $^ -I. $(LDFLAGS) -fsanitize=address -fsanitize=undefined -lowfat
 	$@
 
 check: $(UNITTEST_BIN)
-	echo done
+	@echo done
 
 clean:
 	rm -f t t[1-9] *.[ao] bindrequest tinyldap ldapclient \
diff --git a/bstr.h b/bstr.h
index 5b18778..8b4bf6d 100644
--- a/bstr.h
+++ b/bstr.h
@@ -1,5 +1,17 @@
 #include <stddef.h>
 
+/* The LDAP read-only data store is mmapped and trusted, because it
+ * takes higher privileges than tinyldap has to modify it.
+ * Strings are stored in it as ASCIIZ, so we can just operate on them
+ * after mapping the file into memory.
+ * However, we also need to be able to store binary data including
+ * 0 bytes, so we extend the format slightly. Zero-length strings don't
+ * happen in regular LDAP, so if the string starts with a 0 byte, the
+ * next four bytes are a little-endian 32-bit length value and after
+ * than come that many binary bytes.
+ * This means we need small wrappers around strlen and strcmp.
+ * These are those small wrappers. */
+
 int bstr_diff(const char* a,const char* b);
 #define bstr_equal(s,t) (!bstr_diff((s),(t)))
 
diff --git a/bstr_diff.c b/bstr_diff.c
index d7737e4..dac94d9 100644
--- a/bstr_diff.c
+++ b/bstr_diff.c
@@ -19,8 +19,49 @@ int bstr_diff(const char* a,const char* b) {
     } else
       if (b==B)
 	return 1;
-    if ((j=(*a-*b))) break;
+    if ((j=((unsigned char)*a-(unsigned char)*b))) break;
     ++a; ++b;
   }
   return j;
 }
+
+#ifdef UNITTEST
+#include <assert.h>
+
+int main() {
+  assert(str_diff("bar","foo") < 0);
+  assert(str_diff("foo","bar") > 0);
+  assert(str_diff("foo1","foo") > 0);
+  assert(str_diff("foo","foo1") < 0);
+  assert(str_diff("foo","foo") == 0);
+
+  assert(bstr_diff("bar","foo") < 0);
+  assert(bstr_diff("foo","bar") > 0);
+  assert(bstr_diff("foo1","foo") > 0);
+  assert(bstr_diff("foo","foo1") < 0);
+  assert(bstr_diff("foo","foo") == 0);
+
+  assert(bstr_diff("bar","\x00\x03\x00\x00\x00""foo") < 0);
+  assert(bstr_diff("foo","\x00\x03\x00\x00\x00""bar") > 0);
+  assert(bstr_diff("foo1","\x00\x03\x00\x00\x00""foo") > 0);
+  assert(bstr_diff("foo","\x00\x04\x00\x00\x00""foo1") < 0);
+  assert(bstr_diff("foo","\x00\x03\x00\x00\x00""foo") == 0);
+
+  assert(bstr_diff("\x00\x03\x00\x00\x00""bar","\x00\x03\x00\x00\x00""foo") < 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","\x00\x03\x00\x00\x00""bar") > 0);
+  assert(bstr_diff("\x00\x04\x00\x00\x00""foo1","\x00\x03\x00\x00\x00""foo") > 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","\x00\x04\x00\x00\x00""foo1") < 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","\x00\x03\x00\x00\x00""foo") == 0);
+
+  assert(bstr_diff("\x00\x03\x00\x00\x00""bar","foo") < 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","bar") > 0);
+  assert(bstr_diff("\x00\x04\x00\x00\x00""foo1","foo") > 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","foo1") < 0);
+  assert(bstr_diff("\x00\x03\x00\x00\x00""foo","foo") == 0);
+
+  assert(bstr_diff("\x00\x05\x00\x00\x00""f\x00ord","fnord") < 0);
+  assert(bstr_diff("\x00\x05\x00\x00\x00""f\x00ord","\x00\x05\x00\x00\x00""f\x00ort") < 0);
+
+  assert(bstr_diff("\x00\x03\x00\x00\x00""f\xf6o","foo") > 0);
+}
+#endif
diff --git a/bstr_diff2.c b/bstr_diff2.c
index aae94e8..c73425e 100644
--- a/bstr_diff2.c
+++ b/bstr_diff2.c
@@ -28,3 +28,32 @@ int bstr_diff2(const char* a,const char* b,size_t blen) {
   }
   return j;
 }
+
+#ifdef UNITTEST
+#include <assert.h>
+
+int main() {
+  assert(bstr_diff2("bar","foo",3) < 0);
+  assert(bstr_diff2("foo","bar",3) > 0);
+  assert(bstr_diff2("foo1","foo",3) > 0);
+  assert(bstr_diff2("foo","foo1",4) < 0);
+  assert(bstr_diff2("foo","foo",3) == 0);
+
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""bar","foo",3) < 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","bar",3) > 0);
+  assert(bstr_diff2("\x00\x04\x00\x00\x00""foo1","foo",3) > 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","foo1",4) < 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","foo",3) == 0);
+
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""bar","foo",3) < 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","bar",3) > 0);
+  assert(bstr_diff2("\x00\x04\x00\x00\x00""foo1","foo",3) > 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","foo1",4) < 0);
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""foo","foo",3) == 0);
+
+  assert(bstr_diff2("\x00\x05\x00\x00\x00""f\x00ord","fnord",5) < 0);
+  assert(bstr_diff2("\x00\x05\x00\x00\x00""f\x00ord","f\x00ort",5) < 0);
+
+  assert(bstr_diff2("\x00\x03\x00\x00\x00""f\xf6o","foo",3) > 0);
+}
+#endif
diff --git a/bstrfirst.c b/bstrfirst.c
index db1c425..94565e0 100644
--- a/bstrfirst.c
+++ b/bstrfirst.c
@@ -4,3 +4,13 @@
 const char* bstrfirst(const char* a) {
   if (*a) return a; else return a+5;
 }
+
+#ifdef UNITTEST
+#include <assert.h>
+
+int main() {
+  const char* s;
+  s="foo"; assert(bstrfirst(s) == s);
+  s="\x00\x03\x00\x00\x00""foo"; assert(bstrfirst(s) == s+5);
+}
+#endif
diff --git a/bstrstart.c b/bstrstart.c
index a7e3f02..5b31bcd 100644
--- a/bstrstart.c
+++ b/bstrstart.c
@@ -4,3 +4,12 @@
 size_t bstrstart(const char* a) {
   if (*a) return 0; else return 5;
 }
+
+#ifdef UNITTEST
+#include <assert.h>
+
+int main() {
+  assert(bstrstart("foo") == 0);
+  assert(bstrstart("\x00\x03\x00\x00\x00""foo") == 5);
+}
+#endif