--- src/protocol.c
+++ src/protocol.c
@@ -40,7 +40,7 @@
 
 /* \n is not a character expected in the string */
 #define LINE "%[^\n]"
-#define isprefix(a, b) (strncasecmp((a), (b), strlen(b))==0)
+#define is_prefix(a, b) (strncasecmp((a), (b), strlen(b))==0)
 
 /* protocol-specific function prototypes */
 static void cifs_client(CLI *);
@@ -55,8 +55,8 @@
 static void imap_server(CLI *);
 static void nntp_client(CLI *);
 static void connect_client(CLI *);
+#if !defined(OPENSSL_NO_MD4) && OPENSSL_VERSION_NUMBER>=0x0090700fL
 static void ntlm(CLI *);
-#ifndef OPENSSL_NO_MD4
 static char *ntlm1();
 static char *ntlm3(char *, char *, char *);
 static void crypt_DES(DES_cblock, DES_cblock, DES_cblock);
@@ -183,25 +183,30 @@
 static void smtp_client(CLI *c) {
     char *line;
 
+    line=str_dup("");
     do { /* copy multiline greeting */
+        str_free(line); 
         line=fdgetline(c, c->remote_fd.fd);
         fdputline(c, c->local_wfd.fd, line);
-    } while(isprefix(line, "220-"));
+    } while(is_prefix(line, "220-"));
 
     fdputline(c, c->remote_fd.fd, "EHLO localhost");
     do { /* skip multiline reply */
+        str_free(line);
         line=fdgetline(c, c->remote_fd.fd);
-    } while(isprefix(line, "250-"));
-    if(!isprefix(line, "250 ")) { /* error */
+    } while(is_prefix(line, "250-"));
+    if(!is_prefix(line, "250 ")) { /* error */
         s_log(LOG_ERR, "Remote server is not RFC 1425 compliant");
+        str_free(line);
         longjmp(c->err, 1);
     }
 
     fdputline(c, c->remote_fd.fd, "STARTTLS");
     do { /* skip multiline reply */
+        str_free(line);
         line=fdgetline(c, c->remote_fd.fd);
-    } while(isprefix(line, "220-"));
-    if(!isprefix(line, "220 ")) { /* error */
+    } while(is_prefix(line, "220-"));
+    if(!is_prefix(line, "220 ")) { /* error */
         s_log(LOG_ERR, "Remote server is not RFC 2487 compliant");
         longjmp(c->err, 1);
     }
@@ -225,20 +230,20 @@
     }
 
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "220")) {
+    if(!is_prefix(line, "220")) {
         s_log(LOG_ERR, "Unknown server welcome");
         longjmp(c->err, 1);
     }
     fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);
     line=fdgetline(c, c->local_rfd.fd);
-    if(!isprefix(line, "EHLO ")) {
+    if(!is_prefix(line, "EHLO ")) {
         s_log(LOG_ERR, "Unknown client EHLO");
         longjmp(c->err, 1);
     }
     fdprintf(c, c->local_wfd.fd, "250-%s Welcome", line);
     fdputline(c, c->local_wfd.fd, "250 STARTTLS");
     line=fdgetline(c, c->local_rfd.fd);
-    if(!isprefix(line, "STARTTLS")) {
+    if(!is_prefix(line, "STARTTLS")) {
         s_log(LOG_ERR, "STARTTLS expected");
         longjmp(c->err, 1);
     }
@@ -249,14 +254,14 @@
     char *line;
 
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "+OK ")) {
+    if(!is_prefix(line, "+OK ")) {
         s_log(LOG_ERR, "Unknown server welcome");
         longjmp(c->err, 1);
     }
     fdputline(c, c->local_wfd.fd, line);
     fdputline(c, c->remote_fd.fd, "STLS");
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "+OK ")) {
+    if(!is_prefix(line, "+OK ")) {
         s_log(LOG_ERR, "Server does not support TLS");
         longjmp(c->err, 1);
     }
@@ -268,11 +273,11 @@
     line=fdgetline(c, c->remote_fd.fd);
     fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);
     line=fdgetline(c, c->local_rfd.fd);
-    if(isprefix(line, "CAPA")) { /* client wants RFC 2449 extensions */
+    if(is_prefix(line, "CAPA")) { /* client wants RFC 2449 extensions */
         fdputline(c, c->local_wfd.fd, "-ERR Stunnel does not support capabilities");
         line=fdgetline(c, c->local_rfd.fd);
     }
-    if(!isprefix(line, "STLS")) {
+    if(!is_prefix(line, "STLS")) {
         s_log(LOG_ERR, "Client does not want TLS");
         longjmp(c->err, 1);
     }
@@ -283,14 +288,14 @@
     char *line;
 
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "* OK")) {
+    if(!is_prefix(line, "* OK")) {
         s_log(LOG_ERR, "Unknown server welcome");
         longjmp(c->err, 1);
     }
     fdputline(c, c->local_wfd.fd, line);
     fdputline(c, c->remote_fd.fd, "stunnel STARTTLS");
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "stunnel OK")) {
+    if(!is_prefix(line, "stunnel OK")) {
         fdputline(c, c->local_wfd.fd,
             "* BYE stunnel: Server does not support TLS");
         s_log(LOG_ERR, "Server does not support TLS");
@@ -317,7 +322,7 @@
 
     /* process server welcome and send it to client */
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "* OK")) {
+    if(!is_prefix(line, "* OK")) {
         s_log(LOG_ERR, "Unknown server welcome");
         longjmp(c->err, 1);
     }
@@ -337,11 +342,11 @@
             break;
         *tail++='\0';
 
-        if(isprefix(tail, "STARTTLS")) {
+        if(is_prefix(tail, "STARTTLS")) {
             fdprintf(c, c->local_wfd.fd,
                 "%s OK Begin TLS negotiation now", id);
             return; /* success */
-        } else if(isprefix(tail, "CAPABILITY")) {
+        } else if(is_prefix(tail, "CAPABILITY")) {
             fdputline(c, c->remote_fd.fd, line); /* send it to server */
             line=fdgetline(c, c->remote_fd.fd); /* get the capabilites */
             if(*line=='*') {
@@ -356,13 +361,13 @@
             }
             fdputline(c, c->local_wfd.fd, line); /* forward to the client */
             tail=strchr(line, ' ');
-            if(!tail || !isprefix(tail+1, "OK")) { /* not OK? */
+            if(!tail || !is_prefix(tail+1, "OK")) { /* not OK? */
                 fdputline(c, c->local_wfd.fd,
                     "* BYE unexpected server response");
                 s_log(LOG_ERR, "Unexpected server response: %s", line);
                 break;
             }
-        } else if(isprefix(tail, "LOGOUT")) {
+        } else if(is_prefix(tail, "LOGOUT")) {
             fdputline(c, c->local_wfd.fd, "* BYE server terminating");
             fdprintf(c, c->local_wfd.fd, "%s OK LOGOUT completed", id);
             break;
@@ -385,14 +390,14 @@
     char *line;
 
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "200 ") && !isprefix(line, "201 ")) {
+    if(!is_prefix(line, "200 ") && !is_prefix(line, "201 ")) {
         s_log(LOG_ERR, "Unknown server welcome");
         longjmp(c->err, 1);
     }
     fdputline(c, c->local_wfd.fd, line);
     fdputline(c, c->remote_fd.fd, "STARTTLS");
     line=fdgetline(c, c->remote_fd.fd);
-    if(!isprefix(line, "382 ")) {
+    if(!is_prefix(line, "382 ")) {
         s_log(LOG_ERR, "Server does not support TLS");
         longjmp(c->err, 1);
     }
@@ -437,6 +442,7 @@
     } while(*line);
 }
 
+#if !defined(OPENSSL_NO_MD4) && OPENSSL_VERSION_NUMBER>=0x0090700fL
 /* 
  * NTLM code is based on the following documentation:
  * http://davenport.sourceforge.net/ntlm.html
@@ -446,39 +452,53 @@
 #define s_min(a, b) ((a)>(b)?(b):(a))
 
 static void ntlm(CLI *c) {
-#ifndef OPENSSL_NO_MD4
-    char *line, *encoded;
-    char buf[BUFSIZ], *ntlm2=NULL;
+    char *line, buf[BUFSIZ], *ntlm1_txt, *ntlm2_txt, *ntlm3_txt, *tmpstr;
     long content_length=0; /* no HTTP content */
 
     /* send Proxy-Authorization (phase 1) */
     fdprintf(c, c->remote_fd.fd, "Proxy-Connection: keep-alive");
+    ntlm1_txt=ntlm1();
+    if(!ntlm1_txt) {
+        s_log(LOG_ERR, "Proxy-Authenticate: Failed to build NTLM request");
+        longjmp(c->err, 1);
+    }
     fdprintf(c, c->remote_fd.fd, "Proxy-Authorization: NTLM %s", ntlm1());
+    str_free(ntlm1_txt);
     fdputline(c, c->remote_fd.fd, ""); /* empty line */
     line=fdgetline(c, c->remote_fd.fd);
 
     /* receive Proxy-Authenticate (phase 2) */
-    if(line[9]!='4' || line[10]!='0' || line[11]!='7') { /* code 407 */
-        s_log(LOG_ERR, "NTLM authorization request rejected");
-        do { /* read all headers */
+    if(!is_prefix(line, "HTTP/1.0 407") && !is_prefix(line, "HTTP/1.1 407")) {
+        s_log(LOG_ERR, "Proxy-Authenticate: NTLM authorization request rejected");
+      do { /* read all headers */
+            str_free(line);
             line=fdgetline(c, c->remote_fd.fd);
         } while(*line);
+        str_free(line);
         longjmp(c->err, 1);
     }
+    ntlm2_txt=NULL;
     do { /* read all headers */
         line=fdgetline(c, c->remote_fd.fd);
-        if(isprefix(line, "Proxy-Authenticate: NTLM "))
-            ntlm2=str_dup(line+25);
-        else if(isprefix(line, "Content-Length: "))
-            content_length=atol(line+16);
+        if(is_prefix(line, "Proxy-Authenticate: NTLM "))
+            ntlm2_txt=str_dup(line+25);
+        else if(is_prefix(line, "Content-Length: ")) {
+            content_length=strtol(line+16, &tmpstr, 10);
+            if(tmpstr==line+16 || *tmpstr || content_length<0) {
+                s_log(LOG_ERR, "Proxy-Authenticate: Invalid Content-Length");
+                str_free(line);
+                longjmp(c->err, 1);
+            }
+        }
+
     } while(*line);
-    if(!ntlm2) { /* no Proxy-Authenticate: NTLM header */
+    if(!ntlm2_txt) { /* no Proxy-Authenticate: NTLM header */
         s_log(LOG_ERR, "Proxy-Authenticate: NTLM header not found");
         longjmp(c->err, 1);
     }
 
     /* read and ignore HTTP content (if any) */
-    while(content_length) {
+    while(content_length>0) {
         read_blocking(c, c->remote_fd.fd, buf, s_min(content_length, BUFSIZ));
         content_length-=s_min(content_length, BUFSIZ);
     }
@@ -486,18 +506,16 @@
     /* send Proxy-Authorization (phase 3) */
     fdprintf(c, c->remote_fd.fd, "CONNECT %s HTTP/1.1", c->opt->protocol_host);
     fdprintf(c, c->remote_fd.fd, "Host: %s", c->opt->protocol_host);
-    encoded=ntlm3(c->opt->protocol_username, c->opt->protocol_password, ntlm2);
-    str_free(ntlm2);
-    fdprintf(c, c->remote_fd.fd, "Proxy-Authorization: NTLM %s", encoded);
-    str_free(encoded);
-#else
-    s_log(LOG_ERR, "NTLM authentication is not available");
-    longjmp(c->err, 1);
-#endif
+    ntlm3_txt=ntlm3(c->opt->protocol_username, c->opt->protocol_password, ntlm2_txt);
+    str_free(ntlm2_txt);
+    if(!ntlm3_txt) {
+        s_log(LOG_ERR, "Proxy-Authenticate: Failed to build NTLM response");
+        longjmp(c->err, 1);
+    }
+    fdprintf(c, c->remote_fd.fd, "Proxy-Authorization: NTLM %s", ntlm3_txt);
+    str_free(ntlm3_txt);
 }
 
-#ifndef OPENSSL_NO_MD4
-
 static char *ntlm1() {
     char phase1[16];
 
