diff --git a/src/array.c b/src/array.c
index f914a94b..a85db18e 100644
--- a/src/array.c
+++ b/src/array.c
@@ -69,7 +69,7 @@ void array_reset_data_strings(array * const a) {
 		data_string * const ds = data[i];
 		/*force_assert(ds->type == TYPE_STRING);*/
 		buffer * const k = &ds->key;
-		buffer * const v = ds->value;
+		buffer * const v = &ds->value;
 		if (k->size > BUFFER_MAX_REUSE_SIZE) buffer_reset(k);
 		if (v->size > BUFFER_MAX_REUSE_SIZE) buffer_reset(v);
 	}
@@ -247,18 +247,18 @@ int * array_get_int_ptr(array * const a, const char * const k, const size_t klen
 
 buffer * array_get_buf_ptr(array * const a, const char * const k, const size_t klen) {
     int32_t ipos = array_get_index(a, k, klen);
-    if (ipos >= 0) return ((data_string *)a->data[ipos])->value;
+    if (ipos >= 0) return &((data_string *)a->data[ipos])->value;
 
     data_string * const ds = array_insert_string_at_pos(a, (uint32_t)(-ipos-1));
     buffer_copy_string_len(&ds->key, k, klen);
-    buffer_clear(ds->value);
-    return ds->value;
+    buffer_clear(&ds->value);
+    return &ds->value;
 }
 
 void array_insert_value(array * const a, const char * const v, const size_t vlen) {
     data_string * const ds = array_insert_string_at_pos(a, a->used);
     buffer_clear(&ds->key);
-    buffer_copy_string_len(ds->value, v, vlen);
+    buffer_copy_string_len(&ds->value, v, vlen);
 }
 
 /* if entry already exists return pointer to existing entry, otherwise insert entry and return NULL */
@@ -380,7 +380,7 @@ array_match_value_prefix (const array * const a, const buffer * const b)
     const size_t blen = buffer_string_length(b);
 
     for (uint32_t i = 0; i < a->used; ++i) {
-        const buffer * const value = ((data_string *)a->data[i])->value;
+        const buffer * const value = &((data_string *)a->data[i])->value;
         const size_t vlen = buffer_string_length(value);
         if (vlen <= blen && 0 == memcmp(b->ptr, value->ptr, vlen))
             return value;
@@ -394,7 +394,7 @@ array_match_value_prefix_nc (const array * const a, const buffer * const b)
     const size_t blen = buffer_string_length(b);
 
     for (uint32_t i = 0; i < a->used; ++i) {
-        const buffer * const value = ((data_string *)a->data[i])->value;
+        const buffer * const value = &((data_string *)a->data[i])->value;
         const size_t vlen = buffer_string_length(value);
         if (vlen <= blen && buffer_eq_icase_ssn(b->ptr, value->ptr, vlen))
             return value;
@@ -439,7 +439,7 @@ array_match_value_suffix (const array * const a, const buffer * const b)
     const char * const end = b->ptr + blen;
 
     for (uint32_t i = 0; i < a->used; ++i) {
-        const buffer * const value = ((data_string *)a->data[i])->value;
+        const buffer * const value = &((data_string *)a->data[i])->value;
         const size_t vlen = buffer_string_length(value);
         if (vlen <= blen && 0 == memcmp(end - vlen, value->ptr, vlen))
             return value;
@@ -454,7 +454,7 @@ array_match_value_suffix_nc (const array * const a, const buffer * const b)
     const char * const end = b->ptr + blen;
 
     for (uint32_t i = 0; i < a->used; ++i) {
-        const buffer * const value = ((data_string *)a->data[i])->value;
+        const buffer * const value = &((data_string *)a->data[i])->value;
         const size_t vlen = buffer_string_length(value);
         if (vlen <= blen && buffer_eq_icase_ssn(end - vlen, value->ptr, vlen))
             return value;
diff --git a/src/array.h b/src/array.h
index 196d5e22..1df3838b 100644
--- a/src/array.h
+++ b/src/array.h
@@ -32,7 +32,7 @@ typedef struct {
 typedef struct {
 	DATA_UNSET;
 
-	buffer *value;
+	buffer value;
 } data_string;
 
 data_string *data_string_init(void);
diff --git a/src/chunk.c b/src/chunk.c
index dda95a54..1d67e7e4 100644
--- a/src/chunk.c
+++ b/src/chunk.c
@@ -514,7 +514,7 @@ static chunk *chunkqueue_get_append_tempfile(server *srv, chunkqueue *cq) {
 		for (errno = EIO; cq->tempdir_idx < cq->tempdirs->used; ++cq->tempdir_idx) {
 			data_string *ds = (data_string *)cq->tempdirs->data[cq->tempdir_idx];
 
-			buffer_copy_buffer(template, ds->value);
+			buffer_copy_buffer(template, &ds->value);
 			buffer_append_path_len(template, CONST_STR_LEN("lighttpd-upload-XXXXXX"));
 			if (-1 != (fd = fdevent_mkstemp_append(template->ptr))) break;
 		}
diff --git a/src/configfile-glue.c b/src/configfile-glue.c
index 603cb47d..0c93942c 100644
--- a/src/configfile-glue.c
+++ b/src/configfile-glue.c
@@ -76,7 +76,7 @@ int config_insert_values_internal(server *srv, const array *ca, const config_val
 			if (du->type == TYPE_STRING) {
 				const data_string *ds = (const data_string *)du;
 
-				buffer_copy_buffer(cv[i].destination, ds->value);
+				buffer_copy_buffer(cv[i].destination, &ds->value);
 			} else {
 				log_error_write(srv, __FILE__, __LINE__, "ss", cv[i].key, "should have been a string like ... = \"...\"");
 
@@ -100,16 +100,16 @@ int config_insert_values_internal(server *srv, const array *ca, const config_val
 				 * short before giving up, in order to support setting numeric
 				 * values with environment variables (eg, port number).
 				 */
-				if (ds->value->ptr && *ds->value->ptr) {
+				if (ds->value.ptr && *ds->value.ptr) {
 					char *e;
-					long l = strtol(ds->value->ptr, &e, 10);
-					if (e != ds->value->ptr && !*e && l >=0 && l <= 65535) {
+					long l = strtol(ds->value.ptr, &e, 10);
+					if (e != ds->value.ptr && !*e && l >=0 && l <= 65535) {
 						*((unsigned short *)(cv[i].destination)) = l;
 						break;
 					}
 				}
 
-				log_error_write(srv, __FILE__, __LINE__, "ssb", "got a string but expected a short:", cv[i].key, ds->value);
+				log_error_write(srv, __FILE__, __LINE__, "ssb", "got a string but expected a short:", cv[i].key, &ds->value);
 
 				return -1;
 			}
@@ -129,16 +129,16 @@ int config_insert_values_internal(server *srv, const array *ca, const config_val
 			case TYPE_STRING: {
 				const data_string *ds = (const data_string *)du;
 
-				if (ds->value->ptr && *ds->value->ptr) {
+				if (ds->value.ptr && *ds->value.ptr) {
 					char *e;
-					long l = strtol(ds->value->ptr, &e, 10);
-					if (e != ds->value->ptr && !*e && l >= 0) {
+					long l = strtol(ds->value.ptr, &e, 10);
+					if (e != ds->value.ptr && !*e && l >= 0) {
 						*((unsigned int *)(cv[i].destination)) = l;
 						break;
 					}
 				}
 
-				log_error_write(srv, __FILE__, __LINE__, "ssb", "got a string but expected an integer:", cv[i].key, ds->value);
+				log_error_write(srv, __FILE__, __LINE__, "ssb", "got a string but expected an integer:", cv[i].key, &ds->value);
 
 				return -1;
 			}
@@ -151,12 +151,12 @@ int config_insert_values_internal(server *srv, const array *ca, const config_val
 			if (du->type == TYPE_STRING) {
 				const data_string *ds = (const data_string *)du;
 
-				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("enable"))) {
+				if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("enable"))) {
 					*((unsigned short *)(cv[i].destination)) = 1;
-				} else if (buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))) {
+				} else if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))) {
 					*((unsigned short *)(cv[i].destination)) = 0;
 				} else {
-					log_error_write(srv, __FILE__, __LINE__, "ssbs", "ERROR: unexpected value for key:", cv[i].key, ds->value, "(enable|disable)");
+					log_error_write(srv, __FILE__, __LINE__, "ssbs", "ERROR: unexpected value for key:", cv[i].key, &ds->value, "(enable|disable)");
 
 					return -1;
 				}
diff --git a/src/configfile.c b/src/configfile.c
index 728dade7..85b78fcd 100644
--- a/src/configfile.c
+++ b/src/configfile.c
@@ -35,7 +35,7 @@ static void config_warn_authn_module (server *srv, const char *module, size_t le
 		const data_unset *du = array_get_element_klen(config->value, CONST_STR_LEN("auth.backend"));
 		if (NULL != du && du->type == TYPE_STRING) {
 			data_string *ds = (data_string *)du;
-			if (buffer_is_equal_string(ds->value, module, len)) {
+			if (buffer_is_equal_string(&ds->value, module, len)) {
 				buffer_copy_string_len(srv->tmp_buf, CONST_STR_LEN("mod_authn_"));
 				buffer_append_string_len(srv->tmp_buf, module, len);
 				array_insert_value(srv->srvconf.modules, CONST_BUF_LEN(srv->tmp_buf));
@@ -78,14 +78,14 @@ static int config_http_parseopts (server *srv, array *a) {
         const data_string * const ds = (data_string *)a->data[i];
         unsigned short int opt;
         int val = 0;
-        if (buffer_is_equal_string(ds->value, CONST_STR_LEN("enable")))
+        if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("enable")))
             val = 1;
-        else if (buffer_is_equal_string(ds->value, CONST_STR_LEN("disable")))
+        else if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable")))
             val = 0;
         else {
             log_error_write(srv, __FILE__, __LINE__, "sbsbs",
                             "unrecognized value for server.http-parseopts:",
-                            &ds->key, "=>", ds->value,
+                            &ds->key, "=>", &ds->value,
                             "(expect \"[enable|disable]\")");
             rc = 0;
         }
@@ -570,35 +570,35 @@ static int config_insert(server *srv) {
 		for (i = 0; i < srv->srvconf.modules->used; i++) {
 			ds = (data_string *)srv->srvconf.modules->data[i];
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_indexfile"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_indexfile"))) {
 				prepend_mod_indexfile = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_staticfile"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_staticfile"))) {
 				append_mod_staticfile = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_dirlisting"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_dirlisting"))) {
 				append_mod_dirlisting = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_openssl"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_openssl"))) {
 				append_mod_openssl = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_authn_file"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_authn_file"))) {
 				append_mod_authn_file = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_authn_ldap"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_authn_ldap"))) {
 				append_mod_authn_ldap = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_authn_mysql"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_authn_mysql"))) {
 				append_mod_authn_mysql = 0;
 			}
 
-			if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_auth"))) {
+			if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_auth"))) {
 				contains_mod_auth = 1;
 			}
 
@@ -621,7 +621,7 @@ static int config_insert(server *srv) {
 
 			for (i = 0; i < srv->srvconf.modules->used; i++) {
 				ds = (data_string *)srv->srvconf.modules->data[i];
-				array_insert_value(modules, CONST_BUF_LEN(ds->value));
+				array_insert_value(modules, CONST_BUF_LEN(&ds->value));
 			}
 
 			array_free(srv->srvconf.modules);
@@ -1578,7 +1578,7 @@ int config_set_defaults(server *srv) {
 		for (i = 0; i < srv->srvconf.upload_tempdirs->used; ++i) {
 			const data_string * const ds = (data_string *)srv->srvconf.upload_tempdirs->data[i];
 			buffer_string_set_length(b, len); /*(truncate)*/
-			buffer_append_string_buffer(b, ds->value);
+			buffer_append_string_buffer(b, &ds->value);
 			if (-1 == stat(b->ptr, &st1)) {
 				log_error_write(srv, __FILE__, __LINE__, "sb",
 					"server.upload-dirs doesn't exist:", b);
diff --git a/src/configparser.y b/src/configparser.y
index 6a3d9d69..a4535fae 100644
--- a/src/configparser.y
+++ b/src/configparser.y
@@ -72,12 +72,12 @@ static data_unset *configparser_merge_data(data_unset *op1, const data_unset *op
   if (op1->type != op2->type) {
     if (op1->type == TYPE_STRING && op2->type == TYPE_INTEGER) {
       data_string *ds = (data_string *)op1;
-      buffer_append_int(ds->value, ((data_integer*)op2)->value);
+      buffer_append_int(&ds->value, ((data_integer*)op2)->value);
       return op1;
     } else if (op1->type == TYPE_INTEGER && op2->type == TYPE_STRING) {
       data_string *ds = data_string_init();
-      buffer_append_int(ds->value, ((data_integer*)op1)->value);
-      buffer_append_string_buffer(ds->value, ((data_string*)op2)->value);
+      buffer_append_int(&ds->value, ((data_integer*)op1)->value);
+      buffer_append_string_buffer(&ds->value, &((data_string*)op2)->value);
       op1->fn->free(op1);
       return (data_unset *)ds;
     } else {
@@ -89,7 +89,7 @@ static data_unset *configparser_merge_data(data_unset *op1, const data_unset *op
 
   switch (op1->type) {
     case TYPE_STRING:
-      buffer_append_string_buffer(((data_string *)op1)->value, ((data_string *)op2)->value);
+      buffer_append_string_buffer(&((data_string *)op1)->value, &((data_string *)op2)->value);
       break;
     case TYPE_INTEGER:
       ((data_integer *)op1)->value += ((data_integer *)op2)->value;
@@ -304,7 +304,7 @@ value(A) ::= key(B). {
       if (NULL != (env = getenv(B->ptr + 4))) {
         data_string *ds;
         ds = data_string_init();
-        buffer_append_string(ds->value, env);
+        buffer_append_string(&ds->value, env);
         A = (data_unset *)ds;
       }
       else {
@@ -321,12 +321,8 @@ value(A) ::= key(B). {
 }
 
 value(A) ::= STRING(B). {
-  buffer *b;
   A = (data_unset *)data_string_init();
-  b = ((data_string *)(A))->value;
-  buffer_free(b);
-  ((data_string *)(A))->value = B;
-  B = NULL;
+  buffer_copy_buffer(&((data_string *)A)->value, B);
 }
 
 value(A) ::= INTEGER(B). {
@@ -576,7 +572,7 @@ context ::= DOLLAR SRVVARNAME(B) LBRACKET stringop(C) RBRACKET cond(E) expressio
     buffer_append_string_buffer(b, B);
     buffer_append_string_buffer(b, C);
     buffer_append_string_buffer(b, op);
-    rvalue = ((data_string*)D)->value;
+    rvalue = &((data_string*)D)->value;
     buffer_append_string_buffer(b, rvalue);
 
     if (NULL != (dc = configparser_get_data_config(ctx->all_configs, CONST_BUF_LEN(b)))) {
@@ -764,8 +760,7 @@ stringop(A) ::= expression(B). {
   A = NULL;
   if (ctx->ok) {
     if (B->type == TYPE_STRING) {
-      A = ((data_string*)B)->value;
-      ((data_string*)B)->value = NULL;
+      A = buffer_init_buffer(&((data_string*)B)->value);
     } else if (B->type == TYPE_INTEGER) {
       A = buffer_init();
       buffer_copy_int(A, ((data_integer *)B)->value);
diff --git a/src/data_string.c b/src/data_string.c
index ef7038fc..3b81e33a 100644
--- a/src/data_string.c
+++ b/src/data_string.c
@@ -12,7 +12,7 @@ static data_unset *data_string_copy(const data_unset *s) {
 	data_string *ds = data_string_init();
 
 	if (!buffer_is_empty(&src->key)) buffer_copy_buffer(&ds->key, &src->key);
-	buffer_copy_buffer(ds->value, src->value);
+	buffer_copy_buffer(&ds->value, &src->value);
 	return (data_unset *)ds;
 }
 
@@ -20,7 +20,7 @@ static void data_string_free(data_unset *d) {
 	data_string *ds = (data_string *)d;
 
 	free(ds->key.ptr);
-	buffer_free(ds->value);
+	free(ds->value.ptr);
 
 	free(d);
 }
@@ -30,11 +30,11 @@ static int data_string_insert_dup(data_unset *dst, data_unset *src) {
 	data_string *ds_dst = (data_string *)dst;
 	data_string *ds_src = (data_string *)src;
 
-	if (!buffer_is_empty(ds_dst->value)) {
-		buffer_append_string_len(ds_dst->value, CONST_STR_LEN(", "));
-		buffer_append_string_buffer(ds_dst->value, ds_src->value);
+	if (!buffer_is_empty(&ds_dst->value)) {
+		buffer_append_string_len(&ds_dst->value, CONST_STR_LEN(", "));
+		buffer_append_string_buffer(&ds_dst->value, &ds_src->value);
 	} else {
-		buffer_copy_buffer(ds_dst->value, ds_src->value);
+		buffer_copy_buffer(&ds_dst->value, &ds_src->value);
 	}
 
 	src->fn->free(src);
@@ -49,16 +49,16 @@ static void data_string_print(const data_unset *d, int depth) {
 	UNUSED(depth);
 
 	/* empty and uninitialized strings */
-	if (buffer_string_is_empty(ds->value)) {
+	if (buffer_string_is_empty(&ds->value)) {
 		fputs("\"\"", stdout);
 		return;
 	}
 
 	/* print out the string as is, except prepend " with backslash */
 	putc('"', stdout);
-	len = buffer_string_length(ds->value);
+	len = buffer_string_length(&ds->value);
 	for (i = 0; i < len; i++) {
-		unsigned char c = ds->value->ptr[i];
+		unsigned char c = ds->value.ptr[i];
 		if (c == '"') {
 			fputs("\\\"", stdout);
 		} else {
@@ -81,8 +81,6 @@ data_string *data_string_init(void) {
 	ds = calloc(1, sizeof(*ds));
 	force_assert(NULL != ds);
 
-	ds->value = buffer_init();
-
 	ds->type = TYPE_STRING;
 	ds->fn = &fn;
 
diff --git a/src/gw_backend.c b/src/gw_backend.c
index f2d7d4ab..d6fac695 100644
--- a/src/gw_backend.c
+++ b/src/gw_backend.c
@@ -523,8 +523,8 @@ static int gw_spawn_connection(server *srv, gw_host *host, gw_proc *proc, int de
                     data_string *ds=(data_string *)host->bin_env_copy->data[i];
                     char *ge;
 
-                    if (NULL != (ge = getenv(ds->value->ptr))) {
-                        env_add(&env, CONST_BUF_LEN(ds->value), ge, strlen(ge));
+                    if (NULL != (ge = getenv(ds->value.ptr))) {
+                        env_add(&env,CONST_BUF_LEN(&ds->value),ge,strlen(ge));
                     }
                 }
             } else {
@@ -542,7 +542,7 @@ static int gw_spawn_connection(server *srv, gw_host *host, gw_proc *proc, int de
             for (i = 0; i < host->bin_env->used; ++i) {
                 data_string *ds = (data_string *)host->bin_env->data[i];
 
-                env_add(&env, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+                env_add(&env,CONST_BUF_LEN(&ds->key),CONST_BUF_LEN(&ds->value));
             }
 
             for (i = 0; i < env.used; ++i) {
@@ -1544,13 +1544,13 @@ int gw_set_defaults_backend(server *srv, gw_plugin_data *p, const data_unset *du
                           "unexpected type for x-sendfile-docroot; expected: \"x-sendfile-docroot\" => ( \"/allowed/path\", ... )");
                         goto error;
                     }
-                    if (ds->value->ptr[0] != '/') {
+                    if (ds->value.ptr[0] != '/') {
                         log_error_write(srv, __FILE__, __LINE__, "SBs",
-                          "x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
+                          "x-sendfile-docroot paths must begin with '/'; invalid: \"", &ds->value, "\"");
                         goto error;
                     }
-                    buffer_path_simplify(ds->value, ds->value);
-                    buffer_append_slash(ds->value);
+                    buffer_path_simplify(&ds->value, &ds->value);
+                    buffer_append_slash(&ds->value);
                 }
             }
 
@@ -1591,11 +1591,11 @@ error:
 }
 
 int gw_set_defaults_balance(server *srv, gw_plugin_config *s, const data_unset *du) {
-    buffer *b;
+    const buffer *b;
     if (NULL == du) {
         b = NULL;
     } else if (du->type == TYPE_STRING) {
-        b = ((const data_string *)du)->value;
+        b = &((const data_string *)du)->value;
     } else {
         log_error_write(srv, __FILE__, __LINE__, "s",
                         "unexpected type for xxxxx.balance; expected string");
@@ -2262,7 +2262,7 @@ handler_t gw_check_extension(server *srv, connection *con, gw_plugin_data *p, in
                     for (k = 0; k < exts->used; ++k) {
                         extension = exts->exts[k];
 
-                        if (buffer_is_equal(ds->value, extension->key)) {
+                        if (buffer_is_equal(&ds->value, extension->key)) {
                             break;
                         }
                     }
diff --git a/src/http-header-glue.c b/src/http-header-glue.c
index b6eb7d2d..218fcfb0 100644
--- a/src/http-header-glue.c
+++ b/src/http-header-glue.c
@@ -636,11 +636,11 @@ static void http_response_xsendfile (server *srv, connection *con, buffer *path,
 		size_t i, xlen = buffer_string_length(path);
 		for (i = 0; i < xdocroot->used; ++i) {
 			data_string *ds = (data_string *)xdocroot->data[i];
-			size_t dlen = buffer_string_length(ds->value);
+			size_t dlen = buffer_string_length(&ds->value);
 			if (dlen <= xlen
 			    && (!con->conf.force_lowercase_filenames
-				? 0 == memcmp(path->ptr, ds->value->ptr, dlen)
-				: buffer_eq_icase_ssn(path->ptr, ds->value->ptr, dlen))) {
+				? 0 == memcmp(path->ptr, ds->value.ptr, dlen)
+				: buffer_eq_icase_ssn(path->ptr, ds->value.ptr, dlen))) {
 				break;
 			}
 		}
@@ -710,11 +710,11 @@ static void http_response_xsendfile2(server *srv, connection *con, const buffer
             size_t i, xlen = buffer_string_length(b);
             for (i = 0; i < xdocroot->used; ++i) {
                 data_string *ds = (data_string *)xdocroot->data[i];
-                size_t dlen = buffer_string_length(ds->value);
+                size_t dlen = buffer_string_length(&ds->value);
                 if (dlen <= xlen
                     && (!con->conf.force_lowercase_filenames
-                    ? 0 == memcmp(b->ptr, ds->value->ptr, dlen)
-                    : buffer_eq_icase_ssn(b->ptr, ds->value->ptr, dlen))) {
+                    ? 0 == memcmp(b->ptr, ds->value.ptr, dlen)
+                    : buffer_eq_icase_ssn(b->ptr, ds->value.ptr, dlen))) {
                     break;
                 }
             }
@@ -1532,7 +1532,7 @@ int http_cgi_headers (server *srv, connection *con, http_cgi_opts *opts, http_cg
 
     for (n = 0; n < con->request.headers->used; n++) {
         data_string *ds = (data_string *)con->request.headers->data[n];
-        if (!buffer_string_is_empty(ds->value) && !buffer_is_empty(&ds->key)) {
+        if (!buffer_string_is_empty(&ds->value) && !buffer_is_empty(&ds->key)) {
             /* Security: Do not emit HTTP_PROXY in environment.
              * Some executables use HTTP_PROXY to configure
              * outgoing proxy.  See also https://httpoxy.org/ */
@@ -1543,7 +1543,7 @@ int http_cgi_headers (server *srv, connection *con, http_cgi_opts *opts, http_cg
             buffer_copy_string_encoded_cgi_varnames(srv->tmp_buf,
                                                     CONST_BUF_LEN(&ds->key), 1);
             rc |= cb(vdata, CONST_BUF_LEN(srv->tmp_buf),
-                            CONST_BUF_LEN(ds->value));
+                            CONST_BUF_LEN(&ds->value));
         }
     }
 
@@ -1551,11 +1551,11 @@ int http_cgi_headers (server *srv, connection *con, http_cgi_opts *opts, http_cg
 
     for (n = 0; n < con->environment->used; n++) {
         data_string *ds = (data_string *)con->environment->data[n];
-        if (!buffer_is_empty(ds->value) && !buffer_is_empty(&ds->key)) {
+        if (!buffer_is_empty(&ds->value) && !buffer_is_empty(&ds->key)) {
             buffer_copy_string_encoded_cgi_varnames(srv->tmp_buf,
                                                     CONST_BUF_LEN(&ds->key), 0);
             rc |= cb(vdata, CONST_BUF_LEN(srv->tmp_buf),
-                            CONST_BUF_LEN(ds->value));
+                            CONST_BUF_LEN(&ds->value));
         }
     }
 
diff --git a/src/http_header.c b/src/http_header.c
index 78fd89e0..b140530f 100644
--- a/src/http_header.c
+++ b/src/http_header.c
@@ -94,7 +94,7 @@ __attribute_pure__
 static inline buffer * http_header_generic_get_ifnotempty(const array * const a, const char * const k, const size_t klen) {
     data_string * const ds =
       (data_string *)array_get_element_klen(a, k, klen);
-    return ds && !buffer_string_is_empty(ds->value) ? ds->value : NULL;
+    return ds && !buffer_string_is_empty(&ds->value) ? &ds->value : NULL;
 }
 
 
diff --git a/src/mod_alias.c b/src/mod_alias.c
index 48f89367..fa928b92 100644
--- a/src/mod_alias.c
+++ b/src/mod_alias.c
@@ -184,17 +184,17 @@ PHYSICALPATH_FUNC(mod_alias_physical_handler) {
 				char *s = uri_ptr + alias_len + 1;
 				if (*s == '.') ++s;
 				if (*s == '/' || *s == '\0') {
-					size_t vlen = buffer_string_length(ds->value);
+					size_t vlen = buffer_string_length(&ds->value);
 					if (0 != alias_len && ds->key.ptr[alias_len-1] != '/'
-					    && 0 != vlen && ds->value->ptr[vlen-1] == '/') {
+					    && 0 != vlen && ds->value.ptr[vlen-1] == '/') {
 						con->http_status = 403;
 						return HANDLER_FINISHED;
 					}
 				}
 			}
 
-			buffer_copy_buffer(con->physical.basedir, ds->value);
-			buffer_copy_buffer(srv->tmp_buf, ds->value);
+			buffer_copy_buffer(con->physical.basedir, &ds->value);
+			buffer_copy_buffer(srv->tmp_buf, &ds->value);
 			buffer_append_string(srv->tmp_buf, uri_ptr + alias_len);
 			buffer_copy_buffer(con->physical.path, srv->tmp_buf);
 
diff --git a/src/mod_auth.c b/src/mod_auth.c
index 0c55323f..8787cae8 100644
--- a/src/mod_auth.c
+++ b/src/mod_auth.c
@@ -342,13 +342,13 @@ SETDEFAULTS_FUNC(mod_auth_set_defaults) {
 				if (da_file->value->data[m]->type == TYPE_STRING) {
 					data_string *ds = (data_string *)da_file->value->data[m];
 					if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("method"))) {
-						method = ds->value;
+						method = &ds->value;
 					} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("realm"))) {
-						realm = ds->value;
+						realm = &ds->value;
 					} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("require"))) {
-						require = ds->value;
+						require = &ds->value;
 					} else if (buffer_is_equal_string(&ds->key, CONST_STR_LEN("algorithm"))) {
-						algos = ds->value;
+						algos = &ds->value;
 					} else {
 						log_error_write(srv, __FILE__, __LINE__, "ssbs",
 							"the field is unknown in:",
diff --git a/src/mod_authn_pam.c b/src/mod_authn_pam.c
index 47bd1067..0ce1fb3c 100644
--- a/src/mod_authn_pam.c
+++ b/src/mod_authn_pam.c
@@ -91,7 +91,7 @@ SETDEFAULTS_FUNC(mod_authn_pam_set_defaults) {
 
         ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("service"));
-        s->service = (NULL != ds) ? ds->value->ptr : "http";
+        s->service = (NULL != ds) ? ds->value.ptr : "http";
     }
 
     if (p->config_storage[0]->service == NULL)
diff --git a/src/mod_authn_sasl.c b/src/mod_authn_sasl.c
index d19e1716..949ba481 100644
--- a/src/mod_authn_sasl.c
+++ b/src/mod_authn_sasl.c
@@ -102,11 +102,11 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
 
         ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("service"));
-        s->service = (NULL != ds) ? ds->value->ptr : "http";
+        s->service = (NULL != ds) ? ds->value.ptr : "http";
 
         ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("fqdn"));
-        if (NULL != ds) s->fqdn = ds->value->ptr;
+        if (NULL != ds) s->fqdn = ds->value.ptr;
         if (NULL == s->fqdn) {
             if (NULL == p->fqdn) {
                 struct utsname uts;
@@ -123,25 +123,27 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
         ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("pwcheck_method"));
         if (NULL != ds) {
-            s->pwcheck_method = ds->value;
-            if (!buffer_is_equal_string(ds->value, CONST_STR_LEN("saslauthd"))
-                && !buffer_is_equal_string(ds->value, CONST_STR_LEN("auxprop"))
-                && !buffer_is_equal_string(ds->value, CONST_STR_LEN("sasldb"))){
+            s->pwcheck_method = &ds->value;
+            if (!buffer_is_equal_string(&ds->value, CONST_STR_LEN("saslauthd"))
+                && !buffer_is_equal_string(&ds->value, CONST_STR_LEN("auxprop"))
+                && !buffer_is_equal_string(&ds->value, CONST_STR_LEN("sasldb"))){
                 log_error_write(srv, __FILE__, __LINE__, "sb",
                                 "sasl pwcheck_method must be one of saslauthd, "
-                                "sasldb, or auxprop, not:", ds->value);
+                                "sasldb, or auxprop, not:", &ds->value);
                 return HANDLER_ERROR;
             }
-            if (buffer_is_equal_string(ds->value, CONST_STR_LEN("sasldb"))) {
+            if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("sasldb"))) {
                 /* Cyrus libsasl2 expects "auxprop" instead of "sasldb"
                  * (mod_authn_sasl_cb_getopt auxprop_plugin returns "sasldb") */
-                buffer_copy_string_len(ds->value, CONST_STR_LEN("auxprop"));
+                buffer *pwcheck_method =
+                  array_get_buf_ptr(s->opts, CONST_STR_LEN("pwcheck_method"));
+                buffer_copy_string_len(pwcheck_method, CONST_STR_LEN("auxprop"));
             }
         }
 
         ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("sasldb_path"));
-        if (NULL != ds) s->sasldb_path = ds->value;
+        if (NULL != ds) s->sasldb_path = &ds->value;
     }
 
     return HANDLER_GO_ON;
diff --git a/src/mod_cgi.c b/src/mod_cgi.c
index a0f028e9..b7c49d05 100644
--- a/src/mod_cgi.c
+++ b/src/mod_cgi.c
@@ -230,13 +230,13 @@ SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
 						"unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )");
 					return HANDLER_ERROR;
 				}
-				if (ds->value->ptr[0] != '/') {
+				if (ds->value.ptr[0] != '/') {
 					log_error_write(srv, __FILE__, __LINE__, "SBs",
-						"cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
+						"cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", &ds->value, "\"");
 					return HANDLER_ERROR;
 				}
-				buffer_path_simplify(ds->value, ds->value);
-				buffer_append_slash(ds->value);
+				buffer_path_simplify(&ds->value, &ds->value);
+				buffer_append_slash(&ds->value);
 			}
 		}
 	}
@@ -927,7 +927,7 @@ URIHANDLER_FUNC(cgi_is_handled) {
 		handler_ctx *hctx = cgi_handler_ctx_init();
 		hctx->remote_conn = con;
 		hctx->plugin_data = p;
-		hctx->cgi_handler = ds->value;
+		hctx->cgi_handler = &ds->value;
 		memcpy(&hctx->conf, &p->conf, sizeof(plugin_config));
 		hctx->conf.upgrade =
 		  hctx->conf.upgrade
diff --git a/src/mod_cml.c b/src/mod_cml.c
index 367da6f5..ee87a8f1 100644
--- a/src/mod_cml.c
+++ b/src/mod_cml.c
@@ -123,14 +123,14 @@ SETDEFAULTS_FUNC(mod_cml_set_defaults) {
 				data_string *ds = (data_string *)s->mc_hosts->data[0];
 
 				buffer_append_string_len(option_string, CONST_STR_LEN("--SERVER="));
-				buffer_append_string_buffer(option_string, ds->value);
+				buffer_append_string_buffer(option_string, &ds->value);
 			}
 
 			for (k = 1; k < s->mc_hosts->used; k++) {
 				data_string *ds = (data_string *)s->mc_hosts->data[k];
 
 				buffer_append_string_len(option_string, CONST_STR_LEN(" --SERVER="));
-				buffer_append_string_buffer(option_string, ds->value);
+				buffer_append_string_buffer(option_string, &ds->value);
 			}
 
 			s->memc = memcached(CONST_BUF_LEN(option_string));
diff --git a/src/mod_compress.c b/src/mod_compress.c
index ee5664eb..d757d447 100644
--- a/src/mod_compress.c
+++ b/src/mod_compress.c
@@ -231,21 +231,21 @@ SETDEFAULTS_FUNC(mod_compress_setdefaults) {
 				data_string *ds = (data_string *)encodings_arr->data[j];
 #endif
 #ifdef USE_ZLIB
-				if (NULL != strstr(ds->value->ptr, "gzip"))
+				if (NULL != strstr(ds->value.ptr, "gzip"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_GZIP | HTTP_ACCEPT_ENCODING_X_GZIP;
-				if (NULL != strstr(ds->value->ptr, "x-gzip"))
+				if (NULL != strstr(ds->value.ptr, "x-gzip"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_X_GZIP;
-				if (NULL != strstr(ds->value->ptr, "deflate"))
+				if (NULL != strstr(ds->value.ptr, "deflate"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_DEFLATE;
 				/*
-				if (NULL != strstr(ds->value->ptr, "compress"))
+				if (NULL != strstr(ds->value.ptr, "compress"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_COMPRESS;
 				*/
 #endif
 #ifdef USE_BZ2LIB
-				if (NULL != strstr(ds->value->ptr, "bzip2"))
+				if (NULL != strstr(ds->value.ptr, "bzip2"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_BZIP2 | HTTP_ACCEPT_ENCODING_X_BZIP2;
-				if (NULL != strstr(ds->value->ptr, "x-bzip2"))
+				if (NULL != strstr(ds->value.ptr, "x-bzip2"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_X_BZIP2;
 #endif
 			}
@@ -874,8 +874,8 @@ PHYSICALPATH_FUNC(mod_compress_physical) {
 	for (m = 0; m < p->conf.compress->used; m++) {
 		data_string *compress_ds = (data_string *)p->conf.compress->data[m];
 
-		if (buffer_is_equal(compress_ds->value, sce->content_type)
-		    || (content_type && buffer_is_equal(compress_ds->value, content_type))) {
+		if (buffer_is_equal(&compress_ds->value, sce->content_type)
+		    || (content_type && buffer_is_equal(&compress_ds->value, content_type))) {
 			/* mimetype found */
 			buffer *vb;
 
diff --git a/src/mod_deflate.c b/src/mod_deflate.c
index 559b6c49..26119855 100644
--- a/src/mod_deflate.c
+++ b/src/mod_deflate.c
@@ -346,21 +346,21 @@ SETDEFAULTS_FUNC(mod_deflate_setdefaults) {
 				data_string *ds = (data_string *)p->encodings->data[j];
 #endif
 #ifdef USE_ZLIB
-				if (NULL != strstr(ds->value->ptr, "gzip"))
+				if (NULL != strstr(ds->value.ptr, "gzip"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_GZIP | HTTP_ACCEPT_ENCODING_X_GZIP;
-				if (NULL != strstr(ds->value->ptr, "x-gzip"))
+				if (NULL != strstr(ds->value.ptr, "x-gzip"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_X_GZIP;
-				if (NULL != strstr(ds->value->ptr, "deflate"))
+				if (NULL != strstr(ds->value.ptr, "deflate"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_DEFLATE;
 				/*
-				if (NULL != strstr(ds->value->ptr, "compress"))
+				if (NULL != strstr(ds->value.ptr, "compress"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_COMPRESS;
 				*/
 #endif
 #ifdef USE_BZ2LIB
-				if (NULL != strstr(ds->value->ptr, "bzip2"))
+				if (NULL != strstr(ds->value.ptr, "bzip2"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_BZIP2 | HTTP_ACCEPT_ENCODING_X_BZIP2;
-				if (NULL != strstr(ds->value->ptr, "x-bzip2"))
+				if (NULL != strstr(ds->value.ptr, "x-bzip2"))
 					s->allowed_encodings |= HTTP_ACCEPT_ENCODING_X_BZIP2;
 #endif
 			}
@@ -381,7 +381,7 @@ SETDEFAULTS_FUNC(mod_deflate_setdefaults) {
 		 * so ignore '*' at end of mimetype for end-user flexibility
 		 * in specifying trailing wildcard to grouping of mimetypes */
 		for (size_t m = 0; m < s->mimetypes->used; ++m) {
-			buffer *mimetype = ((data_string *)s->mimetypes->data[m])->value;
+			buffer *mimetype = &((data_string *)s->mimetypes->data[m])->value;
 			size_t len = buffer_string_length(mimetype);
 			if (len > 2 && mimetype->ptr[len-1] == '*') {
 				buffer_string_set_length(mimetype, len-1);
@@ -1140,7 +1140,7 @@ CONNECTION_FUNC(mod_deflate_handle_response_start) {
 	} else {
 		/* If no Content-Type set, compress only if first p->conf.mimetypes value is "" */
 		data_string *mimetype = (data_string *)p->conf.mimetypes->data[0];
-		if (!buffer_string_is_empty(mimetype->value)) return HANDLER_GO_ON;
+		if (!buffer_string_is_empty(&mimetype->value)) return HANDLER_GO_ON;
 	}
 
 	/* Vary: Accept-Encoding (response might change according to request Accept-Encoding) */
diff --git a/src/mod_dirlisting.c b/src/mod_dirlisting.c
index 32796644..49dd3bdf 100644
--- a/src/mod_dirlisting.c
+++ b/src/mod_dirlisting.c
@@ -304,9 +304,9 @@ SETDEFAULTS_FUNC(mod_dirlisting_set_defaults) {
 					return HANDLER_ERROR;
 				}
 
-				if (0 != excludes_buffer_append(s->excludes, ((data_string*)(du_exclude))->value)) {
+				if (0 != excludes_buffer_append(s->excludes, &((data_string*)(du_exclude))->value)) {
 					log_error_write(srv, __FILE__, __LINE__, "sb",
-						"pcre-compile failed for", ((data_string*)(du_exclude))->value);
+						"pcre-compile failed for", &((data_string*)(du_exclude))->value);
 					return HANDLER_ERROR;
 				}
 			}
diff --git a/src/mod_evhost.c b/src/mod_evhost.c
index eb2f8788..4217ee02 100644
--- a/src/mod_evhost.c
+++ b/src/mod_evhost.c
@@ -313,17 +313,17 @@ static void mod_evhost_build_doc_root_path(buffer *b, array *parsed_host, buffer
 				s[1] = ptr[2]; /*(assumes single digit before '.', and, optionally, '.' and single digit after '.')*/
 				if (NULL != (ds = (data_string *)array_get_element_klen(parsed_host, s, 2))) {
 					if (ptr[3] != '.' || ptr[4] == '0') {
-						buffer_append_string_buffer(b, ds->value);
+						buffer_append_string_buffer(b, &ds->value);
 					} else {
-						if ((size_t)(ptr[4]-'0') <= buffer_string_length(ds->value)) {
-							buffer_append_string_len(b, ds->value->ptr+(ptr[4]-'0')-1, 1);
+						if ((size_t)(ptr[4]-'0') <= buffer_string_length(&ds->value)) {
+							buffer_append_string_len(b, ds->value.ptr+(ptr[4]-'0')-1, 1);
 						}
 					}
 				} else {
 					/* unhandled %-sequence */
 				}
 			} else if (NULL != (ds = (data_string *)array_get_element_klen(parsed_host, CONST_BUF_LEN(path_pieces[i])))) {
-				buffer_append_string_buffer(b, ds->value);
+				buffer_append_string_buffer(b, &ds->value);
 			} else {
 				/* unhandled %-sequence */
 			}
diff --git a/src/mod_expire.c b/src/mod_expire.c
index 7e762956..5f494f17 100644
--- a/src/mod_expire.c
+++ b/src/mod_expire.c
@@ -255,9 +255,9 @@ SETDEFAULTS_FUNC(mod_expire_set_defaults) {
 			data_string *ds = (data_string *)s->expire_url->data[k];
 
 			/* parse lines */
-			if (-1 == mod_expire_get_offset(srv, p, ds->value, NULL)) {
+			if (-1 == mod_expire_get_offset(srv, p, &ds->value, NULL)) {
 				log_error_write(srv, __FILE__, __LINE__, "sb",
-						"parsing expire.url failed:", ds->value);
+						"parsing expire.url failed:", &ds->value);
 				return HANDLER_ERROR;
 			}
 		}
@@ -279,9 +279,9 @@ SETDEFAULTS_FUNC(mod_expire_set_defaults) {
 			if (klen && ds->key.ptr[klen-1] == '*') buffer_string_set_length(&ds->key, klen-1);
 
 			/* parse lines */
-			if (-1 == mod_expire_get_offset(srv, p, ds->value, NULL)) {
+			if (-1 == mod_expire_get_offset(srv, p, &ds->value, NULL)) {
 				log_error_write(srv, __FILE__, __LINE__, "sb",
-						"parsing expire.mimetypes failed:", ds->value);
+						"parsing expire.mimetypes failed:", &ds->value);
 				return HANDLER_ERROR;
 			}
 		}
@@ -345,7 +345,7 @@ CONNECTION_FUNC(mod_expire_handler) {
 	/* check expire.url */
 	ds = (const data_string *)array_match_key_prefix(p->conf.expire_url, con->uri.path);
 	if (NULL != ds) {
-		vb = ds->value;
+		vb = &ds->value;
 	}
 	else {
 		/* check expire.mimetypes (if no match with expire.url) */
@@ -354,7 +354,7 @@ CONNECTION_FUNC(mod_expire_handler) {
 		   ? (const data_string *)array_match_key_prefix(p->conf.expire_mimetypes, vb)
 		   : (const data_string *)array_get_element_klen(p->conf.expire_mimetypes, CONST_STR_LEN(""));
 		if (NULL == ds) return HANDLER_GO_ON;
-		vb = ds->value;
+		vb = &ds->value;
 	}
 
 	if (NULL != vb) {
diff --git a/src/mod_extforward.c b/src/mod_extforward.c
index 5c43bddd..01b64a78 100644
--- a/src/mod_extforward.c
+++ b/src/mod_extforward.c
@@ -228,18 +228,18 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 
 		if (array_get_element_klen(config->value, CONST_STR_LEN("extforward.forwarder"))) {
 			const data_string * const allds = (const data_string *)array_get_element_klen(s->forwarder, CONST_STR_LEN("all"));
-			s->forward_all = (NULL == allds) ? 0 : buffer_eq_icase_slen(allds->value, CONST_STR_LEN("trust")) ? 1 : -1;
+			s->forward_all = (NULL == allds) ? 0 : buffer_eq_icase_slen(&allds->value, CONST_STR_LEN("trust")) ? 1 : -1;
 			for (size_t j = 0; j < s->forwarder->used; ++j) {
 				data_string * const ds = (data_string *)s->forwarder->data[j];
 				char * const nm_slash = strchr(ds->key.ptr, '/');
-				if (!buffer_eq_icase_slen(ds->value, CONST_STR_LEN("trust"))) {
-					if (!buffer_eq_icase_slen(ds->value, CONST_STR_LEN("untrusted"))) {
-						log_error_write(srv, __FILE__, __LINE__, "sbsbs", "ERROR: expect \"trust\", not \"", &ds->key, "\" => \"", ds->value, "\"; treating as untrusted");
+				if (!buffer_eq_icase_slen(&ds->value, CONST_STR_LEN("trust"))) {
+					if (!buffer_eq_icase_slen(&ds->value, CONST_STR_LEN("untrusted"))) {
+						log_error_write(srv, __FILE__, __LINE__, "sbsbs", "ERROR: expect \"trust\", not \"", &ds->key, "\" => \"", &ds->value, "\"; treating as untrusted");
 					}
 					if (NULL != nm_slash) {
-						log_error_write(srv, __FILE__, __LINE__, "sbsbs", "ERROR: untrusted CIDR masks are ignored (\"", &ds->key, "\" => \"", ds->value, "\")");
+						log_error_write(srv, __FILE__, __LINE__, "sbsbs", "ERROR: untrusted CIDR masks are ignored (\"", &ds->key, "\" => \"", &ds->value, "\")");
 					}
-					buffer_clear(ds->value); /* empty is untrusted */
+					buffer_clear(&ds->value); /* empty is untrusted */
 					continue;
 				}
 				if (NULL != nm_slash) {
@@ -266,7 +266,7 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 					rc = sock_addr_from_str_numeric(srv, &sm->addr, ds->key.ptr);
 					*nm_slash = '/';
 					if (1 != rc) return HANDLER_ERROR;
-					buffer_clear(ds->value); /* empty is untrusted, e.g. if subnet (incorrectly) appears in X-Forwarded-For */
+					buffer_clear(&ds->value); /* empty is untrusted, e.g. if subnet (incorrectly) appears in X-Forwarded-For */
 				}
 			}
 		}
@@ -313,9 +313,9 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 			}
 			if (du->type == TYPE_STRING) {
 				data_string *ds = (data_string *)du;
-				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("enable"))) {
+				if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("enable"))) {
 					s->opts |= param;
-				} else if (!buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))) {
+				} else if (!buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))) {
 					log_error_write(srv, __FILE__, __LINE__, "sb",
 						        "extforward.params values must be one of: 0, 1, enable, disable; error for key:", &du->key);
 					return HANDLER_ERROR;
@@ -344,13 +344,13 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 			size_t j;
 			for (j = 0; j < srv->srvconf.modules->used; ++j) {
 				data_string *ds = (data_string *)srv->srvconf.modules->data[j];
-				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_extforward"))) {
+				if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_extforward"))) {
 					break;
 				}
 			}
 			for (; j < srv->srvconf.modules->used; ++j) {
 				data_string *ds = (data_string *)srv->srvconf.modules->data[j];
-				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_openssl"))) {
+				if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_openssl"))) {
 					log_error_write(srv, __FILE__, __LINE__, "s",
 						        "mod_extforward must be loaded after mod_openssl in server.modules when extforward.hap-PROXY = \"enable\"");
 					break;
@@ -362,7 +362,7 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 
 	for (i = 0; i < srv->srvconf.modules->used; i++) {
 		data_string *ds = (data_string *)srv->srvconf.modules->data[i];
-		if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_proxy"))) {
+		if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_proxy"))) {
 			extforward_check_proxy = 1;
 			break;
 		}
@@ -460,7 +460,7 @@ static int is_proxy_trusted(plugin_data *p, const char * const ip, size_t iplen)
 {
     const data_string *ds =
       (const data_string *)array_get_element_klen(p->conf.forwarder, ip, iplen);
-    if (NULL != ds) return !buffer_string_is_empty(ds->value);
+    if (NULL != ds) return !buffer_string_is_empty(&ds->value);
 
     if (p->conf.forward_masks) {
         const struct sock_addr_mask * const addrs =p->conf.forward_masks->addrs;
@@ -500,8 +500,8 @@ static const char *last_not_in_array(array *a, plugin_data *p)
 
 	for (i = a->used - 1; i >= 0; i--) {
 		data_string *ds = (data_string *)a->data[i];
-		if (!is_proxy_trusted(p, CONST_BUF_LEN(ds->value))) {
-			return ds->value->ptr;
+		if (!is_proxy_trusted(p, CONST_BUF_LEN(&ds->value))) {
+			return ds->value.ptr;
 		}
 	}
 	return NULL;
@@ -1025,7 +1025,7 @@ URIHANDLER_FUNC(mod_extforward_uri_handler) {
 					    CONST_STR_LEN("SUCCESS"));
 			http_header_env_set(con,
 					    CONST_STR_LEN("REMOTE_USER"),
-					    CONST_BUF_LEN(ds->value));
+					    CONST_BUF_LEN(&ds->value));
 			http_header_env_set(con,
 					    CONST_STR_LEN("AUTH_TYPE"),
 					    CONST_STR_LEN("SSL_CLIENT_VERIFY"));
@@ -1037,7 +1037,7 @@ URIHANDLER_FUNC(mod_extforward_uri_handler) {
 	}
 
 	for (size_t k = 0; k < p->conf.headers->used && NULL == forwarded; ++k) {
-		buffer *hdr = ((data_string *)p->conf.headers->data[k])->value;
+		buffer *hdr = &((data_string *)p->conf.headers->data[k])->value;
 		forwarded = http_header_request_get(con, HTTP_HEADER_UNSPECIFIED, CONST_BUF_LEN(hdr));
 		if (forwarded) {
 			is_forwarded_header = buffer_is_equal_caseless_string(hdr, CONST_STR_LEN("Forwarded"));
@@ -1080,7 +1080,7 @@ CONNECTION_FUNC(mod_extforward_handle_request_env) {
          * (when mod_extforward is listed after mod_openssl in server.modules)*/
         data_string *ds = (data_string *)hctx->env->data[i];
         http_header_env_set(con,
-                            CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+                            CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
     }
     return HANDLER_GO_ON;
 }
diff --git a/src/mod_indexfile.c b/src/mod_indexfile.c
index 34fb8a07..eb0095bb 100644
--- a/src/mod_indexfile.c
+++ b/src/mod_indexfile.c
@@ -164,14 +164,14 @@ URIHANDLER_FUNC(mod_indexfile_subrequest) {
 	for (k = 0; k < p->conf.indexfiles->used; k++) {
 		data_string *ds = (data_string *)p->conf.indexfiles->data[k];
 
-		if (ds->value && ds->value->ptr[0] == '/') {
+		if (ds->value.ptr[0] == '/') {
 			/* if the index-file starts with a prefix as use this file as
 			 * index-generator */
 			buffer_copy_buffer(p->tmp_buf, con->physical.doc_root);
 		} else {
 			buffer_copy_buffer(p->tmp_buf, con->physical.path);
 		}
-		buffer_append_string_buffer(p->tmp_buf, ds->value);
+		buffer_append_string_buffer(p->tmp_buf, &ds->value);
 
 		if (HANDLER_ERROR == stat_cache_get_entry(srv, con, p->tmp_buf, &sce)) {
 			if (errno == EACCES) {
@@ -199,13 +199,13 @@ URIHANDLER_FUNC(mod_indexfile_subrequest) {
 			continue;
 		}
 
-		if (ds->value && ds->value->ptr[0] == '/') {
+		if (ds->value.ptr[0] == '/') {
 			/* replace uri.path */
-			buffer_copy_buffer(con->uri.path, ds->value);
+			buffer_copy_buffer(con->uri.path, &ds->value);
 			http_header_env_set(con, CONST_STR_LEN("PATH_TRANSLATED_DIRINDEX"), CONST_BUF_LEN(con->physical.path));
 		} else {
 			/* append to uri.path the relative path to index file (/ -> /index.php) */
-			buffer_append_string_buffer(con->uri.path, ds->value);
+			buffer_append_string_buffer(con->uri.path, &ds->value);
 		}
 
 		buffer_copy_buffer(con->physical.path, p->tmp_buf);
diff --git a/src/mod_magnet.c b/src/mod_magnet.c
index 5aae757a..fb50bf7c 100644
--- a/src/mod_magnet.c
+++ b/src/mod_magnet.c
@@ -236,7 +236,7 @@ static int magnet_array_get_element(lua_State *L, const array *a) {
     const char * const k = luaL_checklstring(L, 2, &klen);
     const data_string * const ds = (const data_string *)
       array_get_element_klen(a, k, klen);
-    magnet_push_buffer(L, NULL != ds ? ds->value : NULL);
+    magnet_push_buffer(L, NULL != ds ? &ds->value : NULL);
     return 1;
 }
 #endif
@@ -258,7 +258,7 @@ static int magnet_array_next(lua_State *L) {
 		switch (du->type) {
 			case TYPE_STRING:
 				ds = (data_string *)du;
-				magnet_push_buffer(L, ds->value);
+				magnet_push_buffer(L, &ds->value);
 				break;
 			case TYPE_INTEGER:
 				di = (data_integer *)du;
@@ -1064,9 +1064,9 @@ static handler_t magnet_attract_array(server *srv, connection *con, plugin_data
 	for (i = 0; i < files->used && ret == HANDLER_GO_ON; i++) {
 		data_string *ds = (data_string *)files->data[i];
 
-		if (buffer_string_is_empty(ds->value)) continue;
+		if (buffer_string_is_empty(&ds->value)) continue;
 
-		ret = magnet_attract(srv, con, p, ds->value);
+		ret = magnet_attract(srv, con, p, &ds->value);
 	}
 
 	if (con->error_handler_saved_status) {
diff --git a/src/mod_maxminddb.c b/src/mod_maxminddb.c
index dbb92e7a..d5e477e1 100644
--- a/src/mod_maxminddb.c
+++ b/src/mod_maxminddb.c
@@ -204,7 +204,7 @@ SETDEFAULTS_FUNC(mod_maxmind_set_defaults)
                               "maxminddb.env must be a list of strings");
                     return HANDLER_ERROR;
                 }
-                buffer *value = data[j]->value;
+                buffer *value = &data[j]->value;
                 if (buffer_string_is_empty(value)
                     || '/' == value->ptr[0]
                     || '/' == value->ptr[buffer_string_length(value)-1]) {
@@ -384,7 +384,7 @@ CONNECTION_FUNC(mod_maxmind_request_env_handler)
          * (when mod_extforward is listed after mod_openssl in server.modules)*/
         data_string *ds = (data_string *)env->data[i];
         http_header_env_set(con,
-                            CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+                            CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
     }
 
     return HANDLER_GO_ON;
diff --git a/src/mod_openssl.c b/src/mod_openssl.c
index 7e122a3d..d1746388 100644
--- a/src/mod_openssl.c
+++ b/src/mod_openssl.c
@@ -737,16 +737,18 @@ network_openssl_ssl_conf_cmd (server *srv, plugin_config *s)
       array_get_element_klen(s->ssl_conf_cmd,
                              CONST_STR_LEN("CipherString"));
     if (NULL != ds) {
-        buffer_append_string_len(ds->value,
+        buffer *cipher_string =
+          array_get_buf_ptr(s->ssl_conf_cmd, CONST_STR_LEN("CipherString"));
+        buffer_append_string_len(cipher_string,
                                  CONST_STR_LEN(":!aNULL:!eNULL:!EXP"));
     }
 
     for (size_t i = 0; i < s->ssl_conf_cmd->used; ++i) {
         ds = (data_string *)s->ssl_conf_cmd->data[i];
         ERR_clear_error();
-        if (SSL_CONF_cmd(cctx, ds->key.ptr, ds->value->ptr) <= 0) {
+        if (SSL_CONF_cmd(cctx, ds->key.ptr, ds->value.ptr) <= 0) {
             log_error_write(srv, __FILE__, __LINE__, "ssbbss", "SSL:",
-                            "SSL_CONF_cmd", &ds->key, ds->value, ":",
+                            "SSL_CONF_cmd", &ds->key, &ds->value, ":",
                             ERR_error_string(ERR_get_error(), NULL));
             rc = -1;
             break;
diff --git a/src/mod_proxy.c b/src/mod_proxy.c
index 682fd743..ae05c915 100644
--- a/src/mod_proxy.c
+++ b/src/mod_proxy.c
@@ -195,9 +195,9 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 			}
 			if (du->type == TYPE_STRING) {
 				data_string *ds = (data_string *)du;
-				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("enable"))) {
+				if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("enable"))) {
 					s->forwarded |= param;
-				} else if (!buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))) {
+				} else if (!buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))) {
 					log_error_write(srv, __FILE__, __LINE__, "sb",
 						        "proxy.forwarded values must be one of: 0, 1, enable, disable; error for key:", &du->key);
 					return HANDLER_ERROR;
@@ -226,8 +226,8 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 							"unexpected value for proxy.header; expected \"enable\" or \"disable\" for https-remap");
 					return HANDLER_ERROR;
 				}
-				s->header.https_remap = !buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))
-						     && !buffer_is_equal_string(ds->value, CONST_STR_LEN("0"));
+				s->header.https_remap = !buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))
+						     && !buffer_is_equal_string(&ds->value, CONST_STR_LEN("0"));
 				continue;
 			}
 			else if (buffer_is_equal_string(&da->key, CONST_STR_LEN("upgrade"))) {
@@ -237,8 +237,8 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 							"unexpected value for proxy.header; expected \"upgrade\" => \"enable\" or \"disable\"");
 					return HANDLER_ERROR;
 				}
-				s->header.upgrade = !buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))
-						 && !buffer_is_equal_string(ds->value, CONST_STR_LEN("0"));
+				s->header.upgrade = !buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))
+						 && !buffer_is_equal_string(&ds->value, CONST_STR_LEN("0"));
 				continue;
 			}
 			else if (buffer_is_equal_string(&da->key, CONST_STR_LEN("connect"))) {
@@ -248,8 +248,8 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 							"unexpected value for proxy.header; expected \"connect\" => \"enable\" or \"disable\"");
 					return HANDLER_ERROR;
 				}
-				s->header.connect_method = !buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))
-							&& !buffer_is_equal_string(ds->value, CONST_STR_LEN("0"));
+				s->header.connect_method = !buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))
+							&& !buffer_is_equal_string(&ds->value, CONST_STR_LEN("0"));
 				continue;
 			}
 			if (da->type != TYPE_ARRAY || !array_is_kvstring(da->value)) {
@@ -276,7 +276,7 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 
 	for (i = 0; i < srv->srvconf.modules->used; i++) {
 		data_string *ds = (data_string *)srv->srvconf.modules->data[i];
-		if (buffer_is_equal_string(ds->value, CONST_STR_LEN("mod_extforward"))) {
+		if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("mod_extforward"))) {
 			proxy_check_extforward = 1;
 			break;
 		}
@@ -310,14 +310,14 @@ static const buffer * http_header_remap_host_match (buffer *b, size_t off, http_
                 mlen = buffer_string_length(k);
             }
             if (buffer_eq_icase_ss(s, alen, k->ptr, mlen)) {
-                if (buffer_is_equal_string(ds->value, CONST_STR_LEN("-"))) {
+                if (buffer_is_equal_string(&ds->value, CONST_STR_LEN("-"))) {
                     return remap_hdrs->http_host;
                 }
-                else if (!buffer_string_is_empty(ds->value)) {
+                else if (!buffer_string_is_empty(&ds->value)) {
                     /*(save first matched request host for response match)*/
                     if (is_req && NULL == remap_hdrs->forwarded_host)
-                        remap_hdrs->forwarded_host = ds->value;
-                    return ds->value;
+                        remap_hdrs->forwarded_host = &ds->value;
+                    return &ds->value;
                 } /*(else leave authority as-is and stop matching)*/
                 break;
             }
@@ -353,24 +353,24 @@ static size_t http_header_remap_urlpath (buffer *b, size_t off, http_header_rema
                 if (mlen <= plen && 0 == memcmp(s, ds->key.ptr, mlen)) {
                     if (NULL == remap_hdrs->forwarded_urlpath)
                         remap_hdrs->forwarded_urlpath = ds;
-                    buffer_substr_replace(b, off, mlen, ds->value);
-                    return buffer_string_length(ds->value);/*(replacement len)*/
+                    buffer_substr_replace(b, off, mlen, &ds->value);
+                    return buffer_string_length(&ds->value);/*(replacement len)*/
                 }
             }
         }
         else {        /* response; perform reverse map */
             if (NULL != remap_hdrs->forwarded_urlpath) {
                 const data_string * const ds = remap_hdrs->forwarded_urlpath;
-                const size_t mlen = buffer_string_length(ds->value);
-                if (mlen <= plen && 0 == memcmp(s, ds->value->ptr, mlen)) {
+                const size_t mlen = buffer_string_length(&ds->value);
+                if (mlen <= plen && 0 == memcmp(s, ds->value.ptr, mlen)) {
                     buffer_substr_replace(b, off, mlen, &ds->key);
                     return buffer_string_length(&ds->key); /*(replacement len)*/
                 }
             }
             for (size_t i = 0, used = urlpaths->used; i < used; ++i) {
                 const data_string * const ds = (data_string *)urlpaths->data[i];
-                const size_t mlen = buffer_string_length(ds->value);
-                if (mlen <= plen && 0 == memcmp(s, ds->value->ptr, mlen)) {
+                const size_t mlen = buffer_string_length(&ds->value);
+                if (mlen <= plen && 0 == memcmp(s, ds->value.ptr, mlen)) {
                     buffer_substr_replace(b, off, mlen, &ds->key);
                     return buffer_string_length(&ds->key); /*(replacement len)*/
                 }
@@ -794,7 +794,7 @@ static handler_t proxy_create_env(server *srv, gw_handler_ctx *gwhctx) {
 			continue;
 		}
 
-		vlen = buffer_string_length(ds->value);
+		vlen = buffer_string_length(&ds->value);
 		if (0 == vlen) continue;
 
 		if (buffer_string_space(b) < klen + vlen + 4) {
@@ -805,7 +805,7 @@ static handler_t proxy_create_env(server *srv, gw_handler_ctx *gwhctx) {
 
 		buffer_append_string_len(b, ds->key.ptr, klen);
 		buffer_append_string_len(b, CONST_STR_LEN(": "));
-		buffer_append_string_len(b, ds->value->ptr, vlen);
+		buffer_append_string_len(b, ds->value.ptr, vlen);
 		buffer_append_string_len(b, CONST_STR_LEN("\r\n"));
 
 		if (!remap_headers) continue;
diff --git a/src/mod_redirect.c b/src/mod_redirect.c
index 0e37aab2..d8dd479f 100644
--- a/src/mod_redirect.c
+++ b/src/mod_redirect.c
@@ -101,9 +101,9 @@ SETDEFAULTS_FUNC(mod_redirect_set_defaults) {
 			data_string *ds = (data_string *)da->value->data[j];
 			if (srv->srvconf.http_url_normalize) {
 				pcre_keyvalue_burl_normalize_key(&ds->key, srv->tmp_buf);
-				pcre_keyvalue_burl_normalize_value(ds->value, srv->tmp_buf);
+				pcre_keyvalue_burl_normalize_value(&ds->value, srv->tmp_buf);
 			}
-			if (0 != pcre_keyvalue_buffer_append(srv, s->redirect, &ds->key, ds->value)) {
+			if (0 != pcre_keyvalue_buffer_append(srv, s->redirect, &ds->key, &ds->value)) {
 				log_error_write(srv, __FILE__, __LINE__, "sb",
 						"pcre-compile failed for", &ds->key);
 				return HANDLER_ERROR;
diff --git a/src/mod_rewrite.c b/src/mod_rewrite.c
index a4f8e473..eba398d0 100644
--- a/src/mod_rewrite.c
+++ b/src/mod_rewrite.c
@@ -86,9 +86,9 @@ static int parse_config_entry(server *srv, array *ca, pcre_keyvalue_buffer *kvb,
 			data_string *ds = (data_string *)da->value->data[j];
 			if (srv->srvconf.http_url_normalize) {
 				pcre_keyvalue_burl_normalize_key(&ds->key, srv->tmp_buf);
-				pcre_keyvalue_burl_normalize_value(ds->value, srv->tmp_buf);
+				pcre_keyvalue_burl_normalize_value(&ds->value, srv->tmp_buf);
 			}
-			if (0 != pcre_keyvalue_buffer_append(srv, kvb, &ds->key, ds->value)) {
+			if (0 != pcre_keyvalue_buffer_append(srv, kvb, &ds->key, &ds->value)) {
 				log_error_write(srv, __FILE__, __LINE__, "sb",
 						"pcre-compile failed for", &ds->key);
 				return HANDLER_ERROR;
diff --git a/src/mod_scgi.c b/src/mod_scgi.c
index eeca1f55..80aa682d 100644
--- a/src/mod_scgi.c
+++ b/src/mod_scgi.c
@@ -75,10 +75,10 @@ SETDEFAULTS_FUNC(mod_scgi_set_defaults) {
 		if (NULL != (du = array_get_element_klen(config->value, CONST_STR_LEN("scgi.protocol")))) {
 			const data_string *ds = (const data_string *)du;
 			if (du->type == TYPE_STRING
-			    && buffer_is_equal_string(ds->value, CONST_STR_LEN("scgi"))) {
+			    && buffer_is_equal_string(&ds->value, CONST_STR_LEN("scgi"))) {
 				s->proto = LI_PROTOCOL_SCGI;
 			} else if (du->type == TYPE_STRING
-			           && buffer_is_equal_string(ds->value, CONST_STR_LEN("uwsgi"))) {
+			           && buffer_is_equal_string(&ds->value, CONST_STR_LEN("uwsgi"))) {
 				s->proto = LI_PROTOCOL_UWSGI;
 			} else {
 				log_error_write(srv, __FILE__, __LINE__, "sss",
diff --git a/src/mod_setenv.c b/src/mod_setenv.c
index b4bbdb84..6f5c6528 100644
--- a/src/mod_setenv.c
+++ b/src/mod_setenv.c
@@ -221,14 +221,14 @@ URIHANDLER_FUNC(mod_setenv_uri_handler) {
 	for (k = 0; k < p->conf.request_header->used; k++) {
 		data_string *ds = (data_string *)p->conf.request_header->data[k];
 		enum http_header_e id = http_header_hkey_get(CONST_BUF_LEN(&ds->key));
-		http_header_request_append(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+		http_header_request_append(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
 	}
 
 	for (k = 0; k < hctx->conf.set_request_header->used; ++k) {
 		data_string *ds = (data_string *)hctx->conf.set_request_header->data[k];
 		enum http_header_e id = http_header_hkey_get(CONST_BUF_LEN(&ds->key));
-		!buffer_string_is_empty(ds->value)
-		  ? http_header_request_set(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value))
+		!buffer_string_is_empty(&ds->value)
+		  ? http_header_request_set(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value))
 		  : http_header_request_unset(con, id, CONST_BUF_LEN(&ds->key));
 	}
 
@@ -245,12 +245,12 @@ CONNECTION_FUNC(mod_setenv_handle_request_env) {
 
 	for (size_t k = 0; k < hctx->conf.environment->used; ++k) {
 		data_string *ds = (data_string *)hctx->conf.environment->data[k];
-		http_header_env_append(con, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+		http_header_env_append(con, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
 	}
 
 	for (size_t k = 0; k < hctx->conf.set_environment->used; ++k) {
 		data_string *ds = (data_string *)hctx->conf.set_environment->data[k];
-		http_header_env_set(con, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+		http_header_env_set(con, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
 	}
 
 	return HANDLER_GO_ON;
@@ -265,14 +265,14 @@ CONNECTION_FUNC(mod_setenv_handle_response_start) {
 	for (size_t k = 0; k < hctx->conf.response_header->used; ++k) {
 		data_string *ds = (data_string *)hctx->conf.response_header->data[k];
 		enum http_header_e id = http_header_hkey_get(CONST_BUF_LEN(&ds->key));
-		http_header_response_insert(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value));
+		http_header_response_insert(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value));
 	}
 
 	for (size_t k = 0; k < hctx->conf.set_response_header->used; ++k) {
 		data_string *ds = (data_string *)hctx->conf.set_response_header->data[k];
 		enum http_header_e id = http_header_hkey_get(CONST_BUF_LEN(&ds->key));
-		!buffer_string_is_empty(ds->value)
-		  ? http_header_response_set(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(ds->value))
+		!buffer_string_is_empty(&ds->value)
+		  ? http_header_response_set(con, id, CONST_BUF_LEN(&ds->key), CONST_BUF_LEN(&ds->value))
 		  : http_header_response_unset(con, id, CONST_BUF_LEN(&ds->key));
 	}
 
diff --git a/src/mod_ssi.c b/src/mod_ssi.c
index f568ff9a..83975b6e 100644
--- a/src/mod_ssi.c
+++ b/src/mod_ssi.c
@@ -455,7 +455,7 @@ static int process_ssi_stmt(server *srv, connection *con, handler_ctx *p, const
 
 			if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_cgi_env, var_val, strlen(var_val))) ||
 			    NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_vars, var_val, strlen(var_val)))) {
-				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(ds->value));
+				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(&ds->value));
 			} else {
 				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
 			}
@@ -746,7 +746,7 @@ static int process_ssi_stmt(server *srv, connection *con, handler_ctx *p, const
 
 			buffer_append_string_buffer(b, &ds->key);
 			buffer_append_string_len(b, CONST_STR_LEN("="));
-			buffer_append_string_encoded(b, CONST_BUF_LEN(ds->value), ENCODING_MINIMAL_XML);
+			buffer_append_string_encoded(b, CONST_BUF_LEN(&ds->value), ENCODING_MINIMAL_XML);
 			buffer_append_string_len(b, CONST_STR_LEN("\n"));
 		}
 		for (i = 0; i < p->ssi_cgi_env->used; i++) {
@@ -754,7 +754,7 @@ static int process_ssi_stmt(server *srv, connection *con, handler_ctx *p, const
 
 			buffer_append_string_buffer(b, &ds->key);
 			buffer_append_string_len(b, CONST_STR_LEN("="));
-			buffer_append_string_encoded(b, CONST_BUF_LEN(ds->value), ENCODING_MINIMAL_XML);
+			buffer_append_string_encoded(b, CONST_BUF_LEN(&ds->value), ENCODING_MINIMAL_XML);
 			buffer_append_string_len(b, CONST_STR_LEN("\n"));
 		}
 		chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(b));
diff --git a/src/mod_ssi_expr.c b/src/mod_ssi_expr.c
index 6dd51577..0c7f4e72 100644
--- a/src/mod_ssi_expr.c
+++ b/src/mod_ssi_expr.c
@@ -220,9 +220,9 @@ static int ssi_expr_tokenizer(server *srv, connection *con, handler_ctx *p,
 			tid = TK_VALUE;
 
 			if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_cgi_env, CONST_BUF_LEN(token)))) {
-				buffer_copy_buffer(token, ds->value);
+				buffer_copy_buffer(token, &ds->value);
 			} else if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_vars, CONST_BUF_LEN(token)))) {
-				buffer_copy_buffer(token, ds->value);
+				buffer_copy_buffer(token, &ds->value);
 			} else {
 				buffer_copy_string_len(token, CONST_STR_LEN(""));
 			}
diff --git a/src/mod_trigger_b4_dl.c b/src/mod_trigger_b4_dl.c
index deebae46..a3f992fe 100644
--- a/src/mod_trigger_b4_dl.c
+++ b/src/mod_trigger_b4_dl.c
@@ -226,14 +226,14 @@ SETDEFAULTS_FUNC(mod_trigger_b4_dl_set_defaults) {
 				data_string *ds = (data_string *)s->mc_hosts->data[0];
 
 				buffer_append_string_len(option_string, CONST_STR_LEN("--SERVER="));
-				buffer_append_string_buffer(option_string, ds->value);
+				buffer_append_string_buffer(option_string, &ds->value);
 			}
 
 			for (k = 1; k < s->mc_hosts->used; k++) {
 				data_string *ds = (data_string *)s->mc_hosts->data[k];
 
 				buffer_append_string_len(option_string, CONST_STR_LEN(" --SERVER="));
-				buffer_append_string_buffer(option_string, ds->value);
+				buffer_append_string_buffer(option_string, &ds->value);
 			}
 
 			s->memc = memcached(CONST_BUF_LEN(option_string));
diff --git a/src/mod_userdir.c b/src/mod_userdir.c
index 72131e74..097d2315 100644
--- a/src/mod_userdir.c
+++ b/src/mod_userdir.c
@@ -240,7 +240,7 @@ URIHANDLER_FUNC(mod_userdir_docroot_handler) {
 	for (k = 0; k < p->conf.exclude_user->used; k++) {
 		data_string *ds = (data_string *)p->conf.exclude_user->data[k];
 
-		if (buffer_is_equal(ds->value, p->username)) {
+		if (buffer_is_equal(&ds->value, p->username)) {
 			/* user in exclude list */
 			return HANDLER_GO_ON;
 		}
@@ -251,7 +251,7 @@ URIHANDLER_FUNC(mod_userdir_docroot_handler) {
 		for (k = 0; k < p->conf.include_user->used; k++) {
 			data_string *ds = (data_string *)p->conf.include_user->data[k];
 
-			if (buffer_is_equal(ds->value, p->username)) {
+			if (buffer_is_equal(&ds->value, p->username)) {
 				/* user in include list */
 				found_user = 1;
 				break;
diff --git a/src/mod_vhostdb_dbi.c b/src/mod_vhostdb_dbi.c
index aae4f2b0..d7f04a18 100644
--- a/src/mod_vhostdb_dbi.c
+++ b/src/mod_vhostdb_dbi.c
@@ -24,7 +24,7 @@
 typedef struct {
     dbi_conn dbconn;
     dbi_inst dbinst;
-    buffer *sqlquery;
+    const buffer *sqlquery;
     server *srv;
     short reconnect_count;
 } vhostdb_config;
@@ -70,18 +70,18 @@ static void mod_vhostdb_dbconf_free (void *vdata)
 
 static int mod_vhostdb_dbconf_setup (server *srv, array *opts, void **vdata)
 {
-    buffer *sqlquery = NULL;
+    const buffer *sqlquery = NULL;
     const buffer *dbtype=NULL, *dbname=NULL;
 
     for (size_t i = 0; i < opts->used; ++i) {
         const data_string *ds = (data_string *)opts->data[i];
         if (ds->type == TYPE_STRING) {
             if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("sql"))) {
-                sqlquery = ds->value;
+                sqlquery = &ds->value;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("dbname"))) {
-                dbname = ds->value;
+                dbname = &ds->value;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("dbtype"))) {
-                dbtype = ds->value;
+                dbtype = &ds->value;
             }
         }
     }
@@ -131,8 +131,8 @@ static int mod_vhostdb_dbconf_setup (server *srv, array *opts, void **vdata)
                     dbi_conn_set_option_numeric(dbconn, opt->ptr, di->value);
                 } else if (du->type == TYPE_STRING) {
                     data_string *ds = (data_string *)du;
-                    if (ds->value != sqlquery && ds->value != dbtype) {
-                        dbi_conn_set_option(dbconn, opt->ptr, ds->value->ptr);
+                    if (&ds->value != sqlquery && &ds->value != dbtype) {
+                        dbi_conn_set_option(dbconn, opt->ptr, ds->value.ptr);
                     }
                 }
             }
diff --git a/src/mod_vhostdb_ldap.c b/src/mod_vhostdb_ldap.c
index db8b828a..e2f55af8 100644
--- a/src/mod_vhostdb_ldap.c
+++ b/src/mod_vhostdb_ldap.c
@@ -17,7 +17,7 @@
 
 typedef struct {
     LDAP *ldap;
-    buffer *filter;
+    const buffer *filter;
     server *srv;
 
     const char *attr;
@@ -83,32 +83,32 @@ static void mod_vhostdb_dbconf_add_scheme (server *srv, buffer *host)
 
 static int mod_vhostdb_dbconf_setup (server *srv, array *opts, void **vdata)
 {
-    buffer *filter = NULL;
+    const buffer *filter = NULL;
     const char *attr = "documentRoot";
     const char *basedn=NULL,*binddn=NULL,*bindpw=NULL,*host=NULL,*cafile=NULL;
     unsigned short starttls = 0;
 
     for (size_t i = 0; i < opts->used; ++i) {
-        const data_string *ds = (data_string *)opts->data[i];
+        data_string *ds = (data_string *)opts->data[i];
         if (ds->type == TYPE_STRING) {
             if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("filter"))) {
-                filter = ds->value;
+                filter = &ds->value;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("attr"))) {
-                if (!buffer_string_is_empty(ds->value)) attr   = ds->value->ptr;
+                if (!buffer_string_is_empty(&ds->value)) attr   = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("host"))) {
-                mod_vhostdb_dbconf_add_scheme(srv, ds->value);
-                host   = ds->value->ptr;
+                mod_vhostdb_dbconf_add_scheme(srv, &ds->value);
+                host   = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("base-dn"))) {
-                if (!buffer_string_is_empty(ds->value)) basedn = ds->value->ptr;
+                if (!buffer_string_is_empty(&ds->value)) basedn = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("bind-dn"))) {
-                if (!buffer_string_is_empty(ds->value)) binddn = ds->value->ptr;
+                if (!buffer_string_is_empty(&ds->value)) binddn = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("bind-pw"))) {
-                bindpw = ds->value->ptr;
+                bindpw = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("ca-file"))) {
-                if (!buffer_string_is_empty(ds->value)) cafile = ds->value->ptr;
+                if (!buffer_string_is_empty(&ds->value)) cafile = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("starttls"))) {
-                starttls = !buffer_is_equal_string(ds->value, CONST_STR_LEN("disable"))
-                        && !buffer_is_equal_string(ds->value, CONST_STR_LEN("0"));
+                starttls = !buffer_is_equal_string(&ds->value, CONST_STR_LEN("disable"))
+                        && !buffer_is_equal_string(&ds->value, CONST_STR_LEN("0"));
             }
         }
     }
@@ -380,7 +380,7 @@ static int mod_vhostdb_ldap_query(server *srv, connection *con, void *p_d, buffe
     struct berval **vals;
     int count;
     char *basedn;
-    buffer *template;
+    const buffer *template;
 
     /*(reuse buffer for ldap query before generating docroot result)*/
     buffer *filter = docroot;
diff --git a/src/mod_vhostdb_mysql.c b/src/mod_vhostdb_mysql.c
index cc97ed52..7111e1b8 100644
--- a/src/mod_vhostdb_mysql.c
+++ b/src/mod_vhostdb_mysql.c
@@ -17,7 +17,7 @@
 
 typedef struct {
     MYSQL *dbconn;
-    buffer *sqlquery;
+    const buffer *sqlquery;
 } vhostdb_config;
 
 typedef struct {
@@ -41,27 +41,27 @@ static void mod_vhostdb_dbconf_free (void *vdata)
 
 static int mod_vhostdb_dbconf_setup (server *srv, array *opts, void **vdata)
 {
-    buffer *sqlquery = NULL;
+    const buffer *sqlquery = NULL;
     const char *dbname=NULL, *user=NULL, *pass=NULL, *host=NULL, *sock=NULL;
     unsigned int port = 0;
 
     for (size_t i = 0; i < opts->used; ++i) {
         const data_string *ds = (data_string *)opts->data[i];
-        if (ds->type == TYPE_STRING && !buffer_string_is_empty(ds->value)) {
+        if (ds->type == TYPE_STRING && !buffer_string_is_empty(&ds->value)) {
             if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("sql"))) {
-                sqlquery = ds->value;
+                sqlquery = &ds->value;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("dbname"))) {
-                dbname = ds->value->ptr;
+                dbname = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("user"))) {
-                user = ds->value->ptr;
+                user = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("password"))) {
-                pass = ds->value->ptr;
+                pass = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("host"))) {
-                host = ds->value->ptr;
+                host = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("port"))) {
-                port = strtoul(ds->value->ptr, NULL, 10);
+                port = strtoul(ds->value.ptr, NULL, 10);
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("sock"))) {
-                sock = ds->value->ptr;
+                sock = ds->value.ptr;
             }
         }
     }
diff --git a/src/mod_vhostdb_pgsql.c b/src/mod_vhostdb_pgsql.c
index a595a363..da0dbc11 100644
--- a/src/mod_vhostdb_pgsql.c
+++ b/src/mod_vhostdb_pgsql.c
@@ -16,7 +16,7 @@
 
 typedef struct {
     PGconn *dbconn;
-    buffer *sqlquery;
+    const buffer *sqlquery;
 } vhostdb_config;
 
 typedef struct {
@@ -40,24 +40,24 @@ static void mod_vhostdb_dbconf_free (void *vdata)
 
 static int mod_vhostdb_dbconf_setup (server *srv, array *opts, void **vdata)
 {
-    buffer *sqlquery = NULL;
+    const buffer *sqlquery = NULL;
     const char *dbname=NULL, *user=NULL, *pass=NULL, *host=NULL, *port=NULL;
 
     for (size_t i = 0; i < opts->used; ++i) {
         const data_string *ds = (data_string *)opts->data[i];
         if (ds->type == TYPE_STRING) {
             if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("sql"))) {
-                sqlquery = ds->value;
+                sqlquery = &ds->value;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("dbname"))) {
-                dbname = ds->value->ptr;
+                dbname = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("user"))) {
-                user = ds->value->ptr;
+                user = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("password"))) {
-                pass = ds->value->ptr;
+                pass = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("host"))) {
-                host = ds->value->ptr;
+                host = ds->value.ptr;
             } else if (buffer_is_equal_caseless_string(&ds->key, CONST_STR_LEN("port"))) {
-                port = ds->value->ptr;
+                port = ds->value.ptr;
             }
         }
     }
diff --git a/src/mod_webdav.c b/src/mod_webdav.c
index aa7c7ecb..4e40a3c7 100644
--- a/src/mod_webdav.c
+++ b/src/mod_webdav.c
@@ -449,7 +449,7 @@ SETDEFAULTS_FUNC(mod_webdav_set_defaults) {
             data_string *ds = (data_string *)s->opts->data[j];
             if (buffer_is_equal_string(&ds->key,
                   CONST_STR_LEN("deprecated-unsafe-partial-put"))
-                && buffer_is_equal_string(ds->value, CONST_STR_LEN("enable"))) {
+                && buffer_is_equal_string(&ds->value, CONST_STR_LEN("enable"))) {
                 s->deprecated_unsafe_partial_put_compat = 1;
                 continue;
             }
@@ -562,11 +562,22 @@ URIHANDLER_FUNC(mod_webdav_uri_handler)
 
 #ifdef USE_LOCKS
 
+typedef struct webdav_lockdata_wr {
+  buffer locktoken;
+  buffer lockroot;
+  buffer ownerinfo;
+  buffer *owner;           /* NB: caller must provide writable storage */
+  const buffer *lockscope; /* future: might use enum, store int in db */
+  const buffer *locktype;  /* future: might use enum, store int in db */
+  int depth;
+  int timeout;           /* offset from now, not absolute time_t */
+} webdav_lockdata_wr;
+
 typedef struct webdav_lockdata {
   buffer locktoken;
   buffer lockroot;
   buffer ownerinfo;
-  buffer *owner;
+  const buffer *owner;
   const buffer *lockscope; /* future: might use enum, store int in db */
   const buffer *locktype;  /* future: might use enum, store int in db */
   int depth;
@@ -1384,7 +1395,7 @@ webdav_lock_match (const plugin_config * const pconf,
 #ifdef USE_LOCKS
 static void
 webdav_lock_activelocks_lockdata (sqlite3_stmt * const stmt,
-                                  webdav_lockdata * const lockdata)
+                                  webdav_lockdata_wr * const lockdata)
 {
     lockdata->locktoken.ptr  = (char *)sqlite3_column_text(stmt, 0);
     lockdata->locktoken.used = sqlite3_column_bytes(stmt, 0);
@@ -1444,7 +1455,7 @@ webdav_lock_activelocks (const plugin_config * const pconf,
         if (0 != expand_checks && -1 == sqlite3_column_int(stmt, 6) /*depth*/)
             continue;
 
-        webdav_lock_activelocks_lockdata(stmt, &lockdata);
+        webdav_lock_activelocks_lockdata(stmt, (webdav_lockdata_wr *)&lockdata);
         if (lockdata.timeout > 0)
             lock_cb(vdata, &lockdata);
     }
@@ -1461,7 +1472,7 @@ webdav_lock_activelocks (const plugin_config * const pconf,
     sqlite3_bind_text(stmt, 1, CONST_BUF_LEN(uri), SQLITE_STATIC);
 
     while (SQLITE_ROW == sqlite3_step(stmt)) {
-        webdav_lock_activelocks_lockdata(stmt, &lockdata);
+        webdav_lock_activelocks_lockdata(stmt, (webdav_lockdata_wr *)&lockdata);
         if (lockdata.timeout > 0)
             lock_cb(vdata, &lockdata);
     }
@@ -1486,7 +1497,7 @@ webdav_lock_activelocks (const plugin_config * const pconf,
         if (uri->used-1 == (uint32_t)sqlite3_column_bytes(stmt, 1) /*resource*/)
             continue;
 
-        webdav_lock_activelocks_lockdata(stmt, &lockdata);
+        webdav_lock_activelocks_lockdata(stmt, (webdav_lockdata_wr *)&lockdata);
         if (lockdata.timeout > 0)
             lock_cb(vdata, &lockdata);
     }
@@ -3557,7 +3568,7 @@ webdav_has_lock (connection * const con,
     const data_string * const authn_user = (const data_string *)
       array_get_element_klen(con->environment,
                              CONST_STR_LEN("REMOTE_USER"));
-    cbdata.authn_user = authn_user ? authn_user->value : &owner;
+    cbdata.authn_user = authn_user ? &authn_user->value : &owner;
 
     const buffer * const h =
       http_header_request_get(con, HTTP_HEADER_OTHER, CONST_STR_LEN("If"));
@@ -5171,7 +5182,7 @@ mod_webdav_lock (connection * const con, const plugin_config * const pconf)
       { NULL, 0, 0 }, /* locktoken */
       { con->physical.rel_path->ptr,con->physical.rel_path->used,0},/*lockroot*/
       { NULL, 0, 0 }, /* ownerinfo */
-      (authn_user ? authn_user->value : &owner), /* owner */
+      (authn_user ? &authn_user->value : &owner), /* owner */
       NULL, /* lockscope */
       NULL, /* locktype  */
       -1,   /* depth */
@@ -5457,7 +5468,7 @@ mod_webdav_unlock (connection * const con, const plugin_config * const pconf)
       { h->ptr+1, h->used-2, 0 }, /* locktoken (remove < > around token) */
       { con->physical.rel_path->ptr,con->physical.rel_path->used,0},/*lockroot*/
       { NULL, 0, 0 }, /* ownerinfo (unused for unlock) */
-      (authn_user ? authn_user->value : &owner), /* owner */
+      (authn_user ? &authn_user->value : &owner), /* owner */
       NULL, /* lockscope (unused for unlock) */
       NULL, /* locktype  (unused for unlock) */
       0,    /* depth     (unused for unlock) */
diff --git a/src/mod_wstunnel.c b/src/mod_wstunnel.c
index 217779ab..d979121f 100644
--- a/src/mod_wstunnel.c
+++ b/src/mod_wstunnel.c
@@ -283,7 +283,7 @@ SETDEFAULTS_FUNC(mod_wstunnel_set_defaults) {
             return HANDLER_ERROR;
         }
         for (size_t j = 0; j < s->origins->used; ++j) {
-            if (buffer_string_is_empty(((data_string *)s->origins->data[j])->value)) {
+            if (buffer_string_is_empty(&((data_string *)s->origins->data[j])->value)) {
                 log_error_write(srv, __FILE__, __LINE__, "s",
                                 "unexpected empty string in wstunnel.origins");
                 return HANDLER_ERROR;
@@ -435,7 +435,7 @@ static int wstunnel_is_allowed_origin(connection *con, handler_ctx *hctx) {
     }
 
     for (size_t i = 0; i < allowed_origins->used; ++i) {
-        buffer *b = ((data_string *)allowed_origins->data[i])->value;
+        buffer *b = &((data_string *)allowed_origins->data[i])->value;
         size_t blen = buffer_string_length(b);
         if ((olen > blen ? origin->ptr[olen-blen-1] == '.' : olen == blen)
             && buffer_is_equal_right_len(origin, b, blen)) {
diff --git a/src/plugin.c b/src/plugin.c
index 26a8cf45..ab02827c 100644
--- a/src/plugin.c
+++ b/src/plugin.c
@@ -139,13 +139,13 @@ int plugins_load(server *srv) {
 	size_t i, j;
 
 	for (i = 0; i < srv->srvconf.modules->used; i++) {
-		data_string *d = (data_string *)srv->srvconf.modules->data[i];
-		char *module = d->value->ptr;
+		data_string *ds = (data_string *)srv->srvconf.modules->data[i];
+		char *module = ds->value.ptr;
 
 		for (j = 0; j < i; j++) {
-			if (buffer_is_equal(d->value, ((data_string *) srv->srvconf.modules->data[j])->value)) {
+			if (buffer_is_equal(&ds->value, &((data_string *) srv->srvconf.modules->data[j])->value)) {
 				log_error_write(srv, __FILE__, __LINE__, "sbs",
-					"Cannot load plugin", d->value,
+					"Cannot load plugin", &ds->value,
 					"more than once, please fix your config (lighttpd may not accept such configs in future releases)");
 				continue;
 			}
@@ -178,13 +178,13 @@ int plugins_load(server *srv) {
 	size_t i, j;
 
 	for (i = 0; i < srv->srvconf.modules->used; i++) {
-		data_string *d = (data_string *)srv->srvconf.modules->data[i];
-		char *module = d->value->ptr;
+		data_string *ds = (data_string *)srv->srvconf.modules->data[i];
+		char *module = ds->value.ptr;
 
 		for (j = 0; j < i; j++) {
-			if (buffer_is_equal(d->value, ((data_string *) srv->srvconf.modules->data[j])->value)) {
+			if (buffer_is_equal(&ds->value, &((data_string *) srv->srvconf.modules->data[j])->value)) {
 				log_error_write(srv, __FILE__, __LINE__, "sbs",
-					"Cannot load plugin", d->value,
+					"Cannot load plugin", &ds->value,
 					"more than once, please fix your config (lighttpd may not accept such configs in future releases)");
 				continue;
 			}
diff --git a/src/response.c b/src/response.c
index fee0c18a..32997794 100644
--- a/src/response.c
+++ b/src/response.c
@@ -35,7 +35,7 @@ static int http_response_omit_header(connection *con, const data_string * const
             && buffer_eq_icase_ssn(ds->key.ptr+sizeof("X-LIGHTTPD-")-1,
                                    CONST_STR_LEN("KBytes-per-second"))) {
             /* "X-LIGHTTPD-KBytes-per-second" */
-            long limit = strtol(ds->value->ptr, NULL, 10);
+            long limit = strtol(ds->value.ptr, NULL, 10);
             if (limit > 0
                 && (limit < con->conf.kbytes_per_second
                     || 0 == con->conf.kbytes_per_second)) {
@@ -85,7 +85,7 @@ int http_response_write_header(server *srv, connection *con) {
 	for (size_t i = 0; i < con->response.headers->used; ++i) {
 		const data_string * const ds = (data_string *)con->response.headers->data[i];
 
-		if (buffer_string_is_empty(ds->value)) continue;
+		if (buffer_string_is_empty(&ds->value)) continue;
 		if (buffer_string_is_empty(&ds->key)) continue;
 		if ((ds->key.ptr[0] & 0xdf)=='X' && http_response_omit_header(con, ds))
 			continue;
@@ -93,7 +93,7 @@ int http_response_write_header(server *srv, connection *con) {
 		buffer_append_string_len(b, CONST_STR_LEN("\r\n"));
 		buffer_append_string_buffer(b, &ds->key);
 		buffer_append_string_len(b, CONST_STR_LEN(": "));
-		buffer_append_string_buffer(b, ds->value);
+		buffer_append_string_buffer(b, &ds->value);
 	}
 
 	if (!(con->response.htags & HTTP_HEADER_DATE)) {
diff --git a/src/stat_cache.c b/src/stat_cache.c
index 08cac060..558651e6 100644
--- a/src/stat_cache.c
+++ b/src/stat_cache.c
@@ -646,7 +646,7 @@ const buffer * stat_cache_mimetype_by_ext(const connection *con, const char *nam
             const data_string *ds = (data_string *)con->conf.mimetypes->data[i];
             const size_t klen = buffer_string_length(&ds->key);
             if (klen <= nlen && buffer_eq_icase_ssn(end-klen, ds->key.ptr, klen))
-                return ds->value;
+                return &ds->value;
         }
     }
     else {
@@ -661,24 +661,24 @@ const buffer * stat_cache_mimetype_by_ext(const connection *con, const char *nam
         }
         /* search for basename, then longest .ext2.ext1, then .ext1, then "" */
         ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
-        if (NULL != ds) return ds->value;
+        if (NULL != ds) return &ds->value;
         while (++s < end) {
             while (*s != '.' && ++s != end) ;
             if (s == end) break;
             /* search ".ext" then "ext" */
             ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
-            if (NULL != ds) return ds->value;
+            if (NULL != ds) return &ds->value;
             /* repeat search without leading '.' to handle situation where
              * admin configured mimetype.assign keys without leading '.' */
             if (++s < end) {
                 if (*s == '.') { --s; continue; }
                 ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
-                if (NULL != ds) return ds->value;
+                if (NULL != ds) return &ds->value;
             }
         }
         /* search for ""; catchall */
         ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, CONST_STR_LEN(""));
-        if (NULL != ds) return ds->value;
+        if (NULL != ds) return &ds->value;
     }
 
     return NULL;
diff --git a/src/t/test_array.c b/src/t/test_array.c
index dccf528c..daa6f03f 100644
--- a/src/t/test_array.c
+++ b/src/t/test_array.c
@@ -35,7 +35,7 @@ static void test_array_insert_value (void) {
     array_insert_value(a, CONST_STR_LEN("def"));
     ds = (data_string *)a->data[0];
     assert(NULL != ds);
-    assert(buffer_is_equal_string(ds->value, CONST_STR_LEN("def")));
+    assert(buffer_is_equal_string(&ds->value, CONST_STR_LEN("def")));
 
     array_free(a);
 }
@@ -50,7 +50,7 @@ static void test_array_set_key_value (void) {
     ds = (data_string *)array_get_element_klen(a, CONST_STR_LEN("abc"));
     assert(NULL != ds);
     assert(buffer_is_equal_string(&ds->key, CONST_STR_LEN("abc")));
-    assert(buffer_is_equal_string(ds->value, CONST_STR_LEN("def")));
+    assert(buffer_is_equal_string(&ds->value, CONST_STR_LEN("def")));
 
     array_set_key_value(a, CONST_STR_LEN("abc"), CONST_STR_LEN("ghi"));
     ds = (data_string *)array_get_element_klen(a, CONST_STR_LEN("does-not-exist"));
@@ -58,7 +58,7 @@ static void test_array_set_key_value (void) {
     ds = (data_string *)array_get_element_klen(a, CONST_STR_LEN("abc"));
     assert(NULL != ds);
     assert(buffer_is_equal_string(&ds->key, CONST_STR_LEN("abc")));
-    assert(buffer_is_equal_string(ds->value, CONST_STR_LEN("ghi")));
+    assert(buffer_is_equal_string(&ds->value, CONST_STR_LEN("ghi")));
 
     array_free(a);
 }
diff --git a/src/t/test_request.c b/src/t/test_request.c
index b4b29053..a84d7052 100644
--- a/src/t/test_request.c
+++ b/src/t/test_request.c
@@ -332,7 +332,7 @@ static void test_request_http_request_parse(connection *con)
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("Location"));
     assert(ds
-           && buffer_is_equal_string(ds->value,
+           && buffer_is_equal_string(&ds->value,
                                      CONST_STR_LEN("foo, foobar    baz")));
 
     run_http_request_parse(con, __LINE__, 0,
@@ -345,7 +345,7 @@ static void test_request_http_request_parse(connection *con)
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("Location"));
     assert(ds
-           && buffer_is_equal_string(ds->value, CONST_STR_LEN("foobar    baz")));
+           && buffer_is_equal_string(&ds->value, CONST_STR_LEN("foobar    baz")));
 
     run_http_request_parse(con, __LINE__, 0,
       "#1232 - duplicate headers with line-wrapping - test 3",
@@ -357,7 +357,7 @@ static void test_request_http_request_parse(connection *con)
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("Location"));
     assert(ds
-           && buffer_is_equal_string(ds->value, CONST_STR_LEN("foobar    baz")));
+           && buffer_is_equal_string(&ds->value, CONST_STR_LEN("foobar    baz")));
 
     run_http_request_parse(con, __LINE__, 400,
       "missing protocol",
@@ -433,7 +433,7 @@ static void test_request_http_request_parse(connection *con)
                     "\r\n"));
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("ABC"));
-    assert(ds && buffer_is_equal_string(ds->value, CONST_STR_LEN("foo")));
+    assert(ds && buffer_is_equal_string(&ds->value, CONST_STR_LEN("foo")));
 
     run_http_request_parse(con, __LINE__, 0,
       "line-folding",
@@ -443,7 +443,7 @@ static void test_request_http_request_parse(connection *con)
                     "\r\n"));
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("ABC"));
-    assert(ds && buffer_is_equal_string(ds->value, CONST_STR_LEN("foo    bc")));
+    assert(ds && buffer_is_equal_string(&ds->value, CONST_STR_LEN("foo    bc")));
 
     run_http_request_parse(con, __LINE__, 411,
       "POST request, no Content-Length",
@@ -546,7 +546,7 @@ static void test_request_http_request_parse(connection *con)
                     "\r\n"));
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("Host"));
-    assert(ds && buffer_is_equal_string(ds->value, CONST_STR_LEN("zzz.example.org")));
+    assert(ds && buffer_is_equal_string(&ds->value, CONST_STR_LEN("zzz.example.org")));
 
     run_http_request_parse(con, __LINE__, 0,
       "absolute-uri in request-line (with Host match)",
@@ -556,7 +556,7 @@ static void test_request_http_request_parse(connection *con)
                     "\r\n"));
     ds = (data_string *)
       array_get_element_klen(con->request.headers, CONST_STR_LEN("Host"));
-    assert(ds && buffer_is_equal_string(ds->value, CONST_STR_LEN("zzz.example.org")));
+    assert(ds && buffer_is_equal_string(&ds->value, CONST_STR_LEN("zzz.example.org")));
 
     run_http_request_parse(con, __LINE__, 400,
       "absolute-uri in request-line (with Host mismatch)",