Encryption problem after porting from SFL 2.3 to 2.4

["John Stark" <jas@xxxxxxxxxxxx>]

Hello,

I have been attempting to port some code that I previously ported to SFL 2.3
to SFL 2.4.  This has mainly involved restructuring the loops that iterated
over lists that used the old list template class with SetCurrToFirst(),
Curr() and GoNext() methods, and are now based on std::list.

However my code to perform encryption is now failing, because of memory
re-use.  This could be because something has been freed prematurely or
because of general heap corruption.  Basically the RecipientInfo's
certificate object (CSM_CertificateChoice) is getting overwritten because
its pointer is the same as that returned by the next memory allocation.

My code is basically as attached - this has had the clutter of calls to our
own code replaced with "...".  The #ifdef VIC_SFL24 is for SFL 2.4, the
#else is for SFL 2.3.

Can anyone advise me whether I have made a silly mistake?

Thank you.

John Stark
Tel: +44 1223 566732
Mobile: +44 7968 110628
E-mail: jas@xxxxxxxxxxxx
Web: http://www.metanate.com


    CERT::CSM_AppLogin *plogin = ...;
    CTIL::CSM_Buffer   *pcon_buf = NULL;
    CERT::CSM_CSInst   *pinst;
    unsigned            i;

    // Unmark the encrypt instances.
    plogin->ClearFlag(SM_INST_USE_THIS | SM_INST_APPLICABLE);

    // Create a signed data object.
    SFL::CSM_MsgToEncrypt msg;

    // Import the Content to an SFL buffer.
    pcon_buf = ...;

    // Set the Content Type.
    {
      SNACC::AsnOid csmoid(...);
      msg.setContentType(csmoid);
    }

    // Attach the Content.
    msg.SetEncapContentClear(*pcon_buf);

    // Set flags.
    msg.SetIncludeOrigCertsFlag(...);
    msg.SetAddOriginatorAsRecipient(...);
    msg.m_bIssOrSki = ...;

    for (...) // loop over tokens
    {
      pinst = ...;

#ifdef VIC_SFL24
      CTIL::CSM_AlgLstVDA  keyx_algs, con_algs;
      CTIL::CSM_AlgLstVDA *psig_algs = NULL, *pkeyx_algs = &keyx_algs,
                          *pdigest_algs = NULL, *pcon_algs = &con_algs;
      CTIL::CSM_AlgVDA    *palg;
#else // VIC_SFL24
      CTIL::CSM_AlgLst  keyx_algs, con_algs;
      CTIL::CSM_AlgLst *psig_algs = NULL, *pkeyx_algs = &keyx_algs,
                       *pdigest_algs = NULL, *pcon_algs = &con_algs;
      CTIL::CSM_Alg    *palg;
#endif // VIC_SFL24

      // Obtain lists of encryption algorithms.
      pinst->GetAlgIDs(pdigest_algs, psig_algs, pkeyx_algs, pcon_algs);

      // Omitted stuff to check algorithms and compare against
      // those supported for the recipients.
      // ...

      // We will use this token.
      pinst->SetUseThis();
      pinst->SetApplicable();
    }

    // Create recipient list.
    SFL::CSM_RecipientInfoLst *prlist = new SFL::CSM_RecipientInfoLst;
    msg.m_pRecipients = prlist;

    for (...) // each of our application's recipients
    {
      // cb.data and cb.length are recipient's DER-encoded X.509
certificate.
      CTIL::CSM_Buffer csmbuf(reinterpret_cast<char *>(cb.data), cb.length);

#ifdef VIC_SFL24
      prlist->push_back(SFL::CSM_RecipientInfo(csmbuf));

      // This line just added for debugging.
      SFL::CSM_RecipientInfo *prinfo = prlist->back();

      // +++ Problem occurs because prinfo->m_pCert contains a pointer
      // that also gets returned by the next memory allocation, causing
      // the contents of prinfo->m_pCert to be overwritten.
#else // VIC_SFL24
      // This code worked fine with SFL 2.3.
      SFL::CSM_RecipientInfo *prinfo = new SFL::CSM_RecipientInfo(csmbuf);
      prlist->AppendNoCopy(prinfo);
#endif // VIC_SFL24
    }

    // Set SFL's content encryption OID from choice made above.
    {
      SNACC::AsnOid enc_oid(...);
      msg.SetContentEncryptOID(&enc_oid);
    }

    // Perform the encryption operation.
    // +++ Coredump occurs within here because of garbage in
    // prinfo->m_pCert.
    msg.Encrypt(plogin);