[cpp-xmltooling] branch master updated: CPPXT-145 - DataSealer is sharing non-thread safe keys

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-xmltooling.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=12ee193a7d16faf7630a95bc267db02fd21784f7

The following commit(s) were added to refs/heads/master by this push:
       new  12ee193   CPPXT-145 - DataSealer is sharing non-thread safe keys
12ee193 is described below

commit 12ee193a7d16faf7630a95bc267db02fd21784f7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 1 19:16:19 2019 -0400

    CPPXT-145 - DataSealer is sharing non-thread safe keys
    
    https://issues.shibboleth.net/jira/browse/CPPXT-145
---
 xmltooling/security/impl/DataSealer.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/xmltooling/security/impl/DataSealer.cpp b/xmltooling/security/impl/DataSealer.cpp
index c7ec7f9..aef85b7 100644
--- a/xmltooling/security/impl/DataSealer.cpp
+++ b/xmltooling/security/impl/DataSealer.cpp
@@ -156,8 +156,10 @@ string DataSealer::wrap(const char* s, time_t exp) const
 
     safeBuffer ciphertext;
     try {
+        // Keys are not threadsafe, use a clone to encrypt.
+        scoped_ptr<XSECCryptoKey> clonedKey(defaultKey.second->clone());
         scoped_ptr<XENCEncryptionMethod> method(XENCEncryptionMethod::create(env.get(), algorithm));
-        if (!handler->encryptToSafeBuffer(&tx, method.get(), defaultKey.second, dummydoc, ciphertext)) {
+        if (!handler->encryptToSafeBuffer(&tx, method.get(), clonedKey.get(), dummydoc, ciphertext)) {
             throw XMLSecurityException("Data encryption failed.");
         }
     }
@@ -235,8 +237,10 @@ string DataSealer::unwrap(const char* s) const
     unsigned int len = 0;
     safeBuffer plaintext;
     try {
+        // Keys are not threadsafe, use a clone to decrypt.
+        scoped_ptr<XSECCryptoKey> clonedKey(requiredKey.second->clone());
         scoped_ptr<XENCEncryptionMethod> method(XENCEncryptionMethod::create(env.get(), algorithm));
-        len = handler->decryptToSafeBuffer(&tx, method.get(), requiredKey.second, dummydoc, plaintext);
+        len = handler->decryptToSafeBuffer(&tx, method.get(), clonedKey.get(), dummydoc, plaintext);
     }
     catch (const XSECException& ex) {
         auto_ptr_char msg(ex.getMsg());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.