Don't need to copy the challenge data before calling DER_Encode because...

net/third_party/mozilla_security_manager/nsKeygenHandler.cpp

 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
@@ skipping 105 matching lines @@
   SECKEYPrivateKey *privateKey = NULL;
   SECKEYPublicKey *publicKey = NULL;
   CERTSubjectPublicKeyInfo *spkInfo = NULL;
   PRArenaPool *arena = NULL;
   SECStatus sec_rv =SECFailure;
   SECItem spkiItem;
   SECItem pkacItem;
   SECItem signedItem;
   CERTPublicKeyAndChallenge pkac;
   void *keyGenParams;
-  pkac.challenge.data = NULL;
   bool isSuccess = true;  // Set to false as soon as a step fails.
 
   std::string result_blob;  // the result.
 
   // Ensure NSS is initialized.
   base::EnsureNSSInit();
 
   slot = base::GetDefaultNSSKeySlot();
   if (!slot) {
     LOG(ERROR) << "Couldn't get Internal key slot!";
@@ skipping 64 matching lines @@
   sec_rv = DER_Encode(arena, &spkiItem, CERTSubjectPublicKeyInfoTemplate,
                       spkInfo);
   if (SECSuccess != sec_rv) {
     LOG(ERROR) << "Couldn't DER Encode subjectPublicKeyInfo";
     isSuccess = false;
     goto failure;
   }
 
   // Set up the PublicKeyAndChallenge data structure, then DER encode it.
   pkac.spki = spkiItem;
+  pkac.challenge.type = siBuffer;
   pkac.challenge.len = challenge.length();
-  pkac.challenge.data = (unsigned char *)strdup(challenge.c_str());
-  if (!pkac.challenge.data) {
-    LOG(ERROR) << "Out of memory while making a copy of challenge data";
-    isSuccess = false;
-    goto failure;
-  }
+  pkac.challenge.data = (unsigned char *)challenge.data();

[wtc, 2010/06/18 18:26:27]

DER_Encode does not use the |type| field.  I'm initializing
it just for style (or rather defensive programming).

The |data| field is 'unsigned char*', while challenge.data()
is 'const char*'.  If I use C++ casts, I'll need two (first
const_cast and then reinterpret_cast).  So I use a C style
cast for brevity.  If you want, I can change to C++ casts.
DER_Encode does not mutate the bytes pointed to by the
|data| field, which is why it's safe to cast away the const.
(This is a common limitation of C APIs that use a data-buffer
type for both input and output.)

   sec_rv = DER_Encode(arena, &pkacItem, CERTPublicKeyAndChallengeTemplate,
                       &pkac);
   if (SECSuccess != sec_rv) {
     LOG(ERROR) << "Couldn't DER Encode PublicKeyAndChallenge";
     isSuccess = false;
     goto failure;
   }
 
   // Sign the DER encoded PublicKeyAndChallenge.
   sec_rv = SEC_DerSignData(arena, &signedItem, pkacItem.data, pkacItem.len,
@@ skipping 40 matching lines @@
   }
   if (spkInfo) {
     SECKEY_DestroySubjectPublicKeyInfo(spkInfo);
   }
   if (arena) {
     PORT_FreeArena(arena, PR_TRUE);
   }
   if (slot != NULL) {
     PK11_FreeSlot(slot);
   }
-  if (pkac.challenge.data) {
-    free(pkac.challenge.data);
-  }
 
   return (isSuccess ? result_blob : std::string());
 }
 
 }  // namespace mozilla_security_manager