Don't need to copy the challenge data before calling DER_Encode because...

net/third_party/mozilla_security_manager/nsKeygenHandler.cpp

Index: net/third_party/mozilla_security_manager/nsKeygenHandler.cpp
===================================================================
--- net/third_party/mozilla_security_manager/nsKeygenHandler.cpp	(revision 50259)
+++ net/third_party/mozilla_security_manager/nsKeygenHandler.cpp	(working copy)
@@ -123,7 +123,6 @@
   SECItem signedItem;
   CERTPublicKeyAndChallenge pkac;
   void *keyGenParams;
-  pkac.challenge.data = NULL;
   bool isSuccess = true;  // Set to false as soon as a step fails.
 
   std::string result_blob;  // the result.
@@ -208,13 +207,9 @@
 
   // Set up the PublicKeyAndChallenge data structure, then DER encode it.
   pkac.spki = spkiItem;
+  pkac.challenge.type = siBuffer;
   pkac.challenge.len = challenge.length();
-  pkac.challenge.data = (unsigned char *)strdup(challenge.c_str());
-  if (!pkac.challenge.data) {
-    LOG(ERROR) << "Out of memory while making a copy of challenge data";
-    isSuccess = false;
-    goto failure;
-  }
+  pkac.challenge.data = (unsigned char *)challenge.data();

[wtc, 2010/06/18 18:26:27]

DER_Encode does not use the |type| field.  I'm initializing
it just for style (or rather defensive programming).

The |data| field is 'unsigned char*', while challenge.data()
is 'const char*'.  If I use C++ casts, I'll need two (first
const_cast and then reinterpret_cast).  So I use a C style
cast for brevity.  If you want, I can change to C++ casts.
DER_Encode does not mutate the bytes pointed to by the
|data| field, which is why it's safe to cast away the const.
(This is a common limitation of C APIs that use a data-buffer
type for both input and output.)

   sec_rv = DER_Encode(arena, &pkacItem, CERTPublicKeyAndChallengeTemplate,
                       &pkac);
   if (SECSuccess != sec_rv) {
@@ -275,9 +270,6 @@
   if (slot != NULL) {
     PK11_FreeSlot(slot);
   }
-  if (pkac.challenge.data) {
-    free(pkac.challenge.data);
-  }
 
   return (isSuccess ? result_blob : std::string());
 }