Memory Management Problem?

[Tony Selke]

Forgive my rather wide posting of this note, but I was uncertain of where I
would find the best help.

I am working on a class that is basically providing a secure location for
name/value pairs to be stored by the application. I am using TripleDES
encryption and having a very odd problem that appears to be related to a
memory management issue in the CLR. I have the 1.1 .NET Framework installed
and I am using VS.NET 2002.

I have a class whose definition begins like so:

Public Class cSecureConfigFile
' internal constants
Private Const BASE_XML As String = "XML crap here"
' internal objects
Private des As TripleDESCryptoServiceProvider = New
TripleDESCryptoServiceProvider()
Private md5 As New MD5CryptoServiceProvider()
Private xmlDoc As New XmlDocument()
Private ReadOnly fileName As String = Environment.CurrentDirectory &
"\cfg.bin"
Private ReadOnly key() As Byte = {<24 bytes go here>}
Private ReadOnly iv() As Byte = {8, 7, 6, 5, 4, 3, 2, 1}
The first time I run, if there is no file, I create one. Then I save it in
an encrypted manner. This works fine.

The second time I run, I decrypt the file just fine. Then, as soon as I
instantiate a new memory stream (xmlStream) and make the following call:

xmlDoc.Save(xmlStream)

my encryption vector (iv) is "flushed" (all bytes set to 0). Since the
variable is defined ReadOnly and I am not doing anything even remotely
related to the TDES object, I am thinking that the unused, tail-end of the
memory stream being used by xmlDoc is overwriting the vector array. As a
result, when I decrypt my file the next go around, the first 8 bytes are
screwed up.

As a test, I moved the declaration of the key and vector arrays to be inside
of the encryption function, and it all works flawlessly.

Is there something I am missing here, or does it look (as I suspect) like
the CLR is allowing a memory stream to overwrite an existing, used block of
memory?

Tony

[Tom Shelton]

In article <Oa*************@TK2MSFTNGP11.phx.gbl>, Tony Selke wrote:

Forgive my rather wide posting of this note, but I was uncertain of where I
would find the best help.

I am working on a class that is basically providing a secure location for
name/value pairs to be stored by the application. I am using TripleDES
encryption and having a very odd problem that appears to be related to a
memory management issue in the CLR. I have the 1.1 .NET Framework installed
and I am using VS.NET 2002.

If your using VS.NET 2002, then your still using the 1.0 framework -
even if the 1.1 is installed. With out doing alot of analysis, if this
is a framework bug, you may want to recompile it using the 1.1
framework, which means either installing VS.NET 2003 or compiling it by
hand from the command line.

--
Tom Shelton
MVP [Visual Basic]

[Tony Selke]

You know, I hadn't thought about that. I'll have to compile it manually
tomorrow and see if that helps at all.

On a related note, does anyone know if VS2k3 allows you to select what
version of the framework to compile with? I have an upgrade CD on the way,
but Microsoft is terribly back-ordered after that $30 upgrade special they
were running.

Thanks again, I'll let you know how it goes.

Tony

[Tom Shelton]

In article <#Y**************@TK2MSFTNGP11.phx.gbl>, Tony Selke wrote:

You know, I hadn't thought about that. I'll have to compile it manually
tomorrow and see if that helps at all.

Not a guarentee, but who knows :)
On a related note, does anyone know if VS2k3 allows you to select what
version of the framework to compile with? I have an upgrade CD on the way,
but Microsoft is terribly back-ordered after that $30 upgrade special they
were running.

No. VS2k3 only uses 1.1 to compile. It does provide an option to
target the 1.0 framework - but all that does is generate an config file
that says to use the 1.0 framework at runtime. It still compiles with
the 1.1 framework, though.

--
Tom Shelton
MVP [Visual Basic]