tor_asprintf(&buf,
                   "250-ServiceID=%s\r\n"
                   "250-PrivateKey=%s:%s\r\n"
                   "250 OK\r\n",
                   service_id,
                   key_new_alg,
                   key_new_blob); // ====> PrivateKey is leaked

int
tor_asprintf(char **strp, const char *fmt, ...)
{
  int r;
  va_list args;
  va_start(args, fmt);
  r = tor_vasprintf(strp, fmt, args); //  ====> PrivateKey is flowed into args
  va_end(args);
  if (!*strp || r < 0) {
    log_err(LD_BUG, "Internal error in asprintf");
    tor_assert(0);
  }
  return r;
}

int
tor_vasprintf(char **strp, const char *fmt, va_list args)
{
  /* use a temporary variable in case *strp is in args. */
  char *strp_tmp=NULL;
#ifdef HAVE_VASPRINTF
  /* If the platform gives us one, use it. */
  int r = vasprintf(&strp_tmp, fmt, args);
  if (r < 0)
    *strp = NULL;
  else
    *strp = strp_tmp;
  return r;
#elif defined(HAVE__VSCPRINTF)
  /* On Windows, _vsnprintf won't tell us the length of the string if it
   * overflows, so we need to use _vcsprintf to tell how much to allocate */
  int len, r;
  len = _vscprintf(fmt, args);
  if (len < 0) {
    *strp = NULL;
    return -1;
  }
  strp_tmp = tor_malloc(len + 1);
  r = vsnprintf(strp_tmp, len+1, fmt, args);
  if (r != len) {
    tor_free(strp_tmp);
    *strp = NULL;
    return -1;
  }
  *strp = strp_tmp;
  return len;
#else
  /* Everywhere else, we have a decent vsnprintf that tells us how many
   * characters we need.  We give it a try on a short buffer first, since
   * it might be nice to avoid the second vsnprintf call.
   */
  char buf[128];
  int len, r;
  va_list tmp_args;
  va_copy(tmp_args, args); // =============> private key flowed into tmp_args
  len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); 
  va_end(tmp_args);
  if (len < (int)sizeof(buf)) {
    *strp = tor_strdup(buf);
    return len;
  }
  strp_tmp = tor_malloc(len+1); // strp_tmp points to memory outside enclave
  r = vsnprintf(strp_tmp, len+1, fmt, args);// =============> private key flowed into strp_tmp ， so privateKey is writed out, this is a sensitive information leakage.
  if (r != len) {
    tor_free(strp_tmp);
    *strp = NULL;
    return -1;
  }
  *strp = strp_tmp;
  return len;
#endif
}

if (client->client_key) {
      char *client_key_out = NULL;
      if (crypto_pk_write_private_key_to_string(client->client_key,
                                                &client_key_out, &len) != 0) {
        log_warn(LD_BUG, "Internal error: "
                 "crypto_pk_write_private_key_to_string() failed.");
        goto err;
      }
      if (rend_get_service_id(client->client_key, service_id)<0) {
        log_warn(LD_BUG, "Internal error: couldn't encode service ID.");
        /*
         * len is string length, not buffer length, but last byte is NUL
         * anyway.
         */
        memwipe(client_key_out, 0, len);
        tor_free(client_key_out);
        goto err;
      }
      written = tor_snprintf(buf + written, sizeof(buf) - written,
                             "client-key\n%s", client_key_out); // ===========>1. the private is written into buf
      memwipe(client_key_out, 0, len);
      tor_free(client_key_out);
      if (written < 0) {
        log_warn(LD_BUG, "Could not write client entry.");
        goto err;
      }
    }

    if (sgx_fputs(buf, cfile) < 0) { // ===========>2. buf is passed to  function sgx_fputs
      log_warn(LD_FS, "Could not append client entry to file: %s",
               strerror(errno));
      goto err;
    }

int sgx_fputs(const char *str, sgx_file *f)
{
	if(f == NULL || str == NULL) {
		printf("sgx_fputs: Error! sgx_fputs: wrong arguments (NULL)\n");
		return -1;
	}
	int retv = -1;
	long seek = f->seek;
	long content_len = f->content_len;
	long n = strlen(str);
	long mem_size = f->content_len > n + seek ? f->content_len : n + seek;	
	char *new_cont = (char *)sgx_calloc(1, mem_size); // // ===========>3. calloc memory , HOWEVER, the memory new_cont  points to is UNTRUSTED.  
	if (f->content != NULL) {
		int remain = content_len - seek - n;
		remain = remain > 0 ? remain : 0;
		memcpy(new_cont, f->content, seek); 
		memcpy(new_cont+seek, str, n);	//===========>4. client private key is copied to memory outside Enclave.
		memcpy(new_cont+seek+n, f->content, remain);
		f->content_len = seek+n+remain;	
		f->seek = seek+n;
		sgx_free(f->content);
		f->content = new_cont;
	}
	else {
		memcpy(new_cont, str, n);
		f->content_len = n;
		f->seek = n;
		f->content = new_cont;
	}	
	f->mtime = time(NULL);
	retv = n;
	return retv;
}

SSL * s_connect(int sock, char * dest_url)
{
	SSL *ssl;
	int server = 0;
	if (g_ctx == NULL) {
		puts("SSL_CTX is NULL!");
		abort();
	}
	ssl = SSL_new(g_ctx);
	SSL_set_fd(ssl, sock);
	if (SSL_connect(ssl) != 1) {
		printf("Error: Could not build a SSL session to: %s.\n", dest_url); // ========>leak
	}
	else {
		//printf("Successfully enabled SSL/TLS session to: %s.\n", dest_url);
	}
	//printf("Finished SSL/TLS connection with server: %s.\n", dest_url);
	return ssl;
}

cd (rootdir)/Enclave/TrustedLibrary/LibEvent_SGX
./configure
make

bufferevent_openssl.c:237:2: note: (near initialization for 'methods_bufferevent')
bufferevent_openssl.c:228:19: error: storage size of 'methods_bufferevent' isn't known
 static BIO_METHOD methods_bufferevent = {