Revert "Fixed (ICE-7477) - Use native Base64 encode/decode"

This reverts commit 2df05d130ae51a65f51c593800ad722d533f5df3.

10 files changed, 310 insertions, 235 deletions

diff --git a/cpp/include/IceUtil/UniqueRef.h b/cpp/include/IceUtil/UniqueRef.h
deleted file mode 100644
index fea355f6f7b..00000000000
--- a/cpp/include/IceUtil/UniqueRef.h
+++ /dev/null
@@ -1,82 +0,0 @@
-// **********************************************************************
-//
-// Copyright (c) 2003-2016 ZeroC, Inc. All rights reserved.
-//
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
-
-#ifndef ICE_UTIL_UNIQUE_REF_H
-#define ICE_UTIL_UNIQUE_REF_H
-
-#include <IceUtil/Config.h>
-
-#ifdef __APPLE__
-
-#include <CoreFoundation/CoreFoundation.h>
-
-namespace IceUtil
-{
-template<typename T>
-class UniqueRef
-{
-public:
-
-    explicit UniqueRef(CFTypeRef ptr = 0) : _ptr((T)ptr)
-    {
-    }
-
-    ~UniqueRef()
-    {
-        if(_ptr != 0)
-        {
-            CFRelease(_ptr);
-        }
-    }
-
-    T release()
-    {
-        T r = _ptr;
-        _ptr = 0;
-        return r;
-    }
-
-    void reset(CFTypeRef ptr = 0)
-    {
-        if(_ptr == ptr)
-        {
-            return;
-        }
-        if(_ptr != 0)
-        {
-            CFRelease(_ptr);
-        }
-        _ptr = (T)ptr;
-    }
-
-    void retain(CFTypeRef ptr)
-    {
-        reset(ptr ? CFRetain(ptr) : ptr);
-    }
-
-    T get() const
-    {
-        return _ptr;
-    }
-
-    operator bool() const
-    {
-        return _ptr != 0;
-    }
-
-private:
-
-    T _ptr;
-};
-
-}
-#endif
-
-#endif
-
diff --git a/cpp/src/Ice/Base64.cpp b/cpp/src/Ice/Base64.cpp
index 445ab98c90c..566785cc48b 100644
--- a/cpp/src/Ice/Base64.cpp
+++ b/cpp/src/Ice/Base64.cpp
@@ -8,167 +8,262 @@
 // **********************************************************************
 
 #include <Ice/Base64.h>
-#include <Ice/LocalException.h>
-#include <IceUtil/StringConverter.h>
-#include <IceUtil/StringUtil.h>
-#include <IceUtil/UniqueRef.h>
 #include <iterator>
 
-#if defined(ICE_OS_UWP)
-using namespace Platform;
-using namespace Windows::Security::Cryptography;
-using namespace Windows::Storage::Streams;
-#elif defined(_WIN32)
-#   include <Wincrypt.h>
-#elif defined(__APPLE__)
-#   include <Security/Security.h>
-#else
-#   include <openssl/bio.h>
-#   include <openssl/evp.h>
-#endif
-
-using namespace IceUtil;
 using namespace std;
 
 string
-IceInternal::Base64::encode(const vector<unsigned char>& decoded)
+IceInternal::Base64::encode(const vector<unsigned char>& plainSeq)
 {
-#if defined(ICE_OS_UWP)
-    try
+    string retval;
+
+    if(plainSeq.size() == 0) 
+    {
+        return retval;
+    }
+ 
+    // Reserve enough space for the returned base64 string
+    size_t base64Bytes = (((plainSeq.size() * 4) / 3) + 1);
+    size_t newlineBytes = (((base64Bytes * 2) / 76) + 1);
+    size_t totalBytes = base64Bytes + newlineBytes;
+ 
+    retval.reserve(totalBytes);
+
+    unsigned char by1 = 0;
+    unsigned char by2 = 0;
+    unsigned char by3 = 0;
+    unsigned char by4 = 0;
+    unsigned char by5 = 0;
+    unsigned char by6 = 0;
+    unsigned char by7 = 0;
+
+    for(size_t i = 0; i < plainSeq.size(); i += 3)
     {
-        ArrayReference<unsigned char> data(const_cast<unsigned char*>(&decoded[0]),
-                                           static_cast<unsigned int>(decoded.size()));
-        auto writer = ref new DataWriter();
-        writer->WriteBytes(data);
-        return wstringToString(CryptographicBuffer::EncodeToBase64String(writer->DetachBuffer())->Data());
+        by1 = plainSeq[i];
+        by2 = 0;
+        by3 = 0;
+
+        if((i + 1) < plainSeq.size())
+        {
+            by2 = plainSeq[i+1];
+        }
+
+        if((i + 2) < plainSeq.size())
+        {
+            by3 = plainSeq[i+2];
+        }
+ 
+        by4 = by1 >> 2;
+        by5 = ((by1 & 0x3) << 4) | (by2 >> 4);
+        by6 = ((by2 & 0xf) << 2) | (by3 >> 6);
+        by7 = by3 & 0x3f;
+
+        retval += encode(by4);
+        retval += encode(by5);
+ 
+        if((i + 1) < plainSeq.size())
+        {
+            retval += encode(by6);
+        }
+        else
+        {
+            retval += "=";
+        }
+ 
+        if((i + 2) < plainSeq.size())
+        {
+            retval += encode(by7);
+        }
+        else
+        {
+            retval += "=";
+        }
     }
-    catch(Platform::Exception^ ex)
+
+    string outString;
+    outString.reserve(totalBytes);
+    string::iterator iter = retval.begin();
+
+    while((retval.end() - iter) > 76)
+    {
+        copy(iter, iter+76, back_inserter(outString));
+        outString += "\r\n";
+        iter += 76;
+    }
+
+    copy(iter, retval.end(), back_inserter(outString));
+
+    return outString;
+}
+
+vector<unsigned char>
+IceInternal::Base64::decode(const string& str)
+{
+    string newStr;
+
+    newStr.reserve(str.length());
+
+    for(size_t j = 0; j < str.length(); j++)
+    {
+        if(isBase64(str[j]))
+        {
+            newStr += str[j];
+        }
+    }
+
+    vector<unsigned char> retval;
+
+    if(newStr.length() == 0)
+    {
+        return retval;
+    }
+
+    // Note: This is how we were previously computing the size of the return
+    //       sequence.  The method below is more efficient (and correct).
+    // size_t lines = str.size() / 78;
+    // size_t totalBytes = (lines * 76) + (((str.size() - (lines * 78)) * 3) / 4);
+
+    // Figure out how long the final sequence is going to be.
+    size_t totalBytes = (newStr.size() * 3 / 4) + 1;
+
+    retval.reserve(totalBytes);
+
+    unsigned char by1 = 0;
+    unsigned char by2 = 0;
+    unsigned char by3 = 0;
+    unsigned char by4 = 0;
+
+    char c1, c2, c3, c4;
+
+    for(size_t i = 0; i < newStr.length(); i += 4)
     {
-        throw IllegalArgumentException(__FILE__, __LINE__, wstringToString(ex->Message->Data()));
+        c1 = 'A';
+        c2 = 'A';
+        c3 = 'A';
+        c4 = 'A';
+
+        c1 = newStr[i];
+
+        if((i + 1) < newStr.length())
+        {
+            c2 = newStr[i + 1];
+        }
+
+        if((i + 2) < newStr.length())
+        {
+            c3 = newStr[i + 2];
+        }
+
+        if((i + 3) < newStr.length())
+        {
+            c4 = newStr[i + 3];
+        }
+
+        by1 = decode(c1);
+        by2 = decode(c2);
+        by3 = decode(c3);
+        by4 = decode(c4);
+
+        retval.push_back((by1 << 2) | (by2 >> 4));
+
+        if(c3 != '=')
+        {
+            retval.push_back(((by2 & 0xf) << 4) | (by3 >> 2));
+        }
+
+        if(c4 != '=')
+        {
+            retval.push_back(((by3 & 0x3) << 6) | by4);
+        }
     }
-#elif defined(_WIN32)
-    DWORD sz = 0;
-    const DWORD flags = CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF;
-    if(!CryptBinaryToString(&decoded[0], static_cast<DWORD>(decoded.size()), flags, 0, &sz))
+
+    return retval;
+}
+
+bool
+IceInternal::Base64::isBase64(char c)
+{
+    if(c >= 'A' && c <= 'Z')
     {
-        throw IllegalArgumentException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        return true;
     }
-    std::string encoded;
-    encoded.resize(sz - 1);
-    if(!CryptBinaryToString(&decoded[0], static_cast<DWORD>(decoded.size()), flags, &encoded[0], &sz))
+
+    if(c >= 'a' && c <= 'z')
     {
-        throw IllegalArgumentException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        return true;
     }
-    return encoded;
-#elif defined(__APPLE__)
-    CFErrorRef err = 0;
-    UniqueRef<SecTransformRef> encoder(SecEncodeTransformCreate(kSecBase64Encoding, &err));
-    if(err)
+
+    if(c >= '0' && c <= '9')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return true;
     }
-    CFDataRef in = CFDataCreateWithBytesNoCopy(0, &decoded[0], decoded.size(), kCFAllocatorNull);
-    SecTransformSetAttribute(encoder.get(), kSecTransformInputAttributeName, in, &err);
-    if(err)
+
+    if(c == '+')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return true;
     }
-    UniqueRef<CFDataRef> data(static_cast<CFDataRef>(SecTransformExecute(encoder.get(), &err)));
-    if(err)
+
+    if(c == '/')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return true;
     }
-    return string(reinterpret_cast<const char*>(CFDataGetBytePtr(data.get())), CFDataGetLength(data.get()));
-#else
-    BIO* b64 = BIO_new(BIO_f_base64());
-    BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
-    BIO* bio = BIO_new(BIO_s_mem());
-    BIO_push(b64, bio);
-    if(BIO_write(b64, &buffer[0], buffer.size()) <= 0)
+
+    if(c == '=')
     {
-        BIO_free_all(b64);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return true;
     }
-    BIO_flush(b64);
 
-    char* data;
-    long size = BIO_get_mem_data(bio, &data);
-    string encoded(data, size);
-    BIO_free_all(b64);
-    return encoded;
-#endif
+    return false;
 }
 
-vector<unsigned char>
-IceInternal::Base64::decode(const string& encoded)
+char
+IceInternal::Base64::encode(unsigned char uc)
 {
-    vector<unsigned char> decoded;
-#if defined(ICE_OS_UWP)
-    try
-    {
-        auto reader = DataReader::FromBuffer(
-            CryptographicBuffer::DecodeFromBase64String(ref new String(stringToWstring(encoded).c_str())));
-        decoded.resize(reader->UnconsumedBufferLength);
-        if(!decoded.empty())
-        {
-            reader->ReadBytes(ArrayReference<unsigned char>(&decoded[0], reader->UnconsumedBufferLength));
-        }
+    if(uc < 26)
+    {
+        return 'A' + uc;
+    }
+    
+    if(uc < 52)
+    {
+        return 'a' + (uc - 26);
     }
-    catch(Platform::Exception^ ex)
+    
+    if(uc < 62)
     {
-        throw IllegalArgumentException(__FILE__, __LINE__, wstringToString(ex->Message->Data()));
+        return '0' + (uc - 52);
     }
-#elif defined(_WIN32)
-    DWORD sz = static_cast<DWORD>(encoded.size());
-    decoded.resize(sz);
-    if(!CryptStringToBinary(encoded.c_str(), sz, CRYPT_STRING_BASE64, &decoded[0], &sz, 0, 0))
+    
+    if(uc == 62)
     {
-        throw IllegalArgumentException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        return '+';
     }
-    decoded.resize(sz);
-#elif defined(__APPLE__)
-    CFErrorRef err = 0;
-    UniqueRef<SecTransformRef> decoder(SecDecodeTransformCreate(kSecBase64Encoding, &err));
-    if(err)
+
+    return '/';
+}
+
+unsigned char
+IceInternal::Base64::decode(char c)
+{
+    if(c >= 'A' && c <= 'Z')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return c - 'A';
     }
-    CFDataRef input = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const unsigned char*>(&encoded[0]), 
-                                                  encoded.size(), kCFAllocatorNull);
-    SecTransformSetAttribute(decoder.get(), kSecTransformInputAttributeName, input, &err);
-    if(err)
+
+    if(c >= 'a' && c <= 'z')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return c - 'a' + 26;
     }
-    UniqueRef<CFDataRef> data(static_cast<CFDataRef>(SecTransformExecute(decoder.get(), &err)));
-    if(err)
+
+    if(c >= '0' && c <= '9')
     {
-        CFRelease(err);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return c - '0' + 52;
     }
-    vector<unsigned char> out;
-    decoded.resize(CFDataGetLength(data.get()));
-    memcpy(&decoded[0], CFDataGetBytePtr(data.get()), decoded.size());
-    return out;
-#else
-    BIO* b64 = BIO_new(BIO_f_base64());
-    BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
-    BIO* bio = BIO_new_mem_buf(&encoded[0], static_cast<int>(encoded.size()));
-    BIO_push(b64, bio);
-    decoded.resize(encoded.size());
-    int sz = BIO_read(b64, &decoded[0], static_cast<int>(decoded.size()));
-    if(sz <= 0)
+
+    if(c == '+')
     {
-        BIO_free_all(b64);
-        throw IllegalArgumentException(__FILE__, __LINE__, "Base64 bad data");
+        return 62;
     }
-    decoded.resize(sz);
-    BIO_free_all(b64);
-#endif
-    return decoded;
+ 
+    return 63;
 }
diff --git a/cpp/src/Ice/Base64.h b/cpp/src/Ice/Base64.h
index fc3da40839c..57417fe542a 100644
--- a/cpp/src/Ice/Base64.h
+++ b/cpp/src/Ice/Base64.h
@@ -23,6 +23,12 @@ public:
 
     static std::string encode(const std::vector<unsigned char>&);
     static std::vector<unsigned char> decode(const std::string&);
+    static bool isBase64(char);
+
+private:
+
+    static char encode(unsigned char);
+    static unsigned char decode(char);
 };
 
 }
diff --git a/cpp/src/Ice/OpaqueEndpointI.cpp b/cpp/src/Ice/OpaqueEndpointI.cpp
index 3d63538ec56..2be3b400dcb 100644
--- a/cpp/src/Ice/OpaqueEndpointI.cpp
+++ b/cpp/src/Ice/OpaqueEndpointI.cpp
@@ -377,17 +377,19 @@ IceInternal::OpaqueEndpointI::checkOption(const string& option, const string& ar
             ex.str = "no argument provided for -v option in endpoint " + endpoint;
             throw ex;
         }
-
-        try
-        {
-            const_cast<vector<Byte>&>(_rawBytes) = Base64::decode(argument);
-        }
-        catch(const IceUtil::IllegalArgumentException& ex)
+        for(string::size_type i = 0; i < argument.size(); ++i)
         {
-            ostringstream os;
-            os << "Invalid Base64 input in opaque endpoint `" << endpoint << "'\n" << ex;
-            throw EndpointParseException(__FILE__, __LINE__, os.str());
+            if(!Base64::isBase64(argument[i]))
+            {
+                EndpointParseException ex(__FILE__, __LINE__);
+                ostringstream ostr;
+                ostr << "invalid base64 character `" << argument[i] << "' (ordinal " << static_cast<int>(argument[i])
+                     << ") in endpoint " << endpoint;
+                ex.str = ostr.str();
+                throw ex;
+            }
         }
+        const_cast<vector<Byte>&>(_rawBytes) = Base64::decode(argument);
         return true;
     }
 
diff --git a/cpp/src/Ice/msbuild/ice++11/ice++11.vcxproj b/cpp/src/Ice/msbuild/ice++11/ice++11.vcxproj
index bb30ab62b32..0a1e36e1334 100644
--- a/cpp/src/Ice/msbuild/ice++11/ice++11.vcxproj
+++ b/cpp/src/Ice/msbuild/ice++11/ice++11.vcxproj
@@ -75,7 +75,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -83,7 +83,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -91,7 +91,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -99,7 +99,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/cpp/src/Ice/msbuild/ice/ice.vcxproj b/cpp/src/Ice/msbuild/ice/ice.vcxproj
index c0865e33905..0f164e2e80e 100644
--- a/cpp/src/Ice/msbuild/ice/ice.vcxproj
+++ b/cpp/src/Ice/msbuild/ice/ice.vcxproj
@@ -80,7 +80,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -88,7 +88,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -96,7 +96,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -104,7 +104,7 @@
       <PreprocessorDefinitions>ICE_API_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
-      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib;Crypt32.lib</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;ws2_32.lib;Iphlpapi.lib;rpcrt4.lib;DbgHelp.lib;Shlwapi.lib</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/cpp/src/IceSSL/SSLEngine.h b/cpp/src/IceSSL/SSLEngine.h
index 9a48cd7f707..d9f1a87ca81 100644
--- a/cpp/src/IceSSL/SSLEngine.h
+++ b/cpp/src/IceSSL/SSLEngine.h
@@ -17,7 +17,6 @@
 
 #include <IceUtil/Shared.h>
 #include <IceUtil/Mutex.h>
-#include <IceUtil/UniqueRef.h>
 #include <Ice/CommunicatorF.h>
 #include <Ice/Network.h>
 
@@ -127,8 +126,8 @@ private:
     void parseCiphers(const std::string&);
 
     bool _initialized;
-    IceUtil::UniqueRef<CFArrayRef> _certificateAuthorities;
-    IceUtil::UniqueRef<CFArrayRef> _chain;
+    UniqueRef<CFArrayRef> _certificateAuthorities;
+    UniqueRef<CFArrayRef> _chain;
 
     SSLProtocol _protocolVersionMax;
     SSLProtocol _protocolVersionMin;
diff --git a/cpp/src/IceSSL/Util.cpp b/cpp/src/IceSSL/Util.cpp
index af02062389b..f262d09979f 100755
--- a/cpp/src/IceSSL/Util.cpp
+++ b/cpp/src/IceSSL/Util.cpp
@@ -14,7 +14,6 @@
 
 #include <IceSSL/Util.h>
 #include <IceUtil/FileUtil.h>
-#include <IceUtil/UniqueRef.h>
 #include <IceUtil/StringUtil.h>
 
 #include <Ice/Base64.h>
@@ -635,7 +634,6 @@ IceSSL::getCertificateProperty(SecCertificateRef cert, CFTypeRef key)
     {
         ostringstream os;
         os << "IceSSL: error getting property for certificate:\n" << errorToString(err);
-        CFRelease(err);
         throw CertificateReadException(__FILE__, __LINE__, os.str());
     }
 
diff --git a/cpp/src/IceSSL/Util.h b/cpp/src/IceSSL/Util.h
index ed706a6973e..fc6af1020cc 100644
--- a/cpp/src/IceSSL/Util.h
+++ b/cpp/src/IceSSL/Util.h
@@ -109,6 +109,63 @@ std::string getSslErrors(bool);
 
 #elif defined(ICE_USE_SECURE_TRANSPORT)
 
+template<typename T>
+class UniqueRef
+{
+public:
+
+    explicit UniqueRef(CFTypeRef ptr = 0) : _ptr((T)ptr)
+    {
+    }
+
+    ~UniqueRef()
+    {
+        if(_ptr != 0)
+        {
+            CFRelease(_ptr);
+        }
+    }
+
+    T release()
+    {
+        T r = _ptr;
+        _ptr = 0;
+        return r;
+    }
+
+    void reset(CFTypeRef ptr = 0)
+    {
+        if(_ptr == ptr)
+        {
+            return;
+        }
+        if(_ptr != 0)
+        {
+            CFRelease(_ptr);
+        }
+        _ptr = (T)ptr;
+    }
+
+    void retain(CFTypeRef ptr)
+    {
+        reset(ptr ? CFRetain(ptr) : ptr);
+    }
+
+    T get() const
+    {
+        return _ptr;
+    }
+
+    operator bool() const
+    {
+        return _ptr != 0;
+    }
+
+private:
+
+    T _ptr;
+};
+
 //
 // Helper functions to use by Secure Transport.
 //
diff --git a/cpp/test/Ice/proxy/AllTests.cpp b/cpp/test/Ice/proxy/AllTests.cpp
index f4c4176dfd2..269988a9119 100644
--- a/cpp/test/Ice/proxy/AllTests.cpp
+++ b/cpp/test/Ice/proxy/AllTests.cpp
@@ -1128,7 +1128,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Invalid -x option
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 99 -v abcd -x abc");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 99 -v abc -x abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1148,7 +1148,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Repeated -t
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 1 -t 1 -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 1 -t 1 -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1158,7 +1158,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Repeated -v
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 1 -v abcd -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t 1 -v abc -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1168,7 +1168,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Missing -t
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1188,7 +1188,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Missing arg for -t
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1208,7 +1208,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // Not a number for -t
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t x -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t x -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)
@@ -1218,7 +1218,7 @@ allTests(const Ice::CommunicatorPtr& communicator)
     try
     {
         // < 0 for -t
-        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t -1 -v abcd");
+        Ice::ObjectPrxPtr p = communicator->stringToProxy("id:opaque -t -1 -v abc");
         test(false);
     }
     catch(const Ice::EndpointParseException&)