SealSettings(args) { // <<---- args is on the enclave stack but the struct it points to is in the host process region
 if (!in_host_process(args->data_to_seal, args->sz_data_to_seal)) { // <<--- checked here
  return ERROR;
 }
// << --- host process threads can write the region here
 size_t local_size = args->sz_data_to_seal + 4;

 void* local_buffer = malloc(local_size);

 // \/ ---- BUG - thread in host process may change args->data_to_seal before it is used in memcpy below.

 memcpy(local_buffer,args->data_to_seal, local_size);

 EnclaveSealData(local_buffer, local_size, args->protectedBlob, args->sz_protected_blob, &needed);

 return needed;

}