Is building upon existing open source the smart way to go, or will it prove to have legal or other difficulties in the future?
Depends on the license. I'm building my backup system (http://www.tarsnap.com/) around the BSD-licensed libarchive library, and I don't forsee any problems at all. If libarchive were GPL-licensed... well, I wouldn't be using it, because tarsnap is not open source.
(Incidentally, this is a perfect example of where the BSD license encourages more contributions than the GPL -- glancing over my CVS commitmail, I see 52 commits I've made to libarchive code in the past 18 months, which is 52 commits more than I would have done if it was GPLed.)