resilar / sqleet

SQLite3 encryption that sucks less
The Unlicense
375 stars 55 forks source link

sqlite3_key throws access violation if it passed string literal as pKey #14

Closed ryokash closed 6 years ago

ryokash commented 6 years ago

reproduction code:

const char* key = "testkey";
int len = 7
sqlite3_key(db, key, len);

or

sqlite3_key(db, "testkey", 7);
resilar commented 6 years ago

Thanks for reporting the issue.

The root cause is that sqleet zeroes out the provided key buffer after key derivation as a security measure. However, this causes the access violation on a read-only buffer. This is clearly not acceptable behavior and has been fixed in the master. The responsibility of managing key memory belongs to the user.