Provider ctx_init failure leaks a partially initialized codec context #611

Version and environment

Reproduced on SQLCipher commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc, Linux amd64, with a SQLCIPHER_TEST build that reports private-heap allocations at shutdown.

Describe the bug

If a registered crypto provider's ctx_init callback returns SQLITE_ERROR, sqlcipher_codec_ctx_init() has already allocated the codec context and two salt buffers. It returns without freeing them, and the attach caller also omits cleanup. Shutdown reports 160 bytes in three unreleased allocations.

Minimal reproduction

bash sqlcipher-025-inconclusive-partial-codec-context-cleanup-on-initiali-ef4881a8/poc/run_repro.sh

The included bad_provider_leak_harness.c registers a provider whose initialization callback is:

static int bad_ctx_init(void **ctx) {
  *ctx = 0;
  fprintf(stderr, "poc025: provider ctx_init returning SQLITE_ERROR\n");
  return SQLITE_ERROR;
}

It opens :memory:, registers the provider, executes PRAGMA key='poc025-passphrase'; CREATE TABLE t(x);, closes the connection, and calls sqlite3_shutdown().

Actual behavior/output

poc025: provider ctx_init returning SQLITE_ERROR
sqlcipher_codec_ctx_init: error 1 returned from ctx_init
sqlcipherCodecAttach: context initialization failed
sqlcipher_extra_shutdown: SQLCipher private heap unfreed memory 160 bytes in 3 allocations

The harness exits 0 and the separate SELECT 42 liveness check succeeds.

Expected behavior

If provider initialization fails, all allocations owned by the partial codec context must be freed before the error is returned. Shutdown should report no retained private-heap blocks from the failed attach.

Impact and scope

A failing third-party or built-in provider initialization path retains resources. Repeated failures can accumulate allocations during process lifetime. This report is limited to the provider->ctx_init failure point.

Relevant source/root cause

src/sqlcipher.c:1540, :1553, and :1560 allocate the codec context and salts. The provider failure at :1569-1571 returns immediately instead of using sqlcipher_codec_ctx_free(). The caller around :3636-3643 sets error state and jumps to cleanup without freeing the partial ctx.

Suggested regression test

Register a deterministic provider whose ctx_init fails, attempt to apply a key, close/shutdown, and assert that the private-heap allocation count returns to baseline. Also exercise failures after a provider context has itself been allocated.

Reproduction bundle

Attached: sqlcipher-025-inconclusive-partial-codec-context-cleanup-on-initiali-ef4881a8_attachment.zip. It contains the focused PoC, validation evidence, and candidate metadata.

sqlcipher-025-inconclusive-partial-codec-context-cleanup-on-initiali-ef4881a8_attachment.zip