Invalid cipher_default_page_size leaks a partially initialized codec context #615

Version and environment

Reproduced on SQLCipher commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc on Linux amd64. The build enables SQLCIPHER_TEST, SQLITE_HAS_CODEC, and SQLCipher extra init/shutdown so the private heap reports unreleased allocations.

Describe the bug

When sqlcipher_codec_ctx_init() fails while applying an invalid default page size, it has already allocated the codec context and both salt buffers. Neither the initializer nor sqlcipherCodecAttach() frees that partial context. Shutdown reports 160 bytes in three unreleased private-heap allocations.

Minimal reproduction

bash sqlcipher-012-inconclusive-partial-codec-context-leak-on-sqlcipher-c-5e3b9156/poc/reproduce_codec_ctx_leak.sh

The trigger executed by the included C harness is:

PRAGMA cipher_default_page_size = 123;
PRAGMA key = 'validation-key';
SELECT 1;

The control changes only the page size to 4096. In both cases the harness closes the database and calls sqlite3_shutdown().

Actual behavior/output

The trigger reports:

key rc=1
sqlcipher_codec_ctx_init: error 1 returned from sqlcipher_codec_ctx_set_pagesize with 123
sqlcipher_extra_shutdown: SQLCipher private heap unfreed memory 160 bytes in 3 allocations

The control's stderr contains no unreleased-private-heap report.

Expected behavior

Initialization failure should free the allocated codec context, kdf_salt, hmac_kdf_salt, and any initialized provider state before returning the error.

Impact and scope

Repeated failed key initialization with an invalid default page size retains private-heap allocations until global SQLCipher shutdown. This is a resource-cleanup defect, not a crash or data-integrity issue.

Relevant source/root cause

src/sqlcipher.c:1540, :1553, and :1560 allocate the context and salts. The page-size failure at :1583-1585 returns directly. sqlcipher_codec_ctx_free() at :1652-1663 could release them, but the caller's failure path around :3636-3643 does not invoke it.

Suggested regression test

Under SQLCIPHER_TEST, compare private-heap allocation counts before and after setting page size 123 and applying a key. Close and shut down, then assert zero unreleased allocations. Keep the valid-4096 control.

Reproduction bundle

Attached: sqlcipher-012-inconclusive-partial-codec-context-leak-on-sqlcipher-c-5e3b9156_attachment.zip. It contains the focused PoC, validation evidence, and candidate metadata.

sqlcipher-012-inconclusive-partial-codec-context-leak-on-sqlcipher-c-5e3b9156_attachment.zip