From c1f7fe783c25058517c6c90c5d38e198c8d32fa2 Mon Sep 17 00:00:00 2001
From: Nick Parker <nparker@zetetic.net>
Date: Wed, 25 May 2016 16:37:54 -0500
Subject: [PATCH] Prevent writing database with cipher set to invalid value

---
 src/crypto.c      |  4 ++--
 src/crypto_impl.c |  7 +++++--
 test/crypto.test  | 43 ++++++++++++++++++++++++++-----------------
 3 files changed, 33 insertions(+), 21 deletions(-)

diff --git a/src/crypto.c b/src/crypto.c
index 2241fb8..da8d71b 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -143,11 +143,11 @@ int sqlcipher_codec_pragma(sqlite3* db, int iDb, Parse *pParse, const char *zLef
   if( sqlite3StrICmp(zLeft, "cipher")==0 ){
     if(ctx) {
       if( zRight ) {
-        sqlcipher_codec_ctx_set_cipher(ctx, zRight, 2); // change cipher for both
+        rc = sqlcipher_codec_ctx_set_cipher(ctx, zRight, 2); // change cipher for both
         char *pragma_cipher_deprecated_msg = "PRAGMA cipher command is deprecated, please remove from usage.";
         codec_vdbe_return_static_string(pParse, "cipher", pragma_cipher_deprecated_msg);
         sqlite3_log(SQLITE_WARNING, pragma_cipher_deprecated_msg);
-        return SQLITE_ERROR;
+        return rc;
       }else {
         codec_vdbe_return_static_string(pParse, "cipher",
           sqlcipher_codec_ctx_get_cipher(ctx, 2));
diff --git a/src/crypto_impl.c b/src/crypto_impl.c
index 4c6b71f..8a3e61f 100644
--- a/src/crypto_impl.c
+++ b/src/crypto_impl.c
@@ -494,8 +494,11 @@ int sqlcipher_codec_ctx_set_cipher(codec_ctx *ctx, const char *cipher_name, int
   cipher_ctx *c_ctx = for_ctx ? ctx->write_ctx : ctx->read_ctx;
   int rc;
 
-  c_ctx->provider->set_cipher(c_ctx->provider_ctx, cipher_name);
-
+  rc = c_ctx->provider->set_cipher(c_ctx->provider_ctx, cipher_name);
+  if(rc != SQLITE_OK){
+    sqlcipher_codec_ctx_set_error(ctx, rc);
+    return rc;
+  }
   c_ctx->key_sz = c_ctx->provider->get_key_sz(c_ctx->provider_ctx);
   c_ctx->iv_sz = c_ctx->provider->get_iv_sz(c_ctx->provider_ctx);
   c_ctx->block_sz = c_ctx->provider->get_block_sz(c_ctx->provider_ctx);
diff --git a/test/crypto.test b/test/crypto.test
index 0caf7aa..d582ed4 100644
--- a/test/crypto.test
+++ b/test/crypto.test
@@ -614,7 +614,7 @@ do_test non-standard-kdf-and-ciphers {
     SELECT count(*) FROM t1;
   } 
 
-} {2}
+} {{PRAGMA cipher command is deprecated, please remove from usage.} 2}
 db close
 file delete -force test.db
 
@@ -649,7 +649,7 @@ do_test rekey-from-cbc-to-ecb-no-iv {
     SELECT count(*) FROM t1;
   } 
 
-} {1001}
+} {{PRAGMA cipher command is deprecated, please remove from usage.} 1001}
 db close
 file delete -force test.db
 
@@ -1069,7 +1069,7 @@ do_test attached-database-pragmas {
     PRAGMA cipher_use_hmac = OFF;
     SELECT count(*) FROM t1;
   }
-} {1000}
+} {{PRAGMA cipher command is deprecated, please remove from usage.} 1000}
 db close
 file delete -force test.db
 file delete -force test2.db
@@ -1541,7 +1541,7 @@ do_test verify-pragma-cipher-version {
     execsql {
         PRAGMA cipher_version;
     }
-} {3.3.1}
+} {3.4.0}
 db close
 file delete -force test.db
 
@@ -1922,18 +1922,6 @@ do_test verify-pragma-cipher-page-size-changed {
 db close
 file delete -force test.db
 
-# verify invalid cipher does not cause segfault
-if_built_with_openssl verify-invalid-cipher-does-not-segfault {
-    sqlite_orig db test.db
-    execsql {
-        PRAGMA key = 'test';
-        PRAGMA cipher = 'junk';
-        PRAGMA cipher;
-    }
-} {AES-256-CBC}
-db close
-file delete -force test.db
-
 # verify setting cipher_store_pass before key
 # does not cause segfault
 do_test verify-cipher-store-pass-before-key-does-not-segfault {
@@ -1967,7 +1955,7 @@ if_built_with_openssl verify-pragma-cipher-changed {
         PRAGMA cipher = 'AES-256-ECB';
         PRAGMA cipher;
     }
-} {AES-256-ECB}
+} {{PRAGMA cipher command is deprecated, please remove from usage.} AES-256-ECB}
 db close
 file delete -force test.db
 
@@ -2302,5 +2290,26 @@ do_test attach_database_with_non_default_page_size {
 db close
 file delete -force test.db test2.db
 
+if_built_with_openssl wont-write-database-with-invalid-cipher {
+    sqlite_orig db test.db
+    catchsql {
+        PRAGMA key = 'test';
+        PRAGMA cipher = 'foobar';
+        CREATE TABLE t1(a,b);
+    }
+} {1 {SQL logic error or missing database}}
+db close
+file delete -force test.db
+
+if_built_with_openssl wont-write-database-with-invalid-cipher-2 {
+    sqlite_orig db test.db
+    execsql {
+        PRAGMA key = 'test';
+        PRAGMA cipher = 'foobar';
+    }
+} {{PRAGMA cipher command is deprecated, please remove from usage.}}
+db close
+file delete -force test.db
+
 sqlite3_test_control_pending_byte $old_pending_byte
 finish_test