From 9868d9c4352435b6debafe885b579e95ff143365 Mon Sep 17 00:00:00 2001 From: Mathias Berchtold Date: Mon, 9 Nov 2026 00:59:35 +0800 Subject: [PATCH] Recognize binary raw keys containing hexadecimal ASCII bytes sqlite3mcExtractRawKey classifies raw payloads as hex before checking their length. A valid 32-byte binary ChaCha20 key such as 32 bytes of 0x33 is then rejected because it is too short for a hex-encoded key. The same affects a binary key plus salt when all 48 bytes happen to be hexadecimal characters. Only select hex decoding for a supported encoded length. Preserve binary key bytes and the existing handling of valid hex keys and optional salts. --- src/codec_algos.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/codec_algos.c b/src/codec_algos.c index 329416d..3bd256e 100644 --- a/src/codec_algos.c +++ b/src/codec_algos.c @@ -245,7 +245,9 @@ sqlite3mcExtractRawKey(const char* password, int passwordLength, { const int nRaw = passwordLength - 4; const unsigned char* zRaw = (const unsigned char*) password + 4; - int isHex = sqlite3mcIsHexKey(zRaw, nRaw); + /* A binary key can consist entirely of hexadecimal ASCII bytes. */ + int isHex = (nRaw == 2 * keyLength || nRaw == 2 * (keyLength + saltLength)) + && sqlite3mcIsHexKey(zRaw, nRaw); if (isHex) { if (nRaw == 2 * (keyLength + saltLength))