Prepare release of version 2.3.3

Update to SQLite 3.53.0

Author: utelle

CHANGELOG.md

@@ -7,13 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.3.3] - 2026-04-10
+
+### Changed
+
+- Based on SQLite version 3.53.0
+
+### Fixed
+
+- Fixed issue [#230](../../issues/228) - Cipher data structures are not nullified securely on freeing
+
 ## [2.3.2] - 2026-03-19
 
 ### Fixed
 
-- Fixed issue [#227](../../issues/227) - Compile AEGIS with clang version 22 and above
-- Fixed issue [#228](../../issues/228) - Function `sqlite3mc_cipher_name` not thread-safe
-- Fixed issue [#229](../../issues/229) - Symbol conflicts when static linking to both `sqlite3mc` and `libsodium`
+- Fixed issue [#227](../../issues/226) - Compile AEGIS with clang version 22 and above
+- Fixed issue [#228](../../issues/227) - Function `sqlite3mc_cipher_name` not thread-safe
+- Fixed issue [#229](../../issues/228) - Symbol conflicts when static linking to both `sqlite3mc` and `libsodium`
 
 ## [2.3.1] - 2026-03-13
 
@@ -728,7 +738,8 @@ The following ciphers are supported:
 - AES 256 Bit CBC - SHA1/SHA256/SHA512 HMAC ([SQLCipher](https://www.zetetic.net/sqlcipher/), database versions 1, 2, 3, and 4)
 - RC4 - No HMAC ([System.Data.SQLite](http://system.data.sqlite.org))
 
-[Unreleased]: ../../compare/v2.3.2...HEAD
+[Unreleased]: ../../compare/v2.3.3...HEAD
+[2.3.3]: ../../compare/v2.3.2...v2.3.3
 [2.3.2]: ../../compare/v2.3.1...v2.3.2
 [2.3.1]: ../../compare/v2.3.0...v2.3.1
 [2.3.0]: ../../compare/v2.2.7...v2.3.0

CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.24.0.0)
-project(sqlite3mc VERSION 2.3.2)
+project(sqlite3mc VERSION 2.3.3)
 
 # Helper macro
 macro(_Enable_MT _target)

configure.ac

@@ -4,7 +4,7 @@ dnl Copyright (C) 2019-2026 Ulrich Telle <github@telle-online.de>
 dnl
 dnl This file is covered by the same licence as the entire SQLite3 Multiple Ciphers package.
 
-AC_INIT([sqlite3mc], [2.3.2], [github@telle-online.de])
+AC_INIT([sqlite3mc], [2.3.3], [github@telle-online.de])
 
 dnl This is the version tested with, might work with earlier ones.
 AC_PREREQ([2.69])

readme.md

@@ -10,10 +10,9 @@ The code was mainly developed under Windows, but was tested under Linux as well.
 
 ## Version information
 
-* 2.3.2 - *March 2026*
-  - Fixed issue #227: Compile AEGIS with clang version 22 and above
-  - Fixed issue #228: Function `sqlite3mc_cipher_name` not thread-safe
-  - Fixed issue #229: Symbol conflicts when static linking to both `sqlite3mc` and `libsodium`
+* 2.3.3 - *April 2026*
+  - Based on SQLite version 3.53.0
+  - Fixed issue #230: Cipher data structures are not nullified securely on freeing
 
 For further version information please consult the [CHANGELOG](CHANGELOG.md).
 

src/aegis/common/common.h

@@ -23,11 +23,7 @@
 #ifdef __ANDROID_API__
 #    if __ANDROID_API__ < 18
 #        undef HAVE_GETAUXVAL
-#    endif
-#    if defined(__clang__) || defined(__GNUC__)
-#        if __has_include(<cpu-features.h>)
-#            define HAVE_ANDROID_GETCPUFEATURES
-#        endif
+#        define HAVE_ANDROID_GETCPUFEATURES
 #    endif
 #endif
 #if defined(__i386__) || defined(_M_IX86) || defined(__x86_64__) || defined(_M_X64) || defined(_M_AMD64)

src/csv.c

@@ -64,6 +64,7 @@ SQLITE_EXTENSION_INIT1
 
 #ifndef SQLITEINT_H
 typedef sqlite3_int64 i64;
+typedef sqlite3_uint64 u64;
 #endif
 
 /* Max size of the error message in a CsvReader */
@@ -128,7 +129,7 @@ static int csv_reader_open(
   const char *zData           /*  ... or use this data */
 ){
   if( zFilename ){
-    p->zIn = sqlite3_malloc( CSV_INBUFSZ );
+    p->zIn = sqlite3_malloc64( CSV_INBUFSZ );
     if( p->zIn==0 ){
       csv_errmsg(p, "out of memory");
       return 1;
@@ -221,7 +222,7 @@ static char *csv_read_one_field(CsvReader *p){
   }
   if( c=='"' ){
     int pc, ppc;
-    int startLine = p->nLine;
+    i64 startLine = p->nLine;
     pc = ppc = 0;
     while( 1 ){
       c = csv_getc(p);
@@ -325,7 +326,7 @@ typedef struct CsvCursor {
   sqlite3_vtab_cursor base;       /* Base class.  Must be first */
   CsvReader rdr;                  /* The CsvReader object */
   char **azVal;                   /* Value of the current row */
-  int *aLen;                      /* Length of each entry */
+  i64 *aLen;                      /* Length of each entry */
   sqlite3_int64 iRowid;           /* The current rowid.  Negative for EOF */
 } CsvCursor;
 
@@ -497,7 +498,7 @@ static int csvtabConnect(
   CsvTable *pNew = 0;        /* The CsvTable object to construct */
   int bHeader = -1;          /* header= flags.  -1 means not seen yet */
   int rc = SQLITE_OK;        /* Result code from this routine */
-  int i, j;                  /* Loop counters */
+  u64 i, j;                  /* Loop counters */
 #ifdef SQLITE_TEST
   int tstFlags = 0;          /* Value for testflags=N parameter */
 #endif
@@ -516,7 +517,7 @@ static int csvtabConnect(
   assert( sizeof(azPValue)==sizeof(azParam) );
   memset(&sRdr, 0, sizeof(sRdr));
   memset(azPValue, 0, sizeof(azPValue));
-  for(i=3; i<argc; i++){
+  for(i=3; i<(u64)argc; i++){
     const char *z = argv[i];
     const char *zValue;
     for(j=0; j<sizeof(azParam)/sizeof(azParam[0]); j++){
@@ -563,7 +564,7 @@ static int csvtabConnect(
   ){
     goto csvtab_connect_error;
   }
-  pNew = sqlite3_malloc( sizeof(*pNew) );
+  pNew = sqlite3_malloc64( sizeof(*pNew) );
   *ppVtab = (sqlite3_vtab*)pNew;
   if( pNew==0 ) goto csvtab_connect_oom;
   memset(pNew, 0, sizeof(*pNew));
@@ -709,12 +710,12 @@ static int csvtabOpen(sqlite3_vtab *p, sqlite3_vtab_cursor **ppCursor){
   CsvTable *pTab = (CsvTable*)p;
   CsvCursor *pCur;
   size_t nByte;
-  nByte = sizeof(*pCur) + (sizeof(char*)+sizeof(int))*pTab->nCol;
+  nByte = sizeof(*pCur) + (sizeof(char*)+sizeof(i64))*pTab->nCol;
   pCur = sqlite3_malloc64( nByte );
   if( pCur==0 ) return SQLITE_NOMEM;
   memset(pCur, 0, nByte);
   pCur->azVal = (char**)&pCur[1];
-  pCur->aLen = (int*)&pCur->azVal[pTab->nCol];
+  pCur->aLen = (i64*)&pCur->azVal[pTab->nCol];
   *ppCursor = &pCur->base;
   if( csv_reader_open(&pCur->rdr, pTab->zFilename, pTab->zData) ){
     csv_xfer_error(pTab, &pCur->rdr);
@@ -946,6 +947,7 @@ static sqlite3_module CsvModuleFauxWrite = {
 
 #endif /* !defined(SQLITE_OMIT_VIRTUALTABLE) */
 
+
 #ifndef SQLITE_API
 #define SQLITE_API
 #endif

src/fileio.c

@@ -73,11 +73,6 @@
 **   $path is a relative path, then $path is interpreted relative to $dir.
 **   And the paths returned in the "name" column of the table are also
 **   relative to directory $dir.
-**
-** Notes on building this extension for Windows:
-**   Unless linked statically with the SQLite library, a preprocessor
-**   symbol, FILEIO_WIN32_DLL, must be #define'd to create a stand-alone
-**   DLL form of this extension for WIN32. See its use below for details.
 */
 #include "sqlite3ext.h"
 SQLITE_EXTENSION_INIT1
@@ -618,7 +613,7 @@ static int fsdirConnect(
   (void)pzErr;
   rc = sqlite3_declare_vtab(db, "CREATE TABLE x" FSDIR_SCHEMA);
   if( rc==SQLITE_OK ){
-    pNew = (fsdir_tab*)sqlite3_malloc( sizeof(*pNew) );
+    pNew = (fsdir_tab*)sqlite3_malloc64( sizeof(*pNew) );
     if( pNew==0 ) return SQLITE_NOMEM;
     memset(pNew, 0, sizeof(*pNew));
     sqlite3_vtab_config(db, SQLITE_VTAB_DIRECTONLY);
@@ -641,7 +636,7 @@ static int fsdirDisconnect(sqlite3_vtab *pVtab){
 static int fsdirOpen(sqlite3_vtab *p, sqlite3_vtab_cursor **ppCursor){
   fsdir_cursor *pCur;
   (void)p;
-  pCur = sqlite3_malloc( sizeof(*pCur) );
+  pCur = sqlite3_malloc64( sizeof(*pCur) );
   if( pCur==0 ) return SQLITE_NOMEM;
   memset(pCur, 0, sizeof(*pCur));
   pCur->iLvl = -1;

src/regexp.c

@@ -146,7 +146,7 @@ static void re_add_state(ReStateSet *pSet, int newState){
 
 /* Extract the next unicode character from *pzIn and return it.  Advance
 ** *pzIn to the first byte past the end of the character returned.  To
-** be clear:  this routine converts utf8 to unicode.  This routine is
+** be clear:  this routine converts utf8 to unicode.  This routine is 
 ** optimized for the common case where the next character is a single byte.
 */
 static unsigned re_next_char(ReInput *p){
@@ -217,7 +217,7 @@ static int re_match(ReCompiled *pRe, const unsigned char *zIn, int nIn){
   /* Look for the initial prefix match, if there is one. */
   if( pRe->nInit ){
     unsigned char x = pRe->zInit[0];
-    while( in.i+pRe->nInit<=in.mx
+    while( in.i+pRe->nInit<=in.mx 
      && (zIn[in.i]!=x ||
          strncmp((const char*)zIn+in.i, (const char*)pRe->zInit, pRe->nInit)!=0)
     ){
@@ -676,7 +676,7 @@ static const char *re_compile(
   int i, j;
 
   *ppRe = 0;
-  pRe = sqlite3_malloc( sizeof(*pRe) );
+  pRe = sqlite3_malloc64( sizeof(*pRe) );
   if( pRe==0 ){
     return "out of memory";
   }
@@ -712,7 +712,7 @@ static const char *re_compile(
   /* The following is a performance optimization.  If the regex begins with
   ** ".*" (if the input regex lacks an initial "^") and afterwards there are
   ** one or more matching characters, enter those matching characters into
-  ** zInit[].  The re_match() routine can then search ahead in the input
+  ** zInit[].  The re_match() routine can then search ahead in the input 
   ** string looking for the initial match without having to run the whole
   ** regex engine over the string.  Do not worry about trying to match
   ** unicode characters beyond plane 0 - those are very rare and this is
@@ -828,7 +828,6 @@ static void re_bytecode_func(
   int i;
   int n;
   char *z;
-  (void)argc;
   static const char *ReOpName[] = {
     "EOF",
     "MATCH",
@@ -851,6 +850,7 @@ static void re_bytecode_func(
     "ATSTART",
   };
 
+  (void)argc;
   zPattern = (const char*)sqlite3_value_text(argv[0]);
   if( zPattern==0 ) return;
   zErr = re_compile(&pRe, zPattern, re_maxnfa(re_maxlen(context)),
@@ -901,14 +901,14 @@ static void re_bytecode_func(
 #endif
 SQLITE_API
 int sqlite3_regexp_init(
-  sqlite3 *db,
-  char **pzErrMsg,
+  sqlite3 *db, 
+  char **pzErrMsg, 
   const sqlite3_api_routines *pApi
 ){
   int rc = SQLITE_OK;
   SQLITE_EXTENSION_INIT2(pApi);
   (void)pzErrMsg;  /* Unused */
-  rc = sqlite3_create_function(db, "regexp", 2,
+  rc = sqlite3_create_function(db, "regexp", 2, 
                             SQLITE_UTF8|SQLITE_INNOCUOUS|SQLITE_DETERMINISTIC,
                             0, re_sql_func, 0, 0);
   if( rc==SQLITE_OK ){

src/rekeyvacuum.c

@@ -27,7 +27,7 @@
 ** Change 4: Call sqlite3mcBtreeSetPageSize instead of sqlite3BtreeSetPageSize for main database
 **           (sqlite3mcBtreeSetPageSize allows to reduce the number of reserved bytes)
 **
-** This code is generated by the script rekeyvacuum.sh from SQLite version 3.51.3 amalgamation.
+** This code is generated by the script rekeyvacuum.sh from SQLite version 3.53.0 amalgamation.
 */
 SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3mcRunVacuumForRekey(
   char **pzErrMsg,        /* Write error message here */
@@ -118,9 +118,19 @@ SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3mcRunVacuumForRekey(
   pDb = &db->aDb[nDb];
   assert( strcmp(pDb->zDbSName,zDbVacuum)==0 );
   pTemp = pDb->pBt;
+
+  /* A VACUUM cannot change the pagesize of an encrypted database. */
+  if( db->nextPagesize ){
+    extern void sqlite3mcCodecGetKey(sqlite3*, int, void**, int*);
+    int nKey;
+    char *zKey;
+    sqlite3mcCodecGetKey(db, iDb, (void**)&zKey, &nKey);
+    if( nKey ) db->nextPagesize = 0;
+  }
   if( pOut ){
     sqlite3_file *id = sqlite3PagerFile(sqlite3BtreePager(pTemp));
     i64 sz = 0;
+    const char *zFilename;
     if( id->pMethods!=0 && (sqlite3OsFileSize(id, &sz)!=SQLITE_OK || sz>0) ){
       rc = SQLITE_ERROR;
       sqlite3SetString(pzErrMsg, db, "output file already exists");
@@ -132,15 +142,14 @@ SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3mcRunVacuumForRekey(
     ** they are for the database being vacuumed, except that PAGER_CACHESPILL
     ** is always set. */
     pgflags = db->aDb[iDb].safety_level | (db->flags & PAGER_FLAGS_MASK);
-  }
 
-  /* A VACUUM cannot change the pagesize of an encrypted database. */
-  if( db->nextPagesize ){
-    extern void sqlite3mcCodecGetKey(sqlite3*, int, void**, int*);
-    int nKey;
-    char *zKey;
-    sqlite3mcCodecGetKey(db, iDb, (void**)&zKey, &nKey);
-    if( nKey ) db->nextPagesize = 0;
+    /* If the VACUUM INTO target file is a URI filename and if the
+    ** "reserve=N" query parameter is present, reset the reserve to the
+    ** amount specified, if the amount is within range */
+    zFilename = sqlite3BtreeGetFilename(pTemp);
+    if( ALWAYS(zFilename) ){
+      int nNew = (int)sqlite3_uri_int64(zFilename, "reserve", nRes);
+    }
   }
 
   sqlite3BtreeSetCacheSize(pTemp, db->aDb[iDb].pSchema->cache_size);

src/series.c

@@ -239,7 +239,7 @@ static int seriesConnect(
   rc = sqlite3_declare_vtab(db,
      "CREATE TABLE x(value,start hidden,stop hidden,step hidden)");
   if( rc==SQLITE_OK ){
-    pNew = *ppVtab = sqlite3_malloc( sizeof(*pNew) );
+    pNew = *ppVtab = sqlite3_malloc64( sizeof(*pNew) );
     if( pNew==0 ) return SQLITE_NOMEM;
     memset(pNew, 0, sizeof(*pNew));
     sqlite3_vtab_config(db, SQLITE_VTAB_INNOCUOUS);
@@ -261,7 +261,7 @@ static int seriesDisconnect(sqlite3_vtab *pVtab){
 static int seriesOpen(sqlite3_vtab *pUnused, sqlite3_vtab_cursor **ppCursor){
   series_cursor *pCur;
   (void)pUnused;
-  pCur = sqlite3_malloc( sizeof(*pCur) );
+  pCur = sqlite3_malloc64( sizeof(*pCur) );
   if( pCur==0 ) return SQLITE_NOMEM;
   memset(pCur, 0, sizeof(*pCur));
   *ppCursor = &pCur->base;