Merge pull request #812 from kennethshackleton/use-explicit-bzero

Use explicit_bzero for key scrubbing in JNI

Author: kennethshackleton

SQLite3/sqlite3/include/bloomberg/AutoJByteArray.h

@@ -18,8 +18,10 @@
 #define SELEKT_AUTOJBYTEARRAY_H
 
 #include <jni.h>
+#include <cstring>
 #include <stdexcept>
 #include "Throws.h"
+#include "secure_zero.h"
 
 struct JniOutOfMemoryError : std::runtime_error {
     using std::runtime_error::runtime_error;
@@ -40,6 +42,7 @@ class AutoJByteArray
     }
 
     ~AutoJByteArray() {
+        selekt::secure_zero(reinterpret_cast<unsigned char*>(mpBytes), static_cast<size_t>(mLength));
         mEnv->ReleaseByteArrayElements(mJArray, mpBytes, JNI_ABORT);
     }
 

SQLite3/sqlite3/include/bloomberg/secure_zero.h

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2020 Bloomberg Finance L.P.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SELEKT_SECURE_ZERO_H
+#define SELEKT_SECURE_ZERO_H
+
+#include <cstddef>
+#include <cstring>
+
+#if defined(__GLIBC__) || (defined(__ANDROID_API__) && __ANDROID_API__ >= 28)
+#include <strings.h>
+#endif
+
+namespace selekt {
+    inline void secure_zero(unsigned char* p, size_t n) {
+#if defined(__cpp_lib_memset_explicit) || (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L)
+        memset_explicit(p, 0, n);
+#elif defined(__GLIBC__) || (defined(__ANDROID_API__) && __ANDROID_API__ >= 28)
+        explicit_bzero(p, n);
+#else
+        volatile unsigned char* pp = p;
+        while (n--) { *pp++ = 0; }
+#endif
+    }
+}
+
+#endif //SELEKT_SECURE_ZERO_H

SQLite3/sqlite3_jni.cpp

@@ -100,9 +100,8 @@ void throwOutOfMemoryError(JNIEnv* env, const char* message) {
     }
 }
 
-static inline void updateHolder(JNIEnv* env, jlongArray array, int offset, void* p) {
-    auto val = reinterpret_cast<jlong>(p);
-    env->SetLongArrayRegion(array, offset, 1, &val);
+static inline void updateHolder(JNIEnv* env, jlongArray array, int offset, jlong value) {
+    env->SetLongArrayRegion(array, offset, 1, &value);
 }
 
 static jbyteArray newByteArray(JNIEnv* env, const void* p, jsize size) {
@@ -133,24 +132,21 @@ static jint rawKey(
         return SQLITE_ERROR;
     }
     try {
-    AutoJByteArray key(env, jkey, keyLength);
-    char sql[81];
-    std::memcpy(sql, "PRAGMA key=\"x'", 14);
-    const char hex_chars[] = "0123456789abcdef";
-    for (int i = 0; i < keyLength; ++i) {
-        auto byte = static_cast<std::byte>(key[i]);
-        sql[14 + 2*i]     = hex_chars[std::to_integer<unsigned char>(byte >> 4)];
-        sql[14 + 2*i + 1] = hex_chars[std::to_integer<unsigned char>(byte & std::byte{0xF})];
-    }
-    sql[78] = '\'';
-    sql[79] = '"';
-    sql[80] = '\0';
-    auto result = sqlite3_exec(reinterpret_cast<sqlite3*>(jdb), sql, nullptr, nullptr, nullptr);
-    volatile char* p = sql;
-    for (size_t i = 0; i < sizeof(sql); ++i) {
-        p[i] = '\0';
-    }
-    return result;
+        AutoJByteArray key(env, jkey, keyLength);
+        char sql[81];
+        std::memcpy(sql, "PRAGMA key=\"x'", 14);
+        const char hex_chars[] = "0123456789abcdef";
+        for (int i = 0; i < keyLength; ++i) {
+            auto byte = static_cast<std::byte>(key[i]);
+            sql[14 + 2*i] = hex_chars[std::to_integer<unsigned char>(byte >> 4)];
+            sql[15 + 2*i] = hex_chars[std::to_integer<unsigned char>(byte & std::byte{0xF})];
+        }
+        sql[78] = '\'';
+        sql[79] = '"';
+        sql[80] = '\0';
+        auto result = sqlite3_exec(reinterpret_cast<sqlite3*>(jdb), sql, nullptr, nullptr, nullptr);
+        selekt::secure_zero(reinterpret_cast<unsigned char*>(sql), sizeof(sql));
+        return result;
     } catch (const JniOutOfMemoryError&) {
         return SQLITE_NOMEM;
     }
@@ -356,7 +352,7 @@ Java_com_bloomberg_selekt_ExternalSQLite_blobOpen(
     env->ReleaseStringUTFChars(jtable, table);
     env->ReleaseStringUTFChars(jcolumn, column);
     if (result == SQLITE_OK) {
-        updateHolder(env, jholder, 0, blob);
+        updateHolder(env, jholder, 0, reinterpret_cast<jlong>(blob));
     }
     return result;
 }
@@ -970,7 +966,7 @@ Java_com_bloomberg_selekt_ExternalSQLite_openV2(
     }
     auto result = sqlite3_open_v2(filename, &db, jflags, nullptr);
     env->ReleaseStringUTFChars(jfilename, filename);
-    updateHolder(env, dbHolder, 0, db);
+    updateHolder(env, dbHolder, 0, reinterpret_cast<jlong>(db));
     return result;
 }
 
@@ -992,7 +988,7 @@ Java_com_bloomberg_selekt_ExternalSQLite_prepareV2(
     auto result = sqlite3_prepare_v2(reinterpret_cast<sqlite3*>(jdb), sql, jlength, &statement, nullptr);
     env->ReleaseStringUTFChars(jsql, sql);
     if (result == SQLITE_OK) {
-        updateHolder(env, statementHolder, 0, statement);
+        updateHolder(env, statementHolder, 0, reinterpret_cast<jlong>(statement));
     }
     return result;
 }