Ensure challenge-response key buffer is properly cleared.

The challenge-response key buffer is explicitly cleared
before the key transformation if no such key is configured
to ensure one is never injected into the hash even if the
database had a challenge-response key previously.

This patch also adds extensive tests for verifying that a
key change will not add any expired key material to the hash.

Fixes #4146

1 files changed, 4 insertions, 0 deletions

diff --git a/tests/TestKeePass2Format.h b/tests/TestKeePass2Format.h
index 2d4a4b85a..728d73ba9 100644
--- a/tests/TestKeePass2Format.h
+++ b/tests/TestKeePass2Format.h
@@ -62,6 +62,8 @@ private slots:
     void testKdbxAttachments();
     void testKdbxNonAsciiPasswords();
     void testKdbxDeviceFailure();
+    void testKdbxKeyChange();
+    void testKdbxKeyChange_data();
     void testDuplicateAttachments();
 
 protected:
@@ -84,6 +86,8 @@ protected:
                           QString& errorString) = 0;
     virtual void writeKdbx(QIODevice* device, Database* db, bool& hasError, QString& errorString) = 0;
 
+    QSharedPointer<Kdf> fastKdf(QSharedPointer<Kdf> kdf) const;
+
     QSharedPointer<Database> m_xmlDb;
     QSharedPointer<Database> m_kdbxSourceDb;
     QSharedPointer<Database> m_kdbxTargetDb;