From 0ec644dc1ab7824447d2ef933a75b33dde45f9c7 Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Sat, 20 Jun 2026 13:36:13 +0200
Subject: [PATCH] Handle CredWrite memory failures

---
 src/Exceptions/KeyStorageException.cs          | 15 +++++++++++++++
 src/KeePassWinHello.csproj                     |  3 ++-
 src/KeyManagement/Storage/KeyWindowsStorage.cs | 17 ++++++++++++++++-
 3 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 src/Exceptions/KeyStorageException.cs

diff --git a/src/Exceptions/KeyStorageException.cs b/src/Exceptions/KeyStorageException.cs
new file mode 100644
index 0000000..633e3a7
--- /dev/null
+++ b/src/Exceptions/KeyStorageException.cs
@@ -0,0 +1,15 @@
+using System;
+using System.Runtime.Serialization;
+
+namespace KeePassWinHello
+{
+    [Serializable]
+    public class KeyStorageException : KeePassWinHelloException
+    {
+        public override bool IsPresentable { get { return true; } }
+
+        public KeyStorageException(string message) : base(message) { }
+        public KeyStorageException(string message, Exception inner) : base(message, inner) { }
+        protected KeyStorageException(SerializationInfo info, StreamingContext context) : base(info, context) { }
+    }
+}
diff --git a/src/KeePassWinHello.csproj b/src/KeePassWinHello.csproj
index 4157642..4e96bc3 100644
--- a/src/KeePassWinHello.csproj
+++ b/src/KeePassWinHello.csproj
@@ -61,6 +61,7 @@
     <Compile Include="Exceptions\AuthProviderInvalidKeyException.cs" />
     <Compile Include="Exceptions\AuthProviderSystemErrorException.cs" />
     <Compile Include="Exceptions\AuthProviderException.cs" />
+    <Compile Include="Exceptions\KeyStorageException.cs" />
     <Compile Include="AuthProviders\IAuthProvider.cs" />
     <Compile Include="AuthProviders\UIContext.cs" />
     <Compile Include="AuthProviders\WinHelloProviderForegroundDecorator.cs" />
@@ -124,4 +125,4 @@
     <Message Importance="normal" Text="Copy artifacts to KeePass plugins directory." />
     <Exec ContinueOnError="true" Command="powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File &quot;$(ProjectDir)..\Deploy-Plugin.ps1&quot; -ForDebug -Verbose" WorkingDirectory="$(ProjectDir).." />
   </Target>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/src/KeyManagement/Storage/KeyWindowsStorage.cs b/src/KeyManagement/Storage/KeyWindowsStorage.cs
index 1dca357..1caf911 100644
--- a/src/KeyManagement/Storage/KeyWindowsStorage.cs
+++ b/src/KeyManagement/Storage/KeyWindowsStorage.cs
@@ -10,6 +10,7 @@ namespace KeePassWinHello
     internal class KeyWindowsStorage : IKeyStorage
     {
         #region Credential Manager API
+        private const int ERROR_NOT_ENOUGH_MEMORY = 0x8;
         private const int ERROR_NOT_FOUND = 0x490;
 
         private const int CRED_TYPE_GENERIC = 0x1;
@@ -96,7 +97,21 @@ public void AddOrUpdate(string dbPath, ProtectedKey protectedKey)
                     Marshal.Copy(data, 0, ncred.CredentialBlob, data.Length);
                     ncred.CredentialBlobSize = (uint)data.Length;
 
-                    CredWrite(ref ncred, 0).ThrowOnError("CredWrite");
+                    try
+                    {
+                        CredWrite(ref ncred, 0).ThrowOnError("CredWrite");
+                    }
+                    catch (EnviromentErrorException ex)
+                    {
+                        if (ex.ErrorCode != ERROR_NOT_ENOUGH_MEMORY)
+                            throw;
+
+                        throw new KeyStorageException(
+                            "Windows Credential Manager reported that there was not enough memory to store this database key (CredWrite error 0x8)." +
+                            Environment.NewLine +
+                            "The database was locked, but the key was not saved for Windows Hello unlock. KeePass may ask for the regular master key next time.",
+                            ex);
+                    }
                 }
                 finally
                 {