Index: SQLite.Interop/crypt.c
==================================================================
--- SQLite.Interop/crypt.c
+++ SQLite.Interop/crypt.c
@@ -1,25 +1,29 @@
+#ifdef SQLITE_HAS_CODEC
+  void sqlite3pager_free_codecarg(void *pArg);
+#endif
+
 #include "src/pager.c"
 
 #ifndef SQLITE_OMIT_DISKIO
 #ifdef SQLITE_HAS_CODEC
 
 #include <windows.h>
 #include <wincrypt.h>
 
-HCRYPTPROV g_hProvider = 0; // Global instance of the cryptographic provider
-
-#define SQLITECRYPTERROR_PROVIDER "Cryptographic provider not available"
-
 typedef struct _CRYPTBLOCK
 {
   HCRYPTKEY hReadKey;     // Key used to read from the database and write to the journal
   HCRYPTKEY hWriteKey;    // Key used to write to the database
   DWORD     dwPageSize;   // Size of pages
   LPVOID    pvCrypt;      // A buffer for encrypting/decrypting (if necessary)
   DWORD     dwCryptSize;  // Equal to or greater than dwPageSize.  If larger, pvCrypt is valid and this is its size
 } CRYPTBLOCK, *LPCRYPTBLOCK;
+
+HCRYPTPROV g_hProvider = 0; // Global instance of the cryptographic provider
+
+#define SQLITECRYPTERROR_PROVIDER "Cryptographic provider not available"
 
 // Needed for re-keying
 static void * sqlite3pager_get_codecarg(Pager *pPager)
 {
   return (pPager->xCodec) ? pPager->pCodecArg: NULL;
@@ -248,10 +252,27 @@
     sqlite3pager_set_codec(sqlite3BtreePager(db->aDb[nDb].pBt), sqlite3Codec, pBlock);
     rc = SQLITE_OK;
   }
   return rc;
 }
+
+void sqlite3pager_free_codecarg(void *pArg)
+{
+  LPCRYPTBLOCK pBlock = (LPCRYPTBLOCK)pArg;
+
+  if (pBlock)
+  {
+    if (pBlock->hReadKey)
+      CryptDestroyKey(pBlock->hReadKey);
+    if (pBlock->hWriteKey)
+      CryptDestroyKey(pBlock->hWriteKey);
+
+    if (pBlock->pvCrypt)
+      free(pBlock->pvCrypt);
+  }
+  free(pBlock);
+}
 
 // Once a password has been supplied and a key created, we don't keep the 
 // original password for security purposes.  Therefore return NULL.
 void sqlite3CodecGetKey(sqlite3 *db, int nDb, void **ppKey, int *pnKeyLen)
 {