rule,idx,project,file,line,verdict,reason,provenance,confidence
DCL13-C,0,sqlite,ext/misc/anycollseq.c,26,FP,void* NotUsed is an ignored callback param; const adds nothing and signature is fixed by sqlite3_collation_needed contract,,
INT31-C,1,sqlite,ext/misc/anycollseq.c,32,FP,"n = min(nKey1,nKey2), both non-negative key lengths from sqlite collation API; benign size_t conversion",,
INT32-C,2,sqlite,ext/misc/anycollseq.c,33,FP,"nKey1-nKey2 are small non-negative blob lengths; classic memcmp-style tiebreak, no realistic overflow",,
DCL13-C,3,sqlite,ext/misc/anycollseq.c,38,FP,void* NotUsed ignored callback param; fixed collation-needed callback signature,,
API00-C,4,sqlite,ext/misc/anycollseq.c,49,FP,"pApi param consumed by SQLITE_EXTENSION_INIT2; loader contract, not caller-validated",,
DCL15-C,5,sqlite,ext/misc/anycollseq.c,49,FP,sqlite3_anycollseq_init must have external linkage (dlopen entry point),,
DCL13-C,6,sqlite,ext/misc/anycollseq.c,51,FP,pzErrMsg is the standard init out-param; signature fixed by extension API,,
DCL13-C,7,sqlite,ext/misc/blobio.c,35,FP,argv is sqlite3_value** SQL-function arg array; signature fixed by sqlite3_create_function,,
FIO42-C,8,sqlite,ext/misc/blobio.c,69,FP,"'rc' is an int return code from sqlite3_blob_open, not a file descriptor; no open()/close() involved",,
EXP34-C,9,sqlite,ext/misc/blobio.c,75,FP,pBlob is non-NULL: sqlite3_blob_open returned rc==0 (checked line 70) so pBlob is set,,
EXP34-C,10,sqlite,ext/misc/blobio.c,76,FP,"sqlite3_blob_close accepts NULL by API contract, and pBlob is valid here anyway",,
DCL13-C,11,sqlite,ext/misc/blobio.c,88,FP,argv is SQL-function arg array; fixed signature,,
FIO42-C,12,sqlite,ext/misc/blobio.c,121,FP,"'rc' is sqlite3_blob_open return code, not a file descriptor",,
EXP34-C,13,sqlite,ext/misc/blobio.c,126,FP,pBlob valid: open succeeded (rc==0 checked at 122) before blob_write,,
EXP34-C,14,sqlite,ext/misc/blobio.c,127,FP,sqlite3_blob_close tolerates NULL; pBlob valid here,,
API00-C,15,sqlite,ext/misc/blobio.c,135,FP,pApi is init-function loader-contract param consumed by EXTENSION_INIT2,,
DCL13-C,16,sqlite,ext/misc/blobio.c,139,FP,pzErrMsg standard init out-param; fixed signature,,
DCL13-C,17,sqlite,ext/misc/compress.c,49,FP,argv is SQL-function arg array; fixed signature,,
INT14-C,18,sqlite,ext/misc/compress.c,61,FP,readability heuristic; nIn arithmetic is intentional and clear sizing math,,
INT30-C,19,sqlite,ext/misc/compress.c,61,FP,nIn+999 with nIn bounded by SQLITE_MAX_LENGTH cannot wrap unsigned,,
INT30-C,20,sqlite,ext/misc/compress.c,62,FP,nOut+5 with bounded nOut cannot wrap,,
ARR30-C,21,sqlite,ext/misc/compress.c,64,FP,"x[8] indexed by i in [0,4]; in bounds",,
INT14-C,22,sqlite,ext/misc/compress.c,64,FP,readability heuristic on shift/index; benign,,
INT30-C,23,sqlite,ext/misc/compress.c,64,FP,"4-i with i in [0,4] is non-negative; the 7*(4-i) is a shift count not an unsigned subtraction defect",,
INT32-C,24,sqlite,ext/misc/compress.c,68,FP,"j-1 >= 0: loop at 67 runs at least once (i<=4 starting from i in [0,4]) so j>=1",,
INT30-C,25,sqlite,ext/misc/compress.c,71,FP,"nOut+j: nOut is compressed size, j is 1..5 header bytes; no realistic wrap",,
DCL13-C,26,sqlite,ext/misc/compress.c,85,FP,argv is SQL-function arg array; fixed signature,,
EXP34-C,27,sqlite,ext/misc/compress.c,98,uncertain,"pIn=sqlite3_value_blob(argv[0]) can be NULL for a zero-length/NULL blob; loop guard i<nIn protects pIn[i] when nIn==0, but sqlite3_value_bytes vs blob NULL coupling makes this defensible-but-safe",,
INT14-C,28,sqlite,ext/misc/compress.c,98,FP,readability heuristic on nOut shift; benign,,
INT30-C,29,sqlite,ext/misc/compress.c,98,FP,"nOut<<7 accumulates at most 5*7=35 bits into unsigned long (>=64-bit on LP64); bounded, no overflow on real targets",,
INT30-C,30,sqlite,ext/misc/compress.c,101,FP,nOut+1: bounded decoded size; not the real bug (see FN on missing OOM check),,
INT30-C,31,sqlite,ext/misc/compress.c,102,FP,"nIn-i: i<=nIn after the decode loop (i never advances past nIn), so non-negative",,
API00-C,32,sqlite,ext/misc/compress.c,112,FP,pApi init-function loader-contract param,,
DCL13-C,33,sqlite,ext/misc/compress.c,116,FP,pzErrMsg standard init out-param,,
DCL13-C,34,sqlite,ext/misc/eval.c,34,FP,colnames is sqlite3_exec callback param; fixed signature,,
STR34-C,35,sqlite,ext/misc/eval.c,40,FP,strlen takes char* directly; no char-to-int promotion of a signed char occurs here,,
INT31-C,36,sqlite,ext/misc/eval.c,41,FP,"sz is strlen result cast to sqlite3_int64 (explicit), compared in 64-bit; no harmful narrowing",,
INT30-C,37,sqlite,ext/misc/eval.c,43,FP,"nAlloc is sqlite3_int64 (signed), guarded by nAlloc<=0x7fffffff at line 47 before realloc; growth checked",,
INT32-C,38,sqlite,ext/misc/eval.c,43,FP,"nAlloc*2 is int64 growth, bounded by the 0x7fffffff check at line 47 before use",,
MEM30-C,39,sqlite,ext/misc/eval.c,55,FP,"p->nUsed is read, not freed; the free at 49 only happens on the early-return error path, not reached here",,
MEM30-C,40,sqlite,ext/misc/eval.c,56,FP,"p->szSep is an int field, not freed",,
INT32-C,41,sqlite,ext/misc/eval.c,57,FP,nUsed += szSep bounded by prior nAlloc growth check; szSep is small separator length,,
MEM30-C,42,sqlite,ext/misc/eval.c,57,FP,"p->szSep is a scalar field, not a freed pointer",,
MEM30-C,43,sqlite,ext/misc/eval.c,59,FP,p->z live; free at 49 unreachable on this path,,
INT32-C,44,sqlite,ext/misc/eval.c,60,FP,nUsed += sz bounded by nAlloc growth check at 41-47,,
DCL13-C,45,sqlite,ext/misc/eval.c,74,FP,argv is SQL-function arg array; fixed signature,,
EXP34-C,46,sqlite,ext/misc/eval.c,94,FP,sqlite3_result_error tolerates NULL message (treated as error w/ default); also zErr set by sqlite3_exec on failure path,,
API00-C,47,sqlite,ext/misc/eval.c,106,FP,pApi init loader-contract param,,
DCL13-C,48,sqlite,ext/misc/eval.c,110,FP,pzErrMsg standard init out-param,,
API00-C,49,sqlite,ext/misc/mmapwarm.c,37,FP,zDb is documented-optional (NULL allowed); code explicitly handles zDb==NULL throughout,,
DCL15-C,50,sqlite,ext/misc/mmapwarm.c,37,FP,sqlite3_mmap_warm is a public extension API; must have external linkage,,
MEM30-C,51,sqlite,ext/misc/mmapwarm.c,62,FP,zSql freed at 63 after sqlite3_prepare_v2 already consumed it; no later use of that buffer,,
MEM30-C,52,sqlite,ext/misc/mmapwarm.c,63,FP,"zSql freed once per allocation; line 51 frees a different earlier allocation, line 63 frees the second",,
MEM31-C,53,sqlite,ext/misc/mmapwarm.c,63,FP,"two distinct sqlite3_mprintf allocations (lines 46 and 55), each freed once; not a double free",,
EXP34-C,54,sqlite,ext/misc/mmapwarm.c,65,FP,pPgsz NULL would mean prepare failed (rc!=OK) so block at 64 guarded; sqlite3_step also tolerates the prepared-stmt; not pPgsz being a generic null,,
EXP34-C,55,sqlite,ext/misc/mmapwarm.c,81,uncertain,"pFd->pMethods dereferenced; file_control may leave pFd unset/NULL if file not open. rc==SQLITE_OK guards, but pFd could remain 0 if FCNTL is a no-op success — defensible concern",,
ARR30-C,56,sqlite,ext/misc/mmapwarm.c,84,FP,loop is bounded by xFetch returning pMap==0 at EOF (line 87 break); not unbounded in practice,,
EXP34-C,57,sqlite,ext/misc/mmapwarm.c,86,FP,p=pFd->pMethods already validated iVersion>=3 at line 81; non-NULL,,
INT30-C,58,sqlite,ext/misc/mmapwarm.c,89,FP,nTotal is a discarded warm-up accumulator (void)nTotal; wrap is harmless and intended,,
INT30-C,59,sqlite,ext/misc/mmapwarm.c,90,FP,nTotal accumulator deliberately discarded; pgsz-1 index valid for a page buffer,,
INT32-C,60,sqlite,ext/misc/mmapwarm.c,90,FP,pgsz-1: pgsz is a positive page size (checked !=0 at line 70); no overflow,,
INT32-C,61,sqlite,ext/misc/mmapwarm.c,92,FP,pgsz*iPg page offset; pgsz<=65536 and iPg bounded by file pages; sqlite3_int64 cannot realistically overflow,,
DCL13-C,62,sqlite,ext/misc/rot13.c,45,FP,argv is SQL-function arg array; fixed signature,,
INT30-C,63,sqlite,ext/misc/rot13.c,57,FP,sizeof(zTemp)-1 is a compile-time constant (99); no runtime wrap,,
ARR30-C,64,sqlite,ext/misc/rot13.c,66,FP,"when zOut==zTemp, nIn<sizeof(zTemp)-1 (line 57) bounds i; else zOut is malloc(nIn+1); in bounds",,
EXP34-C,65,sqlite,ext/misc/rot13.c,66,FP,"zIn null only if value_text returned NULL; SQLITE_NULL handled at line 54, and value_bytes==0 gives nIn=0 so loop body not entered",,
DCL13-C,66,sqlite,ext/misc/rot13.c,82,FP,void* notUsed ignored collation callback param; fixed signature,,
INT32-C,67,sqlite,ext/misc/rot13.c,90,FP,"rot13() returns unsigned char (0-255); (int)diff range is [-255,255], cannot overflow int",,
INT32-C,68,sqlite,ext/misc/rot13.c,93,FP,"nKey1-nKey2 small non-negative key lengths; collation tiebreak, no realistic overflow",,
API00-C,69,sqlite,ext/misc/rot13.c,98,FP,pApi init loader-contract param,,
DCL13-C,70,sqlite,ext/misc/rot13.c,102,FP,pzErrMsg standard init out-param,,
DCL13-C,71,sqlite,ext/misc/urifuncs.c,42,FP,"argv is SQL-function callback fixed signature (sqlite3_value**), loader contract",,
DCL13-C,72,sqlite,ext/misc/urifuncs.c,58,FP,"argv is SQL-function callback fixed signature, cannot be const",,
DCL13-C,73,sqlite,ext/misc/urifuncs.c,77,FP,"argv is SQL-function callback fixed signature, cannot be const",,
STR34-C,74,sqlite,ext/misc/urifuncs.c,84,FP,zFile/zName are const char* pointers passed to API; no char value widened to int here,,
DCL13-C,75,sqlite,ext/misc/urifuncs.c,96,FP,"argv is SQL-function callback fixed signature, cannot be const",,
DCL13-C,76,sqlite,ext/misc/urifuncs.c,115,FP,"argv is SQL-function callback fixed signature, cannot be const",,
STR34-C,77,sqlite,ext/misc/urifuncs.c,122,FP,"zFile/zName are pointers; iRes is int64 from API return, no char widening",,
DCL13-C,78,sqlite,ext/misc/urifuncs.c,134,FP,"argv is SQL-function callback fixed signature, cannot be const",,
DCL13-C,79,sqlite,ext/misc/urifuncs.c,151,FP,"argv is SQL-function callback fixed signature, cannot be const",,
DCL13-C,80,sqlite,ext/misc/urifuncs.c,168,FP,"argv is SQL-function callback fixed signature, cannot be const",,
API00-C,81,sqlite,ext/misc/urifuncs.c,178,FP,"db/pApi are extension-loader contract params, validated by loader not init",,
DCL13-C,82,sqlite,ext/misc/urifuncs.c,182,FP,"pzErrMsg is fixed _init loader-contract signature, cannot be const",,
ARR02-C,83,sqlite,ext/misc/urifuncs.c,189,FP,aFunc[] initialized with brace list; implicit size is idiomatic and safe,,
WIN04-C,84,sqlite,ext/misc/urifuncs.c,189,FP,"function-pointer table, not a Windows EncodePointer security context",,
INT14-C,85,sqlite,ext/misc/uuid.c,79,FP,"readability heuristic; h is small char-range int, no defect",,
INT32-C,86,sqlite,ext/misc/uuid.c,79,FP,"h holds hex char (0-127), +max9 cannot overflow int",,
INT32-C,87,sqlite,ext/misc/uuid.c,82,FP,"EBCDIC branch; h bounded char value, +9 cannot overflow",,
INT08-C,88,sqlite,ext/misc/uuid.c,106,FP,x is unsigned char; x>>4 and x&0xf cannot overflow,,
STR00-C,89,sqlite,ext/misc/uuid.c,126,FP,zStr is const unsigned char*; zStr[0] already unsigned char for isxdigit,,
STR37-C,90,sqlite,ext/misc/uuid.c,126,FP,argument already unsigned char (zStr declared const unsigned char*),,
INT14-C,91,sqlite,ext/misc/uuid.c,127,FP,readability heuristic on hex-assembly; no defect,,
DCL13-C,92,sqlite,ext/misc/uuid.c,166,FP,"argv is SQL-function callback fixed signature, cannot be const",,
INT14-C,93,sqlite,ext/misc/uuid.c,173,FP,readability heuristic on bit/arith blob fixup; no defect,,
DCL13-C,94,sqlite,ext/misc/uuid.c,183,FP,"argv is SQL-function callback fixed signature, cannot be const",,
DCL13-C,95,sqlite,ext/misc/uuid.c,199,FP,"argv is SQL-function callback fixed signature, cannot be const",,
API00-C,96,sqlite,ext/misc/uuid.c,210,FP,db/pApi are extension-loader contract params,,
DCL13-C,97,sqlite,ext/misc/uuid.c,214,FP,pzErrMsg is fixed _init loader-contract signature,,
PRE00-C,98,sqlite,ext/misc/windirent.h,69,TP,WindowsFileToIgnore(a) evaluates (a) twice; genuine macro-hygiene issue,,
PRE12-C,99,sqlite,ext/misc/windirent.h,69,TP,macro param a evaluated multiple times; inline function preferred,,
DCL09-C,100,sqlite,ext/misc/windirent.h,75,FP,closedir matches POSIX int signature; returning errno-as-int is conventional,,
EXP33-C,101,sqlite,ext/misc/windirent.h,102,FP,b1 written by MultiByteToWideChar before read; not uninitialized,,
INT30-C,102,sqlite,ext/misc/windirent.h,102,FP,"sz from strlen of dir path, (sz+3)*2 cannot wrap in practice",,
INT32-C,103,sqlite,ext/misc/windirent.h,108,FP,"sz bounded by path length, ++ cannot reach INT_MAX",,
STR00-C,104,sqlite,ext/misc/windirent.h,108,FP,'\\' is ASCII value-preserving into wchar_t; L'\\' is style only,,
INT32-C,105,sqlite,ext/misc/windirent.h,109,FP,"sz bounded by path length, ++ cannot overflow",,
STR00-C,106,sqlite,ext/misc/windirent.h,109,FP,'*' is ASCII value-preserving into wchar_t; style only,,
FLP03-C,107,sqlite,ext/misc/windirent.h,111,FP,line is integer size comparison; no floating-point division present,,
ARR00-C,108,sqlite,ext/misc/windirent.h,116,FP,b1 freed at line 117 AFTER memcpy at 116; no use-after-free,,
ARR38-C,109,sqlite,ext/misc/windirent.h,116,FP,memcpy size (sz+1)*2 guarded by check at line 111 vs data.name size,,
INT30-C,110,sqlite,ext/misc/windirent.h,116,FP,size bounded by guard at line 111; cannot wrap,,
INT32-C,111,sqlite,ext/misc/windirent.h,116,FP,size bounded by guard at line 111; cannot overflow,,
DCL30-C,112,sqlite,ext/misc/windirent.h,134,FP,"pDir is heap-allocated via sqlite3_malloc64, not automatic storage",,
INT32-C,113,sqlite,ext/misc/windirent.h,148,FP,"d_ino is per-readdir entry counter, bounded; cannot reach INT_MAX",,
DCL13-C,114,sqlite,ext/misc/zorder.c,48,FP,"argv is SQL-function callback fixed signature, cannot be const",,
ARR30-C,115,sqlite,ext/misc/zorder.c,59,FP,"x[24], index i in 0..argc-1 with argc<=24 guarded at line 53",,
INT10-C,116,sqlite,ext/misc/zorder.c,62,FP,i and argc both positive; modulo well-defined,,
INT14-C,117,sqlite,ext/misc/zorder.c,62,FP,readability heuristic; i is bounded loop index,,
INT32-C,118,sqlite,ext/misc/zorder.c,62,FP,"i in 0..62, argc 2..24, both positive; INT_MIN%-1 unreachable",,
ARR30-C,119,sqlite,ext/misc/zorder.c,63,FP,"j=i%argc < argc <= 24, in bounds of x[24]",,
INT13-C,120,sqlite,ext/misc/zorder.c,63,FP,signed-shift style heuristic; i bounded non-negative,,
INT34-C,121,sqlite,ext/misc/zorder.c,63,FP,shift i in 0..62 valid for 64-bit sqlite3_int64 operand,,
ARR30-C,122,sqlite,ext/misc/zorder.c,64,FP,"j=i%argc < argc <= 24, in bounds of x[24]",,
ARR30-C,123,sqlite,ext/misc/zorder.c,68,FP,"i in 0..argc-1, argc<=24, in bounds of x[24]",,
DCL01-C,124,sqlite,ext/misc/zorder.c,69,TP,char *z shadows outer sqlite3_int64 z declared at line 50,,
INT32-C,125,sqlite,ext/misc/zorder.c,72,FP,i bounded by argc<=24; i+1 cannot overflow,,
DCL13-C,126,sqlite,ext/misc/zorder.c,90,FP,"argv is SQL-function callback fixed signature, cannot be const",,
INT14-C,127,sqlite,ext/misc/zorder.c,109,FP,readability heuristic; j is bounded loop index,,
INT13-C,128,sqlite,ext/misc/zorder.c,110,FP,signed-shift style heuristic; j bounded non-negative,,
INT34-C,129,sqlite,ext/misc/zorder.c,110,FP,"j bounded <63, shift valid for sqlite3_int64",,
API00-C,130,sqlite,ext/misc/zorder.c,117,FP,db/pApi are extension-loader contract params,,
DCL13-C,131,sqlite,ext/misc/zorder.c,121,FP,pzErrMsg is fixed _init loader-contract signature,,
API00-C,132,sqlite,src/auth.c,70,FP,xAuth is allowed to be NULL (clears authorizer); validated by armor block,,
DCL13-C,133,sqlite,src/auth.c,73,FP,pArg is opaque user pointer stored into db->pAuthArg; const inappropriate,,
EXP20-C,134,sqlite,src/auth.c,76,FP,idiomatic !SafetyCheckOk armor guard; clear intent,,
API00-C,135,sqlite,src/auth.c,104,FP,pParse/zTab are internal-call preconditions; never NULL by contract,,
ARR00-C,136,sqlite,src/auth.c,111,FP,iDb is validated by callers; doc states valid db index precondition,,
API00-C,137,sqlite,src/auth.c,136,FP,"pParse/pExpr/pSchema/pTabList are internal preconditions, asserted",,
DCL13-C,138,sqlite,src/auth.c,140,FP,"pTabList traversed read-only but const would break public-ish internal API; pSTab read only, signature shared",,
DCL03-C,139,sqlite,src/auth.c,149,uncertain,"assert(!IN_RENAME_OBJECT): constant only under SQLITE_OMIT rename config, runtime in default build",,
ARR00-C,140,sqlite,src/auth.c,162,FP,"iSrc is the loop induction var initialized to 0, not uninitialized",,
API00-C,141,sqlite,src/auth.c,193,FP,pParse/zArg* internal-call preconditions; zArg may legitimately be NULL,,
API00-C,142,sqlite,src/auth.c,238,FP,"pParse/pContext/zContext internal preconditions, pParse asserted non-NULL",,
API00-C,143,sqlite,src/auth.c,253,FP,pContext is caller-owned non-NULL precondition,,
INT32-C,144,sqlite,src/btmutex.c,94,FP,"wantToLock is recursive lock refcount, bounded by nesting depth",,
INT32-C,145,sqlite,src/btmutex.c,147,FP,decrement guarded by assert(p->wantToLock>0) at line 146,,
API00-C,146,sqlite,src/btmutex.c,161,FP,"assert-only helper; p is caller precondition, never NULL",,
DCL13-C,147,sqlite,src/btmutex.c,161,uncertain,p only read in HoldsMutex; could be const but parallels NDEBUG-macro/public-API form,,
EXP34-C,148,sqlite,src/btmutex.c,162,FP,p is non-NULL by caller contract (assert helper),,
DCL13-C,149,sqlite,src/btmutex.c,203,FP,db drives BtShared.db mutation via sqlite3BtreeEnter; not read-only,,
EXP34-C,150,sqlite,src/btmutex.c,206,FP,db non-NULL by caller contract,,
API00-C,151,sqlite,src/btmutex.c,212,FP,"db is internal-call precondition, never NULL",,
EXP34-C,152,sqlite,src/btmutex.c,213,FP,db non-NULL by caller contract,,
DCL13-C,153,sqlite,src/btmutex.c,223,FP,db read in wrapper but public signature fixed; threadsafe variant mutates state,,
ARR00-C,154,sqlite,src/btmutex.c,260,FP,iDb guarded by assert(iDb>=0 && iDb<db->nDb) at line 257,,
DCL13-C,155,sqlite,src/btmutex.c,280,FP,db drives BtShared.db mutation in loop; not read-only,,
API00-C,156,sqlite,src/btmutex.c,299,FP,"pCur is public incrblob API precondition, never NULL",,
DCL13-C,157,sqlite,src/btmutex.c,299,FP,pCur public btree API fixed signature; pBtree's state subsequently mutated,,
API00-C,158,sqlite,src/btmutex.c,303,FP,"pCur is public incrblob API precondition, never NULL",,
DCL13-C,159,sqlite,src/btmutex.c,303,FP,pCur public btree API fixed signature; cannot be const,,
EXP37-C,160,sqlite,src/btree.h,249,FP,normal prototyped variadic decl guarded by SQLITE_ENABLE_CURSOR_HINTS; no call-site mismatch,,
API02-C,161,sqlite,src/btree.h,253,FP,"int *pRes is a single out-parameter, not a sized buffer",,
API02-C,162,sqlite,src/btree.h,259,FP,"int *pRes is a single out-parameter, not a sized buffer",,
API02-C,163,sqlite,src/btree.h,319,FP,"int *pRes is a single out-parameter, not a sized buffer",,
API02-C,164,sqlite,src/btree.h,320,FP,"int *pRes is a single out-parameter, not a sized buffer",,
API02-C,165,sqlite,src/btree.h,321,FP,"int *pRes is a single out-parameter, not a sized buffer",,
API02-C,166,sqlite,src/btree.h,334,FP,aRoot/aCnt are paired with explicit nRoot count arg; not unbounded,,
PRE05-C,167,sqlite,src/btree.h,396,FP,"the '#' is the '# define' directive marker, not a stringification operator",,
PRE01-C,168,sqlite,src/btreeInt.h,222,TP,MX_CELL_SIZE(pBt) uses pBt unparenthesized as pBt->pageSize; arg expression unsafe per PRE01,,
PRE01-C,169,sqlite,src/btreeInt.h,229,TP,MX_CELL(pBt) uses pBt unparenthesized as pBt->pageSize; arg expression unsafe per PRE01,,
PRE01-C,170,sqlite,src/btreeInt.h,627,TP,PTRMAP_PTROFFSET param pgno unparenthesized in arithmetic 5*(pgno-pgptrmap-1),,
PRE00-C,171,sqlite,src/btreeInt.h,628,uncertain,PTRMAP_ISPAGE evaluates pgno multiple times; benign for current pure-value callers,,
PRE12-C,172,sqlite,src/btreeInt.h,628,uncertain,pgno evaluated twice in PTRMAP_ISPAGE; side-effect args would misbehave but none exist,,
PRE00-C,173,sqlite,src/btreeInt.h,670,uncertain,btreeIntegrity evaluates p multiple times across two asserts; callers pass plain Btree* so benign,,
PRE01-C,174,sqlite,src/btreeInt.h,670,TP,btreeIntegrity uses p unparenthesized as p->pBt in replacement text,,
PRE02-C,175,sqlite,src/btreeInt.h,670,FP,"replacement is assert statements, not an expression; parenthesizing N/A",,
PRE10-C,176,sqlite,src/btreeInt.h,670,TP,btreeIntegrity is two unbraced asserts not wrapped in do{}while(0); breaks in if/else,,
PRE11-C,177,sqlite,src/btreeInt.h,670,TP,btreeIntegrity replacement ends with trailing semicolon after second assert,,
PRE12-C,178,sqlite,src/btreeInt.h,670,uncertain,p evaluated multiple times in btreeIntegrity; benign for current callers,,
PRE01-C,179,sqlite,src/btreeInt.h,683,TP,ISAUTOVACUUM(pBt) uses pBt unparenthesized as pBt->autoVacuum,,
PRE00-C,180,sqlite,src/btreeInt.h,722,uncertain,"get2byte evaluates x multiple times (x[0],x[1]); x is parenthesized but used twice",,
PRE12-C,181,sqlite,src/btreeInt.h,722,uncertain,get2byte indexes (x)[0] and (x)[1]; multi-eval benign for pointer-lvalue callers,,
PRE00-C,182,sqlite,src/btreeInt.h,723,uncertain,"put2byte evaluates p twice ((p)[0],(p)[1]); benign for plain pointer callers",,
PRE12-C,183,sqlite,src/btreeInt.h,723,uncertain,"put2byte evaluates p twice; v evaluated twice too, side-effect args would misbehave",,
PRE00-C,184,sqlite,src/btreeInt.h,739,uncertain,"get2byteAligned fallback evaluates x twice ((x)[0],(x)[1]); benign for current callers",,
PRE12-C,185,sqlite,src/btreeInt.h,739,uncertain,get2byteAligned indexes x twice; multi-eval benign for pointer-lvalue callers,,
PRE01-C,186,sqlite,src/complete.c,27,TP,IdChar(C) uses C unparenthesized in (unsigned char)C; arg expression unsafe per PRE01,,
ARR30-C,187,sqlite,src/complete.c,144,FP,standard null-terminated string scan; loop stops at NUL terminator,,
CON43-C,188,sqlite,src/complete.c,145,FP,single-threaded string tokenizer; no shared state or double-fetch,,
DCL00-C,189,sqlite,src/complete.c,190,FP,"local int c, advisory only; not a pointer/buffer correctness issue",,
STR34-C,190,sqlite,src/complete.c,190,FP,"comparison value from quote char; no ctype/negative-index hazard, plain equality test",,
CON43-C,191,sqlite,src/complete.c,208,FP,single-threaded tokenizer dispatch; no concurrency,,
INT32-C,192,sqlite,src/complete.c,249,FP,"nId starts at 1 and only increments; nId-1>=0, no overflow",,
ARR30-C,193,sqlite,src/complete.c,257,FP,trans[state][token]: state and token both produced bounded 0..7 (or 0..2) by construction,,
API00-C,194,sqlite,src/complete.c,269,FP,public API; zSql passed to sqlite3ValueSetStr which tolerates it; caller precondition,,
EXP33-C,195,sqlite,src/complete.c,276,FP,rc is assigned by sqlite3_initialize() before use; not uninitialized,,
INT13-C,196,sqlite,src/complete.c,287,FP,rc is a small positive SQLite result code; rc&0xff is intentional masking,,
DCL40-C,197,sqlite,src/hwtime.h,33,FP,mutually-exclusive #elif branch; only one sqlite3Hwtime body ever compiled; uint typedefs equal,,
INT30-C,198,sqlite,src/hwtime.h,36,FP,"hi is unsigned int widened to 64-bit then shifted 32; well-defined, no overflow",,
INT31-C,199,sqlite,src/hwtime.h,36,FP,hi cast to (sqlite_uint64) unsigned; no unsigned-to-signed conversion,,
DCL40-C,200,sqlite,src/hwtime.h,41,FP,mutually-exclusive #elif branch; single compiled definition,,
INT30-C,201,sqlite,src/hwtime.h,44,FP,unsigned 64-bit shift by 32 is well-defined; no overflow,,
INT31-C,202,sqlite,src/hwtime.h,44,FP,hi cast to unsigned 64-bit; no signed conversion,,
DCL40-C,203,sqlite,src/hwtime.h,49,FP,mutually-exclusive #elif branch; single compiled definition,,
DCL40-C,204,sqlite,src/hwtime.h,57,FP,mutually-exclusive #elif branch; single compiled definition,,
DCL40-C,205,sqlite,src/hwtime.h,80,FP,mutually-exclusive #else branch; single compiled definition,,
CON03-C,206,sqlite,src/mutex.c,24,FP,mutexIsInit is SQLITE_DEBUG-only init flag set once under init ordering with memory barriers,,
DCL13-C,207,sqlite,src/mutex.c,74,FP,checkMutexHeld matches fixed xMutexHeld callback signature; p cast and dereferenced read,,
DCL13-C,208,sqlite,src/mutex.c,77,FP,checkMutexNotheld matches fixed xMutexNotheld callback signature,,
ARR02-C,209,sqlite,src/mutex.c,98,FP,size fixed by 12-element initializer list; intentional implicit bound,,
CON03-C,210,sqlite,src/mutex.c,98,FP,staticMutexes is mutex-layer internal state; access serialized by SQLite init/config protocol,,
DCL03-C,211,sqlite,src/mutex.c,105,TP,assert of compile-time const (SQLITE_MUTEX_RECURSIVE==1 && SQLITE_MUTEX_FAST==0); use static_assert,,
DCL03-C,212,sqlite,src/mutex.c,137,TP,assert(SQLITE_MUTEX_RECURSIVE<2) is compile-time constant; use static_assert,,
DCL03-C,213,sqlite,src/mutex.c,138,TP,assert(SQLITE_MUTEX_FAST<2) is compile-time constant; use static_assert,,
DCL03-C,214,sqlite,src/mutex.c,139,TP,assert(SQLITE_MUTEX_WARNONCONTENTION<2) is compile-time constant; use static_assert,,
DCL13-C,215,sqlite,src/mutex.c,159,FP,checkMutexEnter matches fixed xMutexEnter callback signature,,
ERR05-C,216,sqlite,src/mutex.c,169,FP,abort() guarded by SQLITE_THREAD_MISUSE_ABORT; deliberate misuse-detection design,,
DCL13-C,217,sqlite,src/mutex.c,178,FP,checkMutexTry matches fixed xMutexTry callback signature,,
DCL13-C,218,sqlite,src/mutex.c,186,FP,checkMutexLeave matches fixed xMutexLeave callback signature,,
EXP34-C,219,sqlite,src/mutex.c,247,FP,pFrom assigned from *Mutex() funcs that all return &static sMutex; never null,,
API00-C,220,sqlite,src/mutex.c,362,FP,sqlite3_mutex_held explicitly handles p==0 (return p==0 || ...),,
API00-C,221,sqlite,src/mutex.c,371,FP,sqlite3_mutex_notheld explicitly handles p==0 (return p==0 || ...),,
INT36-C,222,sqlite,src/mutex_noop.c,42,FP,(sqlite3_mutex*)8 is a deliberate opaque non-null sentinel for the noop mutex; never dereferenced,,
DCL13-C,223,sqlite,src/mutex_noop.c,89,FP,debugMutexHeld matches fixed xMutexHeld callback signature,,
DCL13-C,224,sqlite,src/mutex_noop.c,93,FP,debugMutexNotheld matches fixed xMutexNotheld callback signature,,
MEM05-C,225,sqlite,src/mutex_noop.c,110,FP,"aStatic sized by compile-time macro SQLITE_MUTEX_STATIC_VFS3-1; static array, not a VLA",,
EXP33-C,226,sqlite,src/mutex_noop.c,129,FP,aStatic has static storage (zero-initialized); cnt is well-defined,,
INT32-C,227,sqlite,src/mutex_noop.c,129,FP,id-2 bounded by preceding ArraySize guard; small mutex-id constants,,
INT32-C,228,sqlite,src/mutex_noop.c,166,FP,cnt is recursion-depth counter bounded by actual nesting; cannot reach INT_MAX,,
INT32-C,229,sqlite,src/mutex_noop.c,171,FP,cnt is recursion-depth counter bounded by actual nesting,,
INT32-C,230,sqlite,src/mutex_noop.c,184,FP,cnt-- guarded by assert(debugMutexHeld) i.e. cnt>0; no underflow,,
PRE01-C,231,sqlite,src/mutex_unix.c,53,FP,"id appears in struct-initializer comma-list {..,id,..}; parenthesizing would be illegal in initializer context",,
PRE01-C,232,sqlite,src/mutex_unix.c,56,FP,"id used in aggregate initializer list, cannot be parenthesized",,
DCL13-C,233,sqlite,src/mutex_unix.c,78,FP,pthreadMutexHeld stored as fixed-signature callback in sqlite3_mutex_methods; const would break method-table type match,,
DCL13-C,234,sqlite,src/mutex_unix.c,81,FP,pthreadMutexNotheld stored as fixed-signature callback in sqlite3_mutex_methods; const breaks signature,,
ARR02-C,235,sqlite,src/mutex_unix.c,154,FP,"brace-initialized static array, size inferred from initializer list; idiomatic",,
CON03-C,236,sqlite,src/mutex_unix.c,154,FP,staticMutexes IS the mutex layer; PTHREAD_MUTEX_INITIALIZER statics need no extra sync,,
EXP33-C,237,sqlite,src/mutex_unix.c,171,FP,p = sqlite3MallocZero(...) then guarded by if(p); not uninitialized,,
INT32-C,238,sqlite,src/mutex_unix.c,208,FP,iType-2 guarded by API_ARMOR bounds check; iType is a small enum constant,,
DCL30-C,239,sqlite,src/mutex_unix.c,215,FP,"returns the pointer value p (heap or &static), not address of an automatic object",,
CON31-C,240,sqlite,src/mutex_unix.c,230,FP,pthreadMutexFree is the deallocator; destroying the mutex here is correct (asserts nRef==0),,
CON35-C,241,sqlite,src/mutex_unix.c,270,FP,single pthread_mutex_lock in homegrown branch; no multiple-mutex lock-ordering,,
POS51-C,242,sqlite,src/mutex_unix.c,270,FP,only one lock acquired; no deadlock ordering issue,,
DCL11-C,243,sqlite,src/mutex_unix.c,289,uncertain,%p given sqlite3_mutex* p (non-void*); technically UB but SQLITE_DEBUG-only trace,,
DCL11-C,244,sqlite,src/mutex_unix.c,338,uncertain,"%p given non-void* p in debug trace; pedantic type mismatch, debug-only",,
CON01-C,245,sqlite,src/mutex_unix.c,360,FP,pthreadMutexLeave is the unlock primitive itself; acquisition is by design in caller,,
CON01-C,246,sqlite,src/mutex_unix.c,363,FP,this IS the mutex-leave function; unlock without lock-in-same-fn is its purpose,,
DCL11-C,247,sqlite,src/mutex_unix.c,368,uncertain,"%p given non-void* p in debug trace; pedantic, debug-only",,
PRE01-C,248,sqlite,src/mutex_w32.c,55,FP,"id in aggregate initializer list, cannot be parenthesized",,
PRE01-C,249,sqlite,src/mutex_w32.c,58,FP,"id in struct-initializer comma-list, parenthesizing illegal",,
DCL13-C,250,sqlite,src/mutex_w32.c,66,FP,winMutexHeld stored as fixed-signature callback in sqlite3_mutex_methods; const breaks table,,
DCL13-C,251,sqlite,src/mutex_w32.c,70,FP,"winMutexNotheld2 read-only but part of debug predicate family; SQLITE_DEBUG-only, stylistic",,
ARR02-C,252,sqlite,src/mutex_w32.c,100,FP,"brace-initialized static array, size from initializer; idiomatic",,
CON03-C,253,sqlite,src/mutex_w32.c,100,FP,winMutex_staticMutexes IS the mutex layer; init guarded by interlocked winMutex_lock,,
CON03-C,254,sqlite,src/mutex_w32.c,115,FP,winMutex_isInit init/shutdown ordered by InterlockedCompareExchange handshake,,
CON03-C,255,sqlite,src/mutex_w32.c,116,FP,"winMutex_isNt one-shot lazy query, benign race; sqlite documents it as acceptable",,
EXP20-C,256,sqlite,src/mutex_w32.c,148,FP,InterlockedCompareExchange returns the prior value; ==1 is the correct decrement-to-0 test,,
CON31-C,257,sqlite,src/mutex_w32.c,152,FP,winMutexEnd shutdown path; DeleteCriticalSection is the correct teardown,,
EXP33-C,258,sqlite,src/mutex_w32.c,214,FP,p = sqlite3MallocZero(...) guarded by if(p); not uninitialized,,
INT32-C,259,sqlite,src/mutex_w32.c,233,FP,iType-2 guarded by API_ARMOR bounds check; small enum,,
DCL30-C,260,sqlite,src/mutex_w32.c,243,FP,"returns pointer value p, not address of an automatic variable",,
CON31-C,261,sqlite,src/mutex_w32.c,256,FP,winMutexFree deallocator; DeleteCriticalSection here is correct,,
PRE32-C,262,sqlite,src/mutex_w32.c,293,FP,OSTRACE arg has no preprocessor directive; just a format string with %p/escapes,,
PRE32-C,263,sqlite,src/mutex_w32.c,336,FP,no # directive in OSTRACE argument; misparse of format string,,
PRE32-C,264,sqlite,src/mutex_w32.c,365,FP,no preprocessor directive in argument; plain trace string,,
DCL13-C,265,sqlite,src/notify.c,57,TP,checkListProperties only reads db (compares db to list pointers); const sqlite3* compiles,,
DCL13-C,266,sqlite,src/notify.c,83,TP,removeFromBlockedList only reads db (compared to *pp); const sqlite3* compiles,,
API00-C,267,sqlite,src/notify.c,148,FP,"pArg is an opaque callback context cookie, not a buffer; caller precondition",,
DCL13-C,268,sqlite,src/notify.c,151,FP,"pArg has its address taken (xNotify(&pArg,..)) and is stored in db->pUnlockArg",,
EXP20-C,269,sqlite,src/notify.c,156,FP,sqlite3SafetyCheckOk is a boolean predicate; if(!...) is idiomatic,,
API00-C,270,sqlite,src/notify.c,201,FP,pBlocker validated by caller; internal connection-blocked notifier,,
DCL13-C,271,sqlite,src/notify.c,201,FP,pBlocker is stored into db->pBlockingConnection; not read-only,,
DCL13-C,272,sqlite,src/notify.c,229,FP,db compared to list members and mutated state keyed on it; const would fight comparisons/intent,,
WIN04-C,273,sqlite,src/notify.c,230,FP,EncodePointer hardening not applicable; xUnlockNotify is a normal stored callback,,
EXP33-C,274,sqlite,src/notify.c,237,FP,aStatic is filled (aArg[nArg++]=..) before being read; not an uninitialized read,,
ARR38-C,275,sqlite,src/notify.c,266,FP,nArg bounded; pNew malloc'd at 2x size before memcpy of nArg*sizeof(void*),,
EXP43-C,276,sqlite,src/notify.c,266,FP,"pNew is freshly allocated, aArg points to old buffer; regions do not overlap",,
MEM30-C,277,sqlite,src/notify.c,320,FP,aDyn freed once here; earlier free at L267 immediately reassigns aDyn=pNew; no double free,,
MEM31-C,278,sqlite,src/notify.c,320,FP,single free of current aDyn; prior free path reassigns the pointer first,,
DCL37-C,279,sqlite,src/os_common.h,21,TP,_OS_COMMON_H_ leading underscore + uppercase is a reserved identifier (header guard),,
PRE00-C,280,sqlite,src/os_common.h,63,FP,CODE parameter appears exactly once in the replacement; not multiply-evaluated,,
PRE01-C,281,sqlite,src/os_common.h,63,FP,CODE is a statement argument (e.g. return ...); cannot be parenthesized,,
PRE02-C,282,sqlite,src/os_common.h,63,FP,"statement macro (if-block), not an expression; replacement cannot be parenthesized",,
PRE10-C,283,sqlite,src/os_common.h,63,TP,SimulateIOError expands to a bare if(...){..} not wrapped in do{}while(0); else-attachment hazard,,
PRE00-C,284,sqlite,src/os_common.h,72,FP,CODE appears once in replacement; not multiply-evaluated,,
PRE01-C,285,sqlite,src/os_common.h,72,FP,CODE is a statement argument; cannot be parenthesized,,
PRE02-C,286,sqlite,src/os_common.h,72,FP,"statement macro (nested if), not parenthesizable as an expression",,
PRE10-C,287,sqlite,src/os_common.h,72,TP,SimulateDiskfullError expands to a bare if(...){..} not wrapped in do{}while(0),,
API00-C,288,sqlite,src/threads.c,51,FP,pIn is an opaque cookie passed through; no validation needed,,
EXP33-C,289,sqlite,src/threads.c,65,FP,p = sqlite3Malloc(...) then if(p==0) return; not used uninitialized,,
MEM31-C,290,sqlite,src/threads.c,77,FP,"rc is an int return code from pthread_create, not an allocation; no resource to free",,
DCL30-C,291,sqlite,src/threads.c,83,FP,"*ppThread = p stores a heap pointer (sqlite3Malloc), not an automatic-storage address",,
MEM31-C,292,sqlite,src/threads.c,84,FP,"rc is an int status, not allocated memory; nothing to free",,
API00-C,293,sqlite,src/threads.c,88,FP,ppOut guaranteed non-NULL (assert L91); internal join API,,
API00-C,294,sqlite,src/threads.c,146,FP,ppThread asserted non-NULL (L153); internal API,,
DCL13-C,295,sqlite,src/threads.c,148,FP,xTask is a function pointer stored into p->xTask; const-pointer-to-fn note is spurious here,,
EXP33-C,296,sqlite,src/threads.c,156,FP,p = sqlite3Malloc(...) checked if(p==0) return; not uninitialized,,
DCL30-C,297,sqlite,src/threads.c,177,FP,"*ppThread = p stores a heap pointer, not an automatic address",,
API00-C,298,sqlite,src/threads.c,184,FP,ppOut asserted non-NULL (L188); internal join,,
API00-C,299,sqlite,src/threads.c,226,FP,ppThread asserted non-NULL (L233); internal API,,
DCL13-C,300,sqlite,src/threads.c,228,FP,xTask is a function pointer stored into p->xTask; not a read-only data pointer,,
EXP33-C,301,sqlite,src/threads.c,236,FP,p = sqlite3Malloc(...) checked before use; not uninitialized,,
INT14-C,302,sqlite,src/threads.c,238,FP,macro SQLITE_PTR_TO_INT mixing bit/arith is intentional; not a defect,,
DCL30-C,303,sqlite,src/threads.c,245,FP,"*ppThread = p stores heap pointer, not automatic-storage address",,
API00-C,304,sqlite,src/threads.c,250,FP,ppOut asserted non-NULL (L252); internal join API,,
STR00-C,305,sqlite,src/vdbe.h,57,FP,"p4type holds negative P4_xxx constants (e.g. -1); signed char is intentional integer storage, not text",,
STR00-C,306,sqlite,src/vdbe.h,116,FP,"VdbeOpList.p1 stores small signed operand integers, not character data",,
STR00-C,307,sqlite,src/vdbe.h,117,FP,VdbeOpList.p2 stores small signed operand integers,,
STR00-C,308,sqlite,src/vdbe.h,118,FP,VdbeOpList.p3 stores small signed operand integers,,
EXP37-C,309,sqlite,src/vdbe.h,202,FP,sqlite3VdbeMultiLoad is a well-formed variadic prototype in a header; no type mismatch,,
EXP37-C,310,sqlite,src/vdbe.h,225,FP,sqlite3VdbeExplain is a proper variadic prototype,,
PRE01-C,311,sqlite,src/vdbe.h,228,FP,P is a full parenthesized argument list passed to function-like macro; cannot be re-parenthesized,,
PRE01-C,312,sqlite,src/vdbe.h,230,FP,V is an lvalue assignment target in (V = sqlite3VdbeExplain P); cannot parenthesize,,
EXP37-C,313,sqlite,src/vdbe.h,335,FP,sqlite3VdbeComment is a proper variadic prototype,,
PRE01-C,314,sqlite,src/vdbe.h,336,FP,X is a parenthesized arg list passed to function-like macro; cannot parenthesize,,
EXP37-C,315,sqlite,src/vdbe.h,337,FP,sqlite3VdbeNoopComment is a proper variadic prototype,,
PRE01-C,316,sqlite,src/vdbe.h,338,FP,X is a parenthesized argument list; cannot parenthesize,,
PRE01-C,317,sqlite,src/vdbe.h,340,FP,X is a parenthesized argument list passed whole; cannot parenthesize,,
PRE11-C,318,sqlite,src/vdbe.h,394,TP,VdbeCoverageAlwaysTaken expands to a call ending in ; yielding ';;' at use site,,
PRE11-C,319,sqlite,src/vdbe.h,396,TP,VdbeCoverageNeverTaken macro replacement ends with a semicolon,,
PRE11-C,320,sqlite,src/vdbe.h,398,TP,VdbeCoverageNeverNull macro replacement ends with a semicolon,,
PRE11-C,321,sqlite,src/vdbe.h,400,TP,VdbeCoverageNeverNullIf macro replacement ends with a semicolon,,
PRE11-C,322,sqlite,src/vdbe.h,402,TP,VdbeCoverageEqNe macro replacement ends with a semicolon,,
PRE00-C,323,sqlite,src/vdbeInt.h,151,FP,IsNullCursor(P) multi-eval but callers pass simple pointer lvalues with no side effects,,
PRE12-C,324,sqlite,src/vdbeInt.h,151,FP,same as PRE00: P is a side-effect-free pointer expression,,
PRE00-C,325,sqlite,src/vdbeInt.h,345,FP,"MemSetTypeFlag(p,f) double-eval of p; p is a plain Mem* lvalue, no side effects",,
PRE12-C,326,sqlite,src/vdbeInt.h,345,FP,p is a simple Mem* lvalue; multi-eval harmless,,
PRE00-C,327,sqlite,src/vdbeInt.h,351,FP,MemNullNochng(X) used in asserts with simple pointer args; no side effects,,
PRE12-C,328,sqlite,src/vdbeInt.h,351,FP,X is a side-effect-free Mem* lvalue,,
PRE02-C,329,sqlite,src/vdbeInt.h,364,uncertain,"memIsValid(M) body ((M)->flags & MEM_AffMask)!=0 is not fully parenthesized; debug-assert-only, no reachable defect but genuine hygiene nit",,
EXP37-C,330,sqlite,src/vdbeInt.h,593,FP,sqlite3VdbeError is a proper prototype with named types; variadic decl is correct,,
PRE00-C,331,sqlite,src/vdbeInt.h,604,FP,"swapMixedEndianFloat(X) double-eval; callers pass plain u64 lvalues, no side effects",,
PRE01-C,332,sqlite,src/vdbeInt.h,604,FP,X unparenthesized but always a simple lvalue; assignment-form macro safe in use,,
PRE12-C,333,sqlite,src/vdbeInt.h,604,FP,X is a side-effect-free lvalue,,
DCL40-C,334,sqlite,src/vdbeInt.h,646,FP,the void and int decls are in mutually-exclusive #ifndef SQLITE_OMIT_INCRBLOB branches; only one compiles,,
PRE00-C,335,sqlite,src/vdbeInt.h,746,FP,ExpandBlob(P) double-eval; callers pass simple Mem* pointers,,
PRE12-C,336,sqlite,src/vdbeInt.h,746,FP,P is a side-effect-free pointer expression,,
EXP05-C,337,sqlite,src/vdbetrace.c,36,FP,(u8*)zSql drops const but feeds sqlite3GetToken's const unsigned char* param which does not mutate; no const violation,,
API00-C,338,sqlite,src/vdbetrace.c,72,FP,p is internal Vdbe* with caller precondition (non-null prepared stmt); not a public-API entry,,
ARR30-C,339,sqlite,src/vdbetrace.c,91,FP,loop scans NUL-terminated SQL text bounded by terminator inside while(*zRawSql),,
EXP30-C,340,sqlite,src/vdbetrace.c,93,FP,&& provides a sequence point between zRawSql++ and the *zRawSql read; well-defined,,
INT32-C,341,sqlite,src/vdbetrace.c,93,FP,"zRawSql is a pointer walk over bounded SQL text, not an int counter near INT_MAX",,
INT32-C,342,sqlite,src/vdbetrace.c,105,FP,"n is a token length from sqlite3GetToken (>0, bounded by SQL length)",,
INT32-C,343,sqlite,src/vdbetrace.c,125,FP,nToken bounded by SQL text length; cannot approach INT_MAX,,
INT32-C,344,sqlite,src/vdbetrace.c,126,FP,idx is a host-parameter index bounded by p->nVar (asserted idx<=p->nVar),,
INT32-C,345,sqlite,src/vdbetrace.c,128,FP,idx>0 asserted; idx-1 cannot underflow,,
INT14-C,346,sqlite,src/vdbetrace.c,129,FP,readability-only flag on pVar pointer indexing; no defect,,
INT14-C,347,sqlite,src/vdbetrace.c,154,FP,readability-only flag on nOut; no defect,,
DCL13-C,348,sqlite,src/vdbevtab.c,52,FP,pAux is part of fixed xConnect callback signature; cannot const-qualify,,
DCL13-C,349,sqlite,src/vdbevtab.c,55,FP,pzErr is part of fixed xConnect callback signature,,
EXP33-C,350,sqlite,src/vdbevtab.c,93,FP,pNew is assigned from sqlite3_malloc before use and null-checked at line 95; not uninitialized,,
INT32-C,351,sqlite,src/vdbevtab.c,98,FP,isTabUsed is 0 or 1 (pAux!=0); isTabUsed*2 cannot overflow,,
DCL13-C,352,sqlite,src/vdbevtab.c,115,FP,p is fixed xOpen callback signature param,,
EXP33-C,353,sqlite,src/vdbevtab.c,118,FP,"pCur assigned from sqlite3_malloc, null-checked, memset before use",,
MEM33-C,354,sqlite,src/vdbevtab.c,122,FP,*ppCursor = &pCur->base takes address of base member; no flexible-array struct copy,,
DCL13-C,355,sqlite,src/vdbevtab.c,189,FP,cur is fixed xEof callback signature param,,
INT32-C,356,sqlite,src/vdbevtab.c,236,FP,i is a small column index (0..23); i += 20 cannot overflow,,
DCL13-C,357,sqlite,src/vdbevtab.c,321,FP,cur is fixed xRowid callback signature param,,
DCL13-C,358,sqlite,src/vdbevtab.c,336,FP,argv is fixed xFilter sqlite3_value** callback param,,
DCL13-C,359,sqlite,src/vdbevtab.c,377,FP,tab is fixed xBestIndex callback signature param,,
FLP34-C,360,sqlite,src/vdbevtab.c,385,FP,(double)100 is a constant literal conversion; no range issue,,
CON03-C,361,sqlite,src/vdbevtab.c,407,FP,bytecodevtabModule is an effectively read-only static module table after init,,
API00-C,362,sqlite,src/vdbevtab.c,436,FP,db is caller-supplied connection with API precondition; internal init entry,,
DCL13-C,363,sqlite,src/vdbevtab.c,445,FP,db is param of the stub init in the alternate compile branch; caller precondition,,
EXP34-C,364,sqlite,ext/misc/compress.c,63,FN,compressFunc: pOut=sqlite3_malloc64(nOut+5) written with no NULL check; OOM -> null write,"CONFIRMED REAL + FIXED upstream: compress.c OOM null-checks added in 1c0a370472 (2026-06-03) ""Make ext/misc/compress.c routines responsive to OOM conditions"". Audited b1a73ba34d predates it. sqc FN validated against ground truth.",medium
EXP34-C,365,sqlite,ext/misc/compress.c,102,FN,uncompressFunc: nOut from input blob (attacker-controllable) -> sqlite3_malloc64 to uncompress() no NULL check -> OOM null-write,CONFIRMED REAL + FIXED upstream: compress.c uncompressFunc OOM null-check added in 1c0a370472 (2026-06-03). sqc FN validated against ground truth.,medium