sqc 0.4.84

rule,idx,project,file,line,verdict,reason,provenance,confidence
ARR02-C,0,sqlite,src/btree.c,22,FP,"zMagicHeader is a file-scope static const char[] initialized from a string literal; implicit size is the deliberate idiom, fully bounded",,
PRE01-C,1,sqlite,src/btree.c,30,FP,"TRACE(X) uses X as 'printf X' (whole arg list, statement context); precedence parenthesization inapplicable",,
PRE10-C,2,sqlite,src/btree.c,30,TP,TRACE expands to bare if(...){...} not wrapped in do-while; classic dangling-if macro hazard (though in #if 0 block),,
API00-C,3,sqlite,src/btree.c,119,FP,"internal SQLITE_DEBUG-only accessor; pBt is a caller-owned Btree handle, no untrusted input",,
API00-C,4,sqlite,src/btree.c,136,FP,"p is a MemPage* the contract documents as non-NULL; debug-only error logger, caller-owned",,
DCL13-C,5,sqlite,src/btree.c,136,TP,reads only p->pgno and p->pBt->pPager passed by value; p never mutated,,
PRE01-C,6,sqlite,src/btree.c,151,TP,"SQLITE_CORRUPT_PAGE(pMemPage)->pMemPage->pgno; param used in member-access without parens, breaks on compound arg",,
DCL13-C,7,sqlite,src/btree.c,169,TP,sharedLockTrace (dead #if 0) only reads pBt->pLock to print; pBt not mutated,,
DCL11-C,8,sqlite,src/btree.c,176,FP,inside #if 0 sharedLockTrace block — never compiled,,
INT00-C,9,sqlite,src/btree.c,176,FP,inside #if 0 sharedLockTrace block — never compiled; not a defect in the shipped engine,,
DCL11-C,10,sqlite,src/btree.c,178,FP,inside #if 0 sharedLockTrace block — never compiled,,
ERR33-C,11,sqlite,src/btree.c,189,FP,inside #if 0 sharedLockTrace block — never compiled,,
DCL13-C,12,sqlite,src/btree.c,219,TP,hasSharedCacheTableLock only reads pBtree->pBt/sharable/db fields; pBtree not mutated,,
DCL13-C,13,sqlite,src/btree.c,309,TP,hasReadConflicts only walks pBtree->pBt->pCursor reading fields; pBtree not mutated,,
DCL03-C,14,sqlite,src/btree.c,449,TP,assert(WRITE_LOCK>READ_LOCK) is a compile-time constant comparison; static_assert applicable,,
EXP34-C,15,sqlite,src/btree.c,468,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,16,sqlite,src/btree.c,469,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP40-C,17,sqlite,src/btree.c,469,FP,normal pointer-to-pointer assignment; no const object modified,,
MEM30-C,18,sqlite,src/btree.c,492,FP,pBt is a live BtShared (transaction concluding); never freed on this path,,
MEM30-C,19,sqlite,src/btree.c,493,FP,pBt is a live BtShared; never freed on this path,,
MEM30-C,20,sqlite,src/btree.c,496,FP,"pBt is a live BtShared; the sqlite3_free(pLock) above frees lock nodes, not pBt",,
DCL13-C,21,sqlite,src/btree.c,513,TP,"downgradeAllSharedCacheTableLocks mutates pBt(=p->pBt) and pLock objects, not p's own fields",,
EXP34-C,22,sqlite,src/btree.c,514,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,23,sqlite,src/btree.c,518,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
DCL13-C,24,sqlite,src/btree.c,541,TP,cursorHoldsMutex only reads p->pBt->mutex,,
PRE01-C,25,sqlite,src/btree.c,563,TP,"invalidateOverflowCache(pCur)->pCur->curFlags; param in member-access without parens, breaks on compound arg",,
DCL13-C,26,sqlite,src/btree.c,569,TP,"invalidateAllOverflowCache only reads pBt->pCursor; mutates loop cursors, not pBt",,
DCL13-C,27,sqlite,src/btree.c,673,TP,btreeGetHasContent only reads pBt->pHasContent,,
INT32-C,28,sqlite,src/btree.c,732,FP,"nKey explicitly cast to (i64) before +9+8; addition is 64-bit, u32 max +17 cannot overflow i64",,
ARR38-C,29,sqlite,src/btree.c,736,FP,pKey malloc(nKey+9+8); memset writes exactly the 9+8 trailing padding bytes at offset nKey - within allocation,,
DCL13-C,30,sqlite,src/btree.c,806,TP,"saveAllCursors reads pBt->pCursor/mutex; mutates pExcept, not pBt",,
DCL13-C,31,sqlite,src/btree.c,826,TP,saveCursorsOnList only compares p!=pExcept; pExcept never written,,
API00-C,32,sqlite,src/btree.c,848,FP,caller-owned cursor guarded by assert(cursorHoldsMutex(pCur)); API precondition,,
MEM30-C,33,sqlite,src/btree.c,881,FP,freed pointer is pIdxKey; pCur->pKeyInfo is a live KeyInfo whose ->db field is read,,
PRE00-C,34,sqlite,src/btree.c,922,TP,function-like macro restoreCursorPosition multiple-evaluates p; side-effecting arg unsafe,,
PRE01-C,35,sqlite,src/btree.c,922,TP,restoreCursorPosition(p)->p->eState member access without parenthesized param,,
PRE12-C,36,sqlite,src/btree.c,922,TP,restoreCursorPosition(p) evaluates p multiple times (p->eState and btreeRestoreCursorPosition(p)),,
API00-C,37,sqlite,src/btree.c,939,FP,"NULL handled by design via fake-cursor-aware contract; caller-owned, asserts alignment",,
ARR01-C,38,sqlite,src/btree.c,943,FP,"sizeof(pCur->eState) is sizeof of a struct member (u8), not a decayed array param; asserted ==1",,
DCL03-C,39,sqlite,src/btree.c,943,TP,assert(sizeof(pCur->eState)==1) is compile-time constant; static_assert applicable,,
CON03-C,40,sqlite,src/btree.c,953,FP,"static u8 fakeCursor is a read-only CURSOR_VALID sentinel, only ever read; no real data race",,
API00-C,41,sqlite,src/btree.c,971,FP,asserts pCur!=0 and eState; caller-owned cursor per contract,,
DCL13-C,42,sqlite,src/btree.c,995,TP,sqlite3BtreeCursorHint never references pCur in its body,,
API00-C,43,sqlite,src/btree.c,1020,FP,"caller-owned cursor; only sets pCur->hints, no untrusted deref",,
INT32-C,44,sqlite,src/btree.c,1041,FP,usableSize<=65536 so usableSize/5+1 is small; structurally bounded,,
INT33-C,45,sqlite,src/btree.c,1042,FP,nPagesPerMapPage=(usableSize/5)+1 always >=1,,
INT32-C,46,sqlite,src/btree.c,1043,FP,"iPtrMap=(pgno-2)/nPagesPerMapPage so iPtrMap*nPagesPerMapPage<=pgno (Pgno page number), +2 bounded by page count",,
ARR39-C,47,sqlite,src/btree.c,1099,FP,"offset is a validated byte offset into the full pPtrmap page buffer (offset<0 -> CORRUPT, assert offset<=usableSize-5); pPtrmap[offset] is single-scaled byte access",,
ARR39-C,48,sqlite,src/btree.c,1103,FP,"offset is a validated byte offset into the full pPtrmap page buffer (offset<0 -> CORRUPT, assert offset<=usableSize-5); pPtrmap[offset] is single-scaled byte access",,
ARR39-C,49,sqlite,src/btree.c,1142,FP,"offset is a validated byte offset into the full pPtrmap page buffer (offset<0 -> CORRUPT, assert offset<=usableSize-5); pPtrmap[offset] is single-scaled byte access",,
PRE00-C,50,sqlite,src/btree.c,1166,TP,"findCell(P,I) evaluates P three times; multiple evaluation of macro param",,
PRE12-C,51,sqlite,src/btree.c,1166,TP,"findCell macro evaluates P multiple times (aData, maskPage, aCellIdx)",,
PRE00-C,52,sqlite,src/btree.c,1168,TP,"findCellPastPtr(P,I) evaluates P three times; multiple evaluation of macro param",,
PRE12-C,53,sqlite,src/btree.c,1168,TP,findCellPastPtr macro evaluates P multiple times,,
DCL13-C,54,sqlite,src/btree.c,1179,TP,"reads only pPage->minLocal/maxLocal/pBt->usableSize; pInfo is mutated, not pPage",,
DCL13-C,55,sqlite,src/btree.c,1180,TP,"pCell used only in pointer arithmetic, never dereferenced for write",,
INT10-C,56,sqlite,src/btree.c,1198,FP,operands are page offsets/payload sizes that are non-negative; %% sign-of-result concern not reachable,,
INT32-C,57,sqlite,src/btree.c,1198,FP,minLocal<=usableSize and modulo result < usableSize-4<=65532; sum bounded well below INT_MAX,,
INT33-C,58,sqlite,src/btree.c,1198,FP,usableSize-4 >=508 (usableSize>=512); never zero,,
ARR36-C,59,sqlite,src/btree.c,1201,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
DCL13-C,60,sqlite,src/btree.c,1213,TP,btreePayloadToLocal reads only pPage->maxLocal/minLocal/pBt->usableSize,,
INT10-C,61,sqlite,src/btree.c,1223,FP,operands are page offsets/payload sizes that are non-negative; %% sign-of-result concern not reachable,,
INT32-C,62,sqlite,src/btree.c,1223,FP,minLocal plus (mod usableSize-4) is bounded < ~131064; no overflow,,
INT33-C,63,sqlite,src/btree.c,1223,FP,usableSize-4 never zero (usableSize>=512),,
ARR37-C,64,sqlite,src/btree.c,1253,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,65,sqlite,src/btree.c,1283,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT13-C,66,sqlite,src/btree.c,1285,FP,nPayload is u32 (unsigned) not signed; analyzer mistyped,,
INT14-C,67,sqlite,src/btree.c,1285,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR36-C,68,sqlite,src/btree.c,1286,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT14-C,69,sqlite,src/btree.c,1362,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT13-C,70,sqlite,src/btree.c,1364,FP,nPayload is u32 (unsigned); analyzer mistyped,,
INT14-C,71,sqlite,src/btree.c,1364,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR36-C,72,sqlite,src/btree.c,1365,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR30-C,73,sqlite,src/btree.c,1391,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,74,sqlite,src/btree.c,1409,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,75,sqlite,src/btree.c,1426,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,76,sqlite,src/btree.c,1428,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR36-C,77,sqlite,src/btree.c,1429,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT10-C,78,sqlite,src/btree.c,1439,FP,operands are page offsets/payload sizes that are non-negative; %% sign-of-result concern not reachable,,
INT32-C,79,sqlite,src/btree.c,1439,FP,minLocal + (nSize mod usableSize-4); both operands bounded by page size,,
INT33-C,80,sqlite,src/btree.c,1439,FP,usableSize-4 never zero,,
INT14-C,81,sqlite,src/btree.c,1468,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,82,sqlite,src/btree.c,1470,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR36-C,83,sqlite,src/btree.c,1471,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT10-C,84,sqlite,src/btree.c,1481,FP,operands are page offsets/payload sizes that are non-negative; %% sign-of-result concern not reachable,,
INT32-C,85,sqlite,src/btree.c,1481,FP,minLocal + modulo(usableSize-4); page-size bounded,,
INT33-C,86,sqlite,src/btree.c,1481,FP,usableSize-4 never zero,,
ARR37-C,87,sqlite,src/btree.c,1493,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,88,sqlite,src/btree.c,1508,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
EXP30-C,89,sqlite,src/btree.c,1509,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
INT14-C,90,sqlite,src/btree.c,1530,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,91,sqlite,src/btree.c,1532,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR36-C,92,sqlite,src/btree.c,1533,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT10-C,93,sqlite,src/btree.c,1554,FP,operands are page offsets/payload sizes that are non-negative; %% sign-of-result concern not reachable,,
INT32-C,94,sqlite,src/btree.c,1554,FP,minLocal + modulo(usableSize-4); page-size bounded,,
INT33-C,95,sqlite,src/btree.c,1554,FP,usableSize-4 never zero,,
ARR30-C,96,sqlite,src/btree.c,1571,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
DCL13-C,97,sqlite,src/btree.c,1582,TP,"ptrmapPutOvflPtr reads only pSrc->aDataEnd; pPage/pRC mutated, not pSrc",,
EXP34-C,98,sqlite,src/btree.c,1586,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,99,sqlite,src/btree.c,1589,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
ARR37-C,100,sqlite,src/btree.c,1594,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,101,sqlite,src/btree.c,1639,FP,cellOffset (<=hdr+12) + 2*nCell; nCell<=MX_CELL(pBt) bounded by page size,,
INT32-C,102,sqlite,src/btree.c,1648,FP,hdr+1; hdr is 0 or 100 (page header offset),,
INT32-C,103,sqlite,src/btree.c,1654,FP,cellOffset + nCell*2; nCell bounded by cells-per-page,,
INT32-C,104,sqlite,src/btree.c,1658,FP,hdr+5; hdr is 0 or 100,,
ARR38-C,105,sqlite,src/btree.c,1666,FP,"memmove guarded by preceding CORRUPT_PAGE checks (iFree+sz<=iFree2, iFree2+sz2<=usableSize) within page data[] buffer",,
INT31-C,106,sqlite,src/btree.c,1666,FP,"iFree2-(iFree+sz): 2-byte page offsets, all checked vs usableSize via SQLITE_CORRUPT",,
INT32-C,107,sqlite,src/btree.c,1666,FP,"iFree,sz,sz2 all 2-byte page offsets validated <=usableSize-4; sum bounded by page size",,
INT32-C,108,sqlite,src/btree.c,1667,FP,"sz,sz2 are 2-byte freeblock sizes within a page; sum < usableSize",,
INT32-C,109,sqlite,src/btree.c,1672,FP,"top,sz are page offsets <=usableSize<=65536",,
INT31-C,110,sqlite,src/btree.c,1674,FP,"iFree-top: bounded 2-byte offsets, guarded by corruption checks",,
INT32-C,111,sqlite,src/btree.c,1674,FP,"iFree,top are validated page offsets within usableSize",,
ARR37-C,112,sqlite,src/btree.c,1675,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,113,sqlite,src/btree.c,1677,FP,"pc 2-byte cell pointer, sz page-bounded freeblock size",,
INT32-C,114,sqlite,src/btree.c,1678,FP,"pc 2-byte cell pointer, sz2 page-bounded freeblock size",,
INT32-C,115,sqlite,src/btree.c,1686,FP,"usableSize-4; usableSize in [512,65536], no underflow",,
INT32-C,116,sqlite,src/btree.c,1687,FP,hdr+5; hdr is 0 or 100,,
INT31-C,117,sqlite,src/btree.c,1690,FP,usableSize bounded 512..65536,,
INT32-C,118,sqlite,src/btree.c,1694,FP,"cellOffset + i*2; i<nCell, nCell bounded by cells-per-page",,
INT32-C,119,sqlite,src/btree.c,1706,FP,"cbrk starts at usableSize, size is page-bounded cell size; loop sum bounded by page, also guarded cbrk<iCellStart",,
INT31-C,120,sqlite,src/btree.c,1714,FP,size=xCellSize bounded; cbrk/pc checked vs usableSize before memcpy,,
INT32-C,121,sqlite,src/btree.c,1717,FP,hdr+7; hdr is 0 or 100,,
ARR36-C,122,sqlite,src/btree.c,1724,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
INT32-C,123,sqlite,src/btree.c,1725,FP,hdr+5; hdr is 0 or 100,,
INT32-C,124,sqlite,src/btree.c,1726,FP,hdr+1; hdr is 0 or 100,,
INT32-C,125,sqlite,src/btree.c,1727,FP,hdr+2; hdr is 0 or 100,,
ARR00-C,126,sqlite,src/btree.c,1728,FP,"cbrk/usableSize/iCellFirst are integer offsets within defragmentPage, not pointers from distinct arrays",,
ARR36-C,127,sqlite,src/btree.c,1728,FP,"cbrk/usableSize/iCellFirst are integer offsets within defragmentPage, not pointers from distinct arrays",,
INT31-C,128,sqlite,src/btree.c,1728,FP,"cbrk-iCellFirst: bounded page offsets, asserted in range",,
INT32-C,129,sqlite,src/btree.c,1728,FP,"cbrk,iCellFirst are page offsets <=usableSize",,
INT32-C,130,sqlite,src/btree.c,1750,FP,hdr+1; hdr is page header offset 0 or 100,,
INT32-C,131,sqlite,src/btree.c,1775,FP,hdr+7; hdr is 0 or 100,,
INT32-C,132,sqlite,src/btree.c,1843,FP,hdr+5; hdr is 0 or 100,,
INT32-C,133,sqlite,src/btree.c,1862,FP,hdr+2; hdr is 0 or 100,,
INT32-C,134,sqlite,src/btree.c,1885,FP,"nFree<=usableSize, nByte<usableSize-8; subtraction bounded, asserted nFree>=0",,
INT32-C,135,sqlite,src/btree.c,1887,FP,hdr+5; hdr is 0 or 100,,
INT32-C,136,sqlite,src/btree.c,1898,FP,"top<=usableSize, nByte<usableSize-8; top-=nByte bounded, asserted >=0",,
INT32-C,137,sqlite,src/btree.c,1899,FP,hdr+5; hdr is 0 or 100,,
INT32-C,138,sqlite,src/btree.c,1925,FP,"iStart,iSize are intra-page offsets/sizes <=usableSize<=65536",,
INT14-C,139,sqlite,src/btree.c,1931,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,140,sqlite,src/btree.c,1964,FP,"iFreeBlk,iEnd page offsets within usableSize",,
INT32-C,141,sqlite,src/btree.c,1966,FP,iFreeBlk + 2-byte freeblock size; guarded against >usableSize immediately after,,
INT32-C,142,sqlite,src/btree.c,1970,FP,"iEnd,iStart page offsets <=usableSize",,
INT32-C,143,sqlite,src/btree.c,1979,FP,iPtr page offset + 2-byte size; page-bounded,,
INT32-C,144,sqlite,src/btree.c,1982,FP,"iStart,iPtrEnd page offsets; nFrag accumulation bounded by page size, checked vs data[hdr+7]",,
INT32-C,145,sqlite,src/btree.c,1983,FP,"iEnd,iPtr page offsets <=usableSize",,
INT31-C,146,sqlite,src/btree.c,1995,FP,"iSize = freeblock size, bounded by page; iStart checked",,
INT32-C,147,sqlite,src/btree.c,2010,FP,iStart+2; iStart a page offset <=usableSize-4,,
INT32-C,148,sqlite,src/btree.c,2012,FP,nFree is u16-range per-page free count + iOrigSize<=usableSize; bounded,,
EXP34-C,149,sqlite,src/btree.c,2031,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,150,sqlite,src/btree.c,2034,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,151,sqlite,src/btree.c,2101,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,152,sqlite,src/btree.c,2116,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,153,sqlite,src/btree.c,2118,FP,usableSize-4; usableSize>=512,,
INT32-C,154,sqlite,src/btree.c,2125,FP,data[hdr+7] is single byte (0-255) + top (page offset <=usableSize),,
ARR36-C,155,sqlite,src/btree.c,2135,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
INT31-C,156,sqlite,src/btree.c,2149,FP,comparison cast only; usableSize bounded positive,,
ARR36-C,157,sqlite,src/btree.c,2162,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
ARR36-C,158,sqlite,src/btree.c,2165,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,159,sqlite,src/btree.c,2165,FP,"nFree<=usableSize, iCellFirst is page offset; checked nFree>=iCellFirst just above",,
EXP34-C,160,sqlite,src/btree.c,2183,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,161,sqlite,src/btree.c,2185,FP,usableSize-4; usableSize>=512,,
INT32-C,162,sqlite,src/btree.c,2188,FP,"iCellLast=usableSize-4 then --, far from INT_MIN",,
EXP34-C,163,sqlite,src/btree.c,2190,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,164,sqlite,src/btree.c,2190,FP,cellOffset + i*2; i<nCell bounded by cells-per-page,,
EXP34-C,165,sqlite,src/btree.c,2218,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,166,sqlite,src/btree.c,2233,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT14-C,167,sqlite,src/btree.c,2234,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,168,sqlite,src/btree.c,2278,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT31-C,169,sqlite,src/btree.c,2279,FP,"usableSize-hdr: hdr is 0 or 100, usableSize bounded",,
INT32-C,170,sqlite,src/btree.c,2279,FP,"memset size usableSize-hdr; usableSize<=65536, hdr 0/100; bounded buffer fill",,
INT31-C,171,sqlite,src/btree.c,2281,FP,flags is small PTF_* constant cast to char,,
INT14-C,172,sqlite,src/btree.c,2282,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,173,sqlite,src/btree.c,2282,FP,hdr + 8 or 12; hdr is 0 or 100,,
INT32-C,174,sqlite,src/btree.c,2283,FP,hdr+1; hdr is 0 or 100,,
INT32-C,175,sqlite,src/btree.c,2284,FP,hdr+7; hdr is 0 or 100,,
INT32-C,176,sqlite,src/btree.c,2285,FP,hdr+5; hdr is 0 or 100,,
DCL13-C,177,sqlite,src/btree.c,2304,FP,"pBt is stored into pPage->pBt (field type BtShared*, non-const); const param breaks the assignment",,
DCL30-C,178,sqlite,src/btree.c,2314,FP,"pPage from sqlite3PagerGetExtra (pager-owned memory), not automatic local; return is valid",,
EXP33-C,179,sqlite,src/btree.c,2341,FP,value assigned before use on all reachable paths,,
DCL13-C,180,sqlite,src/btree.c,2364,TP,btreePagecount returns pBt->nPage; pure getter,,
API00-C,181,sqlite,src/btree.c,2367,FP,"caller-owned Btree, asserts HoldsMutex; reads p->pBt only",,
EXP33-C,182,sqlite,src/btree.c,2395,FP,value assigned before use on all reachable paths,,
DCL30-C,183,sqlite,src/btree.c,2407,FP,"*ppPage=pPage where pPage is pager-owned MemPage, not automatic storage",,
DCL13-C,184,sqlite,src/btree.c,2417,TP,releasePageNotNull only reads fields and passes pPage->pDbPage by value to unref,,
EXP34-C,185,sqlite,src/btree.c,2418,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
DCL13-C,186,sqlite,src/btree.c,2429,TP,releasePageOne only reads fields and passes pPage->pDbPage by value to unref,,
API00-C,187,sqlite,src/btree.c,2528,FP,pVfs is a caller-supplied VFS handle per public API contract; not untrusted-derived,,
STR34-C,188,sqlite,src/btree.c,2544,FP,"zFilename[0]==0 is a comparison to 0, not a char widened into a large signed integer",,
STR34-C,189,sqlite,src/btree.c,2552,FP,"strcmp(zFilename,...) passes pointer to library; no char-to-int sign-extension occurs",,
STR34-C,190,sqlite,src/btree.c,2592,FP,sqlite3Strlen30(zFilename) passes pointer; no plain-char widening to large int,,
INT32-C,191,sqlite,src/btree.c,2593,FP,pVfs->mxPathname is small VFS path limit (typ 512/1024); +1 cannot overflow,,
EXP34-C,192,sqlite,src/btree.c,2603,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT31-C,193,sqlite,src/btree.c,2603,FP,nFilename=strlen(zFilename)+1 bounded by path length,,
EXP34-C,194,sqlite,src/btree.c,2619,FP,SQLITE_MUTEX_STATIC_OPEN alloc cannot fail; mutex_enter is a no-op on NULL,,
EXP34-C,195,sqlite,src/btree.c,2623,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,196,sqlite,src/btree.c,2625,FP,zFullPathname use precedes any free; frees at 2611/2633/2644 are on separate return paths,,
ARR00-C,197,sqlite,src/btree.c,2628,FP,"iDb is a for-loop counter (iDb=db->nDb-1; iDb>=0; iDb--), fully initialized; not an uninitialized bound",,
INT32-C,198,sqlite,src/btree.c,2628,FP,db->nDb is count of attached databases (<=~62 + limit); -1 bounded,,
EXP34-C,199,sqlite,src/btree.c,2632,FP,guarded by if(mutexOpen) at 2815; mutex_leave no-op on NULL; static alloc never fails,,
MEM30-C,200,sqlite,src/btree.c,2633,FP,mutually-exclusive return path; zFullPathname freed once per path then function returns,,
MEM30-C,201,sqlite,src/btree.c,2634,FP,p freed once on this CONSTRAINT return path; not a double-free,,
MEM30-C,202,sqlite,src/btree.c,2644,FP,zFullPathname freed once on this path; the 2611/2633 frees are other return paths,,
DCL03-C,203,sqlite,src/btree.c,2664,TP,assert(sizeof(i64)==8) compile-time constant; static_assert applicable,,
DCL03-C,204,sqlite,src/btree.c,2665,TP,assert(sizeof(u64)==8) compile-time constant; static_assert applicable,,
DCL03-C,205,sqlite,src/btree.c,2666,TP,assert(sizeof(u32)==4) compile-time constant; static_assert applicable,,
DCL03-C,206,sqlite,src/btree.c,2667,TP,assert(sizeof(u16)==2) compile-time constant; static_assert applicable,,
DCL03-C,207,sqlite,src/btree.c,2668,TP,assert(sizeof(Pgno)==4) compile-time constant; static_assert applicable,,
INT14-C,208,sqlite,src/btree.c,2705,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
MEM30-C,209,sqlite,src/btree.c,2740,FP,p is the live new Btree being linked into the sibling list; freed only on error return,,
DCL31-C,210,sqlite,src/btree.c,2752,FP,"GLOBAL(BtShared*,...) macro assignment misparsed as declaration; no missing type specifier",,
MEM30-C,211,sqlite,src/btree.c,2763,FP,"p is live; freed only at btree_open_out error path, not here",,
EXP30-C,212,sqlite,src/btree.c,2767,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
MEM30-C,213,sqlite,src/btree.c,2769,FP,p->pBt compared; p is a live Btree being linked into list,,
MEM30-C,214,sqlite,src/btree.c,2774,FP,pSib/p live Btree list traversal; no free on this path,,
MEM30-C,215,sqlite,src/btree.c,2779,FP,p is live; linking into sibling list,,
MEM30-C,216,sqlite,src/btree.c,2780,FP,p is live; setting p->pNext->pPrev during list insert,,
DCL30-C,217,sqlite,src/btree.c,2789,FP,"*ppBtree=p where p is heap-allocated via sqlite3MallocZero, not automatic storage",,
EXP34-C,218,sqlite,src/btree.c,2811,FP,sqlite3PagerFile returns address of embedded sqlite3_file struct; never NULL,,
MSC37-C,219,sqlite,src/btree.c,2829,FP,removeFromSharingList: both #ifndef branch (return removed) and #else (return 1) return a value,,
DCL31-C,220,sqlite,src/btree.c,2841,FP,"GLOBAL(BtShared*,...) macro assignment misparsed; no missing type specifier",,
API00-C,221,sqlite,src/btree.c,2917,FP,"caller-owned Btree handle; asserts mutex held, API contract requires valid handle",,
EXP34-C,222,sqlite,src/btree.c,2918,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,223,sqlite,src/btree.c,2927,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,224,sqlite,src/btree.c,2958,FP,"pBt->xFreeSchema is a function pointer invocation, not a free; pBt live",,
MEM30-C,225,sqlite,src/btree.c,2960,FP,sqlite3DbFree(pBt->pSchema) frees pSchema once; pBt itself not freed yet,,
MEM30-C,226,sqlite,src/btree.c,2962,FP,pBt freed once here (sqlite3_free); use of pBt at 2960/2961 precedes it,,
MEM30-C,227,sqlite,src/btree.c,2966,FP,p is live; freed only at 2972 after these uses,,
MEM30-C,228,sqlite,src/btree.c,2967,FP,p live; assert on p->locked,,
MEM30-C,229,sqlite,src/btree.c,2968,FP,p live; unlinking from sharing list before free,,
MEM30-C,230,sqlite,src/btree.c,2969,FP,p live; unlinking from sharing list before free,,
MEM30-C,231,sqlite,src/btree.c,2972,FP,p freed once here; single sqlite3_free(p),,
EXP34-C,232,sqlite,src/btree.c,2987,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,233,sqlite,src/btree.c,3002,FP,caller-owned Btree; asserts mutex held,,
API00-C,234,sqlite,src/btree.c,3017,FP,caller-owned Btree; asserts mutex held,,
API00-C,235,sqlite,src/btree.c,3036,FP,caller-owned Btree; asserts mutex held,,
API00-C,236,sqlite,src/btree.c,3069,FP,pageSize is range/power-of-2 validated (>=512 && <=SQLITE_MAX_PAGE_SIZE && pow2) before use; no unchecked arithmetic,,
INT14-C,237,sqlite,src/btree.c,3076,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,238,sqlite,src/btree.c,3088,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
MEM30-C,239,sqlite,src/btree.c,3095,FP,"freeTempSpace(pBt) at 3093 frees pBt->pTmpSpace, not pBt; pBt is live",,
MEM30-C,240,sqlite,src/btree.c,3096,FP,"pBt live; pBt->pageSize field access, not freed",,
MEM30-C,241,sqlite,src/btree.c,3098,FP,p live BtShared owner; sqlite3BtreeLeave(p),,
DCL13-C,242,sqlite,src/btree.c,3105,TP,sqlite3BtreeGetPageSize returns p->pBt->pageSize; getter,,
API00-C,243,sqlite,src/btree.c,3120,FP,caller-owned Btree; asserts pBt->mutex held,,
DCL13-C,244,sqlite,src/btree.c,3120,TP,sqlite3BtreeGetReserveNoMutex reads only p->pBt->pageSize/usableSize,,
API00-C,245,sqlite,src/btree.c,3136,FP,caller-owned Btree handle; standard accessor,,
API00-C,246,sqlite,src/btree.c,3151,FP,caller-owned Btree handle; Enter/Leave bracket,,
API00-C,247,sqlite,src/btree.c,3177,FP,"newFlag only used as multiplier for newFlag>=0; bounded by documented {-1,0,1,2} contract, result masked to u16, no overflow",,
DCL03-C,248,sqlite,src/btree.c,3181,TP,assert(BTS_OVERWRITE==BTS_SECURE_DELETE*2) compile-time constant; static_assert applicable,,
INT14-C,249,sqlite,src/btree.c,3181,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
DCL03-C,250,sqlite,src/btree.c,3182,TP,assert on BTS_FAST_SECURE bitmask is compile-time constant; static_assert applicable,,
INT14-C,251,sqlite,src/btree.c,3184,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,252,sqlite,src/btree.c,3187,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
API00-C,253,sqlite,src/btree.c,3198,FP,caller-owned Btree handle; standard mutator,,
MSC37-C,254,sqlite,src/btree.c,3198,FP,"sqlite3BtreeSetAutoVacuum: #ifdef returns READONLY, #else returns rc; all paths return",,
API00-C,255,sqlite,src/btree.c,3222,FP,caller-owned Btree handle; standard accessor,,
MSC37-C,256,sqlite,src/btree.c,3222,FP,sqlite3BtreeGetAutoVacuum: both #ifdef and #else branches return a value,,
DCL13-C,257,sqlite,src/btree.c,3246,TP,"reads only pBt->db/pPager; mutations are on pDb via db->aDb, not pBt",,
EXP30-C,258,sqlite,src/btree.c,3249,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
EXP33-C,259,sqlite,src/btree.c,3249,FP,value assigned before use on all reachable paths,,
EXP34-C,260,sqlite,src/btree.c,3249,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,261,sqlite,src/btree.c,3250,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,262,sqlite,src/btree.c,3294,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,263,sqlite,src/btree.c,3294,FP,"flagged operand is pointer arithmetic 28+(u8*)aData (get4byte arg), not signed int overflow; misfire",,
INT14-C,264,sqlite,src/btree.c,3299,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR38-C,265,sqlite,src/btree.c,3310,FP,"memcmp 16 bytes against page1, a full database page buffer (>=512 bytes)",,
EXP34-C,266,sqlite,src/btree.c,3310,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT14-C,267,sqlite,src/btree.c,3367,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,268,sqlite,src/btree.c,3370,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
MEM30-C,269,sqlite,src/btree.c,3397,FP,"freeTempSpace(pBt) frees pBt->pTmpSpace; pBt live, pBt->pPager passed",,
INT32-C,270,sqlite,src/btree.c,3437,FP,"(usableSize-12)*64/255-23; usableSize<=65536 so product <=~4.2M, well below INT_MAX",,
INT32-C,271,sqlite,src/btree.c,3438,FP,"(usableSize-12)*32/255-23; product <=~2.1M, bounded",,
INT32-C,272,sqlite,src/btree.c,3440,FP,(usableSize-12)*32/255-23; product bounded by page size,,
MSC07-C,273,sqlite,src/btree.c,3451,FP,"code after return SQLITE_OK is the page1_init_failed: goto label target, reachable via goto",,
DCL13-C,274,sqlite,src/btree.c,3470,TP,countValidCursors only walks pBt->pCursor reading fields,,
DCL00-C,275,sqlite,src/btree.c,3472,FP,"int r=0 is incremented (r++) inside the loop; it is modified, cannot be const",,
EXP20-C,276,sqlite,src/btree.c,3495,FP,deliberate test for exact refcount value 1; semantically correct,,
DCL22-C,277,sqlite,src/btree.c,3508,FP,data is a local pointer to page buffer used with memcpy; no signal/setjmp context requiring volatile,,
ARR01-C,278,sqlite,src/btree.c,3520,FP,zMagicHeader is the real file-scope array (line 22) not a decayed param; sizeof(zMagicHeader)==16 is correct and asserted,,
EXP05-C,279,sqlite,src/btree.c,3520,FP,size/index expression or non-const object; no const qualifier actually removed,,
ARR01-C,280,sqlite,src/btree.c,3521,FP,zMagicHeader is the real file-scope array (line 22) not a decayed param; sizeof(zMagicHeader)==16 is correct and asserted,,
DCL03-C,281,sqlite,src/btree.c,3521,TP,assert(sizeof(zMagicHeader)==16) compile-time constant; static_assert applicable,,
INT14-C,282,sqlite,src/btree.c,3522,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
API00-C,283,sqlite,src/btree.c,3550,FP,caller-owned Btree handle; Enter/Leave bracket,,
INT13-C,284,sqlite,src/btree.c,3736,FP,"rc is small SQLITE_* code; & is masking idiom, value bounded",,
INT32-C,285,sqlite,src/btree.c,3745,FP,"nTransaction is in-process open-transaction counter; bounded by handle count, not reachable to INT_MAX",,
API00-C,286,sqlite,src/btree.c,3801,FP,pSchemaVersion is an optional OUT param explicitly NULL-checked before write,,
EXP34-C,287,sqlite,src/btree.c,3835,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
ARR30-C,288,sqlite,src/btree.c,3844,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
EXP43-C,289,sqlite,src/btree.c,3846,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
ARR30-C,290,sqlite,src/btree.c,3895,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,291,sqlite,src/btree.c,3909,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP34-C,292,sqlite,src/btree.c,3949,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
PRE32-C,293,sqlite,src/btree.c,3960,FP,TRACE((...)) args are a printf argument tuple with no # or ## preprocessor operators; macro expands empty,,
EXP34-C,294,sqlite,src/btree.c,4000,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP33-C,295,sqlite,src/btree.c,4112,FP,value assigned before use on all reachable paths,,
INT33-C,296,sqlite,src/btree.c,4141,FP,nEntry=usableSize/5 >=102; never zero,,
DCL13-C,297,sqlite,src/btree.c,4198,TP,"autoVacuumCommit reads only p->pBt/p->db; writes go through pBt-reachable objects, not p",,
API00-C,298,sqlite,src/btree.c,4309,FP,caller-owned Btree handle; reads p->inTrans per contract,,
EXP34-C,299,sqlite,src/btree.c,4337,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,300,sqlite,src/btree.c,4342,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,301,sqlite,src/btree.c,4344,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,302,sqlite,src/btree.c,4357,FP,nTransaction-- guarded; counter never below 0 in practice (matched ++); not reachable to INT_MIN,,
API00-C,303,sqlite,src/btree.c,4430,FP,caller-owned Btree handle; standard commit wrapper,,
API00-C,304,sqlite,src/btree.c,4467,FP,pBtree NULL handled by design (if(pBtree)); caller-owned,,
MEM05-C,305,sqlite,src/btree.c,4467,uncertain,sqlite3BtreeTripAllCursors self-recursion is bounded to depth 1 (recursive call passes writeOnly=0); not excessive stack,,
MSC04-C,306,sqlite,src/btree.c,4467,TP,sqlite3BtreeTripAllCursors calls itself directly at line 4479; direct recursion is factual,,
API00-C,307,sqlite,src/btree.c,4518,FP,caller-owned Btree handle; standard rollback,,
EXP34-C,308,sqlite,src/btree.c,4520,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,309,sqlite,src/btree.c,4542,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,310,sqlite,src/btree.c,4583,FP,caller-owned Btree handle; asserts inTrans==TRANS_WRITE,,
API00-C,311,sqlite,src/btree.c,4614,FP,p NULL handled by design (if(p && ...)); caller-owned,,
DCL13-C,312,sqlite,src/btree.c,4689,FP,"stored into pCur->pKeyInfo (field type struct KeyInfo*, non-const); const param breaks the assignment",,
DCL13-C,313,sqlite,src/btree.c,4798,TP,sqlite3BtreeClosesWithCursor only reads pBtree->pBt and compares pointers; pBtree not mutated,,
DCL13-C,314,sqlite,src/btree.c,4799,TP,only reads pCur->pNext/pBtree and compares; pCur not mutated,,
API00-C,315,sqlite,src/btree.c,4818,FP,p is raw memory to be initialized via memset; caller-owned cursor buffer,,
API00-C,316,sqlite,src/btree.c,4826,FP,caller-owned cursor; pCur->pBtree NULL handled (if(pBtree)),,
DCL13-C,317,sqlite,src/btree.c,4870,TP,cellInfoEqual only reads a->nKey/pPayload/nPayload/nLocal/nSize for comparison; a not mutated,,
API00-C,318,sqlite,src/btree.c,4902,FP,debug-only assert helper; explicitly NULL-tolerant (pCur && ...),,
DCL13-C,319,sqlite,src/btree.c,4902,TP,sqlite3BtreeCursorIsValid reads only pCur->eState,,
API00-C,320,sqlite,src/btree.c,4906,FP,asserts pCur!=0; caller-owned cursor (NN = NotNull contract),,
DCL13-C,321,sqlite,src/btree.c,4906,TP,sqlite3BtreeCursorIsValidNN reads only pCur->eState,,
API00-C,322,sqlite,src/btree.c,4917,FP,caller-owned cursor guarded by assert(eState==CURSOR_VALID),,
API00-C,323,sqlite,src/btree.c,4928,FP,caller-owned cursor; asserts curFlags state,,
API00-C,324,sqlite,src/btree.c,4932,FP,caller-owned cursor; asserts curFlags state,,
API00-C,325,sqlite,src/btree.c,4941,FP,caller-owned cursor; asserts mutex held and eState==CURSOR_VALID,,
INT32-C,326,sqlite,src/btree.c,4945,FP,"pgno cast to (i64) before -1 and i64 multiply by pageSize; computation is 64-bit, no 32-bit overflow",,
API00-C,327,sqlite,src/btree.c,4958,FP,caller-owned cursor; asserts eState==CURSOR_VALID,,
API00-C,328,sqlite,src/btree.c,4978,FP,caller-owned cursor; asserts eState==CURSOR_VALID,,
EXP34-C,329,sqlite,src/btree.c,5047,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
DCL30-C,330,sqlite,src/btree.c,5053,FP,"*ppPage=pPage where pPage is pager-owned MemPage, not automatic storage",,
EXP34-C,331,sqlite,src/btree.c,5055,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT31-C,332,sqlite,src/btree.c,5084,FP,"nByte from accessPayload, min-bounded vs cell payload",,
STR31-C,333,sqlite,src/btree.c,5084,FP,"memcpy(pPayload,pBuf,nByte) copies binary page payload, not a NUL-terminated string",,
INT31-C,334,sqlite,src/btree.c,5087,FP,nByte min-bounded,,
STR31-C,335,sqlite,src/btree.c,5087,FP,"memcpy(pBuf,pPayload,nByte) copies binary page data, not a string needing terminator",,
INT14-C,336,sqlite,src/btree.c,5150,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
EXP08-C,337,sqlite,src/btree.c,5162,FP,integer (u32) offset arithmetic not pointer byte arithmetic on a struct,,
INT33-C,338,sqlite,src/btree.c,5188,FP,ovflSize=usableSize-4 never zero,,
INT30-C,339,sqlite,src/btree.c,5196,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,340,sqlite,src/btree.c,5196,FP,"nOvfl=(nPayload-nLocal+ovflSize-1)/ovflSize; nPayload<=SQLITE_MAX_LENGTH(~1e9), nOvfl<=~2M, *2*4<=~16M < INT_MAX",,
ARR38-C,341,sqlite,src/btree.c,5204,FP,memset of pCur->aOverflow sized nOvfl*sizeof(Pgno); buffer (re)allocated to >= that size immediately above,,
INT30-C,342,sqlite,src/btree.c,5204,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,343,sqlite,src/btree.c,5204,FP,"memset nOvfl*sizeof(Pgno); nOvfl bounded by max payload/ovflSize, product <~16M",,
MEM30-C,344,sqlite,src/btree.c,5204,FP,pCur->aOverflow reassigned from sqlite3Realloc result (aNew); points to live buffer,,
INT33-C,345,sqlite,src/btree.c,5211,FP,ovflSize never zero,,
INT33-C,346,sqlite,src/btree.c,5217,FP,ovflSize never zero,,
INT33-C,347,sqlite,src/btree.c,5218,FP,ovflSize never zero,,
INT33-C,348,sqlite,src/btree.c,5220,FP,ovflSize never zero,,
MEM30-C,349,sqlite,src/btree.c,5228,FP,"pCur->aOverflow is the realloc'd live cache array, not freed",,
MEM30-C,350,sqlite,src/btree.c,5229,FP,pCur->aOverflow live realloc'd array,,
MEM30-C,351,sqlite,src/btree.c,5231,FP,pCur->aOverflow live; writing cache entry,,
INT32-C,352,sqlite,src/btree.c,5242,FP,iIdx+1; iIdx is overflow-page index bounded by nOvfl (max payload bounded),,
MEM30-C,353,sqlite,src/btree.c,5242,FP,pCur->aOverflow live cache array,,
INT32-C,354,sqlite,src/btree.c,5243,FP,"iIdx+1; overflow-page cache index, bounded",,
MEM30-C,355,sqlite,src/btree.c,5243,FP,pCur->aOverflow live cache array,,
EXP08-C,356,sqlite,src/btree.c,5253,FP,integer (u32) offset arithmetic not pointer byte arithmetic on a struct,,
ARR00-C,357,sqlite,src/btree.c,5274,FP,&pBuf[-4] only formed/used under the (6) guard &pBuf[-4]>=pBufStart and asserted aWrite>=pBufStart,,
ARR00-C,358,sqlite,src/btree.c,5278,FP,&pBuf[-4] only formed/used under the (6) guard &pBuf[-4]>=pBufStart and asserted aWrite>=pBufStart,,
ARR36-C,359,sqlite,src/btree.c,5279,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,360,sqlite,src/btree.c,5281,FP,"a+4; a<=ovflSize<=usableSize-4, bounded by page size",,
INT32-C,361,sqlite,src/btree.c,5305,FP,iIdx++; overflow-page index bounded by nOvfl,,
API00-C,362,sqlite,src/btree.c,5333,FP,caller-owned cursor; asserts eState==CURSOR_VALID and pPage set,,
DCL03-C,363,sqlite,src/btree.c,5406,FP,"assert(CORRUPT_DB) - CORRUPT_DB is sqlite3Config.neverCorrupt==0, a runtime value, not constant",,
API00-C,364,sqlite,src/btree.c,5428,FP,"pAmt is a caller-supplied OUT pointer per fetchPayload contract; always written, asserts cover pCur",,
ARR30-C,365,sqlite,src/btree.c,5486,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
DCL03-C,366,sqlite,src/btree.c,5547,TP,assert(CURSOR_INVALID<CURSOR_REQUIRESEEK) enum-constant comparison; static_assert applicable,,
DCL03-C,367,sqlite,src/btree.c,5548,TP,assert(CURSOR_VALID<CURSOR_REQUIRESEEK) enum-constant comparison; static_assert applicable,,
DCL03-C,368,sqlite,src/btree.c,5549,TP,assert(CURSOR_FAULT>CURSOR_REQUIRESEEK) enum-constant comparison; static_assert applicable,,
EXP45-C,369,sqlite,src/btree.c,5635,FP,intentional sqlite assignment-in-condition idiom; value used correctly,,
EXP34-C,370,sqlite,src/btree.c,5636,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
ARR30-C,371,sqlite,src/btree.c,5637,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
EXP45-C,372,sqlite,src/btree.c,5660,FP,intentional sqlite assignment-in-condition idiom; value used correctly,,
EXP34-C,373,sqlite,src/btree.c,5661,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,374,sqlite,src/btree.c,5676,FP,caller-owned cursor; asserts cursorOwnsBtShared and mutex held,,
API00-C,375,sqlite,src/btree.c,5699,FP,pRes is a caller-supplied OUT pointer per contract; always written,,
DCL13-C,376,sqlite,src/btree.c,5726,TP,cursorIsAtLastEntry reads pCur->iPage/aiIdx/apPage/ix/pPage fields; pCur not mutated,,
ARR00-C,377,sqlite,src/btree.c,5728,FP,ii is a for-loop counter initialized ii=0; not uninitialized,,
API00-C,378,sqlite,src/btree.c,5757,FP,pRes is a caller-supplied OUT pointer per contract; always written,,
API00-C,379,sqlite,src/btree.c,5793,FP,"caller-owned cursor; asserts cursorOwnsBtShared, mutex, pRes",,
INT14-C,380,sqlite,src/btree.c,5809,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,381,sqlite,src/btree.c,5876,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,382,sqlite,src/btree.c,5876,FP,"1-biasRight; biasRight asserted 0 or 1, result 0 or 1",,
INT34-C,383,sqlite,src/btree.c,5876,FP,"shift amount (1-biasRight) is 0 or 1 (biasRight in {0,1}); always < width",,
ARR30-C,384,sqlite,src/btree.c,5879,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,385,sqlite,src/btree.c,5881,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP33-C,386,sqlite,src/btree.c,5888,FP,value assigned before use on all reachable paths,,
INT32-C,387,sqlite,src/btree.c,5889,FP,idx+1; idx is cell index bounded by nCell (cells-per-page),,
INT32-C,388,sqlite,src/btree.c,5892,FP,"idx-1; binary-search index in [0,nCell-1]",,
INT14-C,389,sqlite,src/btree.c,5908,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT13-C,390,sqlite,src/btree.c,5909,FP,lwr signed but provably >=0 (binary-search index),,
ARR30-C,391,sqlite,src/btree.c,5924,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR30-C,392,sqlite,src/btree.c,5960,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,393,sqlite,src/btree.c,5962,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,394,sqlite,src/btree.c,5967,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR37-C,395,sqlite,src/btree.c,5968,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
DCL31-C,396,sqlite,src/btree.c,5968,FP,"xRecordCompare is a local function-pointer variable declared earlier, not an undeclared function",,
ARR37-C,397,sqlite,src/btree.c,5969,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP30-C,398,sqlite,src/btree.c,5969,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
ARR37-C,399,sqlite,src/btree.c,5970,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP30-C,400,sqlite,src/btree.c,5970,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
INT13-C,401,sqlite,src/btree.c,5970,FP,nCell signed but >=0 (cell count <=10921),,
ARR37-C,402,sqlite,src/btree.c,5975,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
DCL31-C,403,sqlite,src/btree.c,5975,FP,"xRecordCompare is a local function-pointer variable, declared; not an undeclared function call",,
DCL13-C,404,sqlite,src/btree.c,5988,TP,cursorOnLastPage reads pCur->iPage/apPage/aiIdx; pCur not mutated,,
API00-C,405,sqlite,src/btree.c,6024,FP,"pIdxKey is caller-constructed UnpackedRecord; asserts pCur->pKeyInfo!=0, internal contract",,
EXP34-C,406,sqlite,src/btree.c,6042,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT14-C,407,sqlite,src/btree.c,6065,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,408,sqlite,src/btree.c,6118,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR30-C,409,sqlite,src/btree.c,6121,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,410,sqlite,src/btree.c,6131,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,411,sqlite,src/btree.c,6136,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR37-C,412,sqlite,src/btree.c,6137,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR37-C,413,sqlite,src/btree.c,6138,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP30-C,414,sqlite,src/btree.c,6138,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
ARR37-C,415,sqlite,src/btree.c,6139,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP30-C,416,sqlite,src/btree.c,6139,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
INT13-C,417,sqlite,src/btree.c,6139,FP,nCell >=0 small cell count,,
ARR37-C,418,sqlite,src/btree.c,6144,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT33-C,419,sqlite,src/btree.c,6164,FP,usableSize >=512; never zero,,
EXP05-C,420,sqlite,src/btree.c,6175,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT32-C,421,sqlite,src/btree.c,6175,FP,"flagged operand is pointer arith (u8*)pCellKey+nCell (memset dest), not signed int overflow; misfire",,
MEM30-C,422,sqlite,src/btree.c,6181,FP,pCellKey used before free; free at 6178 is on mutually-exclusive error path,,
MEM30-C,423,sqlite,src/btree.c,6182,FP,pCellKey freed once on this no-error path; single sqlite3_free,,
MEM31-C,424,sqlite,src/btree.c,6182,FP,pCellKey freed at 6178 only on rc!=0 path (then goto); free at 6182 is the mutually-exclusive success path; no double free,,
INT32-C,425,sqlite,src/btree.c,6189,FP,idx+1; cell index bounded by nCell,,
INT32-C,426,sqlite,src/btree.c,6191,FP,idx-1; binary-search index bounded,,
INT14-C,427,sqlite,src/btree.c,6201,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT13-C,428,sqlite,src/btree.c,6202,FP,lwr >=0 binary-search index,,
ARR30-C,429,sqlite,src/btree.c,6216,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
API00-C,430,sqlite,src/btree.c,6262,FP,caller-owned cursor; reads eState only,,
DCL13-C,431,sqlite,src/btree.c,6262,TP,sqlite3BtreeEof reads only pCur->eState,,
MSC04-C,432,sqlite,src/btree.c,6315,TP,btreeNext participates in real indirect recursion via sqlite3BtreeNext->moveToLeftmost->...->btreeNext,,
MSC04-C,433,sqlite,src/btree.c,6369,TP,sqlite3BtreeNext indirect recursion (sqlite3BtreeNext->btreeNext) is factual,,
MSC04-C,434,sqlite,src/btree.c,6409,TP,btreePrevious indirect recursion via sqlite3BtreePrevious is factual,,
ARR30-C,435,sqlite,src/btree.c,6437,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
MSC04-C,436,sqlite,src/btree.c,6461,TP,sqlite3BtreePrevious indirect recursion (->btreePrevious) is factual,,
EXP33-C,437,sqlite,src/btree.c,6542,FP,value assigned before use on all reachable paths,,
DCL30-C,438,sqlite,src/btree.c,6603,FP,"*ppPage=pTrunk where pTrunk is pager-owned MemPage, not automatic storage",,
DCL30-C,439,sqlite,src/btree.c,6618,FP,"*ppPage=pTrunk where pTrunk is pager-owned MemPage, not automatic storage",,
EXP33-C,440,sqlite,src/btree.c,6639,FP,value assigned before use on all reachable paths,,
EXP34-C,441,sqlite,src/btree.c,6650,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,442,sqlite,src/btree.c,6657,FP,"(k-1)*4; k validated k<=usableSize/4-2 at line 6606 before reaching here, so product<=usableSize<=65536",,
PRE32-C,443,sqlite,src/btree.c,6716,FP,TRACE((...)) args contain no # or ## operators; macro expands to nothing,,
INT32-C,444,sqlite,src/btree.c,6785,FP,"flagged operand is pointer arith 28+(u8*)aData (put4byte dest), not signed int overflow; misfire",,
DCL13-C,445,sqlite,src/btree.c,6821,FP,pMemPage assigned to non-const local (pPage=pMemPage) which is then written via PagerWrite; const breaks the assignment,,
INT14-C,446,sqlite,src/btree.c,6849,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
EXP34-C,447,sqlite,src/btree.c,6889,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,448,sqlite,src/btree.c,6952,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,449,sqlite,src/btree.c,6957,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
DCL13-C,450,sqlite,src/btree.c,6966,TP,clearCellOverflow only reads via get4byte(pCell+..) and pointer comparisons; pCell not written,,
DCL13-C,451,sqlite,src/btree.c,6967,TP,clearCellOverflow reads only pInfo->nLocal/nPayload/nSize,,
INT33-C,452,sqlite,src/btree.c,6987,FP,ovflPageSize=usableSize-4; asserted usableSize>4,,
INT32-C,453,sqlite,src/btree.c,6991,FP,"nOvfl-- loop; nOvfl=(nPayload-nLocal+ovflPageSize-1)/ovflPageSize >0, bounded by max payload; not at INT_MIN",,
EXP30-C,454,sqlite,src/btree.c,7005,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
EXP34-C,455,sqlite,src/btree.c,7006,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,456,sqlite,src/btree.c,7024,FP,freePage2 marks DB page on freelist; sqlite3PagerUnref(pOvfl->pDbPage) is distinct in-memory unref,,
PRE00-C,457,sqlite,src/btree.c,7038,TP,BTREE_CLEAR_CELL multiple-evaluates pPage/pCell/sInfo; function-like macro side-effect hazard,,
PRE01-C,458,sqlite,src/btree.c,7038,FP,flagged param 'rc' is used only as assignment lvalue (rc=...); parenthesization inapplicable to lvalue target,,
PRE10-C,459,sqlite,src/btree.c,7038,TP,BTREE_CLEAR_CELL is a multi-statement macro (stmt + if/else) not wrapped in do-while,,
PRE12-C,460,sqlite,src/btree.c,7038,TP,BTREE_CLEAR_CELL evaluates pPage/pCell multiple times (xParseCell call and clearCellOverflow call),,
INT32-C,461,sqlite,src/btree.c,7086,FP,"pX->nData+pX->nZero bounded by SQLITE_LIMIT_LENGTH (<=~2e9<INT_MAX), enforced upstream in vdbe MakeRecord (SQLITE_TOOBIG); cannot overflow",,
ARR37-C,462,sqlite,src/btree.c,7090,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP34-C,463,sqlite,src/btree.c,7090,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,464,sqlite,src/btree.c,7090,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR37-C,465,sqlite,src/btree.c,7091,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,466,sqlite,src/btree.c,7091,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR37-C,467,sqlite,src/btree.c,7096,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,468,sqlite,src/btree.c,7096,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR37-C,469,sqlite,src/btree.c,7100,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,470,sqlite,src/btree.c,7104,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR37-C,471,sqlite,src/btree.c,7109,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT31-C,472,sqlite,src/btree.c,7114,FP,nSrc<=nPayload<=maxLocal (asserted),,
INT31-C,473,sqlite,src/btree.c,7115,FP,nPayload-nSrc bounded by maxLocal,,
INT32-C,474,sqlite,src/btree.c,7115,FP,"nPayload/nSrc/spaceLeft are within-page byte counts <= usableSize; subtraction stays in range, no overflow",,
ARR36-C,475,sqlite,src/btree.c,7123,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
INT32-C,476,sqlite,src/btree.c,7123,FP,"nPayload/nSrc/spaceLeft are within-page byte counts <= usableSize; subtraction stays in range, no overflow",,
INT33-C,477,sqlite,src/btree.c,7123,FP,usableSize-4 never zero,,
INT32-C,478,sqlite,src/btree.c,7128,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR37-C,479,sqlite,src/btree.c,7129,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,480,sqlite,src/btree.c,7129,FP,"nHeader/nPayload within a single cell on one page; bounded by usableSize<=65536, no overflow",,
ARR36-C,481,sqlite,src/btree.c,7160,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
EXP05-C,482,sqlite,src/btree.c,7172,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT31-C,483,sqlite,src/btree.c,7172,FP,n bounded by spaceLeft (<=maxLocal),,
EXP05-C,484,sqlite,src/btree.c,7175,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT31-C,485,sqlite,src/btree.c,7175,FP,n=nSrc bounded,,
EXP05-C,486,sqlite,src/btree.c,7177,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT31-C,487,sqlite,src/btree.c,7177,FP,n bounded by spaceLeft,,
INT32-C,488,sqlite,src/btree.c,7179,FP,"nPayload/nSrc/spaceLeft are within-page byte counts <= usableSize; subtraction stays in range, no overflow",,
ARR37-C,489,sqlite,src/btree.c,7181,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,490,sqlite,src/btree.c,7183,FP,"nPayload/nSrc/spaceLeft are within-page byte counts <= usableSize; subtraction stays in range, no overflow",,
INT32-C,491,sqlite,src/btree.c,7184,FP,"nPayload/nSrc/spaceLeft are within-page byte counts <= usableSize; subtraction stays in range, no overflow",,
EXP34-C,492,sqlite,src/btree.c,7213,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,493,sqlite,src/btree.c,7218,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,494,sqlite,src/btree.c,7232,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,495,sqlite,src/btree.c,7234,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,496,sqlite,src/btree.c,7240,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,497,sqlite,src/btree.c,7267,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,498,sqlite,src/btree.c,7282,FP,"freeSpace at 7277 reorganises cells within MemPage; pPage live, no heap free",,
MEM30-C,499,sqlite,src/btree.c,7283,FP,pPage live; in-place page edit (dropCell),,
INT32-C,500,sqlite,src/btree.c,7284,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,501,sqlite,src/btree.c,7285,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,502,sqlite,src/btree.c,7286,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,503,sqlite,src/btree.c,7286,FP,pPage->pBt live; writing page header bytes,,
MEM30-C,504,sqlite,src/btree.c,7287,FP,pPage live; recomputing nFree in-place,,
MEM30-C,505,sqlite,src/btree.c,7288,FP,pPage live; pPage->hdrOffset access,,
ARR37-C,506,sqlite,src/btree.c,7290,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP43-C,507,sqlite,src/btree.c,7290,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,508,sqlite,src/btree.c,7290,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,509,sqlite,src/btree.c,7290,FP,in-place memmove of cell index; pPage live,,
INT32-C,510,sqlite,src/btree.c,7291,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,511,sqlite,src/btree.c,7291,FP,pPage live; put2byte into page header,,
INT32-C,512,sqlite,src/btree.c,7292,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT31-C,513,sqlite,src/btree.c,7340,FP,"sz=xCellSize asserted, bounded by page",,
INT32-C,514,sqlite,src/btree.c,7374,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
ARR37-C,515,sqlite,src/btree.c,7380,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT31-C,516,sqlite,src/btree.c,7380,FP,sz-4 bounded,,
INT32-C,517,sqlite,src/btree.c,7380,FP,sz is a single cell size <= usableSize; sz-4 cannot overflow,,
INT32-C,518,sqlite,src/btree.c,7382,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
EXP05-C,519,sqlite,src/btree.c,7383,FP,size/index expression or non-const object; no const qualifier actually removed,,
EXP43-C,520,sqlite,src/btree.c,7383,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,521,sqlite,src/btree.c,7383,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
EXP43-C,522,sqlite,src/btree.c,7395,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,523,sqlite,src/btree.c,7464,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
EXP34-C,524,sqlite,src/btree.c,7465,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT31-C,525,sqlite,src/btree.c,7465,FP,sz bounded by page (allocateSpace asserts idx+sz<=usableSize),,
INT32-C,526,sqlite,src/btree.c,7466,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
EXP05-C,527,sqlite,src/btree.c,7467,FP,size/index expression or non-const object; no const qualifier actually removed,,
EXP43-C,528,sqlite,src/btree.c,7467,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,529,sqlite,src/btree.c,7467,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
EXP43-C,530,sqlite,src/btree.c,7479,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
DCL13-C,531,sqlite,src/btree.c,7584,FP,"populateCellCache writes szCell[idx] where szCell=p->szCell, mutating the array p points into",,
ARR00-C,532,sqlite,src/btree.c,7589,FP,idx bounded by assert(idx>=0 && idx+N<=p->nCell) at function entry,,
ARR00-C,533,sqlite,src/btree.c,7591,FP,idx bounded by assert(idx>=0 && idx+N<=p->nCell) at function entry,,
ARR00-C,534,sqlite,src/btree.c,7594,FP,idx bounded by assert(idx>=0 && idx+N<=p->nCell) at function entry,,
INT32-C,535,sqlite,src/btree.c,7596,FP,"loop counter over cells/pages, bounded by nCell<=MX_CELL; increment cannot reach INT_MAX",,
ARR00-C,536,sqlite,src/btree.c,7606,FP,N bounded by assert(N>=0 && N<p->nCell) at function entry,,
ARR00-C,537,sqlite,src/btree.c,7607,FP,N bounded by assert(N>=0 && N<p->nCell) at function entry,,
ARR00-C,538,sqlite,src/btree.c,7608,FP,N bounded by assert(N>=0 && N<p->nCell) at function entry,,
ARR00-C,539,sqlite,src/btree.c,7612,FP,N bounded by assert(N>=0 && N<p->nCell) at function entry,,
DCL13-C,540,sqlite,src/btree.c,7630,TP,"rebuildPage only reads pCArray->apCell/szCell/ixNx/apEnd; mutates page pPg, not pCArray",,
INT32-C,541,sqlite,src/btree.c,7641,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,542,sqlite,src/btree.c,7650,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
EXP05-C,543,sqlite,src/btree.c,7652,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT31-C,544,sqlite,src/btree.c,7652,FP,usableSize-j with j<=usableSize guarded,,
INT32-C,545,sqlite,src/btree.c,7652,FP,within-page or per-cell bounded quantity (index/count/offset <= MX_CELL or usableSize); no overflow,,
ARR36-C,546,sqlite,src/btree.c,7665,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,547,sqlite,src/btree.c,7672,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR36-C,548,sqlite,src/btree.c,7673,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,549,sqlite,src/btree.c,7674,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR36-C,550,sqlite,src/btree.c,7675,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,551,sqlite,src/btree.c,7678,FP,"loop counter over cells/pages, bounded by nCell<=MX_CELL; increment cannot reach INT_MAX",,
INT32-C,552,sqlite,src/btree.c,7681,FP,"loop counter over cells/pages, bounded by nCell<=MX_CELL; increment cannot reach INT_MAX",,
INT32-C,553,sqlite,src/btree.c,7691,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,554,sqlite,src/btree.c,7692,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
ARR36-C,555,sqlite,src/btree.c,7693,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,556,sqlite,src/btree.c,7693,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,557,sqlite,src/btree.c,7694,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
DCL13-C,558,sqlite,src/btree.c,7724,TP,pageInsertArray uses pBegin only in (pData-pBegin) comparison; pBegin not dereferenced,,
DCL13-C,559,sqlite,src/btree.c,7729,TP,pageInsertArray only reads pCArray->ixNx/apEnd/szCell/apCell; pCArray not mutated,,
INT32-C,560,sqlite,src/btree.c,7734,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
ARR36-C,561,sqlite,src/btree.c,7748,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,562,sqlite,src/btree.c,7749,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
DCL03-C,563,sqlite,src/btree.c,7761,FP,"assert(CORRUPT_DB) - CORRUPT_DB is a runtime value (sqlite3Config.neverCorrupt==0), not constant",,
EXP34-C,564,sqlite,src/btree.c,7765,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT31-C,565,sqlite,src/btree.c,7765,FP,"sz from szCell array, bounded by page",,
ARR36-C,566,sqlite,src/btree.c,7766,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,567,sqlite,src/btree.c,7767,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,568,sqlite,src/btree.c,7768,FP,"loop counter over cells/pages, bounded by nCell<=MX_CELL; increment cannot reach INT_MAX",,
INT32-C,569,sqlite,src/btree.c,7771,FP,"loop counter over cells/pages, bounded by nCell<=MX_CELL; increment cannot reach INT_MAX",,
DCL30-C,570,sqlite,src/btree.c,7775,FP,"*ppData=pData where pData points into the page data buffer (pager memory), not automatic storage",,
DCL13-C,571,sqlite,src/btree.c,7792,TP,"pageFreeArray only reads pCArray->apCell/szCell; mutates pPg, not pCArray",,
INT32-C,572,sqlite,src/btree.c,7799,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
ARR36-C,573,sqlite,src/btree.c,7814,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,574,sqlite,src/btree.c,7815,FP,within-page or per-cell bounded quantity (index/count/offset <= MX_CELL or usableSize); no overflow,,
ARR00-C,575,sqlite,src/btree.c,7817,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR30-C,576,sqlite,src/btree.c,7817,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR30-C,577,sqlite,src/btree.c,7818,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR00-C,578,sqlite,src/btree.c,7820,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR30-C,579,sqlite,src/btree.c,7820,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR30-C,580,sqlite,src/btree.c,7821,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
ARR30-C,581,sqlite,src/btree.c,7828,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
MEM30-C,582,sqlite,src/btree.c,7834,FP,"aData is the live MemPage buffer; pageFreeArray does in-place freeSpace, no heap free",,
ARR30-C,583,sqlite,src/btree.c,7841,FP,aOfst[10]/aAfter[10] index j<nFree; nFree capped at sizeof/sizeof(==10) at line 7826 before increment,,
MEM30-C,584,sqlite,src/btree.c,7841,FP,"freeSpace(pPg,...) frees space WITHIN the page; not a heap double-free of pPg",,
INT32-C,585,sqlite,src/btree.c,7867,FP,nNew/nShift/nAdd*2 or szCell*(limit+nOverflow): cell counts bounded by MX_CELL; product << INT_MAX,,
INT32-C,586,sqlite,src/btree.c,7873,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
EXP43-C,587,sqlite,src/btree.c,7877,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,588,sqlite,src/btree.c,7883,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT31-C,589,sqlite,src/btree.c,7885,FP,nCell*2 cell-count <=10921,,
INT32-C,590,sqlite,src/btree.c,7885,FP,nNew/nShift/nAdd*2 or szCell*(limit+nOverflow): cell counts bounded by MX_CELL; product << INT_MAX,,
MEM30-C,591,sqlite,src/btree.c,7885,FP,pPg live MemPage; memmove of aCellIdx after in-place pageFreeArray,,
INT32-C,592,sqlite,src/btree.c,7886,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR00-C,593,sqlite,src/btree.c,7889,FP,"iOldEnd/iNewEnd are integer cell indices (iOld+nCell..., iNew+nNew); the subtraction is integer, not cross-array pointer arithmetic",,
INT32-C,594,sqlite,src/btree.c,7889,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
MEM30-C,595,sqlite,src/btree.c,7889,FP,"pageFreeArray does in-place freeSpace; pPg not heap-freed, no double-free",,
INT32-C,596,sqlite,src/btree.c,7891,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,597,sqlite,src/btree.c,7894,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,598,sqlite,src/btree.c,7894,FP,aData is live MemPage->aData buffer,,
MEM30-C,599,sqlite,src/btree.c,7896,FP,pPg live; reading pPg->aDataEnd,,
INT32-C,600,sqlite,src/btree.c,7900,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
MEM30-C,601,sqlite,src/btree.c,7900,FP,"iOld is an int cell index, not a pointer; no free",,
MEM30-C,602,sqlite,src/btree.c,7901,FP,iOld is an int index; no free,,
MEM30-C,603,sqlite,src/btree.c,7903,FP,pPg live; pPg->aCellIdx access,,
ARR37-C,604,sqlite,src/btree.c,7904,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT31-C,605,sqlite,src/btree.c,7904,FP,nCell*2 bounded cell count,,
INT32-C,606,sqlite,src/btree.c,7904,FP,nNew/nShift/nAdd*2 or szCell*(limit+nOverflow): cell counts bounded by MX_CELL; product << INT_MAX,,
MEM30-C,607,sqlite,src/btree.c,7904,FP,pCellptr points into live pPg->aCellIdx; in-place insert,,
MEM30-C,608,sqlite,src/btree.c,7905,FP,pPg live; passed to pageInsertArray for in-place edit,,
MEM30-C,609,sqlite,src/btree.c,7906,FP,pData points into live page buffer aData,,
INT32-C,610,sqlite,src/btree.c,7909,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
MEM30-C,611,sqlite,src/btree.c,7913,FP,pPg live; iterating pPg->nOverflow,,
INT32-C,612,sqlite,src/btree.c,7914,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
MEM30-C,613,sqlite,src/btree.c,7914,FP,iOld is an int index; not freed,,
INT32-C,614,sqlite,src/btree.c,7916,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,615,sqlite,src/btree.c,7916,FP,pPg live MemPage; reading aiOvfl,,
ARR37-C,616,sqlite,src/btree.c,7918,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,617,sqlite,src/btree.c,7918,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,618,sqlite,src/btree.c,7918,FP,pCellptr into live aCellIdx; in-place memmove,,
INT32-C,619,sqlite,src/btree.c,7921,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
MEM30-C,620,sqlite,src/btree.c,7921,FP,pCArray is live CellArray (caller-owned); cachedCellSize reads it,,
MEM30-C,621,sqlite,src/btree.c,7922,FP,pPg live; pageInsertArray in-place,,
MEM30-C,622,sqlite,src/btree.c,7923,FP,pData into live page buffer,,
INT32-C,623,sqlite,src/btree.c,7924,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,624,sqlite,src/btree.c,7931,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,625,sqlite,src/btree.c,7931,FP,pPg live; pPg->aCellIdx,,
MEM30-C,626,sqlite,src/btree.c,7932,FP,pPg live; pageInsertArray append,,
MEM30-C,627,sqlite,src/btree.c,7933,FP,pData into live page buffer,,
INT32-C,628,sqlite,src/btree.c,7934,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,629,sqlite,src/btree.c,7944,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,630,sqlite,src/btree.c,7944,FP,aData is live page buffer; put2byte writes header,,
ARR36-C,631,sqlite,src/btree.c,7945,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
INT32-C,632,sqlite,src/btree.c,7945,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,633,sqlite,src/btree.c,7945,FP,aData live page buffer; put2byte,,
INT32-C,634,sqlite,src/btree.c,7949,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
MEM30-C,635,sqlite,src/btree.c,7949,FP,pCArray->apCell live CellArray (debug check),,
INT32-C,636,sqlite,src/btree.c,7950,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM30-C,637,sqlite,src/btree.c,7951,FP,pCArray live; SQLITE_WITHIN bounds check,,
ARR36-C,638,sqlite,src/btree.c,7952,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR38-C,639,sqlite,src/btree.c,7954,FP,memcmp in SQLITE_DEBUG editPage validation against pTmp page-temp-space copy of the same usableSize page,,
MEM30-C,640,sqlite,src/btree.c,7954,FP,pCell points into live buffers; memcmp debug assert,,
MEM30-C,641,sqlite,src/btree.c,7955,FP,pCArray->pRef live; xCellSize call,,
MSC07-C,642,sqlite,src/btree.c,7960,FP,"code after return SQLITE_OK is the editpage_fail: goto label, reachable via goto from earlier",,
MEM30-C,643,sqlite,src/btree.c,7963,FP,pCArray live; populateCellCache on editpage_fail rebuild,,
MEM30-C,644,sqlite,src/btree.c,7964,FP,pCArray live; rebuildPage in-place rebuild,,
EXP34-C,645,sqlite,src/btree.c,8020,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP43-C,646,sqlite,src/btree.c,8049,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
ARR30-C,647,sqlite,src/btree.c,8066,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
ARR37-C,648,sqlite,src/btree.c,8067,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR36-C,649,sqlite,src/btree.c,8068,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,650,sqlite,src/btree.c,8068,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
EXP30-C,651,sqlite,src/btree.c,8068,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
ARR37-C,652,sqlite,src/btree.c,8069,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR36-C,653,sqlite,src/btree.c,8070,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
ARR37-C,654,sqlite,src/btree.c,8070,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
EXP30-C,655,sqlite,src/btree.c,8070,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
EXP45-C,656,sqlite,src/btree.c,8070,FP,intentional sqlite assignment-in-condition idiom; value used correctly,,
INT14-C,657,sqlite,src/btree.c,8070,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
MEM33-C,658,sqlite,src/btree.c,8070,FP,"*(pOut++)=*(pCell++) is a byte-copy loop, not a flexible-array struct assignment",,
ARR36-C,659,sqlite,src/btree.c,8074,FP,pointer math within a single page/cell/temp buffer (aData[] / pCell / pTmpSpace); operands derived from the same buffer,,
DCL13-C,660,sqlite,src/btree.c,8095,FP,apPage[i] flows into pPage then pPage->xParseCell which takes non-const MemPage*; const element breaks,,
ARR30-C,661,sqlite,src/btree.c,8108,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
EXP33-C,662,sqlite,src/btree.c,8113,FP,value assigned before use on all reachable paths,,
DCL13-C,663,sqlite,src/btree.c,8148,TP,copyNodeContent reads pFrom->pBt/aData/hdrOffset/cell fields as memcpy source; pFrom not mutated (pTo is),,
EXP34-C,664,sqlite,src/btree.c,8152,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,665,sqlite,src/btree.c,8164,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
EXP34-C,666,sqlite,src/btree.c,8165,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT31-C,667,sqlite,src/btree.c,8165,FP,usableSize-iData with iData<=usableSize asserted,,
INT32-C,668,sqlite,src/btree.c,8165,FP,within-page or per-cell bounded quantity (index/count/offset <= MX_CELL or usableSize); no overflow,,
ARR38-C,669,sqlite,src/btree.c,8166,FP,memcpy within page/cell buffers; size from validated cell size or fixed struct-array size,,
EXP05-C,670,sqlite,src/btree.c,8166,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT32-C,671,sqlite,src/btree.c,8166,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
MEM05-C,672,sqlite,src/btree.c,8252,FP,"apNew[NB+2]: NB is #define NB 3 (compile-time constant), a fixed-size array, not a VLA",,
MEM05-C,673,sqlite,src/btree.c,8254,FP,apDiv[NB-1]: NB is a compile-time constant; fixed-size array not a VLA,,
MEM05-C,674,sqlite,src/btree.c,8255,FP,cntNew[NB+2]: NB constant; fixed-size array not a VLA,,
MEM05-C,675,sqlite,src/btree.c,8256,FP,cntOld[NB+2]: NB constant; fixed-size array not a VLA,,
MEM05-C,676,sqlite,src/btree.c,8257,FP,szNew[NB+2]: NB constant; fixed-size array not a VLA,,
MEM05-C,677,sqlite,src/btree.c,8260,FP,abDone[NB+2]: NB constant; fixed-size array not a VLA,,
MEM05-C,678,sqlite,src/btree.c,8261,FP,aPgno[NB+2]: NB constant; fixed-size array not a VLA,,
EXP33-C,679,sqlite,src/btree.c,8265,FP,value assigned before use on all reachable paths,,
INT30-C,680,sqlite,src/btree.c,8265,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT30-C,681,sqlite,src/btree.c,8266,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,682,sqlite,src/btree.c,8266,FP,sizeof(b)-sizeof(b.ixNx[0]) is a compile-time constant struct size; never overflows,,
INT14-C,683,sqlite,src/btree.c,8304,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,684,sqlite,src/btree.c,8304,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,685,sqlite,src/btree.c,8306,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,686,sqlite,src/btree.c,8308,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,687,sqlite,src/btree.c,8310,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
ARR30-C,688,sqlite,src/btree.c,8314,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
INT32-C,689,sqlite,src/btree.c,8314,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR30-C,690,sqlite,src/btree.c,8319,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
EXP33-C,691,sqlite,src/btree.c,8319,FP,value assigned before use on all reachable paths,,
ARR38-C,692,sqlite,src/btree.c,8322,FP,memset of apOld[]/szCell[] sized by (i+1) or nMaxCells; counts bounded by NB(=3) / asserted nMaxCells,,
EXP05-C,693,sqlite,src/btree.c,8322,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT30-C,694,sqlite,src/btree.c,8322,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,695,sqlite,src/btree.c,8322,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR30-C,696,sqlite,src/btree.c,8325,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
ARR30-C,697,sqlite,src/btree.c,8326,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
ARR38-C,698,sqlite,src/btree.c,8328,FP,memset of apOld[]/szCell[] sized by (i+1) or nMaxCells; counts bounded by NB(=3) / asserted nMaxCells,,
EXP05-C,699,sqlite,src/btree.c,8328,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT30-C,700,sqlite,src/btree.c,8328,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,701,sqlite,src/btree.c,8328,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR30-C,702,sqlite,src/btree.c,8332,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
INT14-C,703,sqlite,src/btree.c,8332,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,704,sqlite,src/btree.c,8332,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,705,sqlite,src/btree.c,8333,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR30-C,706,sqlite,src/btree.c,8341,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
INT32-C,707,sqlite,src/btree.c,8341,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT14-C,708,sqlite,src/btree.c,8357,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
EXP05-C,709,sqlite,src/btree.c,8364,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT32-C,710,sqlite,src/btree.c,8368,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT13-C,711,sqlite,src/btree.c,8374,FP,nMaxCells >=0 (sum of cell counts); &~3 alignment idiom,,
INT32-C,712,sqlite,src/btree.c,8374,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR39-C,713,sqlite,src/btree.c,8380,FP,"nMaxCells*sizeof(u8*) is a malloc size computation (szScratch), not a pointer subscript; szScratch asserted <=7*pageSize",,
INT30-C,714,sqlite,src/btree.c,8380,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT30-C,715,sqlite,src/btree.c,8381,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
ARR30-C,716,sqlite,src/btree.c,8414,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
DCL31-C,717,sqlite,src/btree.c,8420,FP,VVA_ONLY(int nCellAtStart=...) macro misparsed; declaration has explicit int type,,
ARR38-C,718,sqlite,src/btree.c,8447,FP,memset of apOld[]/szCell[] sized by (i+1) or nMaxCells; counts bounded by NB(=3) / asserted nMaxCells,,
INT30-C,719,sqlite,src/btree.c,8447,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
INT32-C,720,sqlite,src/btree.c,8447,FP,nNew/nShift/nAdd*2 or szCell*(limit+nOverflow): cell counts bounded by MX_CELL; product << INT_MAX,,
ARR36-C,721,sqlite,src/btree.c,8454,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
INT14-C,722,sqlite,src/btree.c,8455,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR37-C,723,sqlite,src/btree.c,8480,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,724,sqlite,src/btree.c,8481,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT31-C,725,sqlite,src/btree.c,8484,FP,sz<=maxLocal+23 asserted,,
ARR37-C,726,sqlite,src/btree.c,8500,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR37-C,727,sqlite,src/btree.c,8501,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR30-C,728,sqlite,src/btree.c,8527,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
INT32-C,729,sqlite,src/btree.c,8536,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,730,sqlite,src/btree.c,8539,FP,usableSpace - p->nFree: both within-page byte quantities <= usableSize; no overflow,,
INT32-C,731,sqlite,src/btree.c,8550,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,732,sqlite,src/btree.c,8552,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,733,sqlite,src/btree.c,8553,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,734,sqlite,src/btree.c,8555,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,735,sqlite,src/btree.c,8564,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,736,sqlite,src/btree.c,8579,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,737,sqlite,src/btree.c,8582,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,738,sqlite,src/btree.c,8600,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,739,sqlite,src/btree.c,8602,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,740,sqlite,src/btree.c,8606,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,741,sqlite,src/btree.c,8607,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,742,sqlite,src/btree.c,8619,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,743,sqlite,src/btree.c,8620,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,744,sqlite,src/btree.c,8621,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,745,sqlite,src/btree.c,8626,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
PRE32-C,746,sqlite,src/btree.c,8641,FP,TRACE((...)) args have no # or ## operators; macro expands empty,,
ARR30-C,747,sqlite,src/btree.c,8654,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
ARR30-C,748,sqlite,src/btree.c,8655,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
EXP34-C,749,sqlite,src/btree.c,8675,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT14-C,750,sqlite,src/btree.c,8697,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,751,sqlite,src/btree.c,8702,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,752,sqlite,src/btree.c,8714,FP,"(PENDING_BYTE/pBt->pageSize)+1: PENDING_BYTE constant / pagesize; small page number, no overflow",,
INT33-C,753,sqlite,src/btree.c,8714,FP,pageSize >=512 (validated at db open),,
PRE32-C,754,sqlite,src/btree.c,8725,FP,TRACE((...)) args have no # or ## operators; macro expands empty,,
EXP33-C,755,sqlite,src/btree.c,8739,FP,value assigned before use on all reachable paths,,
INT13-C,756,sqlite,src/btree.c,8746,FP,pageFlags from page header byte 0..255; & masking idiom,,
INT32-C,757,sqlite,src/btree.c,8749,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,758,sqlite,src/btree.c,8751,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR30-C,759,sqlite,src/btree.c,8785,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
INT32-C,760,sqlite,src/btree.c,8786,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
EXP33-C,761,sqlite,src/btree.c,8801,FP,pOld initialized at 8774 (apNew[0]) and reassigned only under assert; never uninitialized,,
EXP34-C,762,sqlite,src/btree.c,8801,FP,pOld initialized at 8774 before the read at 8801,,
ARR37-C,763,sqlite,src/btree.c,8840,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR37-C,764,sqlite,src/btree.c,8843,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,765,sqlite,src/btree.c,8860,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,766,sqlite,src/btree.c,8870,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,767,sqlite,src/btree.c,8898,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR00-C,768,sqlite,src/btree.c,8902,FP,abDone[NB+2] is memset to 0 at line 8264; iPg bounded by assert(iPg>=0 && iPg<nNew<=NB+1),,
ARR00-C,769,sqlite,src/btree.c,8912,FP,abDone[NB+2] is memset to 0 at line 8264; iPg bounded by assert(iPg>=0 && iPg<nNew<=NB+1),,
INT32-C,770,sqlite,src/btree.c,8912,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR00-C,771,sqlite,src/btree.c,8916,FP,abDone[NB+2] is memset to 0 at line 8264; iPg bounded by assert(iPg>=0 && iPg<nNew<=NB+1),,
INT32-C,772,sqlite,src/btree.c,8916,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,773,sqlite,src/btree.c,8922,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,774,sqlite,src/btree.c,8923,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT32-C,775,sqlite,src/btree.c,8924,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
ARR00-C,776,sqlite,src/btree.c,8929,FP,abDone[NB+2] is memset to 0 at line 8264; iPg bounded by assert(iPg>=0 && iPg<nNew<=NB+1),,
INT32-C,777,sqlite,src/btree.c,8930,FP,"balance_nonroot internal index/size: cell counts<=MX_CELL, sibling idx<=NB+2, page-size sizes; asserted bounds, no overflow",,
INT31-C,778,sqlite,src/btree.c,8937,FP,nNew balance page count <=5,,
PRE32-C,779,sqlite,src/btree.c,8979,FP,TRACE((...)) args have no # or ## operators; macro expands empty,,
ARR30-C,780,sqlite,src/btree.c,8985,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
ARR30-C,781,sqlite,src/btree.c,9005,FP,"apOld[NB=3] index i bounded by loop invariant (i starts at 2-bBulk, max 2; nOld<=3) and asserts",,
EXP34-C,782,sqlite,src/btree.c,9050,FP,copyNodeContent no-op when *pRC!=OK; pChild deref-ed later only when rc==0 implying allocate ok,,
EXP34-C,783,sqlite,src/btree.c,9057,FP,releasePage tolerates NULL; pChild==0 path is safe,,
EXP34-C,784,sqlite,src/btree.c,9060,FP,reached only when rc==0 at 9055 which guarantees pChild non-null,,
ARR38-C,785,sqlite,src/btree.c,9067,FP,memcpy within page/cell buffers; size from validated cell size or fixed struct-array size,,
INT32-C,786,sqlite,src/btree.c,9067,FP,"nOverflow*sizeof(ptr): nOverflow<=ArraySize(apOvfl)=5; product tiny, no overflow",,
ARR01-C,787,sqlite,src/btree.c,9068,FP,"sizeof(pRoot->aiOvfl[0]/apOvfl[0]) is element sizeof of fixed-size struct arrays, copy count bounded by nOverflow",,
INT30-C,788,sqlite,src/btree.c,9068,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
ARR38-C,789,sqlite,src/btree.c,9069,FP,memcpy within page/cell buffers; size from validated cell size or fixed struct-array size,,
INT32-C,790,sqlite,src/btree.c,9069,FP,"nOverflow*sizeof(ptr): nOverflow<=ArraySize(apOvfl)=5; product tiny, no overflow",,
ARR01-C,791,sqlite,src/btree.c,9070,FP,"sizeof(pRoot->aiOvfl[0]/apOvfl[0]) is element sizeof of fixed-size struct arrays, copy count bounded by nOverflow",,
INT30-C,792,sqlite,src/btree.c,9070,FP,multiplicand is bounded cell/page count or compile-time sizeof; product cannot wrap size_t,,
DCL30-C,793,sqlite,src/btree.c,9077,FP,"*ppChild=pChild where pChild is pager-owned MemPage, not automatic storage",,
DCL13-C,794,sqlite,src/btree.c,9092,TP,anotherValidCursor reads pCur->pBt->pCursor and compares pCur->pPage; pCur not mutated,,
DCL31-C,795,sqlite,src/btree.c,9120,FP,VVA_ONLY(int balance_quick_called=0) macro misparsed; has explicit int type,,
DCL31-C,796,sqlite,src/btree.c,9121,FP,VVA_ONLY(int balance_deeper_called=0) macro misparsed; has explicit int type,,
INT14-C,797,sqlite,src/btree.c,9128,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
MEM30-C,798,sqlite,src/btree.c,9128,FP,pPage = pCur->pPage live MemPage; releasePage happens at end of iteration (9233),,
MEM30-C,799,sqlite,src/btree.c,9134,FP,pCur live cursor; reading pCur->iPage,,
MEM30-C,800,sqlite,src/btree.c,9135,FP,pPage live; pPage->nOverflow,,
MEM30-C,801,sqlite,src/btree.c,9143,FP,pPage live; passed to balance_deeper before any release,,
MEM30-C,802,sqlite,src/btree.c,9155,FP,pPage live; sqlite3PagerPageRefcount(pPage->pDbPage),,
MEM30-C,803,sqlite,src/btree.c,9159,FP,pPage live; SQLITE_CORRUPT_PAGE(pPage),,
INT32-C,804,sqlite,src/btree.c,9161,FP,"iPage/iCellDepth is cursor tree depth, bounded by BTCURSOR_MAX_DEPTH(=20); no overflow",,
MEM30-C,805,sqlite,src/btree.c,9161,FP,pCur live; pCur->apPage[iPage-1],,
INT32-C,806,sqlite,src/btree.c,9162,FP,"iPage/iCellDepth is cursor tree depth, bounded by BTCURSOR_MAX_DEPTH(=20); no overflow",,
MEM30-C,807,sqlite,src/btree.c,9162,FP,pCur live cursor array access,,
MEM30-C,808,sqlite,src/btree.c,9164,FP,"pParent live MemPage; sqlite3PagerWrite, no free",,
MEM30-C,809,sqlite,src/btree.c,9165,FP,pParent live; pParent->nFree,,
MEM30-C,810,sqlite,src/btree.c,9166,FP,"btreeComputeFreeSpace(pParent); pParent live, not freed",,
MEM30-C,811,sqlite,src/btree.c,9170,FP,pPage live; intKeyLeaf check before any release,,
MEM30-C,812,sqlite,src/btree.c,9171,FP,pPage live; nOverflow check,,
MEM30-C,813,sqlite,src/btree.c,9172,FP,"pPage live; aiOvfl array (in-memory page), not freed",,
MEM30-C,814,sqlite,src/btree.c,9173,FP,pParent live; pgno check,,
MEM30-C,815,sqlite,src/btree.c,9174,FP,pParent live; nCell check,,
MEM30-C,816,sqlite,src/btree.c,9191,FP,"pParent live; balance_quick takes it, no free",,
MEM30-C,817,sqlite,src/btree.c,9212,FP,pCur live; pCur->pBt->pageSize for PageMalloc,,
MEM30-C,818,sqlite,src/btree.c,9213,FP,"pParent live; balance_nonroot, no free of pParent",,
MEM30-C,819,sqlite,src/btree.c,9214,FP,pCur live; hints flag read,,
MEM30-C,820,sqlite,src/btree.c,9234,FP,pCur live; pCur->iPage-- after releasePage of pPage (in-memory ref) at 9233,,
MEM30-C,821,sqlite,src/btree.c,9235,FP,pCur live cursor,,
MEM30-C,822,sqlite,src/btree.c,9236,FP,pCur->apPage live array reassignment,,
MEM30-C,823,sqlite,src/btree.c,9241,FP,pFree freed once after loop; 9220 freed the PREVIOUS iteration's buffer (free-then-reassign),,
MEM05-C,824,sqlite,src/btree.c,9249,uncertain,btreeOverwriteContent recursion bounded by overflow-chain/payload structure; real recursion but not unbounded stack,,
INT32-C,825,sqlite,src/btree.c,9256,FP,iOffset/iAmt/nData within payload bounded by SQLITE_LIMIT_LENGTH<INT_MAX; subtraction in range,,
EXP05-C,826,sqlite,src/btree.c,9264,FP,size/index expression or non-const object; no const qualifier actually removed,,
INT31-C,827,sqlite,src/btree.c,9264,FP,iAmt-i bounded by content/cell payload size,,
INT32-C,828,sqlite,src/btree.c,9264,FP,iOffset/iAmt/nData within payload bounded by SQLITE_LIMIT_LENGTH<INT_MAX; subtraction in range,,
INT32-C,829,sqlite,src/btree.c,9270,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,830,sqlite,src/btree.c,9271,FP,iOffset/iAmt/nData within payload bounded by SQLITE_LIMIT_LENGTH<INT_MAX; subtraction in range,,
INT31-C,831,sqlite,src/btree.c,9275,FP,iAmt bounded,,
INT31-C,832,sqlite,src/btree.c,9282,FP,iAmt bounded,,
INT32-C,833,sqlite,src/btree.c,9282,FP,iOffset/iAmt/nData within payload bounded by SQLITE_LIMIT_LENGTH<INT_MAX; subtraction in range,,
DCL13-C,834,sqlite,src/btree.c,9294,TP,"reads only pCur->info/pCur->pPage; the written MemPage*pPage is a local copy, not pCur's own fields",,
INT32-C,835,sqlite,src/btree.c,9298,FP,"pX->nData+pX->nZero bounded by SQLITE_LIMIT_LENGTH (<=~2e9<INT_MAX), enforced upstream in vdbe MakeRecord (SQLITE_TOOBIG); cannot overflow",,
INT32-C,836,sqlite,src/btree.c,9328,FP,iOffset/iAmt/nData within payload bounded by SQLITE_LIMIT_LENGTH<INT_MAX; subtraction in range,,
EXP43-C,837,sqlite,src/btree.c,9330,FP,memmove handles overlap; or same-ptr args read-only - no restrict UB,,
INT32-C,838,sqlite,src/btree.c,9335,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
INT32-C,839,sqlite,src/btree.c,9345,FP,"pX->nData+pX->nZero bounded by SQLITE_LIMIT_LENGTH (<=~2e9<INT_MAX), enforced upstream in vdbe MakeRecord (SQLITE_TOOBIG); cannot overflow",,
API00-C,840,sqlite,src/btree.c,9394,FP,"caller-owned cursor; pBtree derived from it, write-path asserts follow",,
MSC37-C,841,sqlite,src/btree.c,9394,FP,sqlite3BtreeInsert ends with return rc (line ~9805); all paths return a value,,
PRE32-C,842,sqlite,src/btree.c,9562,FP,TRACE((...)) args have no # or ## operators; macro expands empty,,
MEM30-C,843,sqlite,src/btree.c,9563,FP,pCur/pPage live; TRACE reads pgno before any edit,,
MEM30-C,844,sqlite,src/btree.c,9565,FP,pPage live; isInit assert,,
DCL03-C,845,sqlite,src/btree.c,9568,TP,assert(BTREE_PREFORMAT==OPFLAG_PREFORMAT) compile-time constant; static_assert applicable,,
MEM30-C,846,sqlite,src/btree.c,9576,FP,pPage live; ISAUTOVACUUM/maxLocal check,,
MEM30-C,847,sqlite,src/btree.c,9578,FP,pPage live; xParseCell on in-memory page,,
MEM30-C,848,sqlite,src/btree.c,9581,FP,pPage live; ptrmapPut uses pPage->pgno,,
MEM30-C,849,sqlite,src/btree.c,9586,FP,"pPage live; fillInCell writes into pTmpSpace, not freeing pPage",,
MEM30-C,850,sqlite,src/btree.c,9589,FP,pPage live; xCellSize assert,,
MEM30-C,851,sqlite,src/btree.c,9596,FP,pPage live; nCell bounds check,,
MEM30-C,852,sqlite,src/btree.c,9597,FP,SQLITE_CORRUPT_PAGE(pPage); pPage live,,
MEM30-C,853,sqlite,src/btree.c,9599,FP,pPage live; sqlite3PagerWrite(pPage->pDbPage),,
ARR30-C,854,sqlite,src/btree.c,9603,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
MEM30-C,855,sqlite,src/btree.c,9603,FP,pPage live; findCell in-page,,
MEM30-C,856,sqlite,src/btree.c,9604,FP,pPage live; leaf check,,
EXP33-C,857,sqlite,src/btree.c,9607,FP,value assigned before use on all reachable paths,,
MEM30-C,858,sqlite,src/btree.c,9607,FP,BTREE_CLEAR_CELL in-place page op; pPage live,,
MEM30-C,859,sqlite,src/btree.c,9611,FP,pPage live; minLocal/ISAUTOVACUUM check,,
MEM30-C,860,sqlite,src/btree.c,9623,FP,pPage live; oldCell bounds vs pPage->aData,,
MEM30-C,861,sqlite,src/btree.c,9624,FP,SQLITE_CORRUPT_PAGE(pPage); pPage live,,
MEM30-C,862,sqlite,src/btree.c,9626,FP,pPage live; aDataEnd bounds,,
MEM30-C,863,sqlite,src/btree.c,9627,FP,SQLITE_CORRUPT_PAGE(pPage); pPage live,,
MEM30-C,864,sqlite,src/btree.c,9632,FP,dropCell in-place page op; pPage live,,
MEM30-C,865,sqlite,src/btree.c,9634,FP,pPage live; leaf assert,,
MEM30-C,866,sqlite,src/btree.c,9635,FP,pPage live; insertCellFast in-place,,
MEM30-C,867,sqlite,src/btree.c,9639,FP,pPage live; leaf assert,,
MEM30-C,868,sqlite,src/btree.c,9641,FP,pPage live; insertCellFast,,
MEM30-C,869,sqlite,src/btree.c,9642,FP,pPage live; nOverflow assert,,
MEM30-C,870,sqlite,src/btree.c,9643,FP,pPage live; nCell assert,,
MEM30-C,871,sqlite,src/btree.c,9665,FP,pPage live; nOverflow check before balance(),,
DCL13-C,872,sqlite,src/btree.c,9712,TP,"reads only pDest->pBt/pPage/pKeyInfo by value; output goes to pBt->pTmpSpace, pDest not mutated",,
ARR37-C,873,sqlite,src/btree.c,9721,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR37-C,874,sqlite,src/btree.c,9723,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
ARR37-C,875,sqlite,src/btree.c,9725,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP34-C,876,sqlite,src/btree.c,9733,FP,aOut=pBt->pTmpSpace; scratch buffer allocated at btree open; non-null for open connection,,
INT32-C,877,sqlite,src/btree.c,9746,FP,nOut + (aOut-pTmpSpace): both bounded by page/temp-space size; no overflow,,
ARR37-C,878,sqlite,src/btree.c,9748,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,879,sqlite,src/btree.c,9749,FP,"sum of cell/page indices and small counts, each bounded by nCell<=MX_CELL or NB; no overflow",,
ARR36-C,880,sqlite,src/btree.c,9752,FP,"operands are integer struct fields (minLocal/usableSize/nData/nPayload) or array elements, not pointers from distinct arrays - misclassification",,
INT31-C,881,sqlite,src/btree.c,9765,FP,"nCopy=MIN(nOut,nIn) both positive",,
ARR37-C,882,sqlite,src/btree.c,9768,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
EXP34-C,883,sqlite,src/btree.c,9772,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,884,sqlite,src/btree.c,9776,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,885,sqlite,src/btree.c,9804,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,886,sqlite,src/btree.c,9826,FP,caller-owned cursor; asserts cursorOwnsBtShared and write-flag preconditions,,
INT14-C,887,sqlite,src/btree.c,9839,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT14-C,888,sqlite,src/btree.c,9840,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR30-C,889,sqlite,src/btree.c,9861,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
MEM30-C,890,sqlite,src/btree.c,9863,FP,pPage live; SQLITE_CORRUPT_PAGE on btreeComputeFreeSpace fail,,
MEM30-C,891,sqlite,src/btree.c,9865,FP,pPage live; pCell bounds vs aCellIdx,,
MEM30-C,892,sqlite,src/btree.c,9866,FP,SQLITE_CORRUPT_PAGE(pPage); pPage live,,
MEM30-C,893,sqlite,src/btree.c,9887,FP,pPage live; leaf/nFree check,,
MEM30-C,894,sqlite,src/btree.c,9888,FP,pPage live; xCellSize in bPreserve calc,,
MEM30-C,895,sqlite,src/btree.c,9890,FP,pPage live; nCell==1 check,,
MEM30-C,896,sqlite,src/btree.c,9908,FP,pPage live; leaf check before sqlite3BtreePrevious,,
MEM30-C,897,sqlite,src/btree.c,9930,FP,pPage live; sqlite3PagerWrite(pPage->pDbPage),,
EXP33-C,898,sqlite,src/btree.c,9932,FP,value assigned before use on all reachable paths,,
MEM30-C,899,sqlite,src/btree.c,9932,FP,BTREE_CLEAR_CELL in-place op; pPage live,,
MEM30-C,900,sqlite,src/btree.c,9933,FP,dropCell in-place op; pPage live,,
MEM30-C,901,sqlite,src/btree.c,9941,FP,pPage live; leaf check,,
MEM30-C,902,sqlite,src/btree.c,9951,FP,pCur live; iCellDepth/iPage comparison,,
INT32-C,903,sqlite,src/btree.c,9952,FP,"iPage/iCellDepth is cursor tree depth, bounded by BTCURSOR_MAX_DEPTH(=20); no overflow",,
MEM30-C,904,sqlite,src/btree.c,9952,FP,pCur live; apPage[].pgno,,
MEM30-C,905,sqlite,src/btree.c,9954,FP,pCur live; pCur->pPage->pgno,,
ARR30-C,906,sqlite,src/btree.c,9956,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
MEM30-C,907,sqlite,src/btree.c,9956,FP,pLeaf live MemPage; findCell in-page,,
MEM30-C,908,sqlite,src/btree.c,9957,FP,pLeaf live; pCell bounds vs pLeaf->aData,,
MEM30-C,909,sqlite,src/btree.c,9958,FP,pLeaf live; xCellSize,,
MEM30-C,910,sqlite,src/btree.c,9959,FP,pBt live; MX_CELL_SIZE(pBt) assert,,
MEM30-C,911,sqlite,src/btree.c,9960,FP,pBt live; pBt->pTmpSpace read,,
MEM30-C,912,sqlite,src/btree.c,9962,FP,pLeaf live; sqlite3PagerWrite(pLeaf->pDbPage),,
ARR37-C,913,sqlite,src/btree.c,9964,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
MEM30-C,914,sqlite,src/btree.c,9964,FP,insertCell in-place op on pPage; live,,
MEM30-C,915,sqlite,src/btree.c,9966,FP,dropCell on pLeaf in-place; pLeaf live,,
MEM30-C,916,sqlite,src/btree.c,9985,FP,pCur live; pPage->nOverflow assert after balance,,
MEM30-C,917,sqlite,src/btree.c,9986,FP,pCur live; nFree assert,,
MEM30-C,918,sqlite,src/btree.c,9987,FP,pCur live; nFree vs usableSize check,,
MEM30-C,919,sqlite,src/btree.c,9992,FP,pCur live; balance(pCur),,
MEM30-C,920,sqlite,src/btree.c,9994,FP,"pCur live; releasePageNotNull(pCur->pPage) releases in-memory ref, pCur still live",,
MEM30-C,921,sqlite,src/btree.c,9995,FP,releasePageNotNull releases in-memory page ref; pCur cursor itself live,,
MEM30-C,922,sqlite,src/btree.c,9996,FP,pCur live; iPage--,,
MEM30-C,923,sqlite,src/btree.c,9997,FP,pCur live; iPage loop,,
MEM30-C,924,sqlite,src/btree.c,9998,FP,releasePage of ancestor in-memory refs; pCur live,,
MEM30-C,925,sqlite,src/btree.c,10000,FP,pCur->apPage live array; reassigning pCur->pPage,,
MEM30-C,926,sqlite,src/btree.c,10001,FP,pCur live; second balance(pCur),,
MEM30-C,927,sqlite,src/btree.c,10006,FP,pCur live; iPage assert,,
MEM30-C,928,sqlite,src/btree.c,10007,FP,pPage live; pPage==pCur->pPage assert,,
MEM30-C,929,sqlite,src/btree.c,10008,FP,pPage live; nCell assert,,
MEM30-C,930,sqlite,src/btree.c,10010,FP,pPage live; iCellIdx vs nCell,,
MEM30-C,931,sqlite,src/btree.c,10012,FP,pPage live; pPage->nCell-1,,
MEM30-C,932,sqlite,src/btree.c,10017,FP,pCur live; moveToRoot(pCur),,
MEM30-C,933,sqlite,src/btree.c,10019,FP,pCur live; btreeReleaseAllCursorPages,,
EXP33-C,934,sqlite,src/btree.c,10052,FP,value assigned before use on all reachable paths,,
EXP33-C,935,sqlite,src/btree.c,10072,FP,value assigned before use on all reachable paths,,
EXP33-C,936,sqlite,src/btree.c,10124,FP,value assigned before use on all reachable paths,,
EXP34-C,937,sqlite,src/btree.c,10140,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,938,sqlite,src/btree.c,10184,FP,caller-owned Btree handle; Enter/Leave wrapper,,
MEM05-C,939,sqlite,src/btree.c,10196,uncertain,"clearDatabasePage recurses on child pages; depth bounded by b-tree height (small), not excessive",,
EXP34-C,940,sqlite,src/btree.c,10216,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
ARR30-C,941,sqlite,src/btree.c,10223,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
EXP33-C,942,sqlite,src/btree.c,10228,FP,value assigned before use on all reachable paths,,
INT14-C,943,sqlite,src/btree.c,10232,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,944,sqlite,src/btree.c,10232,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
MEM30-C,945,sqlite,src/btree.c,10247,FP,releasePage releases in-memory ref; freePage at 10241 marked DB page on freelist (distinct),,
API00-C,946,sqlite,src/btree.c,10263,FP,caller-owned Btree handle; asserts inTrans==TRANS_WRITE,,
API00-C,947,sqlite,src/btree.c,10289,FP,caller-owned cursor; forwards pCur->pBtree to ClearTable,,
DCL13-C,948,sqlite,src/btree.c,10289,TP,sqlite3BtreeClearTableOfCursor reads only pCur->pBtree/pgnoRoot,,
EXP34-C,949,sqlite,src/btree.c,10329,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,950,sqlite,src/btree.c,10336,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,951,sqlite,src/btree.c,10337,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,952,sqlite,src/btree.c,10337,FP,freePage marks DB page free; releasePage(pPage) is distinct in-memory ref release,,
EXP34-C,953,sqlite,src/btree.c,10347,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,954,sqlite,src/btree.c,10347,FP,"freePage (freelist) then releasePage (in-memory ref) are distinct ops, not double-free",,
EXP34-C,955,sqlite,src/btree.c,10348,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,956,sqlite,src/btree.c,10348,FP,releasePage(pPage) releases in-memory ref after freePage marked DB page; distinct,,
EXP34-C,957,sqlite,src/btree.c,10358,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,958,sqlite,src/btree.c,10358,FP,releasePage(pPage) in-memory ref release; pPage live until here,,
EXP34-C,959,sqlite,src/btree.c,10392,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,960,sqlite,src/btree.c,10392,FP,"freePage (freelist) + releasePage (in-memory) distinct ops, not double-free",,
EXP34-C,961,sqlite,src/btree.c,10393,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM30-C,962,sqlite,src/btree.c,10393,FP,releasePage(pPage) distinct from freePage above,,
API00-C,963,sqlite,src/btree.c,10398,FP,caller-owned Btree handle; Enter/Leave wrapper,,
API00-C,964,sqlite,src/btree.c,10427,FP,caller-owned Btree handle; asserts inTrans>TRANS_NONE,,
INT32-C,965,sqlite,src/btree.c,10439,FP,"36 + idx*4 with idx asserted 0..15; max 96, no overflow",,
API00-C,966,sqlite,src/btree.c,10457,FP,caller-owned Btree handle; asserts inTrans==TRANS_WRITE,,
API00-C,967,sqlite,src/btree.c,10489,FP,db is the caller-owned sqlite3 connection handle; only read for isInterrupted,,
ARR30-C,968,sqlite,src/btree.c,10546,FP,"findCell offset = maskPage & get2byteAligned(...); maskPage masks the offset to < pageSize, bounding access within the aData[] page buffer",,
DCL13-C,969,sqlite,src/btree.c,10558,TP,sqlite3BtreePager returns p->pBt->pPager; getter,,
INT32-C,970,sqlite,src/btree.c,10569,FP,"pCheck->nErr error counter, bounded by mxErr (small int passed by caller); cannot reach INT_MAX",,
INT32-C,971,sqlite,src/btree.c,10580,FP,"pCheck->nErr error counter, bounded by mxErr (small int passed by caller); cannot reach INT_MAX",,
INT33-C,972,sqlite,src/btree.c,10587,FP,asserted db->nProgressOps>0 immediately above,,
INT32-C,973,sqlite,src/btree.c,10591,FP,"pCheck->nErr error counter, bounded by mxErr (small int passed by caller); cannot reach INT_MAX",,
INT32-C,974,sqlite,src/btree.c,10609,FP,"pCheck->mxErr decrement; small positive caller-supplied limit, no underflow to INT_MIN",,
INT32-C,975,sqlite,src/btree.c,10610,FP,"pCheck->nErr error counter, bounded by mxErr (small int passed by caller); cannot reach INT_MAX",,
DCL13-C,976,sqlite,src/btree.c,10633,TP,getPageReferenced only reads pCheck->aPgRef/nCkPage; pCheck not mutated,,
ARR01-C,977,sqlite,src/btree.c,10635,FP,"sizeof(pCheck->aPgRef[0]) is sizeof of an array element (u8), not a decayed param",,
INT13-C,978,sqlite,src/btree.c,10636,FP,iPg is Pgno (unsigned); analyzer mistyped,,
INT14-C,979,sqlite,src/btree.c,10636,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR01-C,980,sqlite,src/btree.c,10644,FP,"sizeof(pCheck->aPgRef[0]) is sizeof of an array element (u8), not a decayed param",,
INT13-C,981,sqlite,src/btree.c,10645,FP,iPg is Pgno (unsigned); analyzer mistyped,,
INT14-C,982,sqlite,src/btree.c,10645,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
EXP33-C,983,sqlite,src/btree.c,10693,FP,value assigned before use on all reachable paths,,
INT32-C,984,sqlite,src/btree.c,10737,FP,"8+i*4 with i<n<=usableSize/4-2; offset within overflow page, no overflow",,
EXP33-C,985,sqlite,src/btree.c,10756,FP,value assigned before use on all reachable paths,,
EXP30-C,986,sqlite,src/btree.c,10799,FP,reads/writes properly sequenced (short-circuit && or distinct subexpressions),,
EXP34-C,987,sqlite,src/btree.c,10808,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
MEM05-C,988,sqlite,src/btree.c,10840,uncertain,"checkTreePage recurses on children; depth bounded by b-tree height, but each frame is large (integrity check)",,
DCL00-C,989,sqlite,src/btree.c,10849,FP,"depth is reassigned (depth=checkTreePage(...) and depth=d2); it is modified, cannot be const",,
EXP34-C,990,sqlite,src/btree.c,10891,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,991,sqlite,src/btree.c,10893,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,992,sqlite,src/btree.c,10899,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
EXP34-C,993,sqlite,src/btree.c,10909,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
INT32-C,994,sqlite,src/btree.c,10909,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,995,sqlite,src/btree.c,10914,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,996,sqlite,src/btree.c,10922,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,997,sqlite,src/btree.c,10924,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
INT32-C,998,sqlite,src/btree.c,10928,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,999,sqlite,src/btree.c,10946,FP,nCell-1: nCell bounded by MX_CELL(<=10921); no overflow,,
INT14-C,1000,sqlite,src/btree.c,10951,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
ARR37-C,1001,sqlite,src/btree.c,10953,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT14-C,1002,sqlite,src/btree.c,10962,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
FLP03-C,1003,sqlite,src/btree.c,10982,FP,"nPage computation is all integer (u32) arithmetic/division, no floating-point operation",,
INT33-C,1004,sqlite,src/btree.c,10982,FP,usableSize-4 never zero,,
ARR37-C,1005,sqlite,src/btree.c,10983,FP,"pointer arithmetic/subscript on a pointer into the page aData[] or a sized cell/output buffer; bounded by cell size, maskPage, aDataEnd CORRUPT guards or spaceLeft",,
INT32-C,1006,sqlite,src/btree.c,11023,FP,nCell-1: nCell bounded by MX_CELL(<=10921); no overflow,,
INT32-C,1007,sqlite,src/btree.c,11025,FP,"2*cellindex / 2*nCell: cell index/count bounded by MX_CELL (<=10921), product < 22000 << INT_MAX",,
INT14-C,1008,sqlite,src/btree.c,11027,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,1009,sqlite,src/btree.c,11037,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
INT32-C,1010,sqlite,src/btree.c,11043,FP,i+size-1: freeblock offset+size within usableSize<=65536; no overflow,,
INT14-C,1011,sqlite,src/btree.c,11071,FP,"readability heuristic only; flag/mask/pointer usage is idiomatic, no integer-correctness bug",,
INT32-C,1012,sqlite,src/btree.c,11076,FP,"nFrag accumulates byte gaps within one page; bounded by usableSize, no overflow",,
INT32-C,1013,sqlite,src/btree.c,11080,FP,"nFrag accumulates byte gaps within one page; bounded by usableSize, no overflow",,
INT32-C,1014,sqlite,src/btree.c,11089,FP,"hdr is page header offset (0 or 100); hdr+const tiny, no overflow",,
EXP34-C,1015,sqlite,src/btree.c,11095,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,1016,sqlite,src/btree.c,11126,FP,db is caller-owned sqlite3 connection handle; asserts cover the btree state,,
DCL13-C,1017,sqlite,src/btree.c,11127,FP,"db is stored into sCheck.db (IntegrityCk.db field type sqlite3*, non-const); const param breaks the assignment",,
DCL13-C,1018,sqlite,src/btree.c,11129,TP,"sqlite3BtreeIntegrityCheck only reads aRoot[i] elements; never written, const Pgno* compiles",,
FLP03-C,1019,sqlite,src/btree.c,11171,FP,"(sCheck.nCkPage/8)+1 is integer division, not floating-point",,
INT32-C,1020,sqlite,src/btree.c,11171,FP,nCkPage/8 + 1: page count of db file / 8; stays far below INT_MAX,,
EXP30-C,1021,sqlite,src/btree.c,11189,FP,get4byte is a pure read with no side effects; unspecified arg eval order is harmless,,
MEM30-C,1022,sqlite,src/btree.c,11263,FP,"sCheck is a live stack struct; sqlite3_free at 11261/11262 freed distinct members .heap/.aPgRef, not .nErr",,
MEM30-C,1023,sqlite,src/btree.c,11264,FP,"sCheck.nErr is a member of live stack struct, not freed",,
MEM30-C,1024,sqlite,src/btree.c,11265,FP,sCheck.errMsg is a member of live stack struct; sqlite3_str_reset on it,,
STR34-C,1025,sqlite,src/btree.c,11266,FP,"*pzOut=0 assigns a char* pointer to NULL, not a char value widened to int",,
MEM30-C,1026,sqlite,src/btree.c,11268,FP,sCheck.errMsg member of live stack struct; sqlite3StrAccumFinish,,
STR34-C,1027,sqlite,src/btree.c,11268,FP,"*pzOut=sqlite3StrAccumFinish(...) assigns a char* pointer, not a char-to-int widening",,
MEM30-C,1028,sqlite,src/btree.c,11273,FP,"sCheck.rc member of live stack struct, never freed",,
API00-C,1029,sqlite,src/btree.c,11284,FP,caller-owned Btree; asserts p->pBt->pPager!=0,,
DCL13-C,1030,sqlite,src/btree.c,11284,TP,sqlite3BtreeGetFilename reads only p->pBt->pPager,,
API00-C,1031,sqlite,src/btree.c,11297,FP,caller-owned Btree; asserts p->pBt->pPager!=0,,
DCL13-C,1032,sqlite,src/btree.c,11297,TP,sqlite3BtreeGetJournalname reads only p->pBt->pPager,,
API00-C,1033,sqlite,src/btree.c,11306,FP,p NULL handled by design (p==0 || ... ternary); caller-owned,,
DCL13-C,1034,sqlite,src/btree.c,11306,TP,sqlite3BtreeTxnState reads only p->db->mutex (assert) and p->inTrans,,
API00-C,1035,sqlite,src/btree.c,11320,FP,p NULL handled by design (if(p)); caller-owned,,
MSC04-C,1036,sqlite,src/btree.c,11320,TP,sqlite3BtreeCheckpoint participates in real indirect recursion via the pager/WAL checkpoint path,,
API00-C,1037,sqlite,src/btree.c,11339,FP,caller-owned Btree; asserts p and mutex held,,
DCL13-C,1038,sqlite,src/btree.c,11339,TP,sqlite3BtreeIsInBackup reads only p->db->mutex and p->nBackup,,
EXP34-C,1039,sqlite,src/btree.c,11369,FP,pointer non-null on this path (rc==OK / param invariant / guarded above); deref safe,,
API00-C,1040,sqlite,src/btree.c,11382,FP,caller-owned Btree; asserts mutex held,,
API00-C,1041,sqlite,src/btree.c,11400,FP,caller-owned Btree; asserts inTrans!=TRANS_NONE,,
DCL03-C,1042,sqlite,src/btree.c,11405,TP,assert(READ_LOCK+1==WRITE_LOCK) compile-time constant; static_assert applicable,,
EXP05-C,1043,sqlite,src/btree.c,11472,uncertain,real cast removing const from param z to accessPayload(write=1); z read-only here but violates EXP05-C by letter,,
API00-C,1044,sqlite,src/btree.c,11478,FP,caller-owned cursor; only sets curFlags and derived pBtree flag,,
API00-C,1045,sqlite,src/btree.c,11489,FP,caller-owned Btree handle; asserts iVersion range,,
API00-C,1046,sqlite,src/btree.c,11524,FP,caller-owned cursor; assert-only helper reading hints,,
DCL13-C,1047,sqlite,src/btree.c,11524,TP,sqlite3BtreeCursorHasHint reads only pCsr->hints,,
API00-C,1048,sqlite,src/btree.c,11531,FP,caller-owned Btree handle; reads btsFlags,,
DCL13-C,1049,sqlite,src/btree.c,11531,TP,sqlite3BtreeIsReadonly reads only p->pBt->btsFlags,,
API00-C,1050,sqlite,src/btree.c,11544,FP,caller-owned Btree handle; reads inTransaction,,
DCL13-C,1051,sqlite,src/btree.c,11544,TP,"sqlite3BtreeClearCache reads p->pBt->inTransaction; mutates pBt's pager cache, not p",,
API00-C,1052,sqlite,src/btree.c,11555,FP,caller-owned Btree handle; reads p->sharable,,
DCL13-C,1053,sqlite,src/btree.c,11555,TP,sqlite3BtreeSharable reads only p->sharable,,
API00-C,1054,sqlite,src/btree.c,11564,FP,caller-owned Btree handle; reads p->pBt->nRef,,
DCL13-C,1055,sqlite,src/btree.c,11564,TP,sqlite3BtreeConnectionCount reads only p->sharable and p->pBt->nRef,,