sqc 0.4.84

rule,idx,project,file,line,verdict,reason,provenance,confidence
CON03-C,0,sqlite,ext/session/sqlite3session.c,30,uncertain,"sessions_strm_chunk_size is a process-global mutable config var with no synchronization; only a race if config() called concurrently with active sessions, which the sqlite API contract forbids",,
DCL13-C,1,sqlite,ext/session/sqlite3session.c,348,FP,piVal is an OUT param written via getVarint32 macro (B assigned); not read-only,,
DCL13-C,2,sqlite,ext/session/sqlite3session.c,356,FP,"piVal written via getVarint32 into *piVal; OUT param, not read-only",,
STR31-C,3,sqlite,ext/session/sqlite3session.c,360,FP,"memcpy of nBuf<5 bytes into aCopy[5] for varint decode; not a string copy, no null-term needed",,
PRE00-C,4,sqlite,ext/session/sqlite3session.c,367,TP,function-like macro SESSION_UINT32 evaluates parameter x multiple times; could be an inline function,,
PRE12-C,5,sqlite,ext/session/sqlite3session.c,367,TP,"SESSION_UINT32(x) expands (x) four times; multiple-evaluation macro, side-effecting arg would be evaluated 4x",,
INT14-C,6,sqlite,ext/session/sqlite3session.c,376,FP,u64 'x' big-endian assembly idiom (x<<32)+y in sessionGetI64; not arithmetic misuse,,
INT13-C,7,sqlite,ext/session/sqlite3session.c,384,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT14-C,8,sqlite,ext/session/sqlite3session.c,384,FP,sqlite3_int64 'i' byte-serialization idiom (i>>56)&0xFF in sessionPutI64,,
INT13-C,9,sqlite,ext/session/sqlite3session.c,385,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,10,sqlite,ext/session/sqlite3session.c,386,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,11,sqlite,ext/session/sqlite3session.c,387,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,12,sqlite,ext/session/sqlite3session.c,388,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,13,sqlite,ext/session/sqlite3session.c,389,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,14,sqlite,ext/session/sqlite3session.c,390,FP,"big-endian put idiom; signed shift masked to byte, intended",,
INT13-C,15,sqlite,ext/session/sqlite3session.c,391,FP,"big-endian put idiom; signed shift masked to byte, intended",,
DCL03-C,16,sqlite,ext/session/sqlite3session.c,436,TP,assert( sizeof(double)==8 && sizeof(u64)==8 ) is a compile-time constant; static_assert is appropriate,,
INT32-C,17,sqlite,ext/session/sqlite3session.c,465,FP,"nByte from sqlite3_value_bytes of app-supplied value (capture side), i64 via sessionMalloc64; session-side not blob",,
PRE00-C,18,sqlite,ext/session/sqlite3session.c,514,TP,function-like macro HASH_APPEND evaluates parameter hash three times; prefer inline function,,
PRE02-C,19,sqlite,ext/session/sqlite3session.c,514,TP,HASH_APPEND replacement list ((hash)<<3)^(hash)^... lacks outer parens; precedence breaks if used inside a larger expression,,
PRE12-C,20,sqlite,ext/session/sqlite3session.c,514,TP,HASH_APPEND evaluates hash multiple times; multiple-evaluation hazard,,
INT13-C,21,sqlite,ext/session/sqlite3session.c,521,FP,i64 hash idiom i&0xFFFFFFFF in sessionHashAppendI64,,
INT13-C,22,sqlite,ext/session/sqlite3session.c,522,FP,i64 hash idiom (i>>32)&0xFFFFFFFF in sessionHashAppendI64,,
DCL02-C,23,sqlite,ext/session/sqlite3session.c,529,FP,"'n' and 'h' are distinct single-letter locals, not visually confusable; rule misfire",,
DCL13-C,24,sqlite,ext/session/sqlite3session.c,555,TP,sessionPreupdateHash: pSession only read (hook members/pCtx); const sqlite3_session* compiles,,
DCL13-C,25,sqlite,ext/session/sqlite3session.c,557,TP,sessionPreupdateHash: pTab only read (nCol/abPK/aiIdx/bRowid); const compiles,,
DCL00-C,26,sqlite,ext/session/sqlite3session.c,562,FP,"h is reassigned via h=sessionHashAppendI64(h,...) etc; it IS modified, not const-able",,
DCL03-C,27,sqlite,ext/session/sqlite3session.c,592,TP,assert( sizeof(iVal)==8 && sizeof(rVal)==8 ) is compile-time constant; static_assert appropriate,,
DCL02-C,28,sqlite,ext/session/sqlite3session.c,598,FP,"'n' vs 'h' are different letters, not confusable; misfire",,
INT33-C,29,sqlite,ext/session/sqlite3session.c,616,FP,divisor pTab->nChange is in-memory hash bucket count forced >=128 by sessionGrowHash before any hash; not blob-derived,,
EXP33-C,30,sqlite,ext/session/sqlite3session.c,633,FP,"n is written by sessionVarintGet(&a[1],&n) before being added to a; out-param initializes it",,
INT32-C,31,sqlite,ext/session/sqlite3session.c,633,FP,"sessionSerialLen on session-side change record (in-memory captured aRecord), not untrusted changeset blob",,
DCL13-C,32,sqlite,ext/session/sqlite3session.c,646,TP,sessionChangeHash: pTab only read (nCol/abPK); const SessionTable* compiles,,
DCL00-C,33,sqlite,ext/session/sqlite3session.c,651,FP,h is reassigned through the loop (h=sessionHashAppend...); not const-able,,
EXP34-C,34,sqlite,ext/session/sqlite3session.c,655,FP,"internal sessionChangeHash; pTab is a validated SessionTable, never null when iterating change records",,
EXP34-C,35,sqlite,ext/session/sqlite3session.c,656,FP,'a'=aRecord cursor into an allocated SessionChange buffer; callers pass non-null records,,
DCL02-C,36,sqlite,ext/session/sqlite3session.c,672,FP,'n' vs 'h' different letters; misfire,,
EXP33-C,37,sqlite,ext/session/sqlite3session.c,674,FP,"n written by sessionVarintGet(a,&n) before use; out-param initializes it",,
INT33-C,38,sqlite,ext/session/sqlite3session.c,685,FP,"divisor nBucket = pTab->nChange passed after sessionGrowHash (>=128) at caller 6104; never zero, not blob-derived",,
DCL13-C,39,sqlite,ext/session/sqlite3session.c,695,TP,sessionChangeEqual: pTab only read (nCol/abPK); read-only comparison helper,,
ARR00-C,40,sqlite,ext/session/sqlite3session.c,705,FP,iCol is for-loop counter bounded by pTab->nCol (DB schema column count); abPK[iCol] in-bounds; not uninitialized; record is in-memory session data not untrusted blob,,
EXP34-C,41,sqlite,ext/session/sqlite3session.c,705,FP,"internal sessionChangeEqual; pTab validated SessionTable, non-null by construction",,
EXP34-C,42,sqlite,ext/session/sqlite3session.c,710,FP,'a1'=aLeft cursor into allocated change record; caller passes non-null buffers,,
INT31-C,43,sqlite,ext/session/sqlite3session.c,710,FP,"n1 from sessionSerialLen on locally-recorded change record (sessionChangeEqual), guarded n1!=n2; trusted in-memory record",,
INT31-C,44,sqlite,ext/session/sqlite3session.c,752,uncertain,n2 from sessionSerialLen on changegroup-merge record; record buffered via sessionChangesetBufferRecord with no per-field length validation in non-streaming mode -> corrupt internal varint can over-read,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR37-C,45,sqlite,ext/session/sqlite3session.c,753,FP,sessionMergeRecord aOut writes into caller buffer sized for merged record over nCol cols; nCol is DB schema count; pointer arithmetic on legitimate output buffer,,
INT31-C,46,sqlite,ext/session/sqlite3session.c,755,uncertain,"n1 from sessionSerialLen, same merge-record path lacking per-field bounds validation; corrupt blob varint risk",downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR37-C,47,sqlite,ext/session/sqlite3session.c,756,FP,"same as 753, aOut advance bounded by nCol iterations over caller-sized buffer",,
DCL30-C,48,sqlite,ext/session/sqlite3session.c,762,FP,"aOut holds the caller-supplied output-buffer address (*paOut), not local automatic storage; writing it back is correct",,
MEM33-C,49,sqlite,ext/session/sqlite3session.c,800,FP,"*paTwo=&a2[n2] is a pointer assignment, not a flexible-array-member struct copy; misfire",,
MEM33-C,50,sqlite,ext/session/sqlite3session.c,808,FP,"*paOne=&a1[n1] is a pointer assignment, not a struct copy; misfire",,
DCL13-C,51,sqlite,ext/session/sqlite3session.c,819,TP,sessionMergeUpdate: pTab only read (nCol/abPK); const compiles,,
DCL13-C,52,sqlite,ext/session/sqlite3session.c,821,FP,aOldRecord1 copied to local then &local passed to sessionMergeValue(u8**); const u8* breaks that call,,
DCL13-C,53,sqlite,ext/session/sqlite3session.c,822,FP,aOldRecord2 fed via local to sessionMergeValue(u8**); const would not compile,,
DCL13-C,54,sqlite,ext/session/sqlite3session.c,823,FP,aNewRecord1 fed via local to sessionMergeValue(u8**); const would not compile,,
DCL13-C,55,sqlite,ext/session/sqlite3session.c,824,FP,aNewRecord2 fed via local to sessionMergeValue(u8**); const would not compile,,
EXP34-C,56,sqlite,ext/session/sqlite3session.c,840,FP,internal sessionMergeUpdate; pTab validated SessionTable,,
EXP33-C,57,sqlite,ext/session/sqlite3session.c,848,FP,"nOld set by sessionMergeValue(&aOld1,&aOld2,&nOld) which always writes *pnVal before return",,
EXP34-C,58,sqlite,ext/session/sqlite3session.c,848,FP,'aOld' returned by sessionMergeValue which asserts a1!=0 and always returns a valid cursor,,
INT31-C,59,sqlite,ext/session/sqlite3session.c,848,uncertain,nNew/nOld from sessionMergeValue->sessionSerialLen on concat/merge record; unvalidated internal serial length on corrupt changeset,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
INT31-C,60,sqlite,ext/session/sqlite3session.c,850,uncertain,"nOld from sessionSerialLen in sessionMergeUpdate; unvalidated per-field length, corrupt-blob over-read/over-write risk",downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR37-C,61,sqlite,ext/session/sqlite3session.c,851,FP,sessionMergeUpdate aOut writes old.* vector into caller buffer; bounded by pTab->nCol; legitimate output cursor,,
ARR37-C,62,sqlite,ext/session/sqlite3session.c,853,FP,"aOut++ writes single placeholder byte, bounded by nCol loop",,
INT31-C,63,sqlite,ext/session/sqlite3session.c,874,uncertain,nNew from sessionSerialLen in sessionMergeUpdate new.* loop; unvalidated per-field length,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR37-C,64,sqlite,ext/session/sqlite3session.c,876,FP,aOut++ placeholder byte in new.* vector loop bounded by nCol,,
INT31-C,65,sqlite,ext/session/sqlite3session.c,878,uncertain,"nNew memcpy in sessionMergeUpdate; output buffer sized by record totals, per-field serial-len sum unvalidated on corrupt input",downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR37-C,66,sqlite,ext/session/sqlite3session.c,879,FP,aOut += nNew into caller output buffer bounded by nCol loop,,
DCL30-C,67,sqlite,ext/session/sqlite3session.c,883,FP,aOut holds caller buffer address from *paOut; not local automatic storage,,
DCL13-C,68,sqlite,ext/session/sqlite3session.c,895,TP,sessionPreupdateEqual: pSession only read (hook/pCtx); const compiles,,
DCL13-C,69,sqlite,ext/session/sqlite3session.c,897,TP,sessionPreupdateEqual: pTab only read (bRowid/nCol/abPK/aiIdx); const compiles,,
DCL13-C,70,sqlite,ext/session/sqlite3session.c,898,TP,sessionPreupdateEqual: pChange only read (aRecord copied to local cursor); const SessionChange* compiles,,
ARR00-C,71,sqlite,ext/session/sqlite3session.c,910,FP,iCol is for-loop counter bounded by pTab->nCol; abPK[iCol] in-bounds; not uninitialized,,
DCL03-C,72,sqlite,ext/session/sqlite3session.c,947,TP,assert( sizeof(iVal)==8 && sizeof(rVal)==8 ) compile-time constant; static_assert appropriate,,
FLP02-C,73,sqlite,ext/session/sqlite3session.c,949,FP,deliberate exact equality on a bit-reconstructed double for change detection; not a computed-float comparison,,
EXP33-C,74,sqlite,ext/session/sqlite3session.c,955,FP,"n written by sessionVarintGet(a,&n) before use",,
EXP34-C,75,sqlite,ext/session/sqlite3session.c,961,FP,sessionPreupdateEqual; 'a' is pChange->aRecord allocated buffer; memcmp guarded by n>0,,
EXP34-C,76,sqlite,ext/session/sqlite3session.c,986,FP,sessionGrowHash; pTab validated SessionTable passed by internal callers,,
INT32-C,77,sqlite,ext/session/sqlite3session.c,989,FP,"nNew=2*nChange hash-table size, explicitly widened to i64; nChange bounded growth counter (session side)",,
INT30-C,78,sqlite,ext/session/sqlite3session.c,992,FP,"sizeof(SessionChange*)*nNew in sessionGrowHash; nNew = 2*prior bucket count (internal doubling from 128), not blob-derived; sessionMalloc64",,
ARR38-C,79,sqlite,ext/session/sqlite3session.c,1000,FP,"memset apNew size nNew*sizeof(ptr); apNew freshly malloc'd at nNew (hash bucket count, internal); size matches allocation",,
INT30-C,80,sqlite,ext/session/sqlite3session.c,1000,FP,same sessionGrowHash internal bucket doubling; bounded,,
INT32-C,81,sqlite,ext/session/sqlite3session.c,1000,FP,"memset size sizeof(ptr)*nNew, nNew i64 hash table size (session side bounded growth)",,
EXP33-C,82,sqlite,ext/session/sqlite3session.c,1004,FP,pNext assigned (pNext=p->pNext) at loop body before the for-update p=pNext; first iteration uses p=apChange[i],,
STR34-C,83,sqlite,ext/session/sqlite3session.c,1078,FP,"*pazCol=0 is a pointer/output init, not char-to-int widening",,
STR34-C,84,sqlite,ext/session/sqlite3session.c,1083,FP,"*pzTab=0 pointer output init, not byte widening",,
STR34-C,85,sqlite,ext/session/sqlite3session.c,1084,FP,"*pazDflt=0 pointer output init, not byte widening",,
INT32-C,86,sqlite,ext/session/sqlite3session.c,1117,FP,"nByte accumulates sqlite3_column_bytes of DB schema metadata (PRAGMA table_xinfo), i64; not blob",,
INT32-C,87,sqlite,ext/session/sqlite3session.c,1118,FP,"nByte accumulates dflt_value bytes from DB schema query, i64; session/DB side not blob",,
INT32-C,88,sqlite,ext/session/sqlite3session.c,1120,FP,nDbCol counts DB table columns (bounded by SQLITE_MAX_COLUMN); not blob-derived,,
INT32-C,89,sqlite,ext/session/sqlite3session.c,1125,FP,"nDbCol += bRowid (0/1); bounded column counter, not blob",,
INT32-C,90,sqlite,ext/session/sqlite3session.c,1126,FP,nByte += strlen(SESSIONS_ROWID) constant literal; not blob,,
ARR39-C,91,sqlite,ext/session/sqlite3session.c,1130,FP,sessionTableInfo nByte computed from nDbCol (DB schema count); single allocation carved into azCol/azDflt/aiIdx/abPK; not blob-derived,,
INT30-C,92,sqlite,ext/session/sqlite3session.c,1130,FP,nDbCol from local schema query (sessionTableInfo); buffer pre-sized; trusted DB metadata,,
INT32-C,93,sqlite,ext/session/sqlite3session.c,1130,FP,"nByte += nDbCol*const; nDbCol bounded column count, nByte i64; session/DB side",,
ARR38-C,94,sqlite,ext/session/sqlite3session.c,1135,FP,memset nByte on freshly-allocated pAlloc of size nByte,,
INT31-C,95,sqlite,ext/session/sqlite3session.c,1135,FP,nByte is locally computed allocation size for sessionTableInfo buffer,,
ARR38-C,96,sqlite,ext/session/sqlite3session.c,1145,FP,memcpy zThis nThis+1; nByte accounted nThis+1 for table name; within single allocation,,
INT31-C,97,sqlite,ext/session/sqlite3session.c,1145,FP,"nThis = strlen of table name (schema), buffer pre-sized",,
STR34-C,98,sqlite,ext/session/sqlite3session.c,1146,FP,"*pzTab=(char*)pAlloc pointer assignment, not byte widening",,
ARR37-C,99,sqlite,ext/session/sqlite3session.c,1147,FP,pAlloc += nThis+1 within bounds accounted in nByte,,
ARR38-C,100,sqlite,ext/session/sqlite3session.c,1153,FP,memcpy SESSIONS_ROWID nName+1; rowid name fits in per-col allocation budget,,
INT31-C,101,sqlite,ext/session/sqlite3session.c,1153,FP,"nName from sqlite3_column_bytes on schema column name (trusted), buffer pre-sized",,
INT32-C,102,sqlite,ext/session/sqlite3session.c,1153,FP,"nName=strlen(SESSIONS_ROWID) constant; memcpy size on session-allocated buffer, not blob",,
ARR37-C,103,sqlite,ext/session/sqlite3session.c,1155,FP,pAlloc += nName+1 within accounted budget,,
ARR38-C,104,sqlite,ext/session/sqlite3session.c,1168,FP,memcpy zName nName+1; nName from sqlite3_column_bytes(col1) which was summed into nByte at line 1117,,
INT31-C,105,sqlite,ext/session/sqlite3session.c,1168,FP,nName from sqlite3_column_bytes on schema column name (trusted),,
ARR37-C,106,sqlite,ext/session/sqlite3session.c,1170,FP,pAlloc += nName+1 within accounted budget,,
ARR38-C,107,sqlite,ext/session/sqlite3session.c,1172,FP,memcpy zDflt nDflt+1; nDflt from sqlite3_column_bytes(col4) summed into nByte at line 1118,,
INT31-C,108,sqlite,ext/session/sqlite3session.c,1172,FP,nDflt from sqlite3_column_bytes on schema default value (trusted),,
ARR37-C,109,sqlite,ext/session/sqlite3session.c,1174,FP,pAlloc += nDflt+1 within accounted budget,,
EXP40-C,110,sqlite,ext/session/sqlite3session.c,1191,FP,*pazCol=(const char**)azCol ADDS const qualification (char** -> const char**); not a modification of a const object,,
STR34-C,111,sqlite,ext/session/sqlite3session.c,1191,FP,"*pazCol=(const char**)azCol pointer assignment, not byte widening",,
EXP40-C,112,sqlite,ext/session/sqlite3session.c,1192,FP,*pazDflt=(const char**)azDflt adds const; not modifying a const object,,
STR34-C,113,sqlite,ext/session/sqlite3session.c,1192,FP,"*pazDflt=(const char**)azDflt pointer assignment, not byte widening",,
DCL30-C,114,sqlite,ext/session/sqlite3session.c,1193,FP,abPK is a heap allocation from sessionTableInfo stored via out-param; valid after return,,
DCL30-C,115,sqlite,ext/session/sqlite3session.c,1195,FP,aiIdx is a heap allocation stored via out-param; valid after return,,
MEM30-C,116,sqlite,ext/session/sqlite3session.c,1229,FP,"pTab->azCol freed at 1226; line passes &pTab->nCol/zName as OUT params, distinct fields not freed mem",,
MEM30-C,117,sqlite,ext/session/sqlite3session.c,1230,FP,"&pTab->azDflt is an OUT param to sessionTableInfo, distinct field not the freed azCol",,
MEM30-C,118,sqlite,ext/session/sqlite3session.c,1231,FP,"&pTab->bRowid OUT param, distinct field not freed memory",,
MEM30-C,119,sqlite,ext/session/sqlite3session.c,1235,FP,pTab->nCol read after fields repopulated; not the freed azCol pointer,,
EXP34-C,120,sqlite,ext/session/sqlite3session.c,1236,FP,abPK set by sessionTableInfo under rc==SQLITE_OK guard (line 1233); non-null on success,,
MEM30-C,121,sqlite,ext/session/sqlite3session.c,1241,FP,pTab->zName never freed here; distinct from freed azCol,,
INT32-C,122,sqlite,ext/session/sqlite3session.c,1247,FP,nMaxChangesetSize accumulates pTab->nCol (bounded column count) + table name; session side,,
MEM30-C,123,sqlite,ext/session/sqlite3session.c,1247,FP,"pTab->nCol/zName are live fields, not the freed azCol buffer",,
EXP34-C,124,sqlite,ext/session/sqlite3session.c,1272,FP,pSession dereferenced in assert; sessionReinitTable only called internally with non-null pSession,,
EXP34-C,125,sqlite,ext/session/sqlite3session.c,1286,FP,pTab->abPK deref under rc==SQLITE_OK guard after sessionTableInfo; abPK non-null on success,,
FLP02-C,126,sqlite,ext/session/sqlite3session.c,1286,FP,"pTab->abPK[ii]!=abPK[ii] compares u8 PK-flag bytes, not floats; misfire",,
INT32-C,127,sqlite,ext/session/sqlite3session.c,1305,FP,"nCol-nOldCol both bounded DB column counts; session size accounting, not blob",,
EXP05-C,128,sqlite,ext/session/sqlite3session.c,1312,FP,(char*)azCol casts away const only to sqlite3_free the owned buffer; idiomatic and safe,,
EXP34-C,129,sqlite,ext/session/sqlite3session.c,1328,FP,*pp; sessionUpdateOneChange called only from sessionUpdateChanges with valid &pTab->apChange[],,
INT32-C,130,sqlite,ext/session/sqlite3session.c,1346,FP,"n=sqlite3_column_bytes of DB default value (DB side); nIncr for session record, not blob",,
INT30-C,131,sqlite,ext/session/sqlite3session.c,1352,FP,nByte = nIncr + pOld->nRecord; nIncr from schema default value length (trusted); sessionMalloc64,,
INT32-C,132,sqlite,ext/session/sqlite3session.c,1361,FP,"pNew->nRecord++ on session-built record; bounded by allocated nByte (i64), not blob",,
INT32-C,133,sqlite,ext/session/sqlite3session.c,1366,FP,nRecord += 8 on session-built record bounded by allocation; not blob,,
INT32-C,134,sqlite,ext/session/sqlite3session.c,1375,FP,nRecord += 8 on session-built record bounded by allocation; not blob,,
INT32-C,135,sqlite,ext/session/sqlite3session.c,1382,FP,nRecord += sessionVarintPut into session-built record bounded by allocation; not blob,,
INT31-C,136,sqlite,ext/session/sqlite3session.c,1383,FP,n from sqlite3_column_bytes on schema default (trusted); buffer sized nByte,,
INT32-C,137,sqlite,ext/session/sqlite3session.c,1384,FP,"nRecord += n, n=column_bytes of DB default value; session record bounded by allocation; not blob",,
INT32-C,138,sqlite,ext/session/sqlite3session.c,1391,FP,nRecord += sessionVarintPut session record bounded by allocation; not blob,,
INT31-C,139,sqlite,ext/session/sqlite3session.c,1392,FP,n from sqlite3_column_bytes on schema default blob (trusted); buffer sized,,
INT32-C,140,sqlite,ext/session/sqlite3session.c,1393,FP,"nRecord += n, n=DB blob default bytes; session record bounded by allocation; not blob",,
MEM30-C,141,sqlite,ext/session/sqlite3session.c,1403,FP,"pOld freed at 1402 then only reassigned (*pp=pOld=pNew), no dereference of freed pOld",,
INT32-C,142,sqlite,ext/session/sqlite3session.c,1405,FP,"nMaxSize += nIncr (DB default value size); session size accounting, not blob",,
STR34-C,143,sqlite,ext/session/sqlite3session.c,1469,FP,sqlite3Strlen30(zStr) is a strlen; no signed-byte widening into arithmetic,,
EXP34-C,144,sqlite,ext/session/sqlite3session.c,1471,FP,'zStr' originates from zApp (null-checked at 1492) or string literals; non-null by caller,,
INT31-C,145,sqlite,ext/session/sqlite3session.c,1471,FP,nStr from strlen; sessionBufferGrow(nStr+1) precedes memcpy,,
INT32-C,146,sqlite,ext/session/sqlite3session.c,1472,FP,nBuf += nStr (strlen of session-generated string); buffer bounded by sessionBufferGrow/SESSION_MAX_BUFFER_SZ,,
DCL13-C,147,sqlite,ext/session/sqlite3session.c,1515,TP,sessionPrepareDfltStmt: pTab only read (nCol/azDflt); const compiles,,
EXP34-C,148,sqlite,ext/session/sqlite3session.c,1525,FP,sessionPrepareDfltStmt; pTab validated SessionTable,,
EXP34-C,149,sqlite,ext/session/sqlite3session.c,1545,FP,"pSession->rc; sessionUpdateChanges internal, pSession non-null",,
EXP34-C,150,sqlite,ext/session/sqlite3session.c,1548,FP,pStmt passed to sqlite3_step under rc==SQLITE_OK; sessionPrepareDfltStmt sets pStmt non-null on OK,,
EXP34-C,151,sqlite,ext/session/sqlite3session.c,1554,FP,pStmt under rc==SQLITE_OK && SQLITE_ROW==step guard; non-null prepared statement,,
DCL13-C,152,sqlite,ext/session/sqlite3session.c,1577,FP,sessionStat1Old signature fixed by SessionHook.xOld function-pointer type,,
EXP34-C,153,sqlite,ext/session/sqlite3session.c,1581,FP,pVal to sqlite3_value_type guarded by short-circuit rc==SQLITE_OK; xOld sets pVal on success,,
DCL30-C,154,sqlite,ext/session/sqlite3session.c,1584,FP,pVal is a managed sqlite3_value* stored via *ppVal; not local automatic storage,,
DCL13-C,155,sqlite,ext/session/sqlite3session.c,1587,FP,sessionStat1New signature fixed by SessionHook.xNew function-pointer type,,
EXP34-C,156,sqlite,ext/session/sqlite3session.c,1591,FP,pVal to sqlite3_value_type guarded by rc==SQLITE_OK; xNew sets pVal on success,,
DCL30-C,157,sqlite,ext/session/sqlite3session.c,1594,FP,pVal is a managed sqlite3_value* stored via *ppVal; not local automatic storage,,
DCL13-C,158,sqlite,ext/session/sqlite3session.c,1597,FP,sessionStat1Count signature fixed by SessionHook.xCount function-pointer type,,
DCL13-C,159,sqlite,ext/session/sqlite3session.c,1601,FP,sessionStat1Depth signature fixed by SessionHook.xDepth function-pointer type,,
DCL13-C,160,sqlite,ext/session/sqlite3session.c,1609,TP,sessionUpdateMaxSize: pTab only read (bRowid/nCol/aiIdx); const compiles (pC is the mutated arg),,
ARR00-C,161,sqlite,ext/session/sqlite3session.c,1617,FP,ii is for-loop counter bounded by pTab->nCol (DB schema); aiIdx[ii] in-bounds; not uninitialized,,
EXP34-C,162,sqlite,ext/session/sqlite3session.c,1620,FP,sessionSerializeValue explicitly null-checks pValue (line 414/469); null p is handled,,
FLP02-C,163,sqlite,ext/session/sqlite3session.c,1661,FP,deliberate exact equality on bit-reconstructed double for change detection,,
INT32-C,164,sqlite,ext/session/sqlite3session.c,1673,FP,"nOld += nByte from session-side captured change record (preupdate old.* values), not blob",,
ARR38-C,165,sqlite,ext/session/sqlite3session.c,1677,FP,"memcmp(pCsr,...,nByte) over pC->aRecord (in-memory recorded change built by session itself, not untrusted blob); nByte from its own varint",,
INT31-C,166,sqlite,ext/session/sqlite3session.c,1677,FP,"memcmp size nByte gated by nByte==sqlite3_value_bytes(p) (>=0); walks locally-recorded change record (sessionPreupdateEqual), trusted",,
INT32-C,167,sqlite,ext/session/sqlite3session.c,1687,FP,"pC->nRecord+2 on session-side captured change record; nRecord bounded by allocation, not blob",,
INT32-C,168,sqlite,ext/session/sqlite3session.c,1692,FP,"nNew += 1+nOld, nOld from session-side record; size accounting i64, not blob",,
INT32-C,169,sqlite,ext/session/sqlite3session.c,1695,FP,"nNew += 2+nOld, session-side record; size accounting i64, not blob",,
STR30-C,170,sqlite,ext/session/sqlite3session.c,1767,FP,"sqlite3ValueSetStr(p,0,\\""",,
INT32-C,171,sqlite,ext/session/sqlite3session.c,1795,FP,"pTab->nEntry++ session change counter; bounded by table changes, not blob",,
DCL31-C,172,sqlite,ext/session/sqlite3session.c,1807,FP,"TESTONLY(int trc = ) macro expands to 'int trc =' in test builds; type IS int, parser artifact of the macro",,
EXP34-C,173,sqlite,ext/session/sqlite3session.c,1814,FP,sessionSerializeValue explicitly handles pValue==0 (line 414/469); counting mode safe,,
INT32-C,174,sqlite,ext/session/sqlite3session.c,1819,FP,"nByte += 9 rowid field size in session-built record; i64 bounded by columns, not blob",,
EXP34-C,175,sqlite,ext/session/sqlite3session.c,1850,FP,sessionSerializeValue explicitly handles pValue==0; null p serialized as 0x00 placeholder,,
STR34-C,176,sqlite,ext/session/sqlite3session.c,1896,FP,"sqlite3Strlen30(zName) strlen, no signed-byte widening",,
DCL30-C,177,sqlite,ext/session/sqlite3session.c,1923,FP,pRet is a heap SessionTable* stored via *ppTab; valid after return,,
DCL13-C,178,sqlite,ext/session/sqlite3session.c,1931,FP,xPreUpdate is the sqlite3_preupdate_hook callback; signature fixed and pCtx used as mutable session,,
DCL13-C,179,sqlite,ext/session/sqlite3session.c,1932,FP,xPreUpdate db param fixed by preupdate_hook callback signature,,
STR34-C,180,sqlite,ext/session/sqlite3session.c,1940,FP,"sqlite3Strlen30(zDb) strlen, no signed-byte widening",,
EXP33-C,181,sqlite,ext/session/sqlite3session.c,1947,FP,"pTab written by sessionFindTable(...,&pTab) before use at line 1957",,
DCL13-C,182,sqlite,ext/session/sqlite3session.c,2008,FP,sessionDiffOld assigned to hook.xOld function pointer; signature fixed,,
INT32-C,183,sqlite,ext/session/sqlite3session.c,2010,FP,"iVal+nOldOff+bRowid: column index for sqlite3_column_value, bounded by column count; not blob",,
DCL13-C,184,sqlite,ext/session/sqlite3session.c,2013,FP,sessionDiffNew assigned to hook.xNew function pointer; signature fixed,,
INT32-C,185,sqlite,ext/session/sqlite3session.c,2015,FP,iVal+bRowid: column index bounded by column count; not blob,,
DCL13-C,186,sqlite,ext/session/sqlite3session.c,2018,FP,sessionDiffCount assigned to hook.xCount function pointer; signature fixed,,
INT32-C,187,sqlite,ext/session/sqlite3session.c,2020,FP,nOldOff/column_count - bRowid: column-count arithmetic; not blob,,
DCL13-C,188,sqlite,ext/session/sqlite3session.c,2022,FP,sessionDiffDepth assigned to hook.xDepth function pointer; signature fixed,,
DCL13-C,189,sqlite,ext/session/sqlite3session.c,2033,FP,pDiffCtx stored into pSession->hook.pCtx via (void*) cast (non-const sink),,
DCL13-C,190,sqlite,ext/session/sqlite3session.c,2046,TP,sessionExprComparePK: abPK only read (abPK[i]); const u8* compiles,,
ARR00-C,191,sqlite,ext/session/sqlite3session.c,2052,FP,i is for-loop counter bounded by nCol (DB schema); abPK[i]/azCol[i] in-bounds; not uninitialized,,
DCL13-C,192,sqlite,ext/session/sqlite3session.c,2069,TP,sessionExprCompareOther: abPK only read (abPK[i]); const u8* compiles,,
ARR00-C,193,sqlite,ext/session/sqlite3session.c,2076,FP,i is for-loop counter bounded by nCol (DB schema); abPK[i] in-bounds,,
DCL30-C,194,sqlite,ext/session/sqlite3session.c,2110,FP,"zRet holds sqlite3_mprintf() heap result; returning the heap pointer is correct, not automatic storage",,
DCL13-C,195,sqlite,ext/session/sqlite3session.c,2156,TP,sessionAllCols: pTab only read (nCol/zName/azCol); const compiles,,
ARR00-C,196,sqlite,ext/session/sqlite3session.c,2160,FP,ii is for-loop counter bounded by pTab->nCol; azCol[ii] in-bounds; not uninitialized,,
API00-C,197,sqlite,ext/session/sqlite3session.c,2214,FP,"sqlite3session_diff: public API, pSession invalid handle is documented misuse (deref pSession->zDb)",,
STR34-C,198,sqlite,ext/session/sqlite3session.c,2228,FP,"*pzErrMsg=0 pointer output init, not byte widening",,
INT32-C,199,sqlite,ext/session/sqlite3session.c,2235,FP,bAutoAttach++ recursion-guard flag; not blob,,
INT32-C,200,sqlite,ext/session/sqlite3session.c,2237,FP,bAutoAttach-- recursion-guard flag; not blob,,
STR34-C,201,sqlite,ext/session/sqlite3session.c,2280,FP,"*pzErrMsg=sqlite3_mprintf(...) pointer assignment, not byte widening",,
EXP34-C,202,sqlite,ext/session/sqlite3session.c,2288,FP,pTo->abPK / abPK under rc==SQLITE_OK and nCol==pTo->nCol; abPK non-null on success,,
EXP34-C,203,sqlite,ext/session/sqlite3session.c,2289,FP,azCol[i] under rc==SQLITE_OK guard after sessionTableInfo; azCol non-null on success,,
EXP05-C,204,sqlite,ext/session/sqlite3session.c,2294,FP,(char*)azCol casts away const only to sqlite3_free owned buffer; idiomatic,,
STR34-C,205,sqlite,ext/session/sqlite3session.c,2297,FP,"*pzErrMsg=sqlite3_mprintf(...) pointer assignment, not byte widening",,
API00-C,206,sqlite,ext/session/sqlite3session.c,2341,FP,"sqlite3session_create: public API, NULL db is documented caller misuse",,
STR34-C,207,sqlite,ext/session/sqlite3session.c,2348,FP,"sqlite3Strlen30(zDb) strlen, no signed-byte widening",,
INT30-C,208,sqlite,ext/session/sqlite3session.c,2354,FP,sizeof(sqlite3_session)+nDb+1; nDb = strlen of db name API arg (trusted); malloc64,,
ARR38-C,209,sqlite,ext/session/sqlite3session.c,2360,FP,memcpy zDb nDb+1 into pNew->zDb; allocation was sizeof(session)+nDb+1; fits,,
INT31-C,210,sqlite,ext/session/sqlite3session.c,2360,FP,nDb = strlen(zDb) API arg (trusted); buffer pre-sized,,
DCL30-C,211,sqlite,ext/session/sqlite3session.c,2371,FP,pNew is a heap session object stored via *ppSession; valid after return,,
DCL13-C,212,sqlite,ext/session/sqlite3session.c,2379,FP,"sessionDeleteTable: pList objects are freed (sessionFree on derived pTab); destroys pointee, cannot be const",,
EXP33-C,213,sqlite,ext/session/sqlite3session.c,2388,FP,pNextChange assigned (pNextChange=p->pNext) before for-update p=pNextChange; first iter uses p=apChange[i],,
MEM30-C,214,sqlite,ext/session/sqlite3session.c,2395,FP,"sessionFree of pTab->azCol; distinct object, not a pSession double-free",,
MEM30-C,215,sqlite,ext/session/sqlite3session.c,2396,FP,"sessionFree of pTab->apChange; distinct object, not pSession",,
MEM30-C,216,sqlite,ext/session/sqlite3session.c,2397,FP,"sessionFree of pTab (loop element); distinct object, not pSession double-free",,
API00-C,217,sqlite,ext/session/sqlite3session.c,2404,FP,"sqlite3session_delete: public API, invalid pSession is documented misuse",,
EXP34-C,218,sqlite,ext/session/sqlite3session.c,2405,FP,pSession->db; public API sqlite3session_delete; non-null is documented API precondition,,
MEM30-C,219,sqlite,ext/session/sqlite3session.c,2425,FP,"sessionDeleteTable(pSession,pTable) reads pSession; pSession not freed until 2428",,
API00-C,220,sqlite,ext/session/sqlite3session.c,2434,FP,"sqlite3session_table_filter: public API, invalid pSession is documented misuse",,
DCL13-C,221,sqlite,ext/session/sqlite3session.c,2437,FP,"pCtx stored into pSession->pFilterCtx (void*, non-const field)",,
API00-C,222,sqlite,ext/session/sqlite3session.c,2452,FP,"sqlite3session_attach: public API, invalid pSession is documented misuse",,
EXP34-C,223,sqlite,ext/session/sqlite3session.c,2457,FP,pSession->db; public API sqlite3session_attach; non-null API precondition,,
INT30-C,224,sqlite,ext/session/sqlite3session.c,2474,FP,sizeof(SessionTable)+nName+1; nName = strlen of table name API arg (trusted),,
ARR38-C,225,sqlite,ext/session/sqlite3session.c,2487,FP,memcpy zName nName+1 into pTab->zName; allocation sizeof(SessionTable)+nName+1; fits,,
EXP43-C,226,sqlite,ext/session/sqlite3session.c,2487,FP,"memcpy(pTab->zName,zName,...): dest is just-malloc'd &pTab[1], src is the distinct input string zName; no overlap",,
INT31-C,227,sqlite,ext/session/sqlite3session.c,2487,FP,nName = strlen(zName) API arg (trusted); buffer pre-sized,,
INT32-C,228,sqlite,ext/session/sqlite3session.c,2487,FP,"memcpy nName+1, nName=strlen of session table name; session-allocated buffer, not blob",,
INT32-C,229,sqlite,ext/session/sqlite3session.c,2514,FP,nBuf += nByte session output-buffer append; bounded by sessionBufferGrow/SESSION_MAX_BUFFER_SZ,,
INT32-C,230,sqlite,ext/session/sqlite3session.c,2530,FP,"nBuf++ output-buffer append; bounded by sessionBufferGrow, not blob",,
INT32-C,231,sqlite,ext/session/sqlite3session.c,2543,FP,"nBuf += sessionVarintPut output-buffer append; bounded by sessionBufferGrow, not blob",,
EXP34-C,232,sqlite,ext/session/sqlite3session.c,2561,FP,'aBlob' to memcpy only when nBlob>0; callers pair non-null aBlob with positive nBlob,,
INT32-C,233,sqlite,ext/session/sqlite3session.c,2562,FP,"nBuf += nBlob output-buffer append; bounded by sessionBufferGrow, not blob",,
EXP33-C,234,sqlite,ext/session/sqlite3session.c,2580,FP,aBuf is fully written by sqlite3_snprintf before being read by sessionAppendStr,,
INT30-C,235,sqlite,ext/session/sqlite3session.c,2580,FP,sizeof(aBuf)-1 compile-time constant (23); no runtime underflow,,
STR34-C,236,sqlite,ext/session/sqlite3session.c,2598,FP,"sqlite3Strlen30(zStr)*2 is strlen arithmetic on length, no per-byte signed widening",,
ARR37-C,237,sqlite,ext/session/sqlite3session.c,2602,FP,sessionAppendIdent zOut writes into buffer grown by nStr=strlen(zStr)*2+4 (worst case all quotes); zStr is C string not blob,,
STR34-C,238,sqlite,ext/session/sqlite3session.c,2602,FP,"*zOut++='\' writes a literal to char buffer; no widening of a value""",,
ARR30-C,239,sqlite,ext/session/sqlite3session.c,2604,FP,while(*zIn) iterates a nul-terminated C string zStr; output zOut bounded by pre-grown buffer of strlen*2+4,,
ARR37-C,240,sqlite,ext/session/sqlite3session.c,2605,FP,zOut++ for escaped quote within pre-sized buffer,,
STR34-C,241,sqlite,ext/session/sqlite3session.c,2605,FP,*zOut++='\' literal store to char buffer,,
ARR37-C,242,sqlite,ext/session/sqlite3session.c,2606,FP,zOut++ copies char within pre-sized buffer,,
MEM33-C,243,sqlite,ext/session/sqlite3session.c,2606,FP,"*zOut++=*(zIn++) is a single-char copy, not a flexible-array struct assignment; misfire",,
STR34-C,244,sqlite,ext/session/sqlite3session.c,2606,FP,"*zOut++=*(zIn++) char-to-char copy, no integer widening",,
ARR37-C,245,sqlite,ext/session/sqlite3session.c,2609,FP,zOut++ closing quote within pre-sized buffer,,
STR34-C,246,sqlite,ext/session/sqlite3session.c,2609,FP,*zOut++='\' literal store,,
DCL00-C,247,sqlite,ext/session/sqlite3session.c,2636,TP,"local double r is assigned once and only read (memcpy(&i,&r,8)); could be const-qualified",,
DCL13-C,248,sqlite,ext/session/sqlite3session.c,2687,TP,sessionAppendUpdate: p only read (aRecord/bIndirect); aRecord copied to local cursor; const compiles,,
DCL13-C,249,sqlite,ext/session/sqlite3session.c,2688,TP,sessionAppendUpdate: abPK only read (abPK[i]); const u8* compiles,,
FLP02-C,250,sqlite,ext/session/sqlite3session.c,2722,FP,deliberate exact equality on bit-reconstructed double for change detection,,
INT32-C,251,sqlite,ext/session/sqlite3session.c,2733,FP,"nHdr+n from session-side captured old.* record (sessionVarintGet on pCsr); session record, not blob",,
INT31-C,252,sqlite,ext/session/sqlite3session.c,2736,FP,memcmp n gated by n==sqlite3_column_bytes (>=0); pCsr is locally-recorded change record (trusted),,
DCL13-C,253,sqlite,ext/session/sqlite3session.c,2786,TP,sessionAppendDelete: p only read (bIndirect/aRecord/nRecord); const SessionChange* compiles,,
DCL13-C,254,sqlite,ext/session/sqlite3session.c,2788,TP,sessionAppendDelete: abPK only read (abPK[i]); const u8* compiles,,
EXP40-C,255,sqlite,ext/session/sqlite3session.c,2801,FP,*pStart=a both u8* non-const cursors; no const qualifier involved; misfire,,
STR34-C,256,sqlite,ext/session/sqlite3session.c,2838,FP,"sqlite3_prepare_v2(db,zSql,...) passes string pointer; no byte widening",,
STR34-C,257,sqlite,ext/session/sqlite3session.c,2840,FP,"*pzErrmsg=sqlite3_mprintf(...) pointer assignment, not byte widening",,
DCL13-C,258,sqlite,ext/session/sqlite3session.c,2865,TP,sessionSelectStmt: abPK only read (abPK[i]); const u8* compiles,,
INT32-C,259,sqlite,ext/session/sqlite3session.c,2902,FP,i+1 column index in SQL-build loop bounded by nCol; not blob,,
EXP43-C,260,sqlite,ext/session/sqlite3session.c,2904,FP,sessionAppendPrintf args are distinct buffers/format-literal/zTab/azCol; no overlap,,
INT32-C,261,sqlite,ext/session/sqlite3session.c,2905,FP,i+1+nCol column-index placeholders bounded by nCol; not blob,,
EXP33-C,262,sqlite,ext/session/sqlite3session.c,2936,FP,"inside #if 0 dead code; i is the function-scope for-loop variable, set before use",,
INT32-C,263,sqlite,ext/session/sqlite3session.c,2941,FP,i+1 column index in SQL-build loop bounded by nCol; not blob,,
DCL13-C,264,sqlite,ext/session/sqlite3session.c,2972,TP,sessionSelectBind: abPK only read (abPK[i]); const u8* compiles,,
DCL13-C,265,sqlite,ext/session/sqlite3session.c,2973,TP,sessionSelectBind: pChange only read (aRecord to local cursor); const SessionChange* compiles,,
INT32-C,266,sqlite,ext/session/sqlite3session.c,2991,FP,"i+1 bind index bounded by nCol; record is session change object, not blob",,
INT32-C,267,sqlite,ext/session/sqlite3session.c,3002,FP,"i+1 bind index bounded by nCol; session change object, not blob",,
INT32-C,268,sqlite,ext/session/sqlite3session.c,3012,FP,"i+1 bind index bounded by nCol; session change object, not blob",,
INT32-C,269,sqlite,ext/session/sqlite3session.c,3023,FP,"i+1 bind index bounded by nCol; session change object, not blob",,
DCL13-C,270,sqlite,ext/session/sqlite3session.c,3043,TP,sessionAppendTableHdr: pTab only read (nCol/abPK/zName); const compiles,,
INT32-C,271,sqlite,ext/session/sqlite3session.c,3050,FP,"strlen(zName)+1 session table name; sessionAppendBlob bounded by sessionBufferGrow, not blob-derived size",,
EXP34-C,272,sqlite,ext/session/sqlite3session.c,3071,FP,pSession->db; sessionGenerateChangeset entered from public API with non-null pSession,,
EXP34-C,273,sqlite,ext/session/sqlite3session.c,3084,FP,*pnChangeset write guarded by xOutput==0 which (asserts 3076-77) implies pnChangeset non-null,,
EXP34-C,274,sqlite,ext/session/sqlite3session.c,3085,FP,*ppChangeset write guarded by xOutput==0 implying ppChangeset non-null (assert 3077),,
ARR00-C,275,sqlite,ext/session/sqlite3session.c,3097,FP,"pTab is a SessionTable* linked-list iterator (pTab=pTab->pNext), not an array index; ARR00 misclassification",,
EXP34-C,276,sqlite,ext/session/sqlite3session.c,3127,FP,pSel to sessionSelectBind under rc==SQLITE_OK; sessionSelectStmt sets pSel non-null on OK,,
EXP34-C,277,sqlite,ext/session/sqlite3session.c,3129,FP,pSel to sqlite3_step under rc==SQLITE_OK loop guard; pSel non-null on success,,
EXP34-C,278,sqlite,ext/session/sqlite3session.c,3135,FP,pSel to sessionAppendCol under rc==SQLITE_OK; non-null prepared statement,,
EXP34-C,279,sqlite,ext/session/sqlite3session.c,3139,FP,pSel to sessionAppendUpdate under rc==SQLITE_OK guard; non-null,,
API00-C,280,sqlite,ext/session/sqlite3session.c,3193,FP,"sqlite3session_changeset: public API, invalid pSession is documented misuse",,
EXP34-C,281,sqlite,ext/session/sqlite3session.c,3203,FP,pSession in assert; public API sqlite3session_changeset; non-null precondition,,
API00-C,282,sqlite,ext/session/sqlite3session.c,3211,FP,"sqlite3session_changeset_strm: public API, invalid pSession is documented misuse",,
API00-C,283,sqlite,ext/session/sqlite3session.c,3223,FP,"sqlite3session_patchset_strm: public API, invalid pSession is documented misuse",,
API00-C,284,sqlite,ext/session/sqlite3session.c,3239,FP,"sqlite3session_patchset: public API, invalid pSession is documented misuse",,
API00-C,285,sqlite,ext/session/sqlite3session.c,3251,FP,"sqlite3session_enable: public API, invalid pSession is documented misuse",,
API00-C,286,sqlite,ext/session/sqlite3session.c,3265,FP,"sqlite3session_indirect: public API, invalid pSession is documented misuse",,
API00-C,287,sqlite,ext/session/sqlite3session.c,3280,FP,"sqlite3session_isempty: public API, invalid pSession is documented misuse",,
DCL13-C,288,sqlite,ext/session/sqlite3session.c,3280,FP,sqlite3session_isempty: signature fixed by public sqlite3session.h API (cannot const-qualify exported param),,
API00-C,289,sqlite,ext/session/sqlite3session.c,3296,FP,"sqlite3session_memory_used: public API, invalid pSession is documented misuse",,
DCL13-C,290,sqlite,ext/session/sqlite3session.c,3296,FP,sqlite3session_memory_used: signature fixed by public sqlite3session.h API,,
API00-C,291,sqlite,ext/session/sqlite3session.c,3303,FP,"sqlite3session_object_config: public API, invalid pSession is documented misuse",,
DCL13-C,292,sqlite,ext/session/sqlite3session.c,3303,FP,"object_config pArg is written (*(int*)pArg = ...); OUT param, not read-only",,
EXP34-C,293,sqlite,ext/session/sqlite3session.c,3309,FP,pSession member access; public API entry; non-null precondition,,
API00-C,294,sqlite,ext/session/sqlite3session.c,3342,FP,"sqlite3session_changeset_size: public API, invalid pSession is documented misuse",,
DCL13-C,295,sqlite,ext/session/sqlite3session.c,3342,FP,sqlite3session_changeset_size: signature fixed by public sqlite3session.h API,,
DCL13-C,296,sqlite,ext/session/sqlite3session.c,3352,FP,"sessionChangesetStart: pIn stored into pRet->in.pIn (void*, non-const stream field)",,
DCL13-C,297,sqlite,ext/session/sqlite3session.c,3354,FP,sessionChangesetStart: pChangeset stored into pRet->in.aData via (u8*) cast (non-const),,
DCL30-C,298,sqlite,ext/session/sqlite3session.c,3380,FP,pRet is a heap iterator stored via *pp; valid after return,,
API00-C,299,sqlite,ext/session/sqlite3session.c,3387,FP,"sqlite3changeset_start: public API, invalid pp is documented misuse",,
API00-C,300,sqlite,ext/session/sqlite3session.c,3394,FP,"sqlite3changeset_start_v2: public API, invalid pp is documented misuse",,
API00-C,301,sqlite,ext/session/sqlite3session.c,3407,FP,"sqlite3changeset_start_strm: public API, invalid pp is documented misuse",,
API00-C,302,sqlite,ext/session/sqlite3session.c,3414,FP,"sqlite3changeset_start_v2_strm: public API, invalid pp is documented misuse",,
INT32-C,303,sqlite,ext/session/sqlite3session.c,3430,FP,"nMove=buf.nBuf-iCurrent: streaming-input buffer offsets, iCurrent<=nBuf invariant; bounded offsets",,
INT32-C,304,sqlite,ext/session/sqlite3session.c,3435,FP,"buf.nBuf -= iCurrent: buffer offset bookkeeping, iCurrent<=nBuf; bounded",,
INT32-C,305,sqlite,ext/session/sqlite3session.c,3436,FP,iNext -= iCurrent: buffer offset bookkeeping; bounded offsets,,
INT32-C,306,sqlite,ext/session/sqlite3session.c,3461,FP,"buf.nBuf += nNew, nNew=xInput chunk read bounded by chunk size; buffer offset, bounded",,
EXP33-C,307,sqlite,ext/session/sqlite3session.c,3488,FP,nByte written by sessionVarintGet before aRec+=nByte,,
DCL30-C,308,sqlite,ext/session/sqlite3session.c,3494,FP,aRec holds the caller's record buffer address from *ppRec; not local automatic storage,,
INT32-C,309,sqlite,ext/session/sqlite3session.c,3513,FP,(i64)nData+1 explicitly widened to i64 before +1; cannot overflow,,
INT31-C,310,sqlite,ext/session/sqlite3session.c,3515,FP,nData validated by caller sessionReadRecord (nByte<0 || nByte>nData-iNext) at line 3582 before sessionValueSetStr,,
DCL13-C,311,sqlite,ext/session/sqlite3session.c,3547,TP,sessionReadRecord: abPK only read (abPK[i]); const u8* compiles,,
INT32-C,312,sqlite,ext/session/sqlite3session.c,3578,FP,"nRem=nData-iNext: buffer offsets, iNext<=nData invariant; bounded (passed as Safe varint limit)",,
INT32-C,313,sqlite,ext/session/sqlite3session.c,3579,FP,"iNext += sessionVarintGetSafe (<=9, bounds-checked by nRem); iNext buffer offset bounded by nData",,
EXP33-C,314,sqlite,ext/session/sqlite3session.c,3580,FP,"nByte written by sessionVarintGetSafe(aVal,nRem,&nByte) before use",,
INT32-C,315,sqlite,ext/session/sqlite3session.c,3587,FP,"iNext += nByte AFTER guard nByte<0||nByte>nData-iNext at 3582; validated blob size, cannot overflow",,
INT32-C,316,sqlite,ext/session/sqlite3session.c,3603,FP,"iNext += 8 AFTER guard (nData-iNext)<8 at 3592; validated, cannot overflow",,
INT32-C,317,sqlite,ext/session/sqlite3session.c,3632,FP,"nBuf=nData-iNext buffer offsets, bounded; passed as Safe varint limit",,
INT32-C,318,sqlite,ext/session/sqlite3session.c,3633,FP,"nRead += sessionVarintGetSafe (<=9, bounds-checked); nRead bounded",,
INT32-C,319,sqlite,ext/session/sqlite3session.c,3645,FP,"nRead += nCol AFTER guard nCol<0||nCol>65536 at 3641 (comment notes the wrap risk, explicitly prevented)",,
INT32-C,320,sqlite,ext/session/sqlite3session.c,3650,FP,"iNext+nRead: buffer offsets, nRead bounded by validated nCol and loop within nData; bounded",,
INT32-C,321,sqlite,ext/session/sqlite3session.c,3651,FP,nRead++ in nul-terminator scan loop bounded by nData; bounded,,
INT32-C,322,sqlite,ext/session/sqlite3session.c,3658,FP,"nRead+100, nRead bounded by validated nCol/buffer scan; bounded",,
INT32-C,323,sqlite,ext/session/sqlite3session.c,3686,FP,nByte+10 first iteration nByte=0; accumulator overflow is the real concern but +10 itself bounded early,,
INT32-C,324,sqlite,ext/session/sqlite3session.c,3688,FP,"pIn->iNext+nByte++ indexing offset; iNext bounded by buffered nData, nByte increment of 1",,
INT32-C,325,sqlite,ext/session/sqlite3session.c,3691,TP,nByte += unsafe sessionVarintGet of blob-derived size feeds record-size accumulator that can overflow int before validation,"CONFIRMED REAL + fixed upstream: sqlite 535b1f2875 (2026-04-09) changed this exact code (int->i64 nByte, sessionVarintGet->sessionVarintGetSafe, added bounds checks) + 4da2ddf50e; ""buffer overreads in session module on corrupt changesets"". b1a73ba34d (audited) predates the fix.",
EXP33-C,326,sqlite,ext/session/sqlite3session.c,3692,FP,"n written by sessionVarintGet(...,&n) before nByte+=n",,
INT32-C,327,sqlite,ext/session/sqlite3session.c,3692,TP,"nByte += n where n is unbounded blob-derived TEXT/BLOB length varint; accumulates over up-to-65536 cols, overflows int","CONFIRMED REAL + fixed upstream: sqlite 535b1f2875 (2026-04-09) changed this exact code (int->i64 nByte, sessionVarintGet->sessionVarintGetSafe, added bounds checks) + 4da2ddf50e; ""buffer overreads in session module on corrupt changesets"". b1a73ba34d (audited) predates the fix.",
INT32-C,328,sqlite,ext/session/sqlite3session.c,3695,TP,"nByte += 8 per INTEGER/FLOAT col; with up-to-65536 cols and prior blob-derived additions, accumulator can overflow int","CONFIRMED REAL + fixed upstream: sqlite 535b1f2875 (2026-04-09) changed this exact code (int->i64 nByte, sessionVarintGet->sessionVarintGetSafe, added bounds checks) + 4da2ddf50e; ""buffer overreads in session module on corrupt changesets"". b1a73ba34d (audited) predates the fix.",
EXP34-C,329,sqlite,ext/session/sqlite3session.c,3699,FP,"*pnByte write; internal callers pass address of a local (&nCopy/&nByte), never null",,
EXP34-C,330,sqlite,ext/session/sqlite3session.c,3723,FP,p->rc in assert; sessionChangesetReadTblhdr called only with non-null iterator,,
INT32-C,331,sqlite,ext/session/sqlite3session.c,3731,FP,"nCopy -= nVarint; nCopy is buffered tblhdr size, nVarint is varint byte count (<=5), bounded",,
INT32-C,332,sqlite,ext/session/sqlite3session.c,3732,FP,p->in.iNext += nVarint (<=5); offset bounded by buffered nData,,
INT30-C,333,sqlite,ext/session/sqlite3session.c,3733,FP,p->nCol*sizeof*2+nCopy; nCol re-read from same varint already validated <=65536 by sessionChangesetBufferTblhdr; cannot wrap,,
INT30-C,334,sqlite,ext/session/sqlite3session.c,3742,FP,sizeof*nCol*2 with nCol<=65536 (validated in BufferTblhdr); product ~1MB max,,
ARR38-C,335,sqlite,ext/session/sqlite3session.c,3743,FP,memset p->tblhdr.aBuf size iPK=nCol*2*sizeof(ptr); nCol validated >0 and <=65536 in sessionChangesetBufferTblhdr; tblhdr grown to nByte>=iPK at line 3735,,
ARR30-C,336,sqlite,ext/session/sqlite3session.c,3744,FP,aBuf[iPK] memcpy nCopy; iPK and nCopy both accounted in nByte allocation at 3733-3735; nCol validated,,
EXP43-C,337,sqlite,ext/session/sqlite3session.c,3744,FP,memcpy dest p->tblhdr.aBuf and src p->in.aData are distinct allocations; deriving from same struct p does not imply overlap,,
INT31-C,338,sqlite,ext/session/sqlite3session.c,3744,FP,"nCopy is buffered tblhdr size, buffer ensured present by sessionInputBuffer/BufferTblhdr; tblhdr.aBuf sized nByte>=nCopy",,
INT32-C,339,sqlite,ext/session/sqlite3session.c,3745,FP,p->in.iNext += nCopy; nCopy bounded by buffered tblhdr size (nCol<=65536 validated upstream),,
INT32-C,340,sqlite,ext/session/sqlite3session.c,3753,FP,"p->nCol*2; nCol validated <=65536 by sessionChangesetBufferTblhdr, cannot overflow int",,
EXP34-C,341,sqlite,ext/session/sqlite3session.c,3783,FP,"p->rc; sessionChangesetNextOne, p is non-null iterator (internal/public-checked)",,
ARR38-C,342,sqlite,ext/session/sqlite3session.c,3790,FP,memset apValue size nCol*2*sizeof(ptr); apValue points into tblhdr sized for nCol*2 values; nCol validated,,
INT30-C,343,sqlite,ext/session/sqlite3session.c,3790,FP,sizeof(sqlite3_value*)*p->nCol*2 memset; nCol<=65536 (validated); bounded,,
INT32-C,344,sqlite,ext/session/sqlite3session.c,3790,FP,"sizeof(sqlite3_value*)*nCol*2; nCol<=65536, product well within size_t/int",,
INT32-C,345,sqlite,ext/session/sqlite3session.c,3808,FP,p->in.iNext++ single-byte advance; bounded by buffered nData,,
EXP45-C,346,sqlite,ext/session/sqlite3session.c,3813,FP,(p->rc=sessionInputBuffer(...)) is the deliberate parenthesized assign-and-test sqlite idiom,,
INT32-C,347,sqlite,ext/session/sqlite3session.c,3816,FP,p->in.iNext++ single-byte advance; bounded by buffered nData,,
INT32-C,348,sqlite,ext/session/sqlite3session.c,3832,FP,p->in.iNext++ single-byte advance; bounded by buffered nData,,
INT32-C,349,sqlite,ext/session/sqlite3session.c,3837,FP,"p->nCol*2; nCol validated <=65536, no overflow",,
MEM33-C,350,sqlite,ext/session/sqlite3session.c,3846,FP,"line is normal control flow, not a flexible-array struct assignment; misfire",,
EXP34-C,351,sqlite,ext/session/sqlite3session.c,3847,FP,*pnRec write/read under paRec!=0; assert 3779 pairs paRec and pnRec non-null,,
INT32-C,352,sqlite,ext/session/sqlite3session.c,3847,FP,"p->in.iNext += *pnRec; *pnRec from sessionChangesetBufferRecord (overflow flagged at its source 3692), value bounded once buffered correctly",,
EXP40-C,353,sqlite,ext/session/sqlite3session.c,3849,FP,apOld is sqlite3_value** assigned the address of an apValue[] element; no const circumvention,,
EXP40-C,354,sqlite,ext/session/sqlite3session.c,3850,FP,apNew is sqlite3_value** assigned address of apValue[] element; no const circumvention,,
INT32-C,355,sqlite,ext/session/sqlite3session.c,3874,FP,"i+p->nCol array index; i<nCol and nCol<=65536, bounded",,
INT32-C,356,sqlite,ext/session/sqlite3session.c,3876,FP,i+p->nCol array index; bounded by nCol<=65536,,
EXP34-C,357,sqlite,ext/session/sqlite3session.c,3931,FP,"p->bSkipEmpty; sessionChangesetNext, p non-null iterator",,
API00-C,358,sqlite,ext/session/sqlite3session.c,3943,FP,"sqlite3changeset_next: public API, invalid p is documented misuse",,
API00-C,359,sqlite,ext/session/sqlite3session.c,3952,FP,"sqlite3changeset_op: public API, invalid pIter is documented misuse (called only after _next ROW)",,
DCL13-C,360,sqlite,ext/session/sqlite3session.c,3953,FP,sqlite3changeset_op: signature fixed by public sqlite3session.h API,,
EXP34-C,361,sqlite,ext/session/sqlite3session.c,3959,FP,"pIter->op; public sqlite3changeset_op; non-null API precondition, called after ROW",,
STR34-C,362,sqlite,ext/session/sqlite3session.c,3961,FP,"*pzTab=pIter->zTab pointer assignment, not byte widening",,
API00-C,363,sqlite,ext/session/sqlite3session.c,3972,FP,"sqlite3changeset_pk: public API, invalid pIter is documented misuse",,
DCL13-C,364,sqlite,ext/session/sqlite3session.c,3973,FP,sqlite3changeset_pk: signature fixed by public sqlite3session.h API,,
EXP34-C,365,sqlite,ext/session/sqlite3session.c,3977,FP,pIter->abPK; public sqlite3changeset_pk; non-null API precondition,,
API00-C,366,sqlite,ext/session/sqlite3session.c,3995,FP,"sqlite3changeset_old: public API, ppValue/pIter validity is documented misuse",,
DCL13-C,367,sqlite,ext/session/sqlite3session.c,3996,FP,sqlite3changeset_old: signature fixed by public sqlite3session.h API,,
EXP34-C,368,sqlite,ext/session/sqlite3session.c,4000,FP,pIter->op; public sqlite3changeset_old; non-null API precondition,,
ARR00-C,369,sqlite,ext/session/sqlite3session.c,4006,FP,iVal explicitly bounds-checked at line 4003 (iVal<0||iVal>=pIter->nCol returns SQLITE_RANGE) before apValue[iVal],,
API00-C,370,sqlite,ext/session/sqlite3session.c,4023,FP,"sqlite3changeset_new: public API, ppValue/pIter validity is documented misuse",,
DCL13-C,371,sqlite,ext/session/sqlite3session.c,4024,FP,sqlite3changeset_new: signature fixed by public sqlite3session.h API,,
EXP34-C,372,sqlite,ext/session/sqlite3session.c,4028,FP,pIter->op; public sqlite3changeset_new; non-null API precondition,,
INT32-C,373,sqlite,ext/session/sqlite3session.c,4034,FP,"pIter->nCol+iVal; iVal validated <nCol just above, nCol<=65536, bounded",,
PRE00-C,374,sqlite,ext/session/sqlite3session.c,4043,TP,function-like macro sessionChangesetNew evaluates pIter multiple times; prefer inline function,,
PRE12-C,375,sqlite,ext/session/sqlite3session.c,4043,TP,"sessionChangesetNew(pIter,iVal) expands (pIter) twice; multiple-evaluation macro",,
API00-C,376,sqlite,ext/session/sqlite3session.c,4057,FP,"sqlite3changeset_conflict: public API, documented misuse model",,
DCL13-C,377,sqlite,ext/session/sqlite3session.c,4058,FP,sqlite3changeset_conflict: signature fixed by public sqlite3session.h API,,
API00-C,378,sqlite,ext/session/sqlite3session.c,4080,FP,"sqlite3changeset_fk_conflicts: public API, documented misuse model",,
DCL13-C,379,sqlite,ext/session/sqlite3session.c,4081,FP,sqlite3changeset_fk_conflicts: signature fixed by public sqlite3session.h API,,
API00-C,380,sqlite,ext/session/sqlite3session.c,4098,FP,"sqlite3changeset_finalize: public API, invalid p is documented misuse",,
MEM30-C,381,sqlite,ext/session/sqlite3session.c,4106,FP,"frees p->tblhdr.aBuf; distinct field, p freed separately at 4108",,
MEM30-C,382,sqlite,ext/session/sqlite3session.c,4107,FP,"frees p->in.buf.aBuf; distinct field, not double-free of p",,
EXP34-C,383,sqlite,ext/session/sqlite3session.c,4133,FP,*pnInverted write under if(ppInverted); paired non-null with ppInverted,,
EXP45-C,384,sqlite,ext/session/sqlite3session.c,4140,FP,(rc=sessionInputBuffer(...)) is the deliberate parenthesized assign-and-test idiom,,
INT32-C,385,sqlite,ext/session/sqlite3session.c,4155,FP,pInput->iNext++ single-byte advance; bounded by buffered nData,,
EXP45-C,386,sqlite,ext/session/sqlite3session.c,4156,FP,(rc=sessionChangesetBufferTblhdr(...)) is the deliberate parenthesized assign-and-test idiom,,
INT32-C,387,sqlite,ext/session/sqlite3session.c,4161,FP,"pInput->iNext+nVar; nVar varint byte count (<=5), offset bounded by buffered nData",,
INT32-C,388,sqlite,ext/session/sqlite3session.c,4166,FP,pInput->iNext += nByte; nByte from BufferTblhdr bounded by buffered data (nCol<=65536 validated),,
INT32-C,389,sqlite,ext/session/sqlite3session.c,4176,FP,pInput->iNext+1 indexing; bounded by buffered nData,,
INT32-C,390,sqlite,ext/session/sqlite3session.c,4178,FP,pInput->iNext += 2; bounded by buffered nData,,
INT32-C,391,sqlite,ext/session/sqlite3session.c,4184,TP,"pInput->iNext += nByte where nByte is sessionChangesetBufferRecord result; if that accumulator overflowed (3692) iNext advances by wrapped/negative value, blob-derived","CONFIRMED REAL + fixed upstream: sqlite 535b1f2875 (2026-04-09) changed this exact code (int->i64 nByte, sessionVarintGet->sessionVarintGetSafe, added bounds checks) + 4da2ddf50e; ""buffer overreads in session module on corrupt changesets"". b1a73ba34d (audited) predates the fix.",
ARR00-C,392,sqlite,ext/session/sqlite3session.c,4193,FP,"apVal alloc nCol*2; nCol from validated varint (BufferTblhdr enforced <=65536); not use-after-free, freed values are zeroed via memset before reuse",,
EXP34-C,393,sqlite,ext/session/sqlite3session.c,4193,FP,apVal malloc result null-checked at 4194 (goto on null) before any deref at 4216/4224,,
INT30-C,394,sqlite,ext/session/sqlite3session.c,4193,FP,sizeof(apVal[0])*nCol*2 (invert); nCol from same varint validated <=65536 by BufferTblhdr at 4156; malloc64,,
ARR00-C,395,sqlite,ext/session/sqlite3session.c,4198,FP,memset apVal nCol*2 immediately after malloc nCol*2; no UAF,,
ARR38-C,396,sqlite,ext/session/sqlite3session.c,4198,FP,memset size nCol*2*sizeof matches malloc at 4193,,
INT30-C,397,sqlite,ext/session/sqlite3session.c,4198,FP,memset sizeof(apVal[0])*nCol*2; nCol<=65536,,
INT32-C,398,sqlite,ext/session/sqlite3session.c,4198,FP,"sizeof(apVal[0])*nCol*2; nCol validated <=65536, no overflow",,
INT32-C,399,sqlite,ext/session/sqlite3session.c,4203,FP,pInput->iNext+1 indexing; bounded by buffered nData,,
INT32-C,400,sqlite,ext/session/sqlite3session.c,4206,FP,pInput->iNext += 2; bounded by buffered nData,,
ARR00-C,401,sqlite,ext/session/sqlite3session.c,4207,FP,sessionReadRecord into &apVal[0] with nCol; apVal sized nCol*2; bounded,,
ARR00-C,402,sqlite,ext/session/sqlite3session.c,4209,FP,sessionReadRecord into &apVal[nCol] with nCol; writes indices nCol..2*nCol-1; within nCol*2 alloc,,
ARR00-C,403,sqlite,ext/session/sqlite3session.c,4216,FP,apVal[iCol + (abPK?0:nCol)] max index nCol-1+nCol=2*nCol-1 < nCol*2; bounded; abPK from sPK buffer sized nCol,,
INT32-C,404,sqlite,ext/session/sqlite3session.c,4216,FP,"iCol + (abPK?0:nCol) array index; iCol<nCol, nCol<=65536, bounded",,
ARR00-C,405,sqlite,ext/session/sqlite3session.c,4224,FP,apVal[iCol] iCol<nCol bounded; values not freed-then-read (freed at 4229 then memset 4231),,
ARR00-C,406,sqlite,ext/session/sqlite3session.c,4229,FP,sqlite3ValueFree(apVal[iCol]) iCol<nCol*2 bounded,,
ARR00-C,407,sqlite,ext/session/sqlite3session.c,4231,FP,"memset zeroes the array after frees; subsequent iteration reuses zeroed buffer, no UAF",,
ARR38-C,408,sqlite,ext/session/sqlite3session.c,4231,FP,memset apVal nCol*2 matches allocation; zeroes freed pointers preventing UAF on reuse,,
INT30-C,409,sqlite,ext/session/sqlite3session.c,4231,FP,memset sizeof(apVal[0])*nCol*2; nCol<=65536,,
INT32-C,410,sqlite,ext/session/sqlite3session.c,4231,FP,"sizeof(apVal[0])*nCol*2; nCol validated <=65536, no overflow",,
EXP34-C,411,sqlite,ext/session/sqlite3session.c,4255,FP,*pnInverted write under pnInverted && ALWAYS(ppInverted); both non-null,,
API00-C,412,sqlite,ext/session/sqlite3session.c,4272,FP,"sqlite3changeset_invert: public API, documented misuse model",,
EXP05-C,413,sqlite,ext/session/sqlite3session.c,4283,FP,(u8*)pChangeset casts away const but the input is treated strictly read-only via SessionInput,,
API00-C,414,sqlite,ext/session/sqlite3session.c,4291,FP,"sqlite3changeset_invert_strm: public API, NULL xInput is documented misuse",,
DCL13-C,415,sqlite,ext/session/sqlite3session.c,4293,FP,"invert_strm: pIn stored into SessionInput.pIn (void*, non-const stream field)",,
MEM30-C,416,sqlite,ext/session/sqlite3session.c,4306,FP,sInput.buf.aBuf freed once after sessionChangesetInvert returns; no use-after-free,,
EXP34-C,417,sqlite,ext/session/sqlite3session.c,4358,FP,"pIter->nCol; sessionUpdateFind internal, pIter non-null",,
INT32-C,418,sqlite,ext/session/sqlite3session.c,4359,FP,"(nCol+33)/32; nCol<=65536, bounded",,
INT30-C,419,sqlite,ext/session/sqlite3session.c,4363,FP,nU32*sizeof(u32); nU32=(nCol+33)/32 with nCol<=65536 -> nU32<=2050; tiny,,
ARR38-C,420,sqlite,ext/session/sqlite3session.c,4370,FP,memset aUpdateMask nU32*sizeof(u32); aUpdateMask malloc'd nU32*sizeof(u32) at 4363; nU32=(nCol+33)/32,,
INT30-C,421,sqlite,ext/session/sqlite3session.c,4370,FP,memset nU32*sizeof(u32); nU32<=2050,,
INT32-C,422,sqlite,ext/session/sqlite3session.c,4370,FP,"nU32*sizeof(u32); nU32 derived from nCol<=65536, bounded",,
ARR00-C,423,sqlite,ext/session/sqlite3session.c,4372,FP,ii for-loop bounded by pIter->nCol; aUpdateMask[ii/32] max (nCol-1)/32 < nU32=(nCol+33)/32; bounded; not uninitialized,,
INT10-C,424,sqlite,ext/session/sqlite3session.c,4374,FP,ii%32 with ii>=0 loop index; non-negative modulo idiom,,
INT13-C,425,sqlite,ext/session/sqlite3session.c,4374,FP,1<<(ii%32) update-mask bit idiom; ii non-negative bounded,,
INT32-C,426,sqlite,ext/session/sqlite3session.c,4374,FP,"1<<(ii%32); shift amount 0-31, well-defined",,
INT10-C,427,sqlite,ext/session/sqlite3session.c,4381,FP,nCol%32 with nCol>=0; non-negative modulo,,
INT13-C,428,sqlite,ext/session/sqlite3session.c,4381,FP,1<<(nCol%32) bit idiom; nCol non-negative,,
INT14-C,429,sqlite,ext/session/sqlite3session.c,4381,FP,nCol/32 and nCol%32 mask-word index; nCol>=0 bounded,,
INT32-C,430,sqlite,ext/session/sqlite3session.c,4381,FP,"1<<(nCol%32); shift amount 0-31, well-defined",,
EXP40-C,431,sqlite,ext/session/sqlite3session.c,4385,FP,pp=&p->pUp; pp is SessionUpdate** pointing at a non-const member; no const involved,,
INT32-C,432,sqlite,ext/session/sqlite3session.c,4387,FP,"nUp++ counts cached UPDATE stmts, capped at SESSION_UPDATE_CACHE_SZ=12",,
ARR38-C,433,sqlite,ext/session/sqlite3session.c,4388,FP,memcmp size nU32*sizeof(u32) matches both aUpdateMask and (*pp)->aMask allocations,,
EXP42-C,434,sqlite,ext/session/sqlite3session.c,4388,FP,memcmp compares two u32 aMask/aUpdateMask arrays (no struct padding); not comparing padding bytes,,
INT30-C,435,sqlite,ext/session/sqlite3session.c,4388,FP,nU32*sizeof(u32) memcmp size; nU32<=2050,,
INT30-C,436,sqlite,ext/session/sqlite3session.c,4410,FP,"sizeof(SessionUpdate)*nU32*sizeof(u32); over-allocation oddity but nU32<=2050, no wrap",,
EXP33-C,437,sqlite,ext/session/sqlite3session.c,4420,FP,"pUp is malloc'd then every used field (aMask,pStmt,pNext) is written before read; no uninitialized read",,
ARR38-C,438,sqlite,ext/session/sqlite3session.c,4421,FP,memcpy aMask nU32*sizeof(u32) into &pUp[1]; pUp over-allocated nByte=sizeof(SessionUpdate)*nU32*sizeof(u32) (multiplicative over-alloc); fits,,
INT30-C,439,sqlite,ext/session/sqlite3session.c,4421,FP,memcpy nU32*sizeof(u32); nU32<=2050,,
INT32-C,440,sqlite,ext/session/sqlite3session.c,4421,FP,"nU32*sizeof(u32) memcpy size; nU32 from nCol<=65536, bounded",,
INT32-C,441,sqlite,ext/session/sqlite3session.c,4433,FP,"ii*2+1 bind index; ii<nCol<=65536, bounded",,
INT32-C,442,sqlite,ext/session/sqlite3session.c,4454,FP,"ii*2+2 bind index; ii<nCol<=65536, bounded",,
MEM12-C,443,sqlite,ext/session/sqlite3session.c,4483,FP,pUp is linked into p->pUp (4470) or freed (4466); aUpdateMask owned by p; no leak on this return,,
INT32-C,444,sqlite,ext/session/sqlite3session.c,4540,FP,"i+1 bind index; i<nCol, bounded",,
INT32-C,445,sqlite,ext/session/sqlite3session.c,4547,FP,"p->nCol+1 bind index; nCol<=65536, bounded",,
INT32-C,446,sqlite,ext/session/sqlite3session.c,4556,FP,"i+1 bind index; i<nCol, bounded",,
EXP34-C,447,sqlite,ext/session/sqlite3session.c,4673,FP,"pVal->z; callers (sessionBindRow 4716, seek 4769, applyOp pUp-path) guard pVal!=0 before bind",,
DCL13-C,448,sqlite,ext/session/sqlite3session.c,4700,TP,sessionBindRow: abPK only read (abPK[i]); const u8* compiles,,
INT32-C,449,sqlite,ext/session/sqlite3session.c,4721,FP,"i+1 bind index; i<nCol, bounded",,
DCL13-C,450,sqlite,ext/session/sqlite3session.c,4747,TP,sessionSeekToRow: p only read (pSelect/abPK/bIgnoreNoop); const SessionApplyCtx* compiles,,
INT32-C,451,sqlite,ext/session/sqlite3session.c,4768,FP,"ii+1+nCol bind index; ii<nCol<=65536, bounded",,
INT32-C,452,sqlite,ext/session/sqlite3session.c,4769,FP,"ii+1 bind index; ii<nCol, bounded",,
EXP34-C,453,sqlite,ext/session/sqlite3session.c,4800,FP,"pIter->op; sessionRebaseAdd internal, pIter non-null",,
EXP05-C,454,sqlite,ext/session/sqlite3session.c,4807,FP,(u8*)zTab cast for sessionAppendBlob which reads only; no modification of the const data,,
EXP34-C,455,sqlite,ext/session/sqlite3session.c,4807,FP,'zTab'=pIter->zTab to strlen; any ROW change has zTab!=0 (CORRUPT guard at 3819),,
INT32-C,456,sqlite,ext/session/sqlite3session.c,4807,FP,(int)strlen(zTab)+1; zTab is in-memory table name bounded by already-buffered changeset size,,
EXP34-C,457,sqlite,ext/session/sqlite3session.c,4825,FP,pVal to sessionAppendValue which calls sessionSerializeValue; null pVal explicitly handled,,
DCL03-C,458,sqlite,ext/session/sqlite3session.c,4883,TP,assert( SQLITE_CHANGESET_CONFLICT+1==SQLITE_CHANGESET_CONSTRAINT ) is a compile-time constant; static_assert appropriate,,
DCL03-C,459,sqlite,ext/session/sqlite3session.c,4884,TP,assert( SQLITE_CHANGESET_DATA+1==SQLITE_CHANGESET_NOTFOUND ) is compile-time constant; static_assert appropriate,,
EXP34-C,460,sqlite,ext/session/sqlite3session.c,4898,FP,"pIter->pConflict; sessionConflictHandler internal, pIter non-null",,
INT32-C,461,sqlite,ext/session/sqlite3session.c,4908,FP,"iNext - iCurrent; both in-memory buffer offsets, iNext>=iCurrent, bounded by buffer size",,
INT32-C,462,sqlite,ext/session/sqlite3session.c,4915,FP,eType+1; eType is small CHANGESET enum constant,,
EXP34-C,463,sqlite,ext/session/sqlite3session.c,5002,FP,"pIter->bPatchset; sessionApplyOneOp internal, pIter non-null",,
INT32-C,464,sqlite,ext/session/sqlite3session.c,5005,FP,"nCol+1 bind index; nCol<=65536, bounded",,
INT13-C,465,sqlite,ext/session/sqlite3session.c,5015,FP,rc&0xff SQLite extended-error-code masking idiom (sessionApplyOneWithRetry),,
EXP34-C,466,sqlite,ext/session/sqlite3session.c,5033,FP,pUp to sessionBindValue under rc==SQLITE_OK; sessionUpdateFind asserts (rc==OK)==(pUp!=0),,
INT32-C,467,sqlite,ext/session/sqlite3session.c,5033,FP,"i*2+2 bind index; i<nCol<=65536, bounded",,
EXP34-C,468,sqlite,ext/session/sqlite3session.c,5036,FP,pUp to sessionBindValue under rc==SQLITE_OK loop guard; non-null on success,,
INT32-C,469,sqlite,ext/session/sqlite3session.c,5036,FP,"i*2+1 bind index; i<nCol<=65536, bounded",,
EXP34-C,470,sqlite,ext/session/sqlite3session.c,5043,FP,"pUp to sqlite3_step under rc==SQLITE_OK; pUp->pStmt from successful prepare_v2, non-null",,
INT13-C,471,sqlite,ext/session/sqlite3session.c,5055,FP,rc&0xff extended-error-code masking idiom,,
INT13-C,472,sqlite,ext/session/sqlite3session.c,5083,FP,rc&0xff extended-error-code masking idiom,,
EXP34-C,473,sqlite,ext/session/sqlite3session.c,5124,FP,"pIter->op in assert; sessionApplyOneWithRetry internal, pIter non-null",,
EXP43-C,474,sqlite,ext/session/sqlite3session.c,5139,FP,"sqlite3_bind_int(stmt,int,int) takes no overlapping memory regions; misfire",,
INT32-C,475,sqlite,ext/session/sqlite3session.c,5139,FP,"pApply->nCol+1 bind index; nCol<=65536, bounded",,
INT30-C,476,sqlite,ext/session/sqlite3session.c,5179,FP,2*pApply->nCol*sizeof(sqlite3_value*); nCol from changeset <=65536; size_t product bounded,,
INT32-C,477,sqlite,ext/session/sqlite3session.c,5179,FP,"2*pApply->nCol; nCol<=65536, bounded",,
EXP34-C,478,sqlite,ext/session/sqlite3session.c,5181,FP,pIter2 deref under if(rc==SQLITE_OK); sessionChangesetStart sets *pIter2 non-null on OK,,
EXP05-C,479,sqlite,ext/session/sqlite3session.c,5182,FP,(char*)zTab cast away const but pIter2->zTab is used read-only; idiomatic,,
ARR38-C,480,sqlite,ext/session/sqlite3session.c,5187,FP,memset apValue nByte=2*nCol*sizeof(ptr); tblhdr grown to nByte at 5185; nCol=pApply->nCol (apply-table column count),,
EXP34-C,481,sqlite,ext/session/sqlite3session.c,5189,FP,pIter2 to sqlite3changeset_next under rc==SQLITE_OK; non-null after successful start,,
EXP34-C,482,sqlite,ext/session/sqlite3session.c,5190,FP,pIter2 to sessionApplyOneWithRetry under rc==SQLITE_OK; non-null,,
EXP34-C,483,sqlite,ext/session/sqlite3session.c,5193,FP,pIter2 to sqlite3changeset_finalize under rc==SQLITE_OK; non-null,,
MEM30-C,484,sqlite,ext/session/sqlite3session.c,5200,FP,"cons.aBuf freed at 5198 but line reads cons.nBuf (size field, struct on stack not freed)",,
INT32-C,485,sqlite,ext/session/sqlite3session.c,5270,FP,"nTab+1; nTab is strlen of in-memory table name, bounded",,
EXP33-C,486,sqlite,ext/session/sqlite3session.c,5271,FP,"abPK written by sqlite3changeset_pk(pIter,&abPK,0) at 5312 before use",,
EXP34-C,487,sqlite,ext/session/sqlite3session.c,5274,FP,'zTab' to sessionRetryConstraints; only used inside while(constraints.nBuf) loop which is empty on first table,,
MEM30-C,488,sqlite,ext/session/sqlite3session.c,5279,FP,frees sApply.azCol then reassigns to 0 at 5288; no use of freed memory,,
MEM30-C,489,sqlite,ext/session/sqlite3session.c,5280,FP,"sqlite3_finalize(sApply.pDelete) then reset to 0; distinct handle, no UAF",,
MEM30-C,490,sqlite,ext/session/sqlite3session.c,5281,FP,sqlite3_finalize(sApply.pInsert) then reset to 0; no UAF,,
MEM30-C,491,sqlite,ext/session/sqlite3session.c,5282,FP,sqlite3_finalize(sApply.pSelect) then reset to 0; no UAF,,
INT32-C,492,sqlite,ext/session/sqlite3session.c,5319,FP,"i+1; i<sApply.nCol from schema, bounded",,
EXP34-C,493,sqlite,ext/session/sqlite3session.c,5336,FP,sApply.abPK under rc==SQLITE_OK after sessionTableInfo; abPK local from changeset_pk non-null for valid iter,,
INT31-C,494,sqlite,ext/session/sqlite3session.c,5336,FP,"memcmp nCol; column count <=65536, also guarded nCol<nMinCol first; abPK arrays nCol-sized",,
EXP45-C,495,sqlite,ext/session/sqlite3session.c,5345,FP,(rc=sessionStat1Sql(...)) parenthesized assign-and-test idiom,,
EXP34-C,496,sqlite,ext/session/sqlite3session.c,5350,FP,'zTab' to sessionSelectRow set by sessionTableInfo (5313) under rc==SQLITE_OK else-branch; non-null,,
EXP45-C,497,sqlite,ext/session/sqlite3session.c,5350,FP,(rc=sessionSelectRow(...)) parenthesized assign-and-test idiom,,
EXP34-C,498,sqlite,ext/session/sqlite3session.c,5351,FP,"'zTab' to sessionDeleteRow; set by sessionTableInfo on success, non-null",,
EXP45-C,499,sqlite,ext/session/sqlite3session.c,5351,FP,(rc=sessionDeleteRow(...)) parenthesized assign-and-test idiom,,
EXP34-C,500,sqlite,ext/session/sqlite3session.c,5352,FP,"'zTab' to sessionInsertRow; set by sessionTableInfo on success, non-null",,
EXP45-C,501,sqlite,ext/session/sqlite3session.c,5352,FP,(rc=sessionInsertRow(...)) parenthesized assign-and-test idiom,,
EXP34-C,502,sqlite,ext/session/sqlite3session.c,5417,FP,*ppRebase write guarded by sApply.bRebase==(ppRebase&&pnRebase) and assert 5416; non-null,,
EXP34-C,503,sqlite,ext/session/sqlite3session.c,5418,FP,*pnRebase write under same bRebase guard; both output pointers non-null,,
MEM30-C,504,sqlite,ext/session/sqlite3session.c,5426,FP,"frees sApply.constraints.aBuf; distinct buffer, single free at cleanup",,
MEM30-C,505,sqlite,ext/session/sqlite3session.c,5427,FP,"frees sApply.rebase.aBuf (0 if ownership transferred at 5419); single free, no UAF",,
MEM30-C,506,sqlite,ext/session/sqlite3session.c,5435,FP,sApply.zErr read/passed to sqlite3_set_errmsg before its free at 5437; use precedes free,,
MEM30-C,507,sqlite,ext/session/sqlite3session.c,5436,FP,"sApply.zErr used at set_errmsg then freed at 5437; correct ordering, no UAF",,
EXP33-C,508,sqlite,ext/session/sqlite3session.c,5517,FP,"pIter written by sessionChangesetStart(&pIter,...) at 5513 before use",,
API00-C,509,sqlite,ext/session/sqlite3session.c,5528,FP,"sqlite3changeset_apply_v2: public API, invalid db is documented misuse",,
API00-C,510,sqlite,ext/session/sqlite3session.c,5556,FP,"sqlite3changeset_apply_v3: public API, invalid db is documented misuse",,
API00-C,511,sqlite,ext/session/sqlite3session.c,5585,FP,"sqlite3changeset_apply: public API, invalid db is documented misuse",,
API00-C,512,sqlite,ext/session/sqlite3session.c,5612,FP,"sqlite3changeset_apply_v3_strm: public API, invalid db is documented misuse",,
API00-C,513,sqlite,ext/session/sqlite3session.c,5635,FP,"sqlite3changeset_apply_v2_strm: public API, invalid db is documented misuse",,
API00-C,514,sqlite,ext/session/sqlite3session.c,5658,FP,"sqlite3changeset_apply_strm: public API, invalid db is documented misuse",,
INT30-C,515,sqlite,ext/session/sqlite3session.c,5714,FP,"sizeof(SessionChange)+nRec; nRec is buffered-record byte size (int, bounded by input buffer); malloc64",,
INT31-C,516,sqlite,ext/session/sqlite3session.c,5724,FP,memcpy nRec = whole buffered record size into matching-sized alloc; bounded by buffer,,
EXP40-C,517,sqlite,ext/session/sqlite3session.c,5727,FP,pIn=aRec read-only iteration cursor; no const object is modified,,
EXP34-C,518,sqlite,ext/session/sqlite3session.c,5729,FP,"pTab->nCol; sessionChangeMerge internal, pTab validated SessionTable",,
INT31-C,519,sqlite,ext/session/sqlite3session.c,5736,uncertain,nIn from sessionSerialLen on indirect-rebase record; per-field internal serial length unvalidated against record end on corrupt blob,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
ARR39-C,520,sqlite,ext/session/sqlite3session.c,5747,FP,nByte=nRec+pExist->nRecord+sizeof(SessionChange); rebase merge output bounded by sum of two input record sizes; fits allocation,,
INT30-C,521,sqlite,ext/session/sqlite3session.c,5747,FP,"nByte = nRec+pExist->nRecord+sizeof in sqlite3_int64; 64-bit, inputs int-bounded; no wrap",,
INT32-C,522,sqlite,ext/session/sqlite3session.c,5747,FP,nRec + pExist->nRecord computed then widened to i64 (nByte is sqlite3_int64); both in-memory record sizes bounded by buffered changeset,,
EXP40-C,523,sqlite,ext/session/sqlite3session.c,5754,FP,a2=aRec read-only iteration cursor; no modification through it,,
ARR38-C,524,sqlite,ext/session/sqlite3session.c,5757,FP,memset pNew nByte matches malloc64(nByte) at 5748,,
INT31-C,525,sqlite,ext/session/sqlite3session.c,5757,FP,memset nByte (sqlite3_int64) = freshly computed alloc size; matches malloc64,,
EXP43-C,526,sqlite,ext/session/sqlite3session.c,5768,FP,"memcpy dest is freshly malloc'd pNew->aRecord, src a1 is pExist's separate buffer; no overlap",,
INT31-C,527,sqlite,ext/session/sqlite3session.c,5768,uncertain,"n1 from sessionSerialLen in rebase merge loop; output buffer sized by record totals, per-field serial-len sum unvalidated on corrupt input",downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
INT31-C,528,sqlite,ext/session/sqlite3session.c,5771,uncertain,n2 from sessionSerialLen in rebase merge loop; same unvalidated per-field length risk,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
INT30-C,529,sqlite,ext/session/sqlite3session.c,5814,FP,"sizeof(SessionChange)+pExist->nRecord+nRec in sqlite3_int64; 64-bit, int-bounded inputs",,
EXP40-C,530,sqlite,ext/session/sqlite3session.c,5825,FP,a1=aRec read-only cursor; no const modification,,
EXP43-C,531,sqlite,ext/session/sqlite3session.c,5834,FP,"memcpy dest freshly malloc'd aCsr, src aRec is a distinct input buffer; no overlap",,
INT31-C,532,sqlite,ext/session/sqlite3session.c,5834,FP,memcpy nRec = whole buffered patchset record size into sized buffer; bounded,,
EXP40-C,533,sqlite,ext/session/sqlite3session.c,5844,FP,a2=aRec read-only cursor; no const modification,,
EXP43-C,534,sqlite,ext/session/sqlite3session.c,5859,FP,"memcpy dest freshly malloc'd aCsr, src aRec distinct buffer; no overlap",,
INT31-C,535,sqlite,ext/session/sqlite3session.c,5859,FP,memcpy nRec = whole buffered record size into sized buffer; bounded,,
DCL30-C,536,sqlite,ext/session/sqlite3session.c,5873,FP,pNew is a heap SessionChange* stored via *ppNew; valid after return,,
DCL13-C,537,sqlite,ext/session/sqlite3session.c,5884,TP,sessionChangesetCheckCompat: pTab only read (azCol/nCol/abPK); const compiles,,
DCL13-C,538,sqlite,ext/session/sqlite3session.c,5886,TP,sessionChangesetCheckCompat: abPK only read (abPK[ii]/memcmp); const u8* compiles,,
ARR00-C,539,sqlite,ext/session/sqlite3session.c,5890,FP,ii<pTab->nCol but abPK[ii] only read when ii<nCol (guarded ternary at 5891); pTab->abPK[ii] sized pTab->nCol; not uninitialized,,
EXP34-C,540,sqlite,ext/session/sqlite3session.c,5891,FP,abPK[ii] in sessionChangesetCheckCompat; abPK paired with nCol by callers; non-null for ii<nCol,,
INT31-C,541,sqlite,ext/session/sqlite3session.c,5896,FP,memcmp nCol; column count <=65536; abPK arrays nCol-sized,,
DCL13-C,542,sqlite,ext/session/sqlite3session.c,5900,TP,sessionChangesetExtendRecord: pGrp only read (bPatch/db); writes go to pTab/pOut not pGrp; const sqlite3_changegroup* compiles,,
EXP34-C,543,sqlite,ext/session/sqlite3session.c,5911,FP,"pTab->azCol in assert; sessionChangesetExtendRecord, pTab validated table",,
INT32-C,544,sqlite,ext/session/sqlite3session.c,5939,FP,"pOut->nBuf += 8; output buffer offset for locally-generated default values, not blob-driven unbounded",,
INT32-C,545,sqlite,ext/session/sqlite3session.c,5969,FP,"iOff += sessionSerialLen(&aRec[iOff]); accumulates over in-memory record aRec, bounded by nRec, loop bound nCol",,
DCL13-C,546,sqlite,ext/session/sqlite3session.c,5997,FP,sessionChangesetFindTable: writes pGrp->pList (*ppNew=&pGrp->pList); mutates changegroup,,
EXP34-C,547,sqlite,ext/session/sqlite3session.c,6004,FP,'zTab'=pIter->zTab to strlen; valid ROW guarantees zTab!=0 (CORRUPT guard 3819),,
STR34-C,548,sqlite,ext/session/sqlite3session.c,6004,FP,"strlen(zTab) length computation, no per-byte signed widening",,
INT30-C,549,sqlite,ext/session/sqlite3session.c,6020,FP,"sizeof(SessionTable)+nCol+nTab+1; nCol from changeset <=65536, nTab=strlen; malloc64",,
EXP34-C,550,sqlite,ext/session/sqlite3session.c,6027,FP,"memcpy(abPK,..,nCol); abPK=pIter->abPK from changeset_pk, non-null for valid iterator",,
INT31-C,551,sqlite,ext/session/sqlite3session.c,6027,FP,"memcpy abPK nCol bytes; nCol<=65536, buffer sized",,
ARR38-C,552,sqlite,ext/session/sqlite3session.c,6029,FP,memcpy zTab nTab+1 into pTab->zName; allocation sizeof(SessionTable)+nCol+nTab+1; abPK(nCol)+zName(nTab+1) fit,,
INT31-C,553,sqlite,ext/session/sqlite3session.c,6029,FP,"memcpy zTab nTab+1; nTab=strlen, buffer sized",,
INT32-C,554,sqlite,ext/session/sqlite3session.c,6029,FP,"nTab+1 memcpy size; nTab strlen of in-memory table name, bounded",,
DCL30-C,555,sqlite,ext/session/sqlite3session.c,6046,FP,pTab is a heap object stored via *ppTab; valid after return,,
EXP20-C,556,sqlite,ext/session/sqlite3session.c,6050,FP,if(!sessionChangesetCheckCompat(...)) is an explicit ! test on an int-returning predicate; idiomatic,,
EXP34-C,557,sqlite,ext/session/sqlite3session.c,6050,FP,abPK to sessionChangesetCheckCompat; pIter->abPK non-null for valid ROW iterator,,
DCL30-C,558,sqlite,ext/session/sqlite3session.c,6054,FP,pTab is a heap object stored via *ppTab; valid after return,,
EXP34-C,559,sqlite,ext/session/sqlite3session.c,6076,FP,"pIter->in.aData member; sessionOneChangeToHash, pIter non-null",,
INT32-C,560,sqlite,ext/session/sqlite3session.c,6076,FP,"iCurrent+2 indexing; in-memory buffer offset, bounded",,
INT32-C,561,sqlite,ext/session/sqlite3session.c,6077,FP,"(iNext-iCurrent)-2; in-memory buffer offsets, bounded by buffer size",,
EXP34-C,562,sqlite,ext/session/sqlite3session.c,6093,FP,'zTab' to sessionChangesetFindTable; zTab non-null for valid ROW (op set zTab),,
EXP34-C,563,sqlite,ext/session/sqlite3session.c,6096,FP,pTab->nCol under rc==SQLITE_OK; FindTable sets *ppTab non-null on OK (else returns error),,
EXP34-C,564,sqlite,ext/session/sqlite3session.c,6098,FP,pTab to sessionChangesetExtendRecord under rc==SQLITE_OK; non-null on success,,
EXP34-C,565,sqlite,ext/session/sqlite3session.c,6104,FP,pTab to sessionGrowHash under rc==SQLITE_OK; non-null,,
EXP34-C,566,sqlite,ext/session/sqlite3session.c,6112,FP,pTab to sessionChangeHash under rc==SQLITE_OK; non-null,,
EXP34-C,567,sqlite,ext/session/sqlite3session.c,6121,FP,pTab to sessionChangeEqual under rc==SQLITE_OK; non-null,,
EXP34-C,568,sqlite,ext/session/sqlite3session.c,6131,FP,pTab to sessionChangeMerge under rc==SQLITE_OK; non-null,,
INT32-C,569,sqlite,ext/session/sqlite3session.c,6138,FP,pTab->nEntry++ in-memory hash entry counter,,
EXP34-C,570,sqlite,ext/session/sqlite3session.c,6158,FP,"pIter->in member; sessionChangesetToHash, pIter non-null",,
DCL13-C,571,sqlite,ext/session/sqlite3session.c,6187,TP,"sessionChangegroupOutput: pGrp only read (pList/bPatch), no writes; const sqlite3_changegroup* compiles",,
ARR00-C,572,sqlite,ext/session/sqlite3session.c,6201,FP,"pTab is SessionTable* linked-list iterator (pTab=pTab->pNext), not an array index; ARR00 misclassification",,
API00-C,573,sqlite,ext/session/sqlite3session.c,6237,FP,"sqlite3changegroup_new: public API, invalid pp is documented misuse",,
DCL30-C,574,sqlite,ext/session/sqlite3session.c,6246,FP,p is a heap changegroup stored via *pp; valid after return,,
API00-C,575,sqlite,ext/session/sqlite3session.c,6253,FP,"sqlite3changegroup_schema: public API, invalid pGrp is documented misuse",,
DCL13-C,576,sqlite,ext/session/sqlite3session.c,6255,FP,schema db stored into pGrp->db (non-const field assignment),,
API00-C,577,sqlite,ext/session/sqlite3session.c,6279,FP,"sqlite3changegroup_add: public API, invalid pData is documented misuse",,
API00-C,578,sqlite,ext/session/sqlite3session.c,6294,FP,"sqlite3changegroup_add_change: public API, invalid pIter is documented misuse",,
API00-C,579,sqlite,ext/session/sqlite3session.c,6317,FP,"sqlite3changegroup_output: public API, invalid pGrp is documented misuse",,
API00-C,580,sqlite,ext/session/sqlite3session.c,6328,FP,"sqlite3changegroup_add_strm: public API, NULL xInput is documented misuse",,
API00-C,581,sqlite,ext/session/sqlite3session.c,6347,FP,"sqlite3changegroup_output_strm: public API, invalid pGrp is documented misuse",,
API00-C,582,sqlite,ext/session/sqlite3session.c,6358,FP,"sqlite3changegroup_delete: public API, invalid pGrp is documented misuse",,
MEM30-C,583,sqlite,ext/session/sqlite3session.c,6361,FP,"sessionDeleteTable(0,pGrp->pList); distinct field, pGrp freed at 6363",,
MEM30-C,584,sqlite,ext/session/sqlite3session.c,6362,FP,"frees pGrp->rec.aBuf; distinct field, not double-free of pGrp",,
INT32-C,585,sqlite,ext/session/sqlite3session.c,6445,FP,"n1+n2 buffer-grow size; both in-memory record sizes, bounded by buffered changeset",,
EXP34-C,586,sqlite,ext/session/sqlite3session.c,6453,FP,a2 to memcpy in sessionAppendRecordMerge; records of nCol fields passed non-null by callers,,
INT31-C,587,sqlite,ext/session/sqlite3session.c,6453,uncertain,nn2 from sessionSerialLen in sessionAppendRecordMerge; output grown to n1+n2 but per-field serial-len sum unvalidated on corrupt rebase record -> over-read/over-write,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
EXP43-C,588,sqlite,ext/session/sqlite3session.c,6456,FP,"memcpy dest pOut into pBuf output buffer, src a1 from separate record; no overlap",,
INT31-C,589,sqlite,ext/session/sqlite3session.c,6456,uncertain,nn1 from sessionSerialLen in sessionAppendRecordMerge; same per-field-length-vs-buffer risk on corrupt rebase blob,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
DCL13-C,590,sqlite,ext/session/sqlite3session.c,6489,TP,sessionAppendPartialUpdate: pIter only read (bIndirect/nCol/abPK); const sqlite3_changeset_iter* compiles,,
INT32-C,591,sqlite,ext/session/sqlite3session.c,6494,FP,"2+nRec+nChange buffer-grow size; in-memory record sizes, bounded",,
EXP40-C,592,sqlite,ext/session/sqlite3session.c,6499,FP,a1=aRec read-only iteration cursor; no const modification,,
EXP34-C,593,sqlite,ext/session/sqlite3session.c,6503,FP,"pIter->bIndirect; sessionAppendPartialUpdate, pIter non-null",,
EXP34-C,594,sqlite,ext/session/sqlite3session.c,6508,FP,'a1'=aRec cursor; aRec non-null after sessionChangesetNext returns ROW (paRec set to in.aData),,
EXP43-C,595,sqlite,ext/session/sqlite3session.c,6509,FP,"memcpy dest pOut (output buffer), src a1 (separate record buffer); no overlap",,
INT31-C,596,sqlite,ext/session/sqlite3session.c,6509,uncertain,"n1 from sessionSerialLen in sessionAppendPartialUpdate; buffer sized 2+nRec+nChange, per-field sum unvalidated on corrupt rebase blob",downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
INT31-C,597,sqlite,ext/session/sqlite3session.c,6513,uncertain,n2 from sessionSerialLen in sessionAppendPartialUpdate old.* loop; unvalidated per-field length,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
EXP43-C,598,sqlite,ext/session/sqlite3session.c,6527,FP,"memcpy dest pOut (output buffer), src a1 (separate record buffer); no overlap",,
INT31-C,599,sqlite,ext/session/sqlite3session.c,6527,uncertain,n1 from sessionSerialLen in sessionAppendPartialUpdate new.* loop; unvalidated per-field length on corrupt rebase blob,downstream consumer (sessionSerialLen->memcpy) of the sessionChangesetBufferRecord overread fixed at the root upstream in 535b1f2875; truncation real but exploitability governed by the root validation sqlite added,
DCL13-C,600,sqlite,ext/session/sqlite3session.c,6556,TP,sessionRebase: p only read (p->grp.pList); pIter is the mutated arg; const sqlite3_rebaser* compiles,,
EXP34-C,601,sqlite,ext/session/sqlite3session.c,6575,FP,"pIter->zTab; sessionRebase, pIter non-null",,
INT32-C,602,sqlite,ext/session/sqlite3session.c,6590,FP,"(int)strlen(pIter->zTab)+1; in-memory table name length, bounded",,
EXP34-C,603,sqlite,ext/session/sqlite3session.c,6594,FP,'aRec' to sessionChangeHash under pTab && rc==SQLITE_OK; aRec non-null after ROW,,
EXP34-C,604,sqlite,ext/session/sqlite3session.c,6597,FP,'aRec' to sessionChangeEqual; non-null after ROW,,
EXP34-C,605,sqlite,ext/session/sqlite3session.c,6613,FP,'aRec' to sessionAppendBlob; non-null record after sessionChangesetNext ROW,,
EXP40-C,606,sqlite,ext/session/sqlite3session.c,6622,FP,pCsr=aRec read-only cursor; no const modification,,
INT32-C,607,sqlite,ext/session/sqlite3session.c,6627,FP,"nRec-(pCsr-aRec); in-memory offset subtraction, pCsr advanced within aRec, bounded",,
EXP34-C,608,sqlite,ext/session/sqlite3session.c,6633,FP,'aRec' to sessionAppendPartialUpdate; non-null after ROW,,
EXP34-C,609,sqlite,ext/session/sqlite3session.c,6645,FP,'aRec' to sessionAppendRecordMerge; non-null after ROW,,
EXP34-C,610,sqlite,ext/session/sqlite3session.c,6655,FP,'aRec' to sessionAppendBlob; non-null after ROW,,
MEM30-C,611,sqlite,ext/session/sqlite3session.c,6672,FP,"sOut.aBuf used by xOutput only on rc==OK path (not freed at 6665); single free at 6680, path-insensitive",,
MEM30-C,612,sqlite,ext/session/sqlite3session.c,6675,FP,*ppOut=sOut.aBuf then aBuf=0 (ownership transfer); reached only when not freed; no UAF,,
EXP34-C,613,sqlite,ext/session/sqlite3session.c,6676,FP,*pnOut write under if(ppOut); paired non-null with ppOut per documented API contract,,
API00-C,614,sqlite,ext/session/sqlite3session.c,6687,FP,"sqlite3rebaser_create: public API, invalid ppNew is documented misuse",,
DCL30-C,615,sqlite,ext/session/sqlite3session.c,6697,FP,pNew is a heap rebaser stored via *ppNew; valid after return,,
API00-C,616,sqlite,ext/session/sqlite3session.c,6704,FP,"sqlite3rebaser_configure: public API, invalid p is documented misuse",,
EXP05-C,617,sqlite,ext/session/sqlite3session.c,6710,FP,(void*)pRebase cast away const for sqlite3changeset_start which reads only,,
EXP34-C,618,sqlite,ext/session/sqlite3session.c,6712,FP,pIter to sessionChangesetToHash under rc==SQLITE_OK; changeset_start sets pIter non-null on OK,,
EXP34-C,619,sqlite,ext/session/sqlite3session.c,6714,FP,pIter to sqlite3changeset_finalize under rc==SQLITE_OK; non-null,,
EXP05-C,620,sqlite,ext/session/sqlite3session.c,6727,FP,(void*)pIn cast away const for sqlite3changeset_start which reads only,,
EXP34-C,621,sqlite,ext/session/sqlite3session.c,6730,FP,pIter to sessionRebase under rc==SQLITE_OK; non-null after successful start,,
EXP34-C,622,sqlite,ext/session/sqlite3session.c,6731,FP,pIter to sqlite3changeset_finalize under rc==SQLITE_OK; non-null,,
API00-C,623,sqlite,ext/session/sqlite3session.c,6740,FP,"sqlite3rebaser_rebase_strm: public API, NULL xInput is documented misuse",,
EXP34-C,624,sqlite,ext/session/sqlite3session.c,6751,FP,pIter to sessionRebase under rc==SQLITE_OK; non-null,,
EXP34-C,625,sqlite,ext/session/sqlite3session.c,6752,FP,pIter to sqlite3changeset_finalize under rc==SQLITE_OK; non-null,,
API00-C,626,sqlite,ext/session/sqlite3session.c,6761,FP,"sqlite3rebaser_delete: public API, invalid p is documented misuse",,
MEM30-C,627,sqlite,ext/session/sqlite3session.c,6764,FP,"frees p->grp.rec.aBuf; distinct field, p freed at 6765",,