sqc 0.4.84

Software Code Quality - CERT C compliance checker
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
rule,idx,project,file,line,verdict,reason,provenance,confidence
WIN04-C,0,sqlite,src/util.c,45,FP,xTestCallback is sqlite3GlobalConfig field; WIN04 EncodePointer is Windows-only mitigation not a CERT-C defect for a function pointer load,,high
DCL13-C,1,sqlite,src/util.c,104,FP,"pCol passed to strlen and field reads only but signature is fixed by callers using non-const Column; const not idiomatic here and pCol->zCnName etc not written, low value misfire",,med
DCL13-C,2,sqlite,src/util.c,104,TP,zDflt is only returned unchanged never written through; const char* would compile and is correct,,low
EXP34-C,3,sqlite,src/util.c,105,FP,pCol guaranteed non-null by all callers (build/select/pragma) reading a Column; internal contract not a trust boundary,,high
INT14-C,4,sqlite,src/util.c,105,FP,colFlags bitwise test and eCType-1 arithmetic on distinct members is normal field access not a real INT14 readability defect,,high
INT30-C,5,sqlite,src/util.c,109,FP,eCType branch entered only when eCType!=0 and asserted <=SQLITE_N_STDTYPE so eCType-1 is in-range index never wraps,,high
API00-C,6,sqlite,src/util.c,144,FP,db non-null guaranteed by assert(db!=0) at line 145 and internal callers,,high
ARR00-C,7,sqlite,src/util.c,162,FP,ii is the for-loop induction var initialized at line 162 for(ii=0;...); not uninitialized,,high
API00-C,8,sqlite,src/util.c,192,FP,db non-null guaranteed by assert(db!=0) line 193 and internal contract,,high
API00-C,9,sqlite,src/util.c,211,FP,p (Parse*) non-null by internal caller contract; p->db dereferenced under that invariant,,high
INT32-C,10,sqlite,src/util.c,214,FP,"p->nErr is a bounded parse error counter; aborts long before INT_MAX, intended counter",,high
INT32-C,11,sqlite,src/util.c,223,FP,"same nErr bounded parse error counter, no realistic overflow",,high
API00-C,12,sqlite,src/util.c,242,FP,pParse non-null by internal contract; asserted db!=0 follows,,high
MEM30-C,13,sqlite,src/util.c,255,FP,"MEM30 misfire: sqlite3DbFree(db,zMsg) frees zMsg not db; db is the live handle read first as context arg",,high
INT32-C,14,sqlite,src/util.c,256,FP,"pParse->nErr bounded parse error counter, no overflow",,high
MEM30-C,15,sqlite,src/util.c,256,FP,"MEM30 misfire: pParse not freed; sqlite3DbFree frees zErrMsg, pParse stays live",,high
INT32-C,16,sqlite,src/util.c,260,FP,pParse->nErr bounded counter,,high
DCL13-C,17,sqlite,src/util.c,273,FP,"db is read (db->pParse) only not written; but DCL13 const on sqlite3* internal handle is non-idiomatic, still pointee not mutated here so technically const-able",,med
INT32-C,18,sqlite,src/util.c,277,FP,pParse->nErr bounded counter,,high
ARR37-C,19,sqlite,src/util.c,302,FP,"ARR37 misfire: z is char* string buffer, z[0] is normal indexed string access guarded by z==0 check line 301",,high
ARR37-C,20,sqlite,src/util.c,306,FP,z[i] normal string traversal with assert(z[i]) loop invariant,,high
ARR37-C,21,sqlite,src/util.c,307,FP,"z[i] same dequote string scan, in-bounds by zero-terminator invariant",,high
ARR37-C,22,sqlite,src/util.c,308,FP,z[i+1] read only after z[i]==quote so i+1 is within the terminated string,,high
ARR37-C,23,sqlite,src/util.c,309,FP,"z[j++] write index j<=i always (compaction in place), bounded",,high
ARR37-C,24,sqlite,src/util.c,315,FP,"z[j++] in-place compaction, j never exceeds i",,high
ARR37-C,25,sqlite,src/util.c,315,FP,"z[i] string read, bounded by terminator",,high
ARR37-C,26,sqlite,src/util.c,318,FP,"z[j]=0 final terminator write, j<=i in-bounds",,high
API00-C,27,sqlite,src/util.c,320,FP,p (Expr*) non-null by asserts at 321-322 and caller contract,,high
API00-C,28,sqlite,src/util.c,332,FP,pParse used only via sqlite3ErrorMsg under malloc-fail assert; non-null by contract,,high
API00-C,29,sqlite,src/util.c,332,FP,p may be null but guarded: assert at 333 and if(p) at 334 gate all p uses,,med
STR34-C,30,sqlite,src/util.c,337,FP,STR34 misfire: pIn[0]/pIn[1] compared to ASCII literals 'x'/'X'/'0'; equality compare no sign-extension hazard,,high
STR34-C,31,sqlite,src/util.c,337,FP,"same char literal equality compare, no integer promotion bug",,high
STR34-C,32,sqlite,src/util.c,337,FP,"same, comparing against '0'/'x' literals safely",,high
MEM33-C,33,sqlite,src/util.c,343,FP,MEM33 misfire: *pOut++ = *pIn is single-char copy not a flexible-array struct assignment,,high
STR34-C,34,sqlite,src/util.c,343,FP,"*pOut++ = *pIn char copy into same buffer; value-preserving in-place dequote, no sign-extension defect",,high
STR34-C,35,sqlite,src/util.c,343,FP,"*pIn assigned to char *pOut, plain copy, no widening",,high
STR34-C,36,sqlite,src/util.c,343,FP,"same char-to-char copy, no sign extension",,high
ARR00-C,37,sqlite,src/util.c,346,FP,pIn[-1] is valid: loop guarantees pIn has advanced past at least the first char (separator never first per number-token grammar),,high
ARR00-C,38,sqlite,src/util.c,347,FP,"pIn[-1]/pIn[1] reads bounded; quoted-number token grammar ensures separators are interior, prior digit exists",,high
API00-C,39,sqlite,src/util.c,390,FP,p (Token*) non-null by caller contract,,high
API00-C,40,sqlite,src/util.c,390,FP,z passed to sqlite3Strlen30 which itself null-checks; non-null by contract anyway,,high
API00-C,41,sqlite,src/util.c,408,FP,zRight handled: function explicitly checks zLeft==0 then calls StrICmp; zRight null handled in stricmp branch,,high
API00-C,42,sqlite,src/util.c,416,FP,"zLeft cast to unsigned char* and walked to NUL; callers pass valid C strings, internal contract",,high
API00-C,43,sqlite,src/util.c,416,FP,"zRight same, valid C string by contract",,high
CON07-C,44,sqlite,src/util.c,416,FP,"CON07 misfire: a,x are local autos in sqlite3StrICmp not shared statics; no concurrency issue",,high
EXP05-C,45,sqlite,src/util.c,419,FP,"EXP05: (unsigned char*)zLeft casts away const to read bytes only; never written, idiomatic signed/unsigned reinterpret",,high
EXP05-C,46,sqlite,src/util.c,420,FP,same const-cast for read-only byte access of zRight,,high
INT32-C,47,sqlite,src/util.c,427,FP,"UpperToLower[] entries are 0..255 u8; difference fits int easily, no overflow",,high
API00-C,48,sqlite,src/util.c,435,FP,zRight null handled by explicit zRight==0 branch line 439,,high
API00-C,49,sqlite,src/util.c,435,FP,"N is a length count; N-- guarded by N-->0 test, no overflow on int loop counter",,high
CON07-C,50,sqlite,src/util.c,435,FP,CON07 misfire: a is local register var not shared static,,high
EXP05-C,51,sqlite,src/util.c,442,FP,EXP05 const-cast read-only byte access zLeft,,high
EXP05-C,52,sqlite,src/util.c,443,FP,EXP05 const-cast read-only byte access zRight,,high
INT32-C,53,sqlite,src/util.c,444,FP,N-- in while(N-->0) decrements a small length count toward 0; INT_MIN underflow unreachable for valid lengths,,high
DCL00-C,54,sqlite,src/util.c,452,FP,"h is mutated: h += UpperToLower[...] in the loop at 455, so it is NOT init-and-never-modified; DCL00 misfire",,med
ARR37-C,55,sqlite,src/util.c,454,FP,z[0] read after z==0 guard line 453; string byte access bounded by terminator,,high
ARR37-C,56,sqlite,src/util.c,455,FP,z[0] in while loop guarded by z[0] truthiness; in-bounds,,high
ARR37-C,57,sqlite,src/util.c,456,FP,"z++ pointer advance within NUL-terminated string, normal traversal",,high
MSC37-C,58,sqlite,src/util.c,465,FP,sqlite3Multiply128 has return in every #if/#elif/#else branch; MSC37 misfire on preprocessor branches,,high
INT14-C,59,sqlite,src/util.c,468,FP,INT14 on a (u64) in 128-bit multiply shift; deliberate bit math not a defect,,high
INT14-C,60,sqlite,src/util.c,468,FP,INT14 on b same intentional bit/arith mix in mulhi,,high
INT30-C,61,sqlite,src/util.c,468,FP,"(__uint128_t)a*b cannot overflow: 128-bit product of two u64 always fits, >>64 takes hi half by design",,high
INT13-C,62,sqlite,src/util.c,475,FP,"b>>32 where b is u64 param not int; sign operand claim is wrong, value is unsigned",,high
CON07-C,63,sqlite,src/util.c,516,FP,"CON07 misfire: aBase/aScale are const static lookup tables (read-only), x is local; no shared mutable state",,high
ARR02-C,64,sqlite,src/util.c,517,FP,aBase[] sized implicitly by initializer list (27 entries); explicit size unnecessary and ARR02 is style-only here,,high
ARR02-C,65,sqlite,src/util.c,546,FP,aScale[] same const initializer-sized table; safe,,high
INT32-C,66,sqlite,src/util.c,582,FP,"g-- in p<0 branch where g=p/27 (p>=-348 so g>=-12); decrement bounded, no INT_MIN",,high
ARR00-C,67,sqlite,src/util.c,586,FP,"aScale[g+13] index: p in [-348,-1] gives g+13 in [1,12]; bounded by assert(p>=POWERSOF10_FIRST) at 577",,high
INT32-C,68,sqlite,src/util.c,591,FP,g+13 add small bounded ints; no overflow given asserted p range,,high
EXP07-C,69,sqlite,src/util.c,620,FP,EXP07 misfire: (p*108853)>>15 is a deliberate fixed-point ratio approximation documented at 610-618,,high
INT13-C,70,sqlite,src/util.c,620,FP,"p is int but range-bounded; >> used for documented rounding-toward-neg, intentional signed shift",,high
INT14-C,71,sqlite,src/util.c,620,FP,"INT14 intentional fixed-point multiply-then-shift, documented algorithm",,high
INT32-C,72,sqlite,src/util.c,620,FP,"p*108853 with p in [-348,347] gives ~3.78e7 max, far below INT_MAX; no overflow",,high
EXP07-C,73,sqlite,src/util.c,621,FP,EXP07 same documented ratio 78913/262144 fixed-point constant,,high
INT13-C,74,sqlite,src/util.c,621,FP,"p>>18 documented rounding signed shift, intentional",,high
INT14-C,75,sqlite,src/util.c,621,FP,INT14 intentional fixed-point op,,high
INT32-C,76,sqlite,src/util.c,621,FP,"p*78913 with |p|<=348 gives ~2.7e7, well below INT_MAX",,high
MSC37-C,77,sqlite,src/util.c,626,FP,countLeadingZeros has return in builtin branch and full fallback; MSC37 misfire,,high
INT32-C,78,sqlite,src/util.c,631,FP,"n+=32 in countLeadingZeros fallback; n accumulates to at most 64, no overflow",,high
INT32-C,79,sqlite,src/util.c,632,FP,n+=16 bounded to <=64,,high
INT32-C,80,sqlite,src/util.c,633,FP,n+=8 bounded to <=64,,high
INT32-C,81,sqlite,src/util.c,634,FP,n+=4 bounded to <=64,,high
INT32-C,82,sqlite,src/util.c,635,FP,n+=2 bounded to <=64,,high
INT32-C,83,sqlite,src/util.c,636,FP,"n+=1 bounded; final n<=64 (clz of 64-bit), no overflow",,high
DCL02-C,84,sqlite,src/util.c,651,FP,DCL02 misfire: h and n are short distinct locals in different scopes; no real confusability defect,,high
INT14-C,85,sqlite,src/util.c,653,FP,INT14 on e in pwr2to10(e+63) call arg; small bounded exponent arithmetic,,high
INT32-C,86,sqlite,src/util.c,653,FP,"n-1-pwr2to10(e+63): n in [1,18], e a bounded fp exponent; asserts at 655-656 bound the result, no overflow",,high
INT32-C,87,sqlite,src/util.c,653,FP,"n-1 with n in [1,18] per assert line 652; cannot underflow int",,high
INT14-C,88,sqlite,src/util.c,655,FP,INT14 on pwr10to2 fn name false-positive (treated as variable); not a real defect,,high
INT14-C,89,sqlite,src/util.c,655,FP,"INT14 on p in pwr10to2(p); intentional bit/arith, bounded",,high
INT14-C,90,sqlite,src/util.c,658,FP,"INT14 on h (u64 mantissa) shift; deliberate, h is unsigned",,high
INT32-C,91,sqlite,src/util.c,658,FP,e+pwr10to2(p)+2 negated and asserted >=0 (line 655) and within range; bounded fp exponent math,,high
INT32-C,92,sqlite,src/util.c,658,FP,e+pwr10to2(p) bounded by asserts; no overflow for valid double exponents,,high
FIO50-C,93,sqlite,src/util.c,661,FP,FIO50 misfire: h is a u64 local variable not a FILE* stream; no I/O involved,,high
INT34-C,94,sqlite,src/util.c,661,FP,"shift amount -(e+pwr10to2(p)+1) asserted in [0,63] at line 656 before use; validated by assert",,high
INT32-C,95,sqlite,src/util.c,661,FP,e+pwr10to2(p)+1 bounded by asserts 655-656; no overflow,,high
INT32-C,96,sqlite,src/util.c,661,FP,e+pwr10to2(p) bounded fp exponent arithmetic,,high
INT32-C,97,sqlite,src/util.c,663,FP,-p where p=n-1-pwr2to10(...) is bounded small; -INT_MIN unreachable for valid range,,high
INT13-C,98,sqlite,src/util.c,677,FP,"d & U64_BIT(63): d is u64 param (line 669), not signed int; INT13 operand-type claim wrong",,high
INT14-C,99,sqlite,src/util.c,677,FP,"INT14 on d (u64) bit-test then arithmetic; d is unsigned, intentional",,high
INT14-C,100,sqlite,src/util.c,677,FP,INT14 on U64_BIT macro misread as variable; (((u64)1)<<N) is a mask macro,,high
INT32-C,101,sqlite,src/util.c,685,FP,"64-countLeadingZeros(d): clz returns [0,63] for d!=0 (asserted), so result in [1,64]; no overflow",,high
INT14-C,102,sqlite,src/util.c,687,FP,"INT14 on b (int) computed from 64-clz then used in shifts; bounded value, intentional fp bit math",,high
INT32-C,103,sqlite,src/util.c,687,FP,e1=53-b-lp with b in 1..64 and lp bounded by POWERSOF10 range; small bounded ints no overflow,,high
INT32-C,104,sqlite,src/util.c,687,FP,53-b with b in 1..64 (d!=0 asserted) is bounded small int,,high
INT32-C,105,sqlite,src/util.c,692,FP,e1-(64-b) bounded; e1<=1074 and b in 1..64 all small ints,,high
INT32-C,106,sqlite,src/util.c,692,FP,64-b with b in 1..64 yields 0..63 no overflow,,high
INT13-C,107,sqlite,src/util.c,693,FP,d is u64 not signed; bitwise shift on unsigned operand is correct,,high
INT34-C,108,sqlite,src/util.c,693,FP,shift amount 64-b in 0..63 valid; d!=0 ensures b>=1 keeps shift in type width,,high
INT32-C,109,sqlite,src/util.c,693,FP,64-b bounded 0..63 small ints no overflow,,high
INT34-C,110,sqlite,src/util.c,696,FP,shift -(e2+lp+3) explicitly asserted >=0 and <64 at lines 694-695; range guaranteed by POWERSOF10 bounds,,high
INT13-C,111,sqlite,src/util.c,696,FP,e2 used inside a negation/addition not as bitwise operand; h>>... operand is u64 h,,high
INT32-C,112,sqlite,src/util.c,696,FP,e2+lp+3 are small bounded ints from clamped exponent range,,high
INT32-C,113,sqlite,src/util.c,696,FP,e2+lp bounded by clamped POWERSOF10 exponent math,,high
INT14-C,114,sqlite,src/util.c,698,FP,INT14 readability heuristic on out; bit/arith mix is intentional float assembly,,low
INT32-C,115,sqlite,src/util.c,699,FP,e1 bounded <=1074 and >-972 region; decrement cannot reach INT_MIN,,high
EXP07-C,116,sqlite,src/util.c,706,FP,EXP07 1075-e1<<52 is deliberate IEEE754 exponent field construction,,low
EXP05-C,117,sqlite,src/util.c,708,FP,&r passed to memcpy non-const dest; r is local mutable double not const cast-away,,high
API00-C,118,sqlite,src/util.c,743,FP,internal contract; callers always pass valid pResult; *pResult=0.0 set first deterministically,,high
MSC37-C,119,sqlite,src/util.c,743,FP,MSC37 misfire; both #if branches return; non-OMIT branch falls through to explicit return paths,,high
ARR37-C,120,sqlite,src/util.c,755,FP,z walks a NUL-terminated UTF-8 C string; pointer increment is idiomatic and bounded by terminator,,high
ARR37-C,121,sqlite,src/util.c,760,FP,z++ after sign char; bounded by NUL terminator,,high
ARR37-C,122,sqlite,src/util.c,762,FP,z++ idiomatic string walk bounded by NUL,,high
ARR30-C,123,sqlite,src/util.c,766,FP,loop guarded by sqlite3Isdigit(*z) which is false at NUL; terminated string bounds it,,high
ARR37-C,124,sqlite,src/util.c,768,FP,z++ in digit loop bounded by Isdigit guard,,high
INT32-C,125,sqlite,src/util.c,768,FP,nDigit counts digits of a string; cannot realistically reach INT_MAX before NUL,,high
ARR37-C,126,sqlite,src/util.c,772,FP,z++ in non-significant-digit skip loop bounded by Isdigit/NUL,,high
INT32-C,127,sqlite,src/util.c,772,FP,d exponent shift bounded by digit count of input string far below INT_MAX,,high
ARR37-C,128,sqlite,src/util.c,778,FP,z++ after decimal point bounded by NUL,,high
INT32-C,129,sqlite,src/util.c,779,FP,eType increments at most twice (decimal + exponent); no overflow,,high
ARR30-C,130,sqlite,src/util.c,782,FP,"while guarded by sqlite3Isdigit(*z), false at NUL terminator",,high
INT32-C,131,sqlite,src/util.c,785,FP,d-- bounded by fractional digit count of finite string,,high
ARR37-C,132,sqlite,src/util.c,788,FP,z++ in fractional loop bounded by Isdigit/NUL,,high
ARR37-C,133,sqlite,src/util.c,795,FP,z++ after exponent marker bounded by NUL,,high
INT32-C,134,sqlite,src/util.c,796,FP,eType++ second increment bounded,,high
ARR37-C,135,sqlite,src/util.c,801,FP,z++ after exponent sign bounded by NUL,,high
ARR37-C,136,sqlite,src/util.c,803,FP,z++ first exponent digit bounded by NUL,,high
STR34-C,137,sqlite,src/util.c,807,FP,*z is a char from a NUL-terminated digit-validated string; '0'..'9' subtraction safe,,high
STR34-C,138,sqlite,src/util.c,807,FP,z char to int via *z-'0' after Isdigit guard; value 0..9 no sign-extension hazard,,high
ARR37-C,139,sqlite,src/util.c,808,FP,z++ in exponent digit loop bounded by NUL,,high
ARR30-C,140,sqlite,src/util.c,809,FP,while guarded by sqlite3Isdigit(*z) false at NUL,,high
INT32-C,141,sqlite,src/util.c,810,FP,exp explicitly capped exp<10000 ternary before multiply/add; no overflow,,high
INT32-C,142,sqlite,src/util.c,810,FP,exp*10 guarded by exp<10000 clamp at line 810; result <100000,,high
ARR37-C,143,sqlite,src/util.c,811,FP,z++ exponent loop bounded by Isdigit/NUL,,high
INT32-C,144,sqlite,src/util.c,813,FP,d+=esign*exp with exp<=10000 and esign +-1; d stays small bounded int,,high
INT32-C,145,sqlite,src/util.c,813,FP,esign*exp with esign +-1 and exp<=10000 bounded,,high
ARR37-C,146,sqlite,src/util.c,820,FP,z++ trailing-space skip bounded by NUL via Isspace guard,,high
ARR37-C,147,sqlite,src/util.c,832,FP,z[0] terminator check on NUL-terminated string; in-bounds read,,high
CON07-C,148,sqlite,src/util.c,876,FP,sqlite3DigitPairs is const static read-only table; x is a local; CON07 misfire no shared mutable state,,high
EXP07-C,149,sqlite,src/util.c,890,FP,EXP07 (u64)1<<63 deliberate SMALLEST_INT64 magnitude construction,,low
INT30-C,150,sqlite,src/util.c,892,FP,sizeof(u.a)-1 is a compile-time size_t constant (22); no runtime wrap,,high
EXP33-C,151,sqlite,src/util.c,892,FP,u.a is fully written before read; u.a[i]=0 then memcpy reads &u.a[i]; not uninitialized,,high
ARR30-C,152,sqlite,src/util.c,893,FP,i=22 then decremented by 2; max 20 i64 digits stay within a[23]; indices bounded,,high
INT32-C,153,sqlite,src/util.c,895,FP,x is u64 (x=v or (u64)-v); x%100 in 0..99 times 2 <=198 no overflow,,high
INT10-C,154,sqlite,src/util.c,895,FP,x is u64 unsigned so % is well-defined non-negative; INT10 misfire,,high
ARR30-C,155,sqlite,src/util.c,896,FP,kk=(x%100)*2 in 0..198 indexes sqlite3DigitPairs.a[201] not u.a; sqc misattributed buffer; in bounds,,high
INT32-C,156,sqlite,src/util.c,897,FP,i-2 with i>=2 in loop (20 digits max from a[23]); index stays >=0,,high
MEM33-C,157,sqlite,src/util.c,898,FP,*(u16*)(&u.a[i-2]) is aligned 2-byte store of digit pair not flexible-array struct assignment; MEM33 misfire,,high
ARR30-C,158,sqlite,src/util.c,898,FP,"u.a[i-2] write with i decremented by 2; bounded within a[23], i>=2 maintained",,high
INT32-C,159,sqlite,src/util.c,899,FP,i-=2 paired with x/=100; loop bounded by digit count (<=20) keeps i>=2,,high
INT32-C,160,sqlite,src/util.c,903,FP,--i for trailing digit; i>=1 guaranteed after pair loop; no INT_MIN,,high
INT32-C,161,sqlite,src/util.c,905,FP,--i for sign char only when v<0; i still >=0 bounded,,high
INT32-C,162,sqlite,src/util.c,906,FP,memcpy size sizeof(u.a)-i with i in 0..22; positive bounded size_t no overflow,,high
ARR30-C,163,sqlite,src/util.c,906,FP,&u.a[i] read with i>=0 and size sizeof(u.a)-i; in-bounds source,,high
EXP05-C,164,sqlite,src/util.c,906,FP,sizeof(u.a)-i is a size_t length arg not a const-pointer cast-away; EXP05 misfire,,high
INT30-C,165,sqlite,src/util.c,906,FP,sizeof(u.a)-i with i<=22 yields >=1 no unsigned wrap,,high
INT30-C,166,sqlite,src/util.c,907,FP,sizeof(u.a)-1 compile-time constant 22; no wrap,,high
DCL00-C,167,sqlite,src/util.c,925,FP,DCL00 c is reused/reassigned in loop body (c=(zNum[i*incr]-pow63[i])*10); not immutable,,low
EXP34-C,168,sqlite,src/util.c,930,FP,zNum is internal 19-char compare buffer guaranteed valid by caller contract; not a trust boundary,,high
API00-C,169,sqlite,src/util.c,957,FP,internal contract; zNum bounded by zEnd=zNum+length; all reads guarded zNum<zEnd,,high
API00-C,170,sqlite,src/util.c,957,FP,pNum always written on every return path; internal callers pass valid pointer,,high
API00-C,171,sqlite,src/util.c,957,FP,length used to compute zEnd bound; UTF16 path masks length&=~1; reads bounded by zEnd,,high
DCL00-C,172,sqlite,src/util.c,962,FP,DCL00 c reassigned in for-loop (c=zNum[i]) and later c=i>19*incr?...; not const,,low
INT14-C,173,sqlite,src/util.c,966,FP,INT14 length&=~1 then used arithmetically is intentional UTF16 even-length rounding,,low
DCL03-C,174,sqlite,src/util.c,973,FP,DCL03 assert(enc==UTF8||UTF16LE||UTF16BE) is a runtime enum check not a pure compile-time constant,,high
INT14-C,175,sqlite,src/util.c,974,FP,INT14 enc used in &1 and 3-enc arithmetic is intentional encoding-offset computation,,low
EXP34-C,176,sqlite,src/util.c,974,FP,zNum reads bounded by i<length guard in the for loop; not a null deref,,high
INT14-C,177,sqlite,src/util.c,974,FP,INT14 i used as loop counter with i+=2 and indexing; routine arithmetic,,low
STR34-C,178,sqlite,src/util.c,976,FP,zNum[i] compared ==0 (NUL byte scan) not assigned to larger type; STR34 misfire on byte equality,,high
STR34-C,179,sqlite,src/util.c,976,FP,zNum[i^1] address arithmetic for endian offset not a sign-extending char load; i^1 toggles low bit,,high
INT13-C,180,sqlite,src/util.c,976,FP,i^1 is a deliberate endian byte-offset toggle on a small loop counter; intentional bit op,,high
ARR36-C,181,sqlite,src/util.c,979,FP,zNum<zEnd compares pointers into the SAME input buffer (zEnd=zNum+length); valid same-object compare,,high
ARR36-C,182,sqlite,src/util.c,980,FP,same-object pointer compare zNum<zEnd within the input string buffer,,high
ARR36-C,183,sqlite,src/util.c,989,FP,&zNum[i]<zEnd both reference the single input buffer; valid pointer comparison,,high
EXP30-C,184,sqlite,src/util.c,990,FP,"c assigned in for-test (c=zNum[i]) and compared in same expression across the comma/relational sequence; well-defined, single modification",,high
INT32-C,185,sqlite,src/util.c,990,FP,i+=incr loop counter bounded by zEnd; finite input length no overflow,,high
INT07-C,186,sqlite,src/util.c,991,FP,INT07 u is u64 not char here; sqc mis-typed; u=u*10+c-'0' on unsigned accumulator,,low
INT30-C,187,sqlite,src/util.c,991,FP,u*10 unsigned; overflow handled afterward by u>LARGEST_INT64 clamp and 19-digit compare2pow63 path,,high
INT07-C,188,sqlite,src/util.c,1003,FP,INT07 misfire; u is u64 mantissa accumulator not char,,low
INT32-C,189,sqlite,src/util.c,1019,FP,jj+=incr trailing-text scan bounded by &zNum[jj]<zEnd; finite,,high
INT07-C,190,sqlite,src/util.c,1041,FP,INT07 misfire; u is u64 not char,,low
INT30-C,191,sqlite,src/util.c,1041,FP,"u-1 only evaluated in assert when u-1==LARGEST_INT64 (u=2^63 exact path); no wrap, well-defined",,high
API00-C,192,sqlite,src/util.c,1060,FP,pOut always written via memcpy or sqlite3Atoi64; internal contract valid pointer,,high
ARR37-C,193,sqlite,src/util.c,1062,FP,z[0] on NUL-terminated literal string; in-bounds; idiomatic prefix check,,high
EXP34-C,194,sqlite,src/util.c,1062,FP,z is a NUL-terminated C string literal arg; z[0]/z[1] reads safe to terminator,,high
ARR37-C,195,sqlite,src/util.c,1063,FP,z[1] read safe; if z[0]==0 short-circuit && prevents z[1] hazard; even so z[1] is the NUL-following byte in a C string,,high
ARR37-C,196,sqlite,src/util.c,1063,FP,duplicate z[1] subscript; same NUL-terminated string bound,,high
ARR37-C,197,sqlite,src/util.c,1067,FP,z[i] hex-prefix zero-skip loop guarded by z[i]=='0' false at NUL; bounded,,high
ARR37-C,198,sqlite,src/util.c,1068,FP,z[k] guarded by sqlite3Isxdigit(z[k]) false at NUL; bounded walk,,high
INT07-C,199,sqlite,src/util.c,1069,FP,INT07 misfire; u is u64 hex accumulator not char,,low
INT14-C,200,sqlite,src/util.c,1069,FP,INT14 z used as index and pointer; idiomatic string indexing not real bit/arith confusion,,low
INT30-C,201,sqlite,src/util.c,1069,FP,u*16 unsigned hex accumulate; over-length detected by k-i>16 return 2 afterward; intended,,high
ARR37-C,202,sqlite,src/util.c,1069,FP,z[k] hex digit read guarded by Isxdigit/NUL,,high
ARR37-C,203,sqlite,src/util.c,1073,FP,z[k] terminator check z[k]!=0 on NUL-terminated string; in bounds,,high
STR34-C,204,sqlite,src/util.c,1078,FP,z bytes fed to strspn/sqlite3HexToInt; HexToInt indexes via validated xdigit; no sign-extend defect,,high
ARR37-C,205,sqlite,src/util.c,1079,FP,z[n] read after strspn computes n; n bounded by 0x3fffffff mask and string contents; z NUL-terminated,,high
API00-C,206,sqlite,src/util.c,1094,FP,API00 on internal sqlite3GetInt32 pValue; callers pass valid ptr by internal contract not a trust boundary,,high
EXP34-C,207,sqlite,src/util.c,1098,FP,zNum non-null by internal contract; entry to number parser callers never pass null,,high
INT07-C,208,sqlite,src/util.c,1109,FP,u at 1109 is declared u32 not char; sqc misread type,,high
EXP33-C,209,sqlite,src/util.c,1112,FP,i is the for-loop induction var initialized in the for-init before use,,high
INT07-C,210,sqlite,src/util.c,1113,FP,u is u32 not char,,high
INT14-C,211,sqlite,src/util.c,1113,FP,u*16+hexdigit on u32 is intended hex accumulation readability rule only,,high
INT30-C,212,sqlite,src/util.c,1113,FP,u32 hex accumulate bounded by i<8 (32 bits) and post-checked u&0x80000000; intended unsigned,,high
EXP30-C,213,sqlite,src/util.c,1125,FP,c=zNum[i]-'0' then compared across && sequence point; no UB,,high
EXP33-C,214,sqlite,src/util.c,1125,FP,c assigned in for-condition before use,,high
INT32-C,215,sqlite,src/util.c,1126,FP,v is i64 bounded to i<11 digits then checked >2147483647; cannot overflow i64,,high
INT32-C,216,sqlite,src/util.c,1143,FP,-v only after v confirmed within 32-bit range (v-neg<=2147483647); safe,,high
API00-C,217,sqlite,src/util.c,1153,FP,API00 internal sqlite3Atoi z; internal contract,,high
API00-C,218,sqlite,src/util.c,1176,FP,API00 internal FpDecode p; internal contract,,high
API00-C,219,sqlite,src/util.c,1176,FP,iRound is small rounding-digit count from internal callers; no overflow,,high
INT14-C,220,sqlite,src/util.c,1202,FP,v is u64 mantissa; (v>>52)&0x7ff is intended IEEE754 field extraction,,high
EXP07-C,221,sqlite,src/util.c,1202,FP,v>>52 extracts IEEE754 exponent field; documented intended layout not a magic constant,,high
INT32-C,222,sqlite,src/util.c,1204,FP,"1+(v!=const) is 1+{0,1}; no overflow",,high
INT32-C,223,sqlite,src/util.c,1214,FP,nn is countLeadingZeros 0..63; -1074-nn small bounded,,high
EXP07-C,224,sqlite,src/util.c,1216,FP,v<<11 normalizes IEEE754 mantissa; intended,,high
FIO50-C,225,sqlite,src/util.c,1216,FP,v is a u64 mantissa not a file stream; FIO50 total misfire,,high
INT32-C,226,sqlite,src/util.c,1217,FP,e is IEEE exponent 0..2047; e-=1086 bounded,,high
INT32-C,227,sqlite,src/util.c,1219,FP,iRound small bounded rounding count,,high
ARR01-C,228,sqlite,src/util.c,1224,FP,p->zBuf is a real char[20] array member; sizeof yields 20 correctly not decayed,,high
INT30-C,229,sqlite,src/util.c,1224,FP,sizeof(p->zBuf)-1 = 19 compile-time constant; no wrap,,high
INT32-C,230,sqlite,src/util.c,1228,FP,"(v%100)*2 in [0,198]; no overflow",,high
ARR30-C,231,sqlite,src/util.c,1229,FP,"index is sqlite3DigitPairs.a[kk] kk in [0,198] within a[201]; cited size 23/line 880 is wrong attribution",,high
INT32-C,232,sqlite,src/util.c,1230,FP,i is a small zBuf slot index (~19 down to 0); i-1 bounded,,high
MEM33-C,233,sqlite,src/util.c,1231,FP,*(u16*)(&zBuf[i-1])=*(u16*)... is a u16 store not a flexible-array struct assignment,,high
INT32-C,234,sqlite,src/util.c,1231,FP,same i-1 zBuf index; bounded,,high
ARR30-C,235,sqlite,src/util.c,1231,FP,sqlite3DigitPairs.a[kk] bounded; misattributed buffer,,high
INT32-C,236,sqlite,src/util.c,1232,FP,i-=2 stepping down zBuf index; bounded,,high
INT32-C,237,sqlite,src/util.c,1237,FP,i-- small positive index; no INT_MIN reach,,high
ARR01-C,238,sqlite,src/util.c,1239,FP,p->zBuf real array member; sizeof=20,,high
INT30-C,239,sqlite,src/util.c,1239,FP,sizeof(p->zBuf)-1 constant 19,,high
ARR01-C,240,sqlite,src/util.c,1240,FP,p->zBuf real array; sizeof=20,,high
INT30-C,241,sqlite,src/util.c,1240,FP,sizeof(p->zBuf)-1 constant 19,,high
ARR01-C,242,sqlite,src/util.c,1242,FP,p->zBuf real array; sizeof=20,,high
ARR01-C,243,sqlite,src/util.c,1243,FP,p->zBuf real array; sizeof=20,,high
INT30-C,244,sqlite,src/util.c,1243,FP,sizeof(p->zBuf)-1 constant 19,,high
INT32-C,245,sqlite,src/util.c,1244,FP,n (<=19 digits) + exp (bounded base-10 exp from decode); no overflow,,high
INT32-C,246,sqlite,src/util.c,1246,FP,p->iDP and iRound are small bounded digit positions,,high
INT32-C,247,sqlite,src/util.c,1249,FP,i-- small positive zBuf index,,high
INT32-C,248,sqlite,src/util.c,1250,FP,n is digit count <=19; n++ bounded,,high
INT32-C,249,sqlite,src/util.c,1251,FP,p->iDP small bounded; ++ safe,,high
STR34-C,250,sqlite,src/util.c,1254,FP,z=&zBuf[i+1] is a char* pointer assignment not a numeric sign-extension,,high
STR34-C,251,sqlite,src/util.c,1254,FP,same pointer-into-buffer assignment misread as sign extension,,high
INT32-C,252,sqlite,src/util.c,1254,FP,i+1 small bounded zBuf index,,high
ARR37-C,253,sqlite,src/util.c,1263,FP,z is char* into zBuf[20]; z[15] bounded by 17-digit precision logic and asserts,,high
ARR37-C,254,sqlite,src/util.c,1263,FP,z[14] bounded within zBuf,,high
ARR37-C,255,sqlite,src/util.c,1266,FP,"z[jj-1] jj in (0,14]; bounded",,high
ARR37-C,256,sqlite,src/util.c,1270,FP,z[0] bounded,,high
ARR37-C,257,sqlite,src/util.c,1271,FP,z[kk] kk<jj<=14; bounded,,high
ARR37-C,258,sqlite,src/util.c,1277,FP,z[15] bounded within zBuf,,high
ARR37-C,259,sqlite,src/util.c,1277,FP,z[14] bounded,,high
ARR37-C,260,sqlite,src/util.c,1277,FP,z[13] bounded,,high
ARR37-C,261,sqlite,src/util.c,1280,FP,z[0] bounded,,high
ARR37-C,262,sqlite,src/util.c,1281,FP,z[jj-1] jj>0 guarded by loop; bounded,,high
ARR37-C,263,sqlite,src/util.c,1282,FP,z[0] bounded,,high
ARR37-C,264,sqlite,src/util.c,1283,FP,z[kk] kk<jj; bounded,,high
INT32-C,265,sqlite,src/util.c,1285,FP,jj+1 jj<=14; bounded,,high
ARR37-C,266,sqlite,src/util.c,1290,FP,z[iRound] iRound<=mxRound<=n; bounded,,high
INT32-C,267,sqlite,src/util.c,1291,FP,iRound-1 bounded positive,,high
ARR37-C,268,sqlite,src/util.c,1293,FP,z[j] j=iRound-1 bounded,,high
ARR37-C,269,sqlite,src/util.c,1294,FP,"z[j] in carry loop bounded, j decremented to 0",,high
ARR37-C,270,sqlite,src/util.c,1295,FP,z[j] bounded,,high
ARR37-C,271,sqlite,src/util.c,1297,FP,z-- only when j==0 with leading carry; z stays within zBuf (room reserved),,high
ARR37-C,272,sqlite,src/util.c,1298,FP,z[0] after z-- still within zBuf,,high
INT32-C,273,sqlite,src/util.c,1299,FP,n++ digit count bounded,,high
INT32-C,274,sqlite,src/util.c,1300,FP,p->iDP++ small bounded,,high
INT32-C,275,sqlite,src/util.c,1303,FP,j-- bounded positive,,high
ARR37-C,276,sqlite,src/util.c,1309,FP,z[n-1] n>0 asserted; bounded,,high
INT32-C,277,sqlite,src/util.c,1310,FP,n-- guarded by n>0 assert in loop,,high
API00-C,278,sqlite,src/util.c,1323,FP,API00 internal sqlite3GetUInt32 pI; internal contract,,high
ARR37-C,279,sqlite,src/util.c,1326,FP,z is untrusted char* but z[i] loop bounded by isdigit and NUL terminator; subscript legal,,high
ARR37-C,280,sqlite,src/util.c,1327,FP,z[i] same bounded scan,,high
ARR37-C,281,sqlite,src/util.c,1330,FP,z[i] terminating check; bounded,,high
ARR30-C,282,sqlite,src/util.c,1384,FP,buf[10] in putVarint64; p[i]=buf[j] with n<=9 asserted so j<10; bounded,,high
FIO50-C,283,sqlite,src/util.c,1394,FP,v is u32 not a file stream; FIO50 misfire,,high
API00-C,284,sqlite,src/util.c,1418,FP,API00 internal sqlite3GetVarint v; internal contract,,high
CON07-C,285,sqlite,src/util.c,1418,FP,'a' is a local u32 in sqlite3GetVarint not a shared static; CON07 misfire,,high
EXP05-C,286,sqlite,src/util.c,1421,FP,(signed char*)p casts away const but only reads the byte to test sign bit; pointee never written through,,med
MEM33-C,287,sqlite,src/util.c,1422,FP,*v=*p is a u64 integer assignment not a flexible-array struct copy,,high
EXP05-C,288,sqlite,src/util.c,1425,FP,(signed char*)p read-only sign-bit test; const pointee not modified,,med
INT14-C,289,sqlite,src/util.c,1426,FP,p[0]&0x7f<<7|p[1] operates on dereferenced bytes (cast to u32); intended varint decode,,high
INT13-C,290,sqlite,src/util.c,1426,FP,operands are (u32)(p[0]&0x7f) unsigned; bytes not a signed int p,,high
DCL03-C,291,sqlite,src/util.c,1431,TP,assert( SLOT_2_0 == ((0x7f<<14)|0x7f) ) argument is a pure compile-time constant expression,,high
EXP07-C,292,sqlite,src/util.c,1431,FP,0x7f<<14 is a documented precomputed-mask constant inside a compile-time assert; intended,,high
DCL03-C,293,sqlite,src/util.c,1432,TP,assert( SLOT_4_2_0 == ((0xfU<<28)|(0x7f<<14)|0x7f) ) is a pure compile-time constant expression,,high
EXP07-C,294,sqlite,src/util.c,1432,FP,0xfU<<28 documented constant in assert; intended,,high
EXP07-C,295,sqlite,src/util.c,1432,FP,0x7f<<14 documented constant in assert; intended,,high
EXP07-C,296,sqlite,src/util.c,1434,FP,((u32)p[0])<<14 shifts a data byte not a magic constant,,high
INT13-C,297,sqlite,src/util.c,1434,FP,(u32)p[0] is unsigned; shift on unsigned data,,high
FIO50-C,298,sqlite,src/util.c,1443,FP,b is u32 not a file stream; FIO50 misfire,,high
INT13-C,299,sqlite,src/util.c,1443,FP,b is u32 unsigned; intended bit pack,,high
EXP07-C,300,sqlite,src/util.c,1452,FP,b<<14 shifts u32 varint data,,high
INT13-C,301,sqlite,src/util.c,1452,FP,b is u32 unsigned,,high
INT13-C,302,sqlite,src/util.c,1455,FP,b is u32 unsigned; & is intended mask,,high
FIO50-C,303,sqlite,src/util.c,1460,FP,a is u32 not a file stream; FIO50 misfire,,high
EXP07-C,304,sqlite,src/util.c,1476,FP,a<<14 shifts u32 data,,high
INT13-C,305,sqlite,src/util.c,1485,FP,b is u32 unsigned,,high
EXP07-C,306,sqlite,src/util.c,1487,FP,s>>18 shifts u32 data; intended,,high
FIO50-C,307,sqlite,src/util.c,1493,FP,s is u32 not a file stream; FIO50 misfire,,high
EXP07-C,308,sqlite,src/util.c,1498,FP,b<<14 shifts u32 data; intended,,high
INT13-C,309,sqlite,src/util.c,1498,FP,"b is u32 (decl line 1419 a,b,s are u32) so the << is on an unsigned operand not signed int",,high
INT13-C,310,sqlite,src/util.c,1501,FP,b is u32 so the & is on an unsigned operand,,high
EXP07-C,311,sqlite,src/util.c,1508,FP,s is u32 right-shift in fixed-format varint decoder not a constant assumption,,high
FIO50-C,312,sqlite,src/util.c,1508,FP,s is a u32 integer not a FILE stream FIO50 is nonsensical here,,high
EXP07-C,313,sqlite,src/util.c,1514,FP,a is u32 fixed varint decode step not a constant assumption,,high
INT13-C,314,sqlite,src/util.c,1521,FP,b is u32 shift on unsigned operand,,high
EXP07-C,315,sqlite,src/util.c,1523,FP,s is u32 fixed varint decode shift,,high
EXP07-C,316,sqlite,src/util.c,1531,FP,b is u32 fixed varint decode shift,,high
INT13-C,317,sqlite,src/util.c,1531,FP,b is u32 shift on unsigned operand,,high
INT13-C,318,sqlite,src/util.c,1534,FP,b is u32 mask on unsigned operand,,high
EXP07-C,319,sqlite,src/util.c,1547,FP,a is u32 fixed varint decode shift,,high
INT13-C,320,sqlite,src/util.c,1554,FP,b is u32 shift on unsigned operand,,high
FIO50-C,321,sqlite,src/util.c,1557,FP,s is a u32 integer not a FILE stream,,high
ARR00-C,322,sqlite,src/util.c,1558,FP,p has advanced via four p++ so p[-4] indexes back into the read buffer not a negative array index,,high
FIO50-C,323,sqlite,src/util.c,1560,FP,b is a u32 integer not a FILE stream,,high
INT13-C,324,sqlite,src/util.c,1560,FP,b is u32 shift on unsigned operand,,high
API00-C,325,sqlite,src/util.c,1579,FP,internal contract caller via getVarint32 macro always passes a valid p; not a trust boundary,,high
INT13-C,326,sqlite,src/util.c,1585,FP,p is const unsigned char* element promoted to int; mask intended,,high
INT13-C,327,sqlite,src/util.c,1587,FP,p element mask intended in fixed varint decode,,high
INT13-C,328,sqlite,src/util.c,1589,FP,p element OR intended in fixed varint decode,,high
INT13-C,329,sqlite,src/util.c,1592,FP,p element mask intended,,high
INT13-C,330,sqlite,src/util.c,1594,FP,p element OR intended,,high
EXP07-C,331,sqlite,src/util.c,1594,FP,p[0]&0x7f is a small value promoted to int; shift cannot overflow,,high
MSC37-C,332,sqlite,src/util.c,1622,FP,every #if/#else branch of sqlite3Get4byte ends in return; no fallthrough,,high
INT13-C,333,sqlite,src/util.c,1636,FP,p is unsigned char element promoted to int; mask intended,,high
INT13-C,334,sqlite,src/util.c,1637,FP,p element OR intended,,high
INT30-C,335,sqlite,src/util.c,1637,FP,shift is explicitly (unsigned)p[0]<<24 author-intended big-endian assembly with testcase guard,,high
API00-C,336,sqlite,src/util.c,1640,FP,internal contract sqlite3Put4byte callers always pass valid p,,high
API00-C,337,sqlite,src/util.c,1664,FP,h validated by assert to be a hex char 0-9a-fA-F bounded value,,high
INT14-C,338,sqlite,src/util.c,1667,FP,h bounded to ASCII hex range; bitwise+arith style note only,,high
INT32-C,339,sqlite,src/util.c,1667,FP,h in 48..102 adding 9 cannot overflow int,,high
INT32-C,340,sqlite,src/util.c,1670,FP,EBCDIC branch h bounded hex range adding 9 cannot overflow,,high
API00-C,341,sqlite,src/util.c,1682,FP,internal contract db is a valid connection handle,,high
API00-C,342,sqlite,src/util.c,1682,FP,z is the blob-literal text caller-guaranteed non-null,,high
API00-C,343,sqlite,src/util.c,1682,FP,n is the literal byte length bounded by parser,,high
INT32-C,344,sqlite,src/util.c,1686,FP,n is a small positive literal length n/2+1 cannot overflow int,,high
INT32-C,345,sqlite,src/util.c,1687,FP,n is positive length decrement is safe far from INT_MIN,,high
ARR00-C,346,sqlite,src/util.c,1689,FP,n is the function parameter (initialized) not an uninitialized variable,,high
INT14-C,347,sqlite,src/util.c,1689,FP,i is the loop index style note only,,high
ARR37-C,348,sqlite,src/util.c,1690,FP,z points to the input literal buffer; subscript is valid array access,,high
EXP34-C,349,sqlite,src/util.c,1690,FP,z is caller-guaranteed non-null blob literal text,,high
ARR37-C,350,sqlite,src/util.c,1690,FP,z[i+1] valid access into literal buffer i+1<n+1 within bounds,,high
INT32-C,351,sqlite,src/util.c,1690,FP,i bounded by loop condition i<n; no overflow,,high
DCL30-C,352,sqlite,src/util.c,1694,FP,zBlob is heap from sqlite3DbMallocRawNN not local storage; comment states malloc-owned,,high
ARR00-C,353,sqlite,src/util.c,1694,FP,zBlob is heap-allocated and returned to caller to free; not a dangling local,,high
DCL13-C,354,sqlite,src/util.c,1741,TP,db only read (db->eOpenState) never written nor propagated to non-const; const would compile,,low
API00-C,355,sqlite,src/util.c,1761,FP,internal contract pA is a valid pointer to caller i64,,high
MSC37-C,356,sqlite,src/util.c,1761,FP,both #if and #else paths return; no fallthrough,,high
API00-C,357,sqlite,src/util.c,1781,FP,internal contract pA valid pointer,,high
MSC37-C,358,sqlite,src/util.c,1781,FP,both #if and #else paths return,,high
API00-C,359,sqlite,src/util.c,1796,FP,internal contract pA valid pointer,,high
MSC37-C,360,sqlite,src/util.c,1796,FP,both #if and #else paths return,,high
API00-C,361,sqlite,src/util.c,1822,FP,x==INT_MIN handled explicitly at line 1824 before any arithmetic,,high
INT32-C,362,sqlite,src/util.c,1825,FP,-x reached only after the ==0x80000000 case returns so x>=INT_MIN+1 negation safe,,high
INT32-C,363,sqlite,src/util.c,1853,FP,sz is Strlen30 result >=0; sz-1 cannot overflow,,high
ARR37-C,364,sqlite,src/util.c,1853,FP,z is the filename buffer; subscript is valid array access,,high
EXP34-C,365,sqlite,src/util.c,1853,FP,z is the filename param caller-guaranteed non-null,,high
ARR37-C,366,sqlite,src/util.c,1853,FP,z valid array access into filename buffer,,high
ARR37-C,367,sqlite,src/util.c,1854,FP,z valid array access,,high
EXP05-C,368,sqlite,src/util.c,1854,FP,z is char* not const here; no const qualification to cast away,,high
ARR37-C,369,sqlite,src/util.c,1854,FP,z[i+1] valid access guarded by loop bound,,high
ARR37-C,370,sqlite,src/util.c,1854,FP,z[sz-3] guarded by ALWAYS(sz>i+4),,high
INT32-C,371,sqlite,src/util.c,1854,FP,sz-3 reached only when sz>i+4>=4 so non-negative,,high
ARR02-C,372,sqlite,src/util.c,1866,FP,x[] is a static const lookup-table initializer; implicit bounds correct and intentional,,high
CON07-C,373,sqlite,src/util.c,1892,FP,a and x are static const read-only lookup tables not mutated shared state,,high
CON03-C,374,sqlite,src/util.c,1893,FP,a is a static const read-only table; no synchronization needed,,high
ARR02-C,375,sqlite,src/util.c,1893,FP,a[] static const initializer; implicit bounds intentional,,high
INT14-C,376,sqlite,src/util.c,1897,FP,x is the u64 value style note only,,high
INT32-C,377,sqlite,src/util.c,1900,FP,__builtin_clzll(x) in 0..63 so 60-clzll bounded; no overflow,,high
INT32-C,378,sqlite,src/util.c,1901,FP,i = 60-clzll <=60 so i*10 bounded,,high
ARR30-C,379,sqlite,src/util.c,1908,FP,x&7 masks index to 0..7 and a[] has 8 elements; in-bounds by construction,,high
DCL03-C,380,sqlite,src/util.c,1918,TP,assert(sizeof(x)==8 && sizeof(a)==8) is a pure compile-time constant; static_assert fits,,med
EXP05-C,381,sqlite,src/util.c,1921,FP,"a is a u64 local non-const; memcpy(&a,...) casts away nothing",,high
INT14-C,382,sqlite,src/util.c,1922,FP,a is u64 raw double bits; bitwise+arith style note only,,high
INT32-C,383,sqlite,src/util.c,1922,FP,a>>52 in 0..4095 for the reached path; minus 1022 cannot overflow,,high
EXP07-C,384,sqlite,src/util.c,1922,FP,a>>52 extracts the exponent field; not a constant assumption,,high
FIO50-C,385,sqlite,src/util.c,1922,FP,a is a u64 not a FILE stream,,high
CON07-C,386,sqlite,src/util.c,1929,FP,x is the function parameter not a shared static variable; misfire,,high
INT14-C,387,sqlite,src/util.c,1931,FP,x is LogEst parameter style note only,,high
INT10-C,388,sqlite,src/util.c,1931,FP,x is non-negative LogEst; modulo well-defined; style note,,high
INT14-C,389,sqlite,src/util.c,1933,FP,n is u64 local style note only,,high
INT34-C,390,sqlite,src/util.c,1936,FP,shift guarded by x>=3 and x>60 returns early so x-3 in 0..57 < 64,,high
FIO50-C,391,sqlite,src/util.c,1936,FP,(n+8) is an integer expression not a FILE stream,,high
INT34-C,392,sqlite,src/util.c,1936,FP,else branch x<3 so 3-x in 1..3 valid shift amount,,high
API00-C,393,sqlite,src/util.c,1975,FP,internal contract pIn may be NULL and is explicitly checked,,high
API00-C,394,sqlite,src/util.c,1975,FP,internal contract zName valid; not a trust boundary,,high
INT32-C,395,sqlite,src/util.c,1986,FP,nName is a name length; nName/4+3 cannot overflow int,,high
INT32-C,396,sqlite,src/util.c,1990,FP,computed in sqlite3_int64 arithmetic; no overflow,,high
INT32-C,397,sqlite,src/util.c,1990,FP,2*(sqlite3_int64)pIn[0] is explicit i64 cast; no 32-bit overflow,,high
INT30-C,398,sqlite,src/util.c,1991,FP,nAlloc is i64 bounded; multiply for realloc size; not an unsigned wrap defect,,high
INT32-C,399,sqlite,src/util.c,1991,FP,nAlloc is i64; sizeof promotes to size_t; result bounded by realloc contract,,high
INT32-C,400,sqlite,src/util.c,1999,FP,i indexes into the just-allocated VList within nAlloc bound,,high
INT32-C,401,sqlite,src/util.c,2000,FP,i+2 indexes within allocated VList,,high
INT32-C,402,sqlite,src/util.c,2001,FP,i+nInt bounded by assert pIn[1]<=pIn[0] at line 2002,,high
INT31-C,403,sqlite,src/util.c,2003,FP,nName is a non-negative length; conversion to size_t is benign,,high
EXP05-C,404,sqlite,src/util.c,2003,FP,z is char* (cast from &pIn[i+2]); zName is the const source; no const cast on dest,,high
ARR37-C,405,sqlite,src/util.c,2004,FP,z[nName] writes the terminator into the allocated VList slot; in-bounds,,high
DCL13-C,406,sqlite,src/util.c,2013,TP,pIn only read in sqlite3VListNumToName; const would compile (return casts away on a copy),,low
INT32-C,407,sqlite,src/util.c,2020,FP,pIn contents are trusted VList internal slot counts; no overflow,,high
DCL13-C,408,sqlite,src/util.c,2029,TP,pIn only read in sqlite3VListNameToNum returning a copied int; const would compile,,low
INT31-C,409,sqlite,src/util.c,2036,FP,nName is a non-negative length passed to strncmp; benign conversion,,high
ARR37-C,410,sqlite,src/util.c,2036,FP,z[nName] checks the terminator within the VList buffer; in-bounds,,high
INT32-C,411,sqlite,src/util.c,2037,FP,pIn slot counts trusted VList internal; no overflow,,high