rule,idx,project,file,line,verdict,reason,provenance,confidence
PRE06-C,0,sqlite,ext/expert/sqlite3expert.h,1,FP,has guard #if !defined(SQLITEEXPERT_H)/#define at l13-14; sqc missed the #if-!defined form,,
API02-C,1,sqlite,ext/expert/sqlite3expert.h,28,FP,"char**pzErr is an OUT error-msg pointer, not a sized buffer",,
EXP37-C,2,sqlite,ext/expert/sqlite3expert.h,58,FP,"legitimate prototyped variadic API (op,...), not old-style",,
API02-C,3,sqlite,ext/expert/sqlite3expert.h,83,FP,"char**pzErr is an OUT error-msg pointer, not a sized buffer",,
EXP37-C,4,sqlite,ext/expert/sqlite3expert.h,83,FP,multi-line decl fully prototypes all params; sqc misparsed the line break,,
API02-C,5,sqlite,ext/expert/sqlite3expert.h,108,FP,"char**pzErr is an OUT error-msg pointer, not a sized buffer",,
PRE06-C,6,sqlite,ext/fts3/fts3.h,1,TP,header genuinely lacks an include guard (only wraps extern C),,
DCL37-C,7,sqlite,ext/fts3/fts3_hash.h,18,TP,_FTS3_HASH_H_ is a reserved identifier (leading _ + uppercase),,
DCL37-C,8,sqlite,ext/fts3/fts3_tokenizer.h,21,TP,_FTS3_TOKENIZER_H_ is a reserved identifier,,
DCL37-C,9,sqlite,ext/fts5/fts5.h,22,TP,_FTS5_H is a reserved identifier (leading _ + uppercase),,
PRE06-C,10,sqlite,ext/icu/sqliteicu.h,1,TP,header genuinely lacks an include guard,,
DCL37-C,11,sqlite,ext/intck/sqlite3intck.h,59,TP,_SQLITE_INTCK_H is a reserved identifier,,
PRE01-C,12,sqlite,ext/misc/basexx.c,50,TP,INIT2(v) -> (void)v; unparenthesized v misparses with a comma/expr arg,,
API00-C,13,sqlite,ext/misc/basexx.c,68,FP,db/pApi supplied non-null by the extension-loader contract,,
DCL13-C,14,sqlite,ext/misc/noop.c,35,FP,argv is the fixed SQL-function callback signature; cannot const,,
DCL13-C,15,sqlite,ext/misc/noop.c,51,FP,argv is the fixed SQL-function callback signature; cannot const,,
API00-C,16,sqlite,ext/misc/noop.c,60,FP,db/pApi loader-guaranteed non-null at extension entry,,
DCL13-C,17,sqlite,ext/misc/noop.c,64,FP,pzErrMsg is the fixed extension-init signature (char**),,
DCL13-C,18,sqlite,ext/misc/remember.c,48,FP,argv fixed SQL-function callback signature,,
API00-C,19,sqlite,ext/misc/remember.c,62,FP,db/pApi loader-guaranteed non-null at extension init,,
DCL15-C,20,sqlite,ext/misc/remember.c,62,FP,sqlite3_remember_init is the public extension entry point; must be external,,
DCL13-C,21,sqlite,ext/misc/remember.c,64,FP,pzErrMsg is the fixed extension-init signature,,
DCL13-C,22,sqlite,ext/misc/showauth.c,28,FP,pClientData is the fixed sqlite3_set_authorizer callback signature (void*),,
EXP33-C,23,sqlite,ext/misc/showauth.c,75,FP,zOpSpace written by sqlite3_snprintf before read via zOp; not uninitialized,,
API00-C,24,sqlite,ext/misc/showauth.c,93,FP,db/pApi loader-guaranteed non-null at extension init,,
DCL15-C,25,sqlite,ext/misc/showauth.c,93,FP,sqlite3_showauth_init is the public extension entry point; must be external,,
DCL13-C,26,sqlite,ext/misc/showauth.c,95,FP,pzErrMsg fixed extension-init signature,,
DCL13-C,27,sqlite,ext/misc/sqlar.c,40,FP,argv fixed SQL-function callback signature,,
DCL13-C,28,sqlite,ext/misc/sqlar.c,81,FP,argv fixed SQL-function callback signature,,
API00-C,29,sqlite,ext/misc/sqlar.c,107,FP,db/pApi loader-guaranteed non-null at extension init,,
DCL13-C,30,sqlite,ext/misc/sqlar.c,111,FP,pzErrMsg fixed extension-init signature,,
DCL37-C,31,sqlite,ext/misc/sqlite3_stdio.h,30,TP,_SQLITE3_STDIO_H_ is a reserved identifier,,
API02-C,32,sqlite,ext/misc/sqlite3_stdio.h,39,FP,"stdio shim mirrors fgets/fputs/fprintf/vfprintf; size present or NUL-terminated/va_list, no sized buffer",,
API02-C,33,sqlite,ext/misc/sqlite3_stdio.h,40,FP,"stdio shim mirrors fgets/fputs/fprintf/vfprintf; size present or NUL-terminated/va_list, no sized buffer",,
API02-C,34,sqlite,ext/misc/sqlite3_stdio.h,41,FP,"stdio shim mirrors fgets/fputs/fprintf/vfprintf; size present or NUL-terminated/va_list, no sized buffer",,
EXP37-C,35,sqlite,ext/misc/sqlite3_stdio.h,41,FP,legitimate printf-style variadic with proper prototype,,
API02-C,36,sqlite,ext/misc/sqlite3_stdio.h,42,FP,"stdio shim mirrors fgets/fputs/fprintf/vfprintf; size present or NUL-terminated/va_list, no sized buffer",,
DCL13-C,37,sqlite,ext/misc/stmtrand.c,48,FP,argv fixed SQL-function callback signature,,
INT14-C,38,sqlite,ext/misc/stmtrand.c,74,FP,deliberate PRNG bit-mixing; idiomatic,,
INT32-C,39,sqlite,ext/misc/stmtrand.c,74,FP,"operands are unsigned int (p->x); unsigned, no signed overflow; intentional PRNG wrap",,
INT30-C,40,sqlite,ext/misc/stmtrand.c,75,FP,deliberate unsigned LCG modular wrap (p->y unsigned int),,
API00-C,41,sqlite,ext/misc/stmtrand.c,80,FP,db/pApi loader-guaranteed non-null at extension init,,
DCL13-C,42,sqlite,ext/misc/stmtrand.c,84,FP,pzErrMsg fixed extension-init signature,,
API02-C,43,sqlite,ext/qrf/qrf.h,65,FP,opaque stmt*/spec/out-err pointers; no sized buffer,,
DCL37-C,44,sqlite,ext/rbu/sqlite3rbu.h,268,TP,_SQLITE3RBU_H is a reserved identifier,,
API02-C,45,sqlite,ext/rbu/sqlite3rbu.h,458,FP,opaque handle + out-params/callbacks; no sized buffer,,
INT30-C,46,sqlite,ext/rbu/sqlite3rbu.h,465,FP,"misparse: sqlite3rbu*pRbu is a pointer param, no arithmetic",,
API02-C,47,sqlite,ext/rbu/sqlite3rbu.h,507,FP,opaque handle + out-params/callbacks; no sized buffer,,
API02-C,48,sqlite,ext/rbu/sqlite3rbu.h,568,FP,opaque handle + out-params/callbacks; no sized buffer,,
DCL37-C,49,sqlite,ext/recover/sqlite3recover.h,51,TP,_SQLITE_RECOVER_H is a reserved identifier,,
API02-C,50,sqlite,ext/recover/sqlite3recover.h,117,FP,db handle + NUL-terminated path strings; no sized buffer,,
PRE06-C,51,sqlite,ext/rtree/rtree.h,1,TP,header genuinely lacks an include guard (only __cplusplus guard),,
DCL37-C,52,sqlite,ext/rtree/sqlite3rtree.h,15,TP,_SQLITE3RTREE_H_ is a reserved identifier,,
API02-C,53,sqlite,ext/rtree/sqlite3rtree.h,41,FP,db handle/NUL-string/opaque ctx/callback ptrs; no sized buffer,,
API02-C,54,sqlite,ext/rtree/sqlite3rtree.h,67,FP,db handle/NUL-string/opaque ctx/callback ptrs; no sized buffer,,
MSC37-C,55,sqlite,src/fault.c,35,FP,"line 35 is a static struct decl, not a non-void function",,
API00-C,56,sqlite,src/fault.c,60,FP,"xBenignBegin/xBenignEnd only stored into a struct field, NULL-checked before call",,
DCL13-C,57,sqlite,src/mem0.c,32,FP,param fixed by sqlite3_mem_methods function-pointer struct; cannot const,,
DCL13-C,58,sqlite,src/mem0.c,33,FP,param fixed by sqlite3_mem_methods function-pointer struct; cannot const,,
DCL13-C,59,sqlite,src/mem0.c,34,FP,param fixed by sqlite3_mem_methods function-pointer struct; cannot const,,
DCL13-C,60,sqlite,src/mem0.c,36,FP,param fixed by sqlite3_mem_methods function-pointer struct; cannot const,,
DCL13-C,61,sqlite,src/mem0.c,37,FP,param fixed by sqlite3_mem_methods function-pointer struct; cannot const,,
MSC04-C,62,sqlite,src/mem0.c,45,FP,false indirect-recursion: sqlite3MemSetDefault->sqlite3_config never calls back,,
PRE06-C,63,sqlite,src/mutex.h,1,TP,header genuinely lacks an include guard,,
PRE05-C,64,sqlite,src/mutex.h,59,FP,"sqlite3_mutex_enter(X) empty replacement, no # operator present",,
PRE00-C,65,sqlite,src/mutex.h,61,FP,sqlite3_mutex_leave(X) empty replacement; X never evaluated,,
PRE05-C,66,sqlite,src/mutex.h,61,FP,empty replacement; no # operator,,
PRE12-C,67,sqlite,src/mutex.h,61,FP,empty replacement; X never evaluated,,
PRE01-C,68,sqlite,src/mutex.h,69,FP,MUTEX_LOGIC(X)=X must expand bare to wrap declarations; parenthesizing breaks purpose,,
DCL37-C,69,sqlite,src/os.h,21,TP,_SQLITE_OS_H_ is a reserved identifier,,
API02-C,70,sqlite,src/os.h,184,FP,"pResOut is a single-object int out-pointer, not an array",,
API02-C,71,sqlite,src/os.h,205,FP,"pResOut is a single-object int out-pointer, not an array",,
PRE02-C,72,sqlite,src/pager.h,26,TP,object-like macro body -1 unparenthesized; should be (-1) (cf l78),,
PRE02-C,73,sqlite,src/pager.h,67,TP,PAGER_LOCKINGMODE_QUERY bare -1; should be (-1) like l78,,
API02-C,74,sqlite,src/pager.h,194,FP,"pisOpen single-object int out-pointer, not an array",,
API02-C,75,sqlite,src/pcache.h,74,FP,szPage/szExtra ARE the sizes; xStress is a callback ptr; no unsized buffer,,
PRE11-C,76,sqlite,src/sqlite3ext.h,727,TP,SQLITE_EXTENSION_INIT1 expands to a statement ending in ; (PRE11 hazard),,
PRE01-C,77,sqlite,src/sqlite3ext.h,728,TP,INIT2(v)=sqlite3_api=v; unparenthesized v; comma-expr arg misbinds,,
PRE11-C,78,sqlite,src/sqlite3ext.h,728,TP,INIT2 replacement (sqlite3_api=v;) ends in a semicolon,,
PRE11-C,79,sqlite,src/sqlite3ext.h,729,FP,"INIT3 is an extern decl whose ; is required syntax, not a macro-terminating ;",,
PRE01-C,80,sqlite,src/sqlite3ext.h,735,TP,(void)v; unparenthesized cast operand can misbind with comma-expr,,
PRE11-C,81,sqlite,src/sqlite3ext.h,735,TP,INIT2 static branch ((void)v;) ends in a semicolon,,
PRE02-C,82,sqlite,src/sqliteLimit.h,161,TP,object-like macro expands to unparenthesized negative literal -2000,,
API02-C,83,sqlite,src/wal.h,87,FP,xUndo callback + opaque pUndoCtx; no sized buffer,,
API02-C,84,sqlite,src/wal.h,101,FP,nBuf is the explicit size for zBuf; handles/callbacks otherwise,,
INT12-C,85,sqlite,src/whereInt.h,140,FP,"line 140 is ""union {""; the only bit-fields use explicit unsigned u32",,
INT12-C,86,sqlite,src/whereInt.h,149,FP,"line 149 is ""struct {""; bit-fields are u32 :1 (explicitly unsigned)",,
STR31-C,87,sqlite,src/whereInt.h,363,FP,"WhereTerm aStatic[1] is a struct-hack object array, not a char string",,
EXP37-C,88,sqlite,src/whereInt.h,540,FP,"full prototype with named typed params, not old-style K&R",,
INT31-C,90,sqlite,ext/misc/sqlar.c,94,FN,"sqlite3_int64 sz (uncompressed size from a sqlar blob; attacker-controllable) -> sqlite3_malloc(int); sz>INT_MAX truncates the allocation, then uncompress writes full szf bytes -> heap overflow","CONFIRMED REAL + FIXED upstream: sqlar.c sqlite3_malloc(sz)->sqlite3_malloc64(sz) in 34e139d3a3 (2026-04-01) ""Always use sqlite3_malloc64() in extensions"". Audited b1a73ba34d predates it. sqc FN validated against ground truth.",medium
PRE06-C,91,sqlite,src/pcache.h,16,FN,#ifndef _PCACHE_H_ at l16 has NO matching #define so the include guard never arms (re-inclusion unprotected); _PCACHE_H_ is also a reserved identifier,TRUNK-VALIDATED: STILL PRESENT on sqlite-main 124f449319 (#ifndef _PCACHE_H_ still has no matching #define). Trivial/harmless in the single-include amalgamation; low-value upstream PR candidate.,medium