sqc 0.4.84

rule,idx,project,file,line,verdict,reason,provenance,confidence
ARR02-C,0,sqlite,src/json.c,142,FP,"jsonbType const lookup table with initializer-determined bounds, correctly sized for indices 0-12",,high
ARR02-C,1,sqlite,src/json.c,153,FP,jsonIsSpace const table sized by initializer; indexed via (unsigned char) cast so 0-255 in bounds,,high
PRE01-C,2,sqlite,src/json.c,196,TP,"jsonIsspace(x) macro expands x as (unsigned char)x without parens; compound arg would misparse, PRE01 hygiene issue",,med
ARR02-C,3,sqlite,src/json.c,216,FP,jsonIsOk[256] has 256 initializers per mutually-exclusive ifdef branch; analyzer summed both,,high
EXP05-C,4,sqlite,src/json.c,428,FP,"p is void* (not const) in jsonCacheDeleteGeneric; cast of non-const pointer, no const discarded",,high
ARR38-C,5,sqlite,src/json.c,459,FP,"memmove size (JSON_CACHE_SIZE-1)*sizeof is compile-time constant 24, not attacker-influenced",,high
INT30-C,6,sqlite,src/json.c,459,FP,"constant 3*8 evaluated at compile time, cannot wrap",,high
INT32-C,7,sqlite,src/json.c,459,FP,"memmove size constant 24, no runtime arithmetic overflow",,high
INT32-C,8,sqlite,src/json.c,467,FP,"p->nUsed bounded 0..4, increment cannot approach INT_MAX",,high
INT31-C,9,sqlite,src/json.c,508,FP,nJson non-negative from value_bytes; memcmp runs after equality check; size_t conversion safe,,high
ARR38-C,10,sqlite,src/json.c,515,FP,memmove over JsonParse array bounded by nUsed<=4; indices guarded by i<nUsed,,high
INT30-C,11,sqlite,src/json.c,515,FP,"i+1 indexes 4-entry cache; i<nUsed-1<=2, no wrap",,high
INT30-C,12,sqlite,src/json.c,515,FP,"(nUsed-i-1)*sizeof with nUsed<=4 small, no wrap",,high
INT30-C,13,sqlite,src/json.c,515,FP,nUsed-i positive since i<nUsed; nUsed<=4,,high
INT32-C,14,sqlite,src/json.c,515,FP,memmove size bounded by cache size 4,,high
INT32-C,15,sqlite,src/json.c,515,FP,i+1 bounded by cache size 4,,high
INT32-C,16,sqlite,src/json.c,515,FP,nUsed-i-1 positive (i<nUsed-1) and small,,high
INT32-C,17,sqlite,src/json.c,515,FP,nUsed-i positive (i<nUsed) small,,high
INT32-C,18,sqlite,src/json.c,516,FP,nUsed-1 with nUsed 1..4 after match,,high
INT32-C,19,sqlite,src/json.c,517,FP,nUsed-1 bounded by cache size 4,,high
ARR01-C,20,sqlite,src/json.c,535,FP,"sizeof(p->zSpace) is sizeof a fixed char[100] member, yields 100 correctly",,high
DCL13-C,21,sqlite,src/json.c,542,FP,"pCtx stored into non-const field p->pCtx, const param would not compile",,high
INT32-C,22,sqlite,src/json.c,577,FP,(size_t)p->nUsed bounded by prior allocation,,high
DCL03-C,23,sqlite,src/json.c,599,FP,"assert(N>0) on runtime u32 param, not a constant expression",,high
EXP05-C,24,sqlite,src/json.c,601,FP,"N is a u32 size value, not a const pointer",,high
EXP05-C,25,sqlite,src/json.c,609,FP,"N is a u32 size value, not a const pointer",,high
EXP34-C,26,sqlite,src/json.c,609,FP,jsonAppendRaw memcpy reached only when N>0; null+N>0 unreachable per caller contract,,med
DCL03-C,27,sqlite,src/json.c,614,FP,assert(N>0) runtime param not constant,,high
EXP05-C,28,sqlite,src/json.c,618,FP,"N size value, not const pointer",,high
ARR02-C,29,sqlite,src/json.c,687,FP,"aSpecial const table sized by initializer, verified by assert; indices bounded by assert c<sizeof",,high
DCL03-C,30,sqlite,src/json.c,691,TP,assert(sizeof(aSpecial)==32) is a compile-time constant; static_assert would be idiomatic (DCL03),,med
STR00-C,31,sqlite,src/json.c,699,FP,c is u8 (unsigned) bounded by assert(c<sizeof); not a signed char index,,high
STR00-C,32,sqlite,src/json.c,701,FP,c is u8 unsigned bounded by assert c<32,,high
INT08-C,33,sqlite,src/json.c,708,FP,c is u8 unsigned; c>>4 no signedness issue,,high
INT13-C,34,sqlite,src/json.c,708,FP,c is u8 unsigned; >>4 well-defined,,high
INT13-C,35,sqlite,src/json.c,709,FP,c is u8 unsigned; c&0xf well-defined,,high
STR00-C,36,sqlite,src/json.c,709,FP,"c is u8 unsigned, no signedness issue",,high
ARR30-C,37,sqlite,src/json.c,737,FP,"z is const u8*; z[k] is 0-255, jsonIsOk has 256 entries",,high
STR00-C,38,sqlite,src/json.c,737,FP,z is const u8* index 0-255 in bounds for jsonIsOk[256],,high
ARR30-C,39,sqlite,src/json.c,740,FP,"z is const u8*; index 0-255, jsonIsOk sized 256",,high
STR00-C,40,sqlite,src/json.c,740,FP,z is const u8* unsigned index in bounds,,high
STR00-C,41,sqlite,src/json.c,743,FP,z is const u8* unsigned index,,high
STR00-C,42,sqlite,src/json.c,747,FP,z is const u8* unsigned index,,high
STR00-C,43,sqlite,src/json.c,751,FP,z is const u8* unsigned index,,high
EXP05-C,44,sqlite,src/json.c,760,FP,"k is u32 byte count for memcpy, not a const pointer",,high
EXP05-C,45,sqlite,src/json.c,766,FP,"k is u32 byte count, not a const pointer",,high
INT13-C,46,sqlite,src/json.c,855,FP,flags is int bit-flags from user_data; flags & JSON_BLOB is intended bit test,,high
INT14-C,47,sqlite,src/json.c,938,FP,h is small hex-char int 0-127; h+=9*(1&(h>>6)) cannot approach INT_MAX,,high
INT32-C,48,sqlite,src/json.c,938,FP,h tiny hex magnitude; no overflow,,high
INT32-C,49,sqlite,src/json.c,941,FP,h small hex value; EBCDIC adjustment cannot overflow,,high
EXP07-C,50,sqlite,src/json.c,951,FP,jsonHexToInt4 shifts small 0-15 nibbles; EXP07 misfire on hex conversion,,high
INT14-C,51,sqlite,src/json.c,951,FP,z indexed/shifted in standard 4-hex decode; readability note only,,high
INT14-C,52,sqlite,src/json.c,951,FP,jsonHexToInt is a function name not a variable; INT14 misfire,,high
MSC37-C,53,sqlite,src/json.c,1008,FP,json5Whitespace while(1) exits via goto whitespace_done then return n; all paths return,,high
EXP05-C,54,sqlite,src/json.c,1010,TP,(u8*)zIn casts away const from const char* zIn before assigning to const u8* z; genuine EXP05 const-discard,,med
INT32-C,55,sqlite,src/json.c,1019,FP,n counts whitespace in NUL-terminated text bounded by SQLite text size limit; cannot reach INT_MAX,,high
INT32-C,56,sqlite,src/json.c,1025,FP,n+3 indexes within NUL-terminated input; n bounded well below INT_MAX,,high
INT32-C,57,sqlite,src/json.c,1028,FP,j+1 within comment scan of NUL-terminated input; bounded,,high
INT32-C,58,sqlite,src/json.c,1033,FP,n+2 index bounded by NUL-terminated finite input,,high
INT32-C,59,sqlite,src/json.c,1038,FP,j+=2 bounded by finite NUL-terminated input,,high
INT32-C,60,sqlite,src/json.c,1043,FP,n++ bounded by finite input length far below INT_MAX,,high
INT32-C,61,sqlite,src/json.c,1050,FP,n+=2 bounded by finite input,,high
INT32-C,62,sqlite,src/json.c,1057,FP,n+=3 bounded by finite input,,high
DCL00-C,63,sqlite,src/json.c,1064,TP,local u8 c=z[n+2] assigned once never modified; const-qualifying would compile (DCL00),,low
INT32-C,64,sqlite,src/json.c,1064,FP,n+2 indexes NUL-terminated input; bounded,,high
INT32-C,65,sqlite,src/json.c,1067,FP,n+=3 bounded by finite input,,high
INT32-C,66,sqlite,src/json.c,1071,FP,n+=3 bounded by finite input,,high
INT32-C,67,sqlite,src/json.c,1078,FP,n+=3 bounded by finite input,,high
INT32-C,68,sqlite,src/json.c,1085,FP,n+=3 bounded by finite input,,high
ARR02-C,69,sqlite,src/json.c,1110,FP,"aNanInfName const struct table sized by initializer; ARR02 style-only, correctly sized",,high
EXP43-C,70,sqlite,src/json.c,1181,FP,memcpy copies external aOld into freshly realloc'd aBlob; distinct non-overlapping buffers,,high
EXP43-C,71,sqlite,src/json.c,1191,FP,jsonBlobExpand is a realloc helper not a memcpy; no overlapping-region copy,,high
MSC04-C,72,sqlite,src/json.c,1212,TP,"jsonBlobExpandAndAppendNode and jsonBlobAppendNode are genuinely mutually recursive, factual indirect recursion",,high
MSC04-C,73,sqlite,src/json.c,1232,TP,jsonBlobAppendNode->jsonBlobExpandAndAppendNode->jsonBlobAppendNode genuine indirect recursion,,high
INT14-C,74,sqlite,src/json.c,1239,FP,szPayload bit-shift plus compare is readable idiom; INT14 style-only,,high
ARR37-C,75,sqlite,src/json.c,1246,FP,a points into pParse->aBlob[nBlob] sized by the expand check; subscript valid,,high
ARR37-C,76,sqlite,src/json.c,1249,FP,a indexes the just-resized aBlob region (szPayload+9 headroom guaranteed),,high
ARR37-C,77,sqlite,src/json.c,1250,FP,a[1] within the >=2-byte header headroom ensured by nBlobAlloc check,,high
ARR37-C,78,sqlite,src/json.c,1253,FP,a[0] valid within expanded aBlob,,high
ARR37-C,79,sqlite,src/json.c,1254,FP,a[1] valid (3-byte header headroom guaranteed),,high
FIO50-C,80,sqlite,src/json.c,1254,FP,"FIO50 misfire: szPayload is an integer, not a FILE* stream",,high
ARR37-C,81,sqlite,src/json.c,1255,FP,a[2] valid within 3-byte header space,,high
ARR37-C,82,sqlite,src/json.c,1258,FP,a[0] valid within 5-byte header space,,high
ARR37-C,83,sqlite,src/json.c,1259,FP,a[1] valid within 5-byte header space,,high
ARR37-C,84,sqlite,src/json.c,1260,FP,a[2] valid within 5-byte header space,,high
ARR37-C,85,sqlite,src/json.c,1261,FP,a[3] valid within 5-byte header space,,high
ARR37-C,86,sqlite,src/json.c,1262,FP,a[4] valid within 5-byte header space,,high
ARR37-C,87,sqlite,src/json.c,1285,FP,a=&aBlob[i] with i a valid node offset (i<=nBlob); a[0] reads existing header,,high
ARR00-C,88,sqlite,src/json.c,1306,FP,nNeeded/nExtra are local u8 counts not pointers; ARR00 pointer-subtraction misread,,high
ARR37-C,89,sqlite,src/json.c,1314,FP,"a=&aBlob[i], buffer grown before memmove; a[1+delta] within bounds",,high
ARR37-C,90,sqlite,src/json.c,1314,FP,a[1] is the header-following byte within grown buffer,,high
ARR38-C,91,sqlite,src/json.c,1314,FP,memmove size nBlob-(i+1) valid (i+1<=nBlob); buffer pre-expanded for delta>0,,high
EXP05-C,92,sqlite,src/json.c,1314,FP,&a[1+delta] is u8* into mutable aBlob; no const cast away,,high
INT30-C,93,sqlite,src/json.c,1314,FP,i+1 bounded node index << UINT32_MAX; no wrap,,high
INT32-C,94,sqlite,src/json.c,1314,FP,"nBlob-(i+1): i is a node offset < nBlob, in-range, no overflow",,high
ARR37-C,95,sqlite,src/json.c,1316,FP,a[1] within aBlob after shrink memmove,,high
ARR37-C,96,sqlite,src/json.c,1316,FP,"a[1-delta] with delta<0 means offset >1, within existing bytes",,high
ARR38-C,97,sqlite,src/json.c,1316,FP,shrink-path memmove size nBlob-(i+1-delta) in range,,high
EXP05-C,98,sqlite,src/json.c,1316,FP,&a[1] is u8* into writable aBlob; no const cast-away,,high
INT30-C,99,sqlite,src/json.c,1316,FP,"i+1 bounded node index, no wrap",,high
INT32-C,100,sqlite,src/json.c,1316,FP,nBlob-(i+1-delta) in range for shrink path,,high
ARR37-C,101,sqlite,src/json.c,1321,FP,a[0] writes header byte in valid aBlob slot,,high
ARR37-C,102,sqlite,src/json.c,1321,FP,duplicate a[0] same valid slot,,high
FIO50-C,103,sqlite,src/json.c,1321,FP,FIO50 misfire: szPayload not a file stream,,high
ARR37-C,104,sqlite,src/json.c,1323,FP,a[0] valid header slot (nNeeded==1),,high
ARR37-C,105,sqlite,src/json.c,1323,FP,duplicate a[0],,high
ARR37-C,106,sqlite,src/json.c,1324,FP,a[1] valid (1 extra byte reserved),,high
ARR37-C,107,sqlite,src/json.c,1326,FP,a[0] valid header slot (nNeeded==2),,high
ARR37-C,108,sqlite,src/json.c,1326,FP,duplicate a[0],,high
ARR37-C,109,sqlite,src/json.c,1327,FP,a[1] valid,,high
FIO50-C,110,sqlite,src/json.c,1327,FP,FIO50 misfire on integer szPayload,,high
ARR37-C,111,sqlite,src/json.c,1328,FP,a[2] valid (2 extra bytes),,high
ARR37-C,112,sqlite,src/json.c,1330,FP,a[0] valid header slot (nNeeded==4),,high
ARR37-C,113,sqlite,src/json.c,1330,FP,duplicate a[0],,high
ARR37-C,114,sqlite,src/json.c,1331,FP,a[1] valid,,high
ARR37-C,115,sqlite,src/json.c,1332,FP,a[2] valid,,high
ARR37-C,116,sqlite,src/json.c,1333,FP,a[3] valid,,high
ARR37-C,117,sqlite,src/json.c,1334,FP,a[4] valid (4 extra bytes reserved),,high
MEM05-C,118,sqlite,src/json.c,1361,TP,"jsonbValidityCheck recurses, recursion genuinely exists (depth-bounded by JSON_MAX_DEPTH)",,high
INT14-C,119,sqlite,src/json.c,1370,FP,i used in shift+arith is readable idiom; INT14 style-only,,high
INT30-C,120,sqlite,src/json.c,1370,FP,i+1 where i is bounded blob offset < nBlob; no wrap,,high
INT30-C,121,sqlite,src/json.c,1373,FP,"i+1 bounded blob offset, no wrap",,high
INT30-C,122,sqlite,src/json.c,1374,FP,"i+1 bounded blob offset, no wrap",,high
EXP34-C,123,sqlite,src/json.c,1376,FP,z=pParse->aBlob non-null when n!=0; z[i] in-bounds,,high
STR00-C,124,sqlite,src/json.c,1376,FP,z is const u8* so z[i] is unsigned 0-255; bit op on unsigned,,high
INT30-C,125,sqlite,src/json.c,1381,FP,i+1 bounded blob offset,,high
INT30-C,126,sqlite,src/json.c,1384,FP,i+1 bounded blob offset,,high
INT30-C,127,sqlite,src/json.c,1388,FP,i+1 bounded blob offset,,high
EXP33-C,128,sqlite,src/json.c,1391,FP,j assigned j=i+n before any read in each switch branch,,high
EXP33-C,129,sqlite,src/json.c,1391,FP,k assigned k=i+n+sz (or j+sz) before use in each branch,,high
INT14-C,130,sqlite,src/json.c,1395,FP,j shift+arith readable idiom; INT14 style-only,,high
INT32-C,131,sqlite,src/json.c,1395,FP,j+1 where j<k<=nBlob; no signed overflow reachable,,high
INT30-C,132,sqlite,src/json.c,1401,FP,i+1 bounded blob offset,,high
INT30-C,133,sqlite,src/json.c,1404,FP,i+1 bounded blob offset,,high
INT30-C,134,sqlite,src/json.c,1407,FP,i+1 bounded blob offset,,high
INT32-C,135,sqlite,src/json.c,1408,FP,"j+2 bounded blob offset, no overflow",,high
INT30-C,136,sqlite,src/json.c,1423,FP,i+1 bounded blob offset,,high
INT30-C,137,sqlite,src/json.c,1428,FP,i+1 bounded blob offset,,high
INT30-C,138,sqlite,src/json.c,1462,FP,i+1 bounded blob offset,,high
ARR30-C,139,sqlite,src/json.c,1469,FP,z[j] is const u8* index 0-255 into jsonIsOk[256]; in-bounds,,high
INT32-C,140,sqlite,src/json.c,1469,FP,"j+1 bounded blob offset, no overflow",,high
STR00-C,141,sqlite,src/json.c,1469,FP,z is u8* so z[j] index is unsigned 0-255,,high
ARR30-C,142,sqlite,src/json.c,1479,FP,"z[j] unsigned index into jsonIsOk[256], in-bounds",,high
STR00-C,143,sqlite,src/json.c,1479,FP,"z u8* index unsigned, not negative",,high
INT32-C,144,sqlite,src/json.c,1481,FP,j+1 bounded blob offset,,high
INT32-C,145,sqlite,src/json.c,1484,FP,j+1 bounded blob offset,,high
INT32-C,146,sqlite,src/json.c,1486,FP,j+1 bounded blob offset,,high
INT32-C,147,sqlite,src/json.c,1490,FP,j+1 bounded blob offset,,high
INT32-C,148,sqlite,src/json.c,1491,FP,j+2 bounded; j+5>=k guard ensures z[j+2] within payload,,high
INT32-C,149,sqlite,src/json.c,1491,FP,j+1 bounded blob offset,,high
INT32-C,150,sqlite,src/json.c,1494,FP,j+1 bounded blob offset,,high
DCL00-C,151,sqlite,src/json.c,1496,FP,c passed by address to jsonUnescapeOneChar and written through; const would break it,,high
INT32-C,152,sqlite,src/json.c,1498,FP,j+1 bounded blob offset,,high
INT07-C,153,sqlite,src/json.c,1499,FP,szC is u32 from jsonUnescapeOneChar return; INT07 char-numeric misfire,,high
INT32-C,154,sqlite,src/json.c,1516,FP,j+1 bounded blob offset,,high
INT32-C,155,sqlite,src/json.c,1517,FP,j+1 bounded blob offset,,high
INT32-C,156,sqlite,src/json.c,1533,FP,"j+1 bounded blob offset (array element scan, j<k)",,high
INT32-C,157,sqlite,src/json.c,1534,FP,j+1 bounded blob offset,,high
STR00-C,158,sqlite,src/json.c,1536,FP,"z const u8*; z[j] unsigned, no signedness issue",,high
INT32-C,159,sqlite,src/json.c,1537,FP,j+1 bounded blob offset,,high
INT32-C,160,sqlite,src/json.c,1545,FP,j+1 bounded blob offset (object element scan),,high
INT30-C,161,sqlite,src/json.c,1549,FP,i+1 bounded blob offset,,high
MEM05-C,162,sqlite,src/json.c,1570,TP,"jsonTranslateTextToBlob recurses, recursion genuinely exists, bounded by iDepth/JSON_MAX_DEPTH",,high
MSC37-C,163,sqlite,src/json.c,1570,FP,switch has default: return i+1; every path returns a value,,high
INT14-C,164,sqlite,src/json.c,1582,FP,pParse pointer-arith INT14 misread (member access),,high
INT30-C,165,sqlite,src/json.c,1582,FP,nJson-i: i advances only over consumed input so i<=nJson; no underflow in practice,,high
INT30-C,166,sqlite,src/json.c,1588,FP,i+1 bounded text offset into NUL-terminated zJson,,high
EXP33-C,167,sqlite,src/json.c,1590,FP,j assigned in for-init (j=i+1) before use,,high
EXP33-C,168,sqlite,src/json.c,1591,FP,x assigned x=jsonTranslateTextToBlob(...) before any read,,high
EXP33-C,169,sqlite,src/json.c,1595,FP,iStart assigned iStart=pParse->nBlob before use,,high
EXP33-C,170,sqlite,src/json.c,1620,FP,t assigned in each branch before read,,high
INT32-C,171,sqlite,src/json.c,1656,FP,1+(u32)strspn bounded by remaining NUL-terminated input; no overflow,,high
EXP33-C,172,sqlite,src/json.c,1676,FP,iThis assigned iThis=pParse->nBlob before use,,high
INT30-C,173,sqlite,src/json.c,1684,FP,nJson-i: i<=nJson since parser only advances over consumed bytes,,high
INT30-C,174,sqlite,src/json.c,1691,FP,i+1 bounded text offset,,high
INT32-C,175,sqlite,src/json.c,1709,FP,1+(u32)strspn bounded by NUL-terminated input,,high
MSC07-C,176,sqlite,src/json.c,1739,FP,case label reachable via switch dispatch; not dead after goto,,high
INT30-C,177,sqlite,src/json.c,1744,FP,i+1 bounded text offset,,high
ARR30-C,178,sqlite,src/json.c,1746,FP,"(u8)z[j] cast to unsigned index into jsonIsOk[256], in-bounds",,high
EXP33-C,179,sqlite,src/json.c,1757,FP,c assigned c=z[j] before read in each branch,,high
INT30-C,180,sqlite,src/json.c,1798,FP,j-1-i: j>i in parse loop (j starts at i+1) so non-negative; bounded,,high
INT30-C,181,sqlite,src/json.c,1798,FP,i+1 bounded text offset,,high
INT30-C,182,sqlite,src/json.c,1802,FP,i+4 reads within NUL-terminated zJson; short-circuit at NUL,,high
INT30-C,183,sqlite,src/json.c,1804,FP,i+4 bounded; reads gated by prior char checks and NUL terminator,,high
INT30-C,184,sqlite,src/json.c,1810,FP,"i+5 bounded text offset, NUL-terminated input",,high
INT30-C,185,sqlite,src/json.c,1812,FP,i+5 bounded text offset,,high
MSC07-C,186,sqlite,src/json.c,1822,FP,case '.': label reachable via switch dispatch; not dead after goto,,high
INT30-C,187,sqlite,src/json.c,1823,FP,i+1 bounded text offset,,high
DCL03-C,188,sqlite,src/json.c,1846,TP,assert('-'<'0') is a constant expression in runtime assert; static_assert would be more appropriate (DCL03),,high
STR09-C,189,sqlite,src/json.c,1846,FP,'-'<'0' compile-time constant comparison documenting ASCII ordering; intentional,,med
DCL03-C,190,sqlite,src/json.c,1847,TP,assert('+'<'0') constant expression; static_assert candidate (DCL03),,high
STR09-C,191,sqlite,src/json.c,1847,FP,"'+'<'0' constant comparison in assert, intentional",,med
DCL03-C,192,sqlite,src/json.c,1848,TP,assert('.'<'0') constant expression; static_assert candidate (DCL03),,high
STR09-C,193,sqlite,src/json.c,1848,FP,"'.'<'0' constant comparison in assert, intentional",,med
INT30-C,194,sqlite,src/json.c,1853,FP,i+1 bounded text offset,,high
INT30-C,195,sqlite,src/json.c,1853,FP,i+1 bounded text offset,,high
INT30-C,196,sqlite,src/json.c,1853,FP,i+2 bounded; reads gated by NUL-terminated input,,high
INT30-C,197,sqlite,src/json.c,1857,FP,i+3 bounded text offset,,high
INT30-C,198,sqlite,src/json.c,1859,FP,i+1 bounded text offset,,high
INT30-C,199,sqlite,src/json.c,1860,FP,i+1 bounded text offset,,high
INT30-C,200,sqlite,src/json.c,1864,FP,i+1 bounded text offset,,high
INT30-C,201,sqlite,src/json.c,1868,FP,i+1 bounded text offset,,high
INT30-C,202,sqlite,src/json.c,1868,FP,i+1 bounded text offset,,high
INT30-C,203,sqlite,src/json.c,1869,FP,i+1 bounded text offset,,high
INT30-C,204,sqlite,src/json.c,1877,FP,"i + (strNICmp(...)?9:4): i bounded text offset, small addend; no wrap",,high
INT30-C,205,sqlite,src/json.c,1877,FP,i+4 bounded; strNICmp short-circuits at NUL,,high
INT30-C,206,sqlite,src/json.c,1879,FP,i+1 bounded text offset,,high
INT14-C,207,sqlite,src/json.c,1881,FP,t bit+arith readable idiom; INT14 style-only,,high
INT30-C,208,sqlite,src/json.c,1887,FP,i+1 bounded text offset,,high
INT30-C,209,sqlite,src/json.c,1888,FP,i+2 bounded text offset,,high
INT30-C,210,sqlite,src/json.c,1889,FP,i+1 bounded text offset,,high
INT30-C,211,sqlite,src/json.c,1891,FP,i+2 bounded text offset,,high
INT30-C,212,sqlite,src/json.c,1891,FP,i+2 bounded text offset,,high
INT30-C,213,sqlite,src/json.c,1891,FP,i+3 bounded text offset,,high
INT30-C,214,sqlite,src/json.c,1894,FP,i+4 bounded text offset,,high
INT30-C,215,sqlite,src/json.c,1902,FP,i+1 bounded text offset,,high
DCL03-C,216,sqlite,src/json.c,1952,TP,assert(JSONB_INT+0x01==JSONB_INT5) constant expression; static_assert candidate (DCL03),,high
DCL03-C,217,sqlite,src/json.c,1953,TP,assert(JSONB_FLOAT+0x01==JSONB_FLOAT5) constant expression; static_assert candidate (DCL03),,high
DCL03-C,218,sqlite,src/json.c,1954,TP,assert(JSONB_INT+0x02==JSONB_FLOAT) constant expression; static_assert candidate (DCL03),,high
INT30-C,219,sqlite,src/json.c,1955,FP,i++ where i is a bounded text offset far below UINT32_MAX; no wrap,,high
INT30-C,220,sqlite,src/json.c,1982,FP,i += 1+strspn bounded by NUL-terminated remaining input,,high
INT30-C,221,sqlite,src/json.c,1982,FP,i+1 bounded text offset,,high
INT32-C,222,sqlite,src/json.c,1982,FP,1+(u32)strspn bounded; no overflow reachable,,high
INT30-C,223,sqlite,src/json.c,1995,FP,i += j where j is small parsed token length; bounded text offset,,high
INT30-C,224,sqlite,src/json.c,2003,FP,i+4 bounded text offset,,high
INT30-C,225,sqlite,src/json.c,2005,FP,i+4 bounded text offset,,high
ARR01-C,226,sqlite,src/json.c,2014,FP,"aNanInfName is a file-scope array, not a decayed parameter; sizeof/sizeof[0] is correct count idiom",,high
ARR01-C,227,sqlite,src/json.c,2014,FP,aNanInfName[0] sizeof is the element size of a real array,,high
INT32-C,228,sqlite,src/json.c,2059,FP,i++ on bounded blob/text offset; no signed overflow reachable,,high
INT30-C,229,sqlite,src/json.c,2061,FP,i += json5Whitespace bounded by remaining NUL-terminated input,,high
INT32-C,230,sqlite,src/json.c,2061,FP,"small whitespace-run addend, no overflow",,high
INT14-C,231,sqlite,src/json.c,2121,FP,i bit+arith INT14 readability style-only,,high
INT14-C,232,sqlite,src/json.c,2121,FP,"pParse INT14 misread of member access, not pointer arithmetic",,high
INT30-C,233,sqlite,src/json.c,2126,FP,i+1 where i is blob offset validated <= nBlob by jsonbPayloadSize,,high
INT30-C,234,sqlite,src/json.c,2130,FP,i+1 bounded blob offset,,high
INT30-C,235,sqlite,src/json.c,2133,FP,i+2 bounded; jsonbPayloadSize validated i+n+sz<=nBlob,,high
INT30-C,236,sqlite,src/json.c,2137,FP,i+1 bounded blob offset,,high
INT30-C,237,sqlite,src/json.c,2137,FP,i+2 bounded blob offset,,high
INT30-C,238,sqlite,src/json.c,2140,FP,i+4 bounded blob offset (within validated payload),,high
INT30-C,239,sqlite,src/json.c,2144,FP,i+1 bounded blob offset,,high
INT30-C,240,sqlite,src/json.c,2144,FP,i+2 bounded blob offset,,high
INT30-C,241,sqlite,src/json.c,2145,FP,i+3 bounded blob offset,,high
INT30-C,242,sqlite,src/json.c,2145,FP,i+4 bounded blob offset,,high
INT30-C,243,sqlite,src/json.c,2148,FP,i+8 bounded; jsonbPayloadSize 9-byte header checks i+8<nBlob,,high
INT30-C,244,sqlite,src/json.c,2149,FP,i+1 bounded; guarded by i+8>=nBlob check,,high
INT30-C,245,sqlite,src/json.c,2150,FP,i+2 bounded blob offset,,high
INT30-C,246,sqlite,src/json.c,2151,FP,i+3 bounded blob offset,,high
INT30-C,247,sqlite,src/json.c,2152,FP,i+4 bounded blob offset,,high
INT30-C,248,sqlite,src/json.c,2157,FP,i+5 bounded blob offset,,high
INT30-C,249,sqlite,src/json.c,2157,FP,i+6 bounded blob offset,,high
INT30-C,250,sqlite,src/json.c,2158,FP,i+7 bounded blob offset,,high
INT30-C,251,sqlite,src/json.c,2158,FP,i+8 bounded; checked against nBlob before read,,high
MEM05-C,252,sqlite,src/json.c,2185,TP,"jsonTranslateBlobToText recurses on nested arrays/objects, recursion genuinely exists",,high
MSC04-C,253,sqlite,src/json.c,2185,TP,"jsonTranslateBlobToText calls itself directly, direct recursion factually present",,high
INT14-C,254,sqlite,src/json.c,2195,FP,pParse INT14 misread of member access,,high
INT14-C,255,sqlite,src/json.c,2197,FP,i INT14 readability style-only,,high
INT30-C,256,sqlite,src/json.c,2200,FP,i+1 bounded blob offset (validated payload),,high
INT30-C,257,sqlite,src/json.c,2204,FP,i+1 bounded blob offset,,high
INT30-C,258,sqlite,src/json.c,2208,FP,i+1 bounded blob offset,,high
ARR37-C,259,sqlite,src/json.c,2222,FP,zIn=&aBlob[i+n] points into validated payload; zIn[0] in-bounds (sz>=1 guarded),,high
ARR37-C,260,sqlite,src/json.c,2225,FP,zIn[0] within validated payload (sz!=0 guard),,high
ARR37-C,261,sqlite,src/json.c,2229,FP,"zIn[k] with k<sz, within payload validated by jsonbPayloadSize",,high
EXP07-C,262,sqlite,src/json.c,2232,FP,u>>60 is a deliberate overflow-precheck before u*16; EXP07 misread,,high
INT14-C,263,sqlite,src/json.c,2232,FP,u shift+arith is the hex-accumulate idiom; INT14 style-only,,high
ARR37-C,264,sqlite,src/json.c,2235,FP,zIn[k] with k<sz within validated payload,,high
INT30-C,265,sqlite,src/json.c,2235,FP,u*16 guarded by the u>>60 overflow precheck that sets bOverflow and skips the multiply,,high
ARR37-C,266,sqlite,src/json.c,2245,FP,zIn[0] within validated FLOAT5 payload (sz!=0 guard),,high
ARR37-C,267,sqlite,src/json.c,2249,FP,zIn[k] k<sz within validated payload,,high
ARR37-C,268,sqlite,src/json.c,2253,FP,zIn[k] k<sz within validated payload,,high
ARR37-C,269,sqlite,src/json.c,2254,FP,zIn[k] k<sz within validated payload,,high
ARR37-C,270,sqlite,src/json.c,2254,FP,zIn[k+1] read guarded by (k+1==sz || ...) short-circuit so k+1<sz when dereferenced,,high
ARR30-C,271,sqlite,src/json.c,2277,FP,"zIn bounded by jsonbPayloadSize (i+n+sz<=nBlob); k<sz2, jsonIsOk 256-entry indexed by u8",,high
ARR37-C,272,sqlite,src/json.c,2277,FP,"zIn[k] read within bounded blob region, k<sz2<=sz validated",,high
ARR37-C,273,sqlite,src/json.c,2277,FP,"bounded zIn[k] access, ARR37 pointer-notation style misfire",,high
ARR37-C,274,sqlite,src/json.c,2283,FP,"zIn+=k advances within remaining sz2 bytes, bounded by validated sz",,high
ARR37-C,275,sqlite,src/json.c,2286,FP,zIn[0] read with sz2>0 guaranteed by while(sz2>0),,high
ARR37-C,276,sqlite,src/json.c,2288,FP,"zIn++ within bounded region, sz2 decremented in lockstep",,high
ARR37-C,277,sqlite,src/json.c,2292,FP,zIn[0] guarded by enclosing sz2>0 loop,,high
ARR37-C,278,sqlite,src/json.c,2294,FP,zIn[0]<=0x1f read under sz2>0,,high
ARR37-C,279,sqlite,src/json.c,2295,FP,"zIn++ bounded, sz2-- maintained",,high
ARR37-C,280,sqlite,src/json.c,2299,FP,zIn[0]=='\\' read under sz2>0,,high
ARR37-C,281,sqlite,src/json.c,2305,FP,zIn[1] guarded by sz2>=2 check,,high
ARR37-C,282,sqlite,src/json.c,2319,FP,zIn[2] in \x case guarded by sz2<4 check,,high
ARR37-C,283,sqlite,src/json.c,2320,FP,"zIn+=2 after sz2 decremented, bounded",,high
ARR37-C,284,sqlite,src/json.c,2327,FP,zIn[2] in \r case guarded by sz2>2,,high
ARR37-C,285,sqlite,src/json.c,2328,FP,zIn++ bounded with sz2--,,high
ARR37-C,286,sqlite,src/json.c,2339,FP,zIn[2] guarded by sz2<4 check,,high
ARR37-C,287,sqlite,src/json.c,2340,FP,zIn[3] guarded by sz2<4 check,,high
ARR37-C,288,sqlite,src/json.c,2340,FP,zIn[3] same sz2<4 guard,,high
ARR37-C,289,sqlite,src/json.c,2346,FP,"zIn+=2 bounded, sz2-=2 under assert",,high
ARR37-C,290,sqlite,src/json.c,2354,FP,"zIn+=2 final advance, sz2-=2 under sz2>=2 assert",,high
EXP33-C,291,sqlite,src/json.c,2367,FP,j assigned at j=i+n before use; not read uninitialized,,high
EXP33-C,292,sqlite,src/json.c,2368,FP,iEnd assigned iEnd=j+sz before use,,high
INT07-C,293,sqlite,src/json.c,2384,FP,"x is the int object-counter x++, INT07 char-numeric misfire",,high
DCL13-C,294,sqlite,src/json.c,2413,TP,jsonPrettyIndent only reads pPretty members and mutates pointee *pOut; const JsonPretty* would compile,,med
MEM05-C,295,sqlite,src/json.c,2437,TP,"jsonTranslateBlobToPrettyText recurses, MEM05 stack-growth advisory factual",,high
MSC04-C,296,sqlite,src/json.c,2437,TP,jsonTranslateBlobToPrettyText calls itself directly (MSC04),,high
INT14-C,297,sqlite,src/json.c,2447,FP,"INT14 readability advisory on pParse, not a defect",,high
INT14-C,298,sqlite,src/json.c,2449,FP,INT14 readability advisory on loop index i,,high
EXP33-C,299,sqlite,src/json.c,2452,FP,j assigned before use in pretty ARRAY case,,high
EXP33-C,300,sqlite,src/json.c,2454,FP,iEnd assigned before use,,high
INT30-C,301,sqlite,src/json.c,2515,FP,jsonbArrayCount i+=sz+n bounded by iEnd from valid blob; pure counting,,high
INT32-C,302,sqlite,src/json.c,2535,FP,delta accumulator on editable blob bounded by nBlobAlloc<0x7fffffff,,high
ARR02-C,303,sqlite,src/json.c,2568,TP,aType[] declared with implicit bounds from initializer (ARR02 factual declaration observation),,med
EXP34-C,304,sqlite,src/json.c,2570,FP,aIns checked non-null by caller jsonBlobEdit before jsonBlobOverwrite,,high
INT14-C,305,sqlite,src/json.c,2573,FP,INT14 readability advisory on d,,high
INT32-C,306,sqlite,src/json.c,2573,FP,"d constrained to 1..8 by callers; 1<<d max 256, no overflow",,high
INT34-C,307,sqlite,src/json.c,2573,FP,"d is positive (1..8), shift amount valid; INT34 misfire",,high
INT32-C,308,sqlite,src/json.c,2579,FP,"1<<d with d in 1..8, no overflow",,high
INT34-C,309,sqlite,src/json.c,2579,FP,d non-negative and bounded,,high
INT14-C,310,sqlite,src/json.c,2600,FP,INT14 readability advisory on i,,high
INT30-C,311,sqlite,src/json.c,2600,FP,"i in [2,9] by assert, i-2 cannot underflow",,high
INT30-C,312,sqlite,src/json.c,2601,FP,"i>=2 guaranteed, i-2 safe",,high
INT32-C,313,sqlite,src/json.c,2602,FP,nIns>=szHdr since aIns is a valid node containing its header,,high
INT30-C,314,sqlite,src/json.c,2605,FP,"i-- loop stops at i==1 (break), never below 1",,high
ARR38-C,315,sqlite,src/json.c,2645,FP,memmove size nBlob-(iDel+nDel) within blob; nBlob expanded to fit,,high
INT32-C,316,sqlite,src/json.c,2645,FP,bounded blob-edit arithmetic; nBlob+d checked against nBlobAlloc,,high
INT32-C,317,sqlite,src/json.c,2649,FP,delta accumulator bounded by editable blob size,,high
INT30-C,318,sqlite,src/json.c,2671,FP,jsonBytesToBypass i+=2 guarded by i+1<n loop,,high
INT30-C,319,sqlite,src/json.c,2676,FP,i+=3 guarded by i+2<n check,,high
INT30-C,320,sqlite,src/json.c,2678,FP,i+=2 under i+1<n,,high
INT30-C,321,sqlite,src/json.c,2687,FP,i+=4 guarded by i+3<n check,,high
MEM05-C,322,sqlite,src/json.c,2704,TP,"jsonUnescapeOneChar recurses, MEM05 advisory factual",,high
INT14-C,323,sqlite,src/json.c,2719,FP,INT14 readability advisory on v,,high
EXP45-C,324,sqlite,src/json.c,2723,FP,EXP45 intentional assignment-in-condition idiom (vlo),,high
INT14-C,325,sqlite,src/json.c,2723,FP,INT14 readability advisory on vlo,,high
INT14-C,326,sqlite,src/json.c,2723,FP,INT14 readability advisory on z,,high
EXP07-C,327,sqlite,src/json.c,2725,FP,EXP07 style advisory on surrogate-pair arithmetic constants,,high
EXP08-C,328,sqlite,src/json.c,2776,FP,"z is const char*, not a struct pointer; EXP08 misfire on &z[nSkip]",,high
EXP08-C,329,sqlite,src/json.c,2778,FP,char-pointer arithmetic not struct-pointer,,high
STR34-C,330,sqlite,src/json.c,2778,FP,"z read via (u8*) cast, signedness handled",,high
STR34-C,331,sqlite,src/json.c,2778,FP,(u8*)&z[nSkip] casts to unsigned before read; STR34 misfire,,high
MSC37-C,332,sqlite,src/json.c,2797,FP,"jsonLabelCompareEscaped is while(1) with internal returns, never falls through",,high
EXP05-C,333,sqlite,src/json.c,2811,TP,(u8*)zLeft casts away const from const char* zLeft (EXP05),,med
EXP05-C,334,sqlite,src/json.c,2813,TP,(u8*)zLeft in Utf8ReadLimited call casts away const (EXP05),,med
STR34-C,335,sqlite,src/json.c,2813,FP,"zLeft read via (u8*) cast, value unsigned; STR34 misfire",,high
EXP05-C,336,sqlite,src/json.c,2829,TP,(u8*)zRight casts away const from const char* zRight (EXP05),,med
EXP05-C,337,sqlite,src/json.c,2831,TP,(u8*)zRight in Utf8ReadLimited call casts away const (EXP05),,med
STR34-C,338,sqlite,src/json.c,2831,FP,"zRight read via (u8*) cast, unsigned; STR34 misfire",,high
EXP33-C,339,sqlite,src/json.c,2844,FP,cLeft assigned on every branch before compare,,high
EXP33-C,340,sqlite,src/json.c,2844,FP,cRight assigned on every branch before compare,,high
MSC04-C,341,sqlite,src/json.c,2904,TP,jsonCreateEditSubstructure->jsonLookupStep->jsonCreateEditSubstructure genuine indirect recursion (MSC04),,high
ARR02-C,342,sqlite,src/json.c,2909,TP,emptyObject[] declared with implicit bounds from initializer (ARR02 factual),,med
ARR01-C,343,sqlite,src/json.c,2911,FP,"sizeof(*pIns) is sizeof(JsonParse) struct, not a decayed-pointer sizeof",,high
MEM05-C,344,sqlite,src/json.c,2948,TP,"jsonLookupStep recurses, MEM05 advisory factual",,high
INT14-C,345,sqlite,src/json.c,2964,FP,INT14 readability advisory on iRoot,,high
ARR00-C,346,sqlite,src/json.c,2972,FP,"zPath[-1] valid: zPath points past consumed chars (entry path non-empty, recursion passes &zPath[i+1])",,high
ARR00-C,347,sqlite,src/json.c,2990,FP,"zPath+1 points within NUL-terminated path (at least the NUL byte), in-bounds",,high
INT30-C,348,sqlite,src/json.c,2992,FP,"i indexes NUL-terminated zPath, bounded by zPath[i] checks",,high
INT30-C,349,sqlite,src/json.c,2992,FP,"i++ over NUL-terminated path, bounded",,high
INT30-C,350,sqlite,src/json.c,2996,FP,"i++ over NUL-terminated path, bounded",,high
INT14-C,351,sqlite,src/json.c,3013,FP,INT14 readability advisory on j,,high
INT14-C,352,sqlite,src/json.c,3027,FP,INT14 readability advisory on v,,high
EXP33-C,353,sqlite,src/json.c,3058,FP,v is JsonParse populated by jsonCreateEditSubstructure before use,,high
EXP05-C,354,sqlite,src/json.c,3066,FP,aBlob is u8* (non-const) member; memcpy has no const cast,,high
EXP05-C,355,sqlite,src/json.c,3068,FP,aBlob is non-const u8*; no const qualification cast,,high
EXP05-C,356,sqlite,src/json.c,3070,FP,aBlob is non-const u8*; no const cast,,high
ARR36-C,357,sqlite,src/json.c,3103,FP,"nn and kk are u64 scalars (path index counters), not pointers; ARR36 misfire",,high
EXP05-C,358,sqlite,src/json.c,3164,TP,x.aBlob=(u8*)aBlob casts away const from const u8* aBlob param (EXP05),,med
INT14-C,359,sqlite,src/json.c,3203,FP,INT14 readability advisory on i,,high
EXP33-C,360,sqlite,src/json.c,3237,FP,rc assigned (sqlite3DecOrHexToI64) before use,,high
FLP34-C,361,sqlite,src/json.c,3246,FP,u64-to-double conversion always in range; precision-only,,high
INT32-C,362,sqlite,src/json.c,3249,FP,"iRes is i64>=0 in this branch (else of iRes<0), -iRes cannot overflow",,high
MEM30-C,363,sqlite,src/json.c,3267,FP,"sqlite3DbFree(db,z) frees z not db; db is the live connection handle, never freed",,high
MEM30-C,364,sqlite,src/json.c,3269,FP,"z freshly allocated by sqlite3DbStrNDup, used before free",,high
MEM30-C,365,sqlite,src/json.c,3270,FP,"db never freed; sqlite3DbFree(db,z) is z-free using db allocator",,high
MEM30-C,366,sqlite,src/json.c,3270,FP,z freed once per allocation; INT path free and to_double free are distinct allocs,,high
INT32-C,367,sqlite,src/json.c,3289,FP,(u64)nOut+1 with nOut u32 cannot overflow u64,,high
MEM30-C,368,sqlite,src/json.c,3289,FP,"db is the live connection handle passed to malloc, not freed",,high
DCL00-C,369,sqlite,src/json.c,3292,TP,c is initialized once per loop iteration and never modified; const-qualifiable (DCL00),,med
MEM30-C,370,sqlite,src/json.c,3292,FP,z=&pParse->aBlob[i+n] is a blob pointer never freed; zOut is the alloc target,,high
MEM30-C,371,sqlite,src/json.c,3295,FP,"z is the const blob input pointer, never freed",,high
MEM30-C,372,sqlite,src/json.c,3295,FP,z (blob pointer) not freed; dereference valid in-bounds,,high
MEM30-C,373,sqlite,src/json.c,3295,FP,"z (blob pointer) bounded by sz, not freed",,high
EXP07-C,374,sqlite,src/json.c,3304,FP,EXP07 style advisory on v>>12 constant,,high
EXP07-C,375,sqlite,src/json.c,3311,FP,EXP07 style advisory on v>>18 constant,,high
EXP07-C,376,sqlite,src/json.c,3312,FP,EXP07 style advisory on v>>12 constant,,high
MEM30-C,377,sqlite,src/json.c,3318,FP,"zOut allocated (nOut+1), iOut bounded by assert(iOut<=nOut); valid write",,high
MSC07-C,378,sqlite,src/json.c,3348,FP,returnfromblob_oom label reachable via goto; not unreachable code,,high
ARR02-C,379,sqlite,src/json.c,3380,TP,aNull[] declared with implicit bounds from initializer (ARR02 factual),,med
CON03-C,380,sqlite,src/json.c,3380,FP,"aNull static only read (assigned to read-only aBlob with nBlobAlloc==0), never mutated",,high
ARR01-C,381,sqlite,src/json.c,3381,FP,"sizeof(pParse[0]) is sizeof(JsonParse) struct, not a decayed-pointer sizeof",,high
EXP05-C,382,sqlite,src/json.c,3401,TP,(char*)zJson at 3401 casts away const from value_text's const char* return into non-const pParse->zJson; real const-cast (EXP05),,low
ARR01-C,383,sqlite,src/json.c,3406,FP,"sizeof(pParse[0]) is sizeof(JsonParse) via dereference, correct idiom",,high
DCL00-C,384,sqlite,src/json.c,3415,TP,double r at 3415 assigned once and only read in NEVER(sqlite3IsNaN(r)); const-qualifiable (DCL00),,med
DCL30-C,385,sqlite,src/json.c,3465,FP,"zMsg returned is heap memory from sqlite3_mprintf, not automatic storage",,high
DCL13-C,386,sqlite,src/json.c,3486,FP,argv signature fixed by SQLite scalar-function callback typedef; cannot be const,,high
INT14-C,387,sqlite,src/json.c,3496,FP,argc is a small int arg count in i+=2 loop bound; no real overflow,,high
EXP33-C,388,sqlite,src/json.c,3498,FP,jsonParseFuncArg is a function not an uninitialized static variable,,high
INT30-C,389,sqlite,src/json.c,3500,FP,i is int loop counter over argc; for(i=1;i<argc-1;i+=2) cannot wrap,,high
INT30-C,390,sqlite,src/json.c,3509,FP,i bounded by argc loop; i+1 cannot wrap,,high
INT32-C,391,sqlite,src/json.c,3509,FP,i bounded by small argc; i+1 cannot overflow,,high
MSC07-C,392,sqlite,src/json.c,3534,FP,"code after return is the labeled error-handler reached via goto, not unreachable",,high
MEM30-C,393,sqlite,src/json.c,3535,FP,jsonParseFree(p) on patherror path is single free per control path,,high
EXP30-C,394,sqlite,src/json.c,3578,FP,c and n assigned inside && short-circuit chain with sequence points; well-defined,,high
EXP30-C,395,sqlite,src/json.c,3578,FP,&& short-circuit sequence-point chain; well-defined,,high
EXP30-C,396,sqlite,src/json.c,3578,FP,n assigned then used across && operators which are sequence points,,high
EXP45-C,397,sqlite,src/json.c,3580,FP,c=p->aBlob[0] inside if is intentional idiom within guarded && chain (nBlob>0 checked),,high
INT13-C,398,sqlite,src/json.c,3580,FP,"c is u8 (declared u8 c), not signed char; bitwise & well-defined",,high
EXP33-C,399,sqlite,src/json.c,3582,FP,n assigned by jsonbPayloadSize earlier in the && chain before use,,high
EXP33-C,400,sqlite,src/json.c,3583,FP,c assigned (c=p->aBlob[0]) earlier in the && chain before & operation,,high
INT13-C,401,sqlite,src/json.c,3583,FP,"c is u8, not signed; bitwise & well-defined",,high
STR00-C,402,sqlite,src/json.c,3583,FP,"c is declared u8, not plain char",,high
INT13-C,403,sqlite,src/json.c,3629,FP,flgs is int bitfield-style flag tested with &; controlled constants,,high
EXP05-C,404,sqlite,src/json.c,3637,FP,"line 3637 is memset(p,0,sizeof(*p)); p is non-const JsonParse*, no const cast",,high
EXP43-C,405,sqlite,src/json.c,3644,FP,memcpy copies pFromCache->aBlob into freshly malloc'd p->aBlob; distinct allocations,,high
MEM30-C,406,sqlite,src/json.c,3648,FP,"p is a fresh allocation being returned; only pFromCache freed, no UAF",,high
INT13-C,407,sqlite,src/json.c,3652,FP,flgs flag-bits tested with &; sign irrelevant,,high
EXP34-C,408,sqlite,src/json.c,3672,FP,db from sqlite3_context_db_handle non-null for valid context; SQLite contract,,med
INT13-C,409,sqlite,src/json.c,3675,FP,flgs flag bits; sign irrelevant,,high
INT13-C,410,sqlite,src/json.c,3676,FP,flgs flag bits; sign irrelevant,,high
INT13-C,411,sqlite,src/json.c,3698,FP,flgs flag bits; sign irrelevant,,high
MSC07-C,412,sqlite,src/json.c,3706,FP,"code after return reached via goto label, not unreachable",,high
INT13-C,413,sqlite,src/json.c,3707,FP,flgs flag bits; sign irrelevant,,high
MEM30-C,414,sqlite,src/json.c,3711,FP,jsonParseFree(p) is on json_pfa_malformed path; single free per path,,high
MEM30-C,415,sqlite,src/json.c,3718,FP,"jsonParseFree(p) on json_pfa_oom path; pFromCache and p each freed once, both may be 0",,high
INT13-C,416,sqlite,src/json.c,3738,FP,flgs flag bits; sign irrelevant,,high
MEM05-C,417,sqlite,src/json.c,3765,TP,"jsonDebugPrintBlob recurses per nesting depth; deep crafted JSONB grows stack (SQLITE_DEBUG-only, MEM05)",,med
MSC04-C,418,sqlite,src/json.c,3765,TP,jsonDebugPrintBlob calls itself; factual direct recursion (MSC04),,high
INT14-C,419,sqlite,src/json.c,3775,FP,iStart is u32 blob index bounded by iEnd; bitwise/arith mix readability-only,,high
INT32-C,420,sqlite,src/json.c,3820,FP,"nIndent small indent counter (+2 per level); bounded by recursion depth, debug-only",,high
INT32-C,421,sqlite,src/json.c,3826,FP,nIndent small bounded indent counter; debug-only,,high
DCL00-C,422,sqlite,src/json.c,3843,FP,c at 3843 IS modified at 3844 (c='.'); cannot be const,,high
EXP36-C,423,sqlite,src/json.c,3845,FP,"&c is u8* cast to char*, both alignment 1; no alignment violation",,high
DCL13-C,424,sqlite,src/json.c,3883,FP,argv fixed by SQLite scalar-function callback typedef; cannot be const,,high
EXP33-C,425,sqlite,src/json.c,3890,FP,"jsonParseFuncArg is a function, not uninitialized static",,high
DCL13-C,426,sqlite,src/json.c,3916,FP,argv fixed by callback typedef,,high
DCL13-C,427,sqlite,src/json.c,3935,FP,argv fixed by callback typedef,,high
EXP33-C,428,sqlite,src/json.c,3968,FP,"jsonParseFuncArg is a function, not uninitialized static",,high
DCL13-C,429,sqlite,src/json.c,4028,FP,argv fixed by callback typedef,,high
EXP33-C,430,sqlite,src/json.c,4036,FP,"jsonParseFuncArg is a function, not uninitialized static",,high
INT13-C,431,sqlite,src/json.c,4052,FP,flags flag bits tested with &; sign irrelevant,,high
INT13-C,432,sqlite,src/json.c,4091,FP,flags flag bits; sign irrelevant,,high
INT13-C,433,sqlite,src/json.c,4096,FP,flags flag bits; sign irrelevant,,high
INT13-C,434,sqlite,src/json.c,4100,FP,flags flag bits; sign irrelevant,,high
INT13-C,435,sqlite,src/json.c,4128,FP,flags flag bits; sign irrelevant,,high
MEM05-C,436,sqlite,src/json.c,4192,TP,jsonMergePatch recurses per nested object depth; deep crafted patch grows stack (MEM05),,med
INT14-C,437,sqlite,src/json.c,4224,FP,iPatch u32 blob index bounded by iPEnd; bitwise/arith mix readability-only,,high
INT14-C,438,sqlite,src/json.c,4224,FP,pPatch bounded pointer with bounded index; readability-only,,high
INT14-C,439,sqlite,src/json.c,4236,FP,iTarget bounded blob index; readability-only,,high
INT14-C,440,sqlite,src/json.c,4236,FP,pTarget bounded pointer use; readability-only,,high
INT14-C,441,sqlite,src/json.c,4246,FP,iPCursor bounded by iPEnd checks before each use; readability-only,,high
INT14-C,442,sqlite,src/json.c,4264,FP,iPValue checked <iPEnd before use; readability-only,,high
INT32-C,443,sqlite,src/json.c,4307,FP,pTarget->delta i32 bounded by edit sizes within blob limit; save/restore cannot overflow,,med
ARR38-C,444,sqlite,src/json.c,4316,FP,memcpy size szPValue+nPValue bounded by jsonbPayloadSize within pPatch->nBlob; dest pre-expanded,,high
INT32-C,445,sqlite,src/json.c,4316,FP,"szPValue and nPValue each <2^31 from bounded payload-size; sum cannot overflow u32, dest sized to fit",,high
INT32-C,446,sqlite,src/json.c,4328,FP,delta i32 bounded by blob edit sizes; save/restore cannot overflow,,med
DCL13-C,447,sqlite,src/json.c,4345,FP,argv fixed by callback typedef,,high
EXP33-C,448,sqlite,src/json.c,4353,FP,"jsonParseFuncArg is a function, not uninitialized static",,high
DCL13-C,449,sqlite,src/json.c,4379,FP,argv fixed by callback typedef,,high
INT30-C,450,sqlite,src/json.c,4393,FP,i is int over argc loop; i+=2 cannot wrap,,high
INT30-C,451,sqlite,src/json.c,4404,FP,i bounded by argc; i+1 cannot wrap,,high
INT32-C,452,sqlite,src/json.c,4404,FP,i bounded by small argc; i+1 cannot overflow,,high
DCL13-C,453,sqlite,src/json.c,4421,FP,argv fixed by callback typedef,,high
EXP33-C,454,sqlite,src/json.c,4429,FP,"jsonParseFuncArg is a function, not uninitialized static",,high
MSC07-C,455,sqlite,src/json.c,4461,FP,"code after return reached via json_remove goto labels, not unreachable",,high
MEM30-C,456,sqlite,src/json.c,4465,FP,jsonParseFree(p) at shared json_remove_done label; each path frees p once,,high
ARR02-C,457,sqlite,src/json.c,4508,FP,azInsType[] 3 string literals giving implicit size 3; aEditType matches; eInsType asserted 0..2,,high
ARR02-C,458,sqlite,src/json.c,4509,FP,aEditType[] const initializer indexed by eInsType asserted 0..2 with 3 elements; canonical correct C,,high
DCL13-C,459,sqlite,src/json.c,4530,FP,argv signature fixed by FuncDef xFunc typedef; const would break the function-pointer assignment,,high
EXP33-C,460,sqlite,src/json.c,4536,FP,"jsonParseFuncArg is a function, not an uninitialized static variable",,high
DCL13-C,461,sqlite,src/json.c,4577,FP,argv signature fixed by xFunc function-pointer typedef,,high
EXP33-C,462,sqlite,src/json.c,4583,FP,jsonParseFuncArg is a called function not a static variable,,high
INT07-C,463,sqlite,src/json.c,4589,FP,message cites x of type char but x is a JsonPretty struct (x.szIndent); wrong-symbol misread,,high
DCL13-C,464,sqlite,src/json.c,4658,FP,argv signature fixed by xFunc typedef,,high
INT13-C,465,sqlite,src/json.c,4684,FP,"flags is a small JSON_* bitmask, masking non-negative constants; no UB",,high
INT13-C,466,sqlite,src/json.c,4688,FP,flags bitmask test on small non-negative value,,high
INT13-C,467,sqlite,src/json.c,4701,FP,flags bitmask; no UB,,high
EXP33-C,468,sqlite,src/json.c,4704,FP,"jsonParseFuncArg is a function call, not uninitialized static var",,high
EXP33-C,469,sqlite,src/json.c,4705,FP,p assigned p=jsonParseFuncArg and guarded by if(p) before deref,,high
INT13-C,470,sqlite,src/json.c,4710,FP,flags bitmask on small non-negative constant,,high
DCL13-C,471,sqlite,src/json.c,4740,FP,argv signature fixed by xFunc typedef,,high
EXP05-C,472,sqlite,src/json.c,4747,FP,"&s is address of a local non-const JsonParse; no const cast, zJson=(char*)text is owned-text idiom",,high
DCL13-C,473,sqlite,src/json.c,4788,FP,argv signature fixed by xFunc typedef,,high
EXP33-C,474,sqlite,src/json.c,4792,FP,pStr assigned from sqlite3_aggregate_context then guarded by if(pStr),,high
INT13-C,475,sqlite,src/json.c,4814,FP,flags bitmask on small non-negative value,,high
INT13-C,476,sqlite,src/json.c,4831,FP,flags bitmask; no UB,,high
INT30-C,477,sqlite,src/json.c,4877,FP,"i is unsigned loop counter bounded by i<pStr->nUsed on internal buffer, not attacker input",,high
INT30-C,478,sqlite,src/json.c,4885,FP,i+1 indexes within internal accumulator bounded by nUsed; not attacker-controlled,,high
INT30-C,479,sqlite,src/json.c,4885,FP,"after nUsed-=i in branch i<old nUsed, nUsed>=1 so (size_t)nUsed-1>=0",,high
INT32-C,480,sqlite,src/json.c,4885,FP,memmove size (size_t)nUsed-1 >=0 within internal accumulator buffer,,high
DCL13-C,481,sqlite,src/json.c,4904,FP,argv signature fixed by xStep/xFunc typedef,,high
EXP33-C,482,sqlite,src/json.c,4910,FP,pStr assigned from sqlite3_aggregate_context then guarded by if(pStr),,high
INT13-C,483,sqlite,src/json.c,4938,FP,flags bitmask on small non-negative value,,high
INT13-C,484,sqlite,src/json.c,4955,FP,flags bitmask; no UB,,high
EXP33-C,485,sqlite,src/json.c,5045,FP,pNew assigned from MallocZero and checked if(pNew==0) return before deref,,high
EXP05-C,486,sqlite,src/json.c,5065,FP,(JsonEachConnection*)p casts non-const sqlite3_vtab* base to derived; no const involved,,high
EXP33-C,487,sqlite,src/json.c,5069,FP,pCur assigned from MallocZero and checked if(pCur==0) return before use,,high
MEM33-C,488,sqlite,src/json.c,5075,FP,*ppCursor=&pCur->base pointer assignment; no flexible-array struct copy,,high
DCL13-C,489,sqlite,src/json.c,5105,FP,cur param signature fixed by sqlite3_module method typedef,,high
EXP43-C,490,sqlite,src/json.c,5151,FP,jsonPrintf source z=&sParse.aBlob[k] and dest p->path are distinct buffers; no overlap,,high
EXP43-C,491,sqlite,src/json.c,5153,FP,"source in sParse.aBlob, dest in path.zBuf; non-overlapping",,high
INT14-C,492,sqlite,src/json.c,5167,FP,INT14 readability advisory; i operations well-defined,,high
INT14-C,493,sqlite,src/json.c,5167,FP,INT14 readability advisory; no defect,,high
INT30-C,494,sqlite,src/json.c,5175,FP,sizeof(JsonParent)*nNew is u64; nNew bounded by nesting depth; u64 product cannot wrap,,high
INT07-C,495,sqlite,src/json.c,5239,FP,message cites x of type char but x is u32 (x+jsonbPayloadSize); wrong-symbol misread,,high
INT14-C,496,sqlite,src/json.c,5259,FP,INT14 readability advisory; p arithmetic well-defined,,high
ARR30-C,497,sqlite,src/json.c,5262,FP,zBuf is p->path.zBuf indexed by j<=path.nUsed with nRoot-j>0 checked; size-1000 attribution wrong,,high
DCL13-C,498,sqlite,src/json.c,5344,FP,cur signature fixed by sqlite3_module xRowid typedef,,high
DCL03-C,499,sqlite,src/json.c,5367,FP,assert(JEACH_ROOT==JEACH_JSON+1) is a compile-constant invariant; DCL03 advisory,,high
INT13-C,500,sqlite,src/json.c,5378,FP,1<<iCol with iCol asserted 0 or 1; no overflow,,high
INT32-C,501,sqlite,src/json.c,5378,FP,"shift amount iCol is 0 or 1 by guard+assert; result 1 or 2, no UB",,high
INT34-C,502,sqlite,src/json.c,5378,FP,iCol guarded non-negative and <=1; shift amount validated,,high
ARR30-C,503,sqlite,src/json.c,5382,FP,aIdx[2] indexed by iCol asserted 0 or 1; in-bounds,,high
INT13-C,504,sqlite,src/json.c,5393,FP,unusableMask/idxMask small non-negative int masks (0..3); bitwise well-defined,,high
DCL13-C,505,sqlite,src/json.c,5424,FP,argv signature fixed by xFilter typedef,,high
MEM30-C,506,sqlite,src/json.c,5457,FP,"jsonEachCursorReset resets cursor p and frees p->aParent, not cur->pVtab (live)",,high
MEM30-C,507,sqlite,src/json.c,5458,FP,cur->pVtab not freed by jsonEachCursorReset; live pointer,,high
MEM30-C,508,sqlite,src/json.c,5460,FP,cur->pVtab->zErrMsg write targets live vtab,,high
MEM30-C,509,sqlite,src/json.c,5460,FP,cur->pVtab is live; not freed,,high
MEM30-C,510,sqlite,src/json.c,5475,FP,cur->pVtab live; reset does not free the vtab,,high
MEM30-C,511,sqlite,src/json.c,5476,FP,cur->pVtab live; no free,,high
MEM30-C,512,sqlite,src/json.c,5478,FP,cur->pVtab->zErrMsg on live vtab; no use-after-free,,high
MEM30-C,513,sqlite,src/json.c,5478,FP,cur->pVtab live,,high
INT14-C,514,sqlite,src/json.c,5497,FP,INT14 readability advisory; i operations well-defined,,high
MSC07-C,515,sqlite,src/json.c,5512,FP,"json_each_malformed_input is a goto target reached via goto; reachable, not dead code",,high
MEM30-C,516,sqlite,src/json.c,5513,FP,cur->pVtab live; reset frees only cursor-internal aParent,,high
MEM30-C,517,sqlite,src/json.c,5514,FP,cur->pVtab live,,high
MEM30-C,518,sqlite,src/json.c,5516,FP,cur->pVtab->zErrMsg on live vtab,,high
MEM30-C,519,sqlite,src/json.c,5516,FP,cur->pVtab live,,high
CON03-C,520,sqlite,src/json.c,5520,FP,"jsonEachModule is a static const module dispatch table, read-only; CON03 not applicable",,high
ARR02-C,521,sqlite,src/json.c,5555,FP,aJsonFunc[] initializer list with implicit bounds; canonical correct form,,high
CON03-C,522,sqlite,src/json.c,5555,FP,aJsonFunc static const function-definition table read via ArraySize; no shared-mutation,,high
INT32-C,523,sqlite,src/json.c,5573,FP,"'->' is the operator name token in a JFUNCTION macro arg, not a negation; misparse",,high
INT32-C,524,sqlite,src/json.c,5574,FP,"'->>' is the operator name in JFUNCTION, not signed negation; misparse",,high
API00-C,525,sqlite,src/json.c,5621,FP,db is an internal SQLite connection pointer guaranteed non-null on register path,,high
ARR02-C,526,sqlite,src/json.c,5623,FP,azModule[] initializer list with implicit bounds; canonical correct form,,high
CON03-C,0,sqlite,ext/rtree/geopoly.c,23,FP,"geo_debug exists only under GEOPOLY_ENABLE_DEBUG as a single-threaded debug flag, not concurrency-shared",,high
PRE01-C,1,sqlite,ext/rtree/geopoly.c,24,FP,GEODEBUG(X) expands to printf X where X is a parenthesized arg list; parenthesizing X would break the call,,high
ARR02-C,2,sqlite,ext/rtree/geopoly.c,49,TP,geopolyIsSpace[] declared with implicit bounds via initializer; ARR02 advisory fires correctly though table fully initialized,,low
PRE01-C,3,sqlite,ext/rtree/geopoly.c,67,TP,fast_isspace(x) expands to geopolyIsSpace[(unsigned char)x]; x not parenthesized so (unsigned char)a+b would misparse (PRE01),,med
DCL00-C,4,sqlite,ext/rtree/geopoly.c,164,FP,"c reassigned repeatedly (z[j], z[j+1]) in geopolyParseNumber, not const-eligible",,high
INT32-C,5,sqlite,ext/rtree/geopoly.c,174,FP,"j is a JSON-text scan index bounded by NUL-terminated input capped by SQLITE_MAX_LENGTH, cannot reach INT_MAX",,med
INT32-C,6,sqlite,ext/rtree/geopoly.c,187,FP,j+1 index into NUL-terminated text bounded by SQLITE_MAX_LENGTH,,med
INT32-C,7,sqlite,ext/rtree/geopoly.c,189,FP,j increment bounded by input length under SQLITE_MAX_LENGTH,,med
INT32-C,8,sqlite,ext/rtree/geopoly.c,190,FP,j+1 bounded by input length,,med
ERR07-C,9,sqlite,ext/rtree/geopoly.c,206,FP,"atof only under non-amalgamation; value pre-validated as numeric, advisory",,low
ERR34-C,10,sqlite,ext/rtree/geopoly.c,206,FP,atof on pre-validated numeric token; advisory,,low
EXP40-C,11,sqlite,ext/rtree/geopoly.c,206,FP,"*pVal target is GeoParse.a[] (non-const GeoCoord storage), not const; misread of cast",,high
EXP05-C,12,sqlite,ext/rtree/geopoly.c,224,FP,"&s is address-of a local GeoParse, no const cast away",,high
INT14-C,13,sqlite,ext/rtree/geopoly.c,234,FP,"s used in array indexing/arithmetic in parser, advisory readability",,low
INT32-C,14,sqlite,ext/rtree/geopoly.c,234,FP,s.nAlloc*2+16 grows geometrically; reaching INT_MAX needs multi-GB input beyond SQLITE_MAX_LENGTH,,med
INT32-C,15,sqlite,ext/rtree/geopoly.c,234,FP,s.nAlloc*2 bounded by realistic input size under SQLITE_MAX_LENGTH,,med
INT30-C,16,sqlite,ext/rtree/geopoly.c,235,FP,"s.nAlloc*sizeof(GeoCoord) is size_t arithmetic, nAlloc bounded by input, no wrap",,high
INT32-C,17,sqlite,ext/rtree/geopoly.c,238,FP,"s.nErr small error counter, cannot approach INT_MAX",,high
INT32-C,18,sqlite,ext/rtree/geopoly.c,243,FP,"s.nVertex*2+ii index in-bounds (nVertex<nAlloc enforced, buffer nAlloc*2)",,high
INT32-C,19,sqlite,ext/rtree/geopoly.c,243,FP,s.nVertex*2 bounded by nAlloc which is bounded by input size,,high
INT32-C,20,sqlite,ext/rtree/geopoly.c,244,FP,"ii is 0/1/2 inner coordinate counter, bounded",,high
INT32-C,21,sqlite,ext/rtree/geopoly.c,245,FP,s.nVertex bounded by input vertex count,,high
INT32-C,22,sqlite,ext/rtree/geopoly.c,250,FP,nErr small error counter,,high
INT32-C,23,sqlite,ext/rtree/geopoly.c,268,FP,"s.nVertex-- removes redundant vertex, nVertex>=4 guaranteed, no underflow",,high
ARR38-C,24,sqlite,ext/rtree/geopoly.c,273,FP,memcpy size s.nVertex*2*sizeof is size_t; pOut allocated GEOPOLY_SZ(nVertex) to hold it,,high
INT30-C,25,sqlite,ext/rtree/geopoly.c,273,FP,"s.nVertex*2*sizeof size_t, nVertex bounded, matches allocation",,high
INT32-C,26,sqlite,ext/rtree/geopoly.c,273,FP,memcpy size matches GEOPOLY_SZ(nVertex) allocation,,high
INT32-C,27,sqlite,ext/rtree/geopoly.c,273,FP,s.nVertex*2 bounded; size_t multiply does not wrap,,high
INT32-C,28,sqlite,ext/rtree/geopoly.c,282,FP,nErr small counter,,high
INT30-C,29,sqlite,ext/rtree/geopoly.c,307,FP,"6*sizeof(GeoCoord) is constant 24, no wrap",,high
INT14-C,30,sqlite,ext/rtree/geopoly.c,315,FP,"nVertex byte-assembly from unsigned char header, standard big-endian decode, readability advisory",,high
INT30-C,31,sqlite,ext/rtree/geopoly.c,317,FP,"nVertex*2*sizeof size_t; equality check at 317 binds to nByte (<=~1GB), no wrap",,high
INT31-C,32,sqlite,ext/rtree/geopoly.c,317,FP,"nByte>=28 (positive, validated) so signed->size_t conversion safe",,high
INT30-C,33,sqlite,ext/rtree/geopoly.c,319,FP,"sizeof(*p)+(nVertex-1)*2*sizeof size_t; nVertex constrained to nByte, correctly sized",,high
INT30-C,34,sqlite,ext/rtree/geopoly.c,319,FP,"(nVertex-1)*2*sizeof size_t; nVertex>=3 after 317, no wrap/underflow",,high
INT32-C,35,sqlite,ext/rtree/geopoly.c,319,FP,"(nVertex-1)*2 with nVertex>=3, bounded by validated nByte",,high
INT32-C,36,sqlite,ext/rtree/geopoly.c,319,FP,"nVertex-1 with nVertex>=3, no underflow",,high
ARR38-C,37,sqlite,ext/rtree/geopoly.c,326,FP,"memcpy(p->hdr,a,nByte): nByte == validated allocation size; copy fits",,high
INT31-C,38,sqlite,ext/rtree/geopoly.c,326,FP,nByte validated positive and equal to allocated region,,high
ARR30-C,39,sqlite,ext/rtree/geopoly.c,330,FP,"GeoX macro index ii bounded by ii<nVertex loop, p sized for nVertex pairs",,high
ARR30-C,40,sqlite,ext/rtree/geopoly.c,331,FP,GeoY macro index ii bounded by ii<nVertex loop,,high
DCL13-C,41,sqlite,ext/rtree/geopoly.c,362,FP,argv signature fixed by sqlite3_create_function callback typedef,,high
INT32-C,42,sqlite,ext/rtree/geopoly.c,368,FP,"4+8*p->nVertex result_blob size; nVertex validated/bounded, fits int",,high
INT32-C,43,sqlite,ext/rtree/geopoly.c,368,FP,8*p->nVertex bounded by validated nVertex,,high
DCL13-C,44,sqlite,ext/rtree/geopoly.c,382,FP,argv signature fixed by SQL-function callback typedef,,high
MEM31-C,45,sqlite,ext/rtree/geopoly.c,388,FP,"x from sqlite3_str_new consumed/freed by sqlite3_str_finish(x), not leaked",,high
ARR30-C,46,sqlite,ext/rtree/geopoly.c,392,FP,GeoX index i bounded by i<p->nVertex loop,,high
ARR30-C,47,sqlite,ext/rtree/geopoly.c,392,FP,GeoY index i bounded by i<p->nVertex,,high
EXP30-C,48,sqlite,ext/rtree/geopoly.c,392,FP,"GeoX(p,i)/GeoY(p,i) are pure array reads with no side effects",,high
ARR30-C,49,sqlite,ext/rtree/geopoly.c,394,FP,"GeoX(p,0) pure read, in-bounds",,high
ARR30-C,50,sqlite,ext/rtree/geopoly.c,394,FP,"GeoY(p,0) pure read, in-bounds",,high
EXP30-C,51,sqlite,ext/rtree/geopoly.c,394,FP,side-effect-free array-read arguments,,high
DCL13-C,52,sqlite,ext/rtree/geopoly.c,409,FP,argv signature fixed by callback typedef,,high
MEM31-C,53,sqlite,ext/rtree/geopoly.c,416,FP,"x consumed/freed by sqlite3_str_finish(x), not leaked",,high
ARR30-C,54,sqlite,ext/rtree/geopoly.c,421,FP,GeoX index i bounded by i<p->nVertex loop,,high
ARR30-C,55,sqlite,ext/rtree/geopoly.c,421,FP,GeoY index i bounded by loop,,high
EXP30-C,56,sqlite,ext/rtree/geopoly.c,421,FP,"pure array-read arguments, no side effects",,high
ARR30-C,57,sqlite,ext/rtree/geopoly.c,424,FP,"GeoX(p,0) in-bounds read",,high
ARR30-C,58,sqlite,ext/rtree/geopoly.c,424,FP,"GeoY(p,0) in-bounds read",,high
EXP30-C,59,sqlite,ext/rtree/geopoly.c,424,FP,side-effect-free array-read arguments,,high
DCL13-C,60,sqlite,ext/rtree/geopoly.c,456,FP,argv signature fixed by callback typedef,,high
DCL00-C,61,sqlite,ext/rtree/geopoly.c,461,TP,"C initialized from value_double and only read in xform expressions, const-qualifiable (DCL00)",,med
DCL00-C,62,sqlite,ext/rtree/geopoly.c,463,TP,"E initialized from value_double and only read, const-qualifiable (DCL00)",,med
ARR30-C,63,sqlite,ext/rtree/geopoly.c,470,FP,GeoX index ii bounded by ii<p->nVertex loop,,high
ARR30-C,64,sqlite,ext/rtree/geopoly.c,471,FP,GeoY index ii bounded by loop,,high
ARR30-C,65,sqlite,ext/rtree/geopoly.c,474,FP,"GeoX(p,ii) write target in-bounds (ii<nVertex)",,high
ARR30-C,66,sqlite,ext/rtree/geopoly.c,475,FP,"GeoY(p,ii) write target in-bounds",,high
INT32-C,67,sqlite,ext/rtree/geopoly.c,478,FP,"4+8*p->nVertex blob size, nVertex bounded",,high
INT32-C,68,sqlite,ext/rtree/geopoly.c,478,FP,8*p->nVertex bounded by validated nVertex,,high
ARR30-C,69,sqlite,ext/rtree/geopoly.c,494,FP,"GeoX(p,ii) bounded by ii<nVertex-1 loop",,high
ARR30-C,70,sqlite,ext/rtree/geopoly.c,494,FP,"GeoX(p,ii+1) with ii<nVertex-1 so ii+1<nVertex, in-bounds",,high
INT32-C,71,sqlite,ext/rtree/geopoly.c,494,FP,"ii+1 index bounded (ii<nVertex-1), nVertex small, no overflow",,high
ARR30-C,72,sqlite,ext/rtree/geopoly.c,495,FP,"GeoY(p,ii) in-bounds",,high
ARR30-C,73,sqlite,ext/rtree/geopoly.c,495,FP,"GeoY(p,ii+1) with ii+1<nVertex",,high
INT32-C,74,sqlite,ext/rtree/geopoly.c,495,FP,"ii+1 bounded by loop, no overflow",,high
ARR30-C,75,sqlite,ext/rtree/geopoly.c,498,FP,"GeoX(p,ii) after loop ii==nVertex-1, in-bounds",,high
ARR30-C,76,sqlite,ext/rtree/geopoly.c,498,FP,"GeoX(p,0) in-bounds",,high
ARR30-C,77,sqlite,ext/rtree/geopoly.c,499,FP,"GeoY(p,ii) in-bounds",,high
ARR30-C,78,sqlite,ext/rtree/geopoly.c,499,FP,"GeoY(p,0) in-bounds",,high
DCL13-C,79,sqlite,ext/rtree/geopoly.c,515,FP,argv signature fixed by callback typedef,,high
DCL13-C,80,sqlite,ext/rtree/geopoly.c,541,FP,argv signature fixed by callback typedef,,high
INT32-C,81,sqlite,ext/rtree/geopoly.c,548,FP,"p->nVertex-1 with nVertex>=4 from valid polygon, no underflow",,high
ARR30-C,82,sqlite,ext/rtree/geopoly.c,549,FP,"GeoX(p,ii) bounded by ii<jj<=nVertex-1 loop",,high
ARR30-C,83,sqlite,ext/rtree/geopoly.c,550,FP,"GeoX(p,jj) jj<=nVertex-1, in-bounds",,high
ARR30-C,84,sqlite,ext/rtree/geopoly.c,550,FP,"GeoX(p,jj) in-bounds",,high
ARR30-C,85,sqlite,ext/rtree/geopoly.c,551,FP,"GeoX(p,ii) in-bounds",,high
ARR30-C,86,sqlite,ext/rtree/geopoly.c,552,FP,"GeoY(p,ii) in-bounds",,high
ARR30-C,87,sqlite,ext/rtree/geopoly.c,553,FP,"GeoY(p,jj) in-bounds",,high
ARR30-C,88,sqlite,ext/rtree/geopoly.c,553,FP,"GeoY(p,jj) in-bounds",,high
ARR30-C,89,sqlite,ext/rtree/geopoly.c,554,FP,"GeoY(p,ii) in-bounds",,high
INT32-C,90,sqlite,ext/rtree/geopoly.c,558,FP,"4+8*p->nVertex blob size, bounded",,high
INT32-C,91,sqlite,ext/rtree/geopoly.c,558,FP,8*p->nVertex bounded,,high
MEM05-C,92,sqlite,ext/rtree/geopoly.c,567,TP,geopolySine recursively calls geopolySine(r-GEOPOLY_PI); genuine recursion though depth-bounded to one (MEM05),,med
FLP06-C,93,sqlite,ext/rtree/geopoly.c,575,FP,"r2=r*r is float-from-float arithmetic, not integer-initialized; misread",,high
FLP06-C,94,sqlite,ext/rtree/geopoly.c,576,FP,"r3=r2*r float arithmetic, misread",,high
FLP06-C,95,sqlite,ext/rtree/geopoly.c,577,FP,"r5=r3*r2 float arithmetic, misread",,high
DCL13-C,96,sqlite,ext/rtree/geopoly.c,591,FP,argv signature fixed by callback typedef,,high
DCL00-C,97,sqlite,ext/rtree/geopoly.c,595,TP,"r from value_double only read (n<3||r<=0.0 test and r*geopolySine), never modified, const-qualifiable (DCL00)",,med
EXP33-C,98,sqlite,ext/rtree/geopoly.c,603,FP,p assigned from sqlite3_malloc64 and NULL-checked before any deref; not uninitialized,,high
INT14-C,99,sqlite,ext/rtree/geopoly.c,603,FP,"n used in shifts/arithmetic for header bytes, readability advisory",,low
INT30-C,100,sqlite,ext/rtree/geopoly.c,603,FP,"sizeof(*p)+(n-1)*2*sizeof size_t; n bounded 3..1000, no wrap",,high
INT30-C,101,sqlite,ext/rtree/geopoly.c,603,FP,"(n-1)*2*sizeof size_t; n in 3..1000, no wrap",,high
INT13-C,102,sqlite,ext/rtree/geopoly.c,611,FP,n&0xff with n in 3..1000 building header byte; benign masking,,high
INT13-C,103,sqlite,ext/rtree/geopoly.c,612,FP,"(n>>8)&0xff header byte extraction, n bounded",,high
FLP03-C,104,sqlite,ext/rtree/geopoly.c,614,FP,"division i/n with n>=3, no division by zero",,high
INT30-C,105,sqlite,ext/rtree/geopoly.c,614,FP,"2.0*GEOPOLY_PI*i is floating-point, not unsigned-integer multiplication; misread",,high
ARR30-C,106,sqlite,ext/rtree/geopoly.c,615,FP,"GeoX(p,i) index bounded by i<n loop, allocation sized for n",,high
ARR30-C,107,sqlite,ext/rtree/geopoly.c,616,FP,"GeoY(p,i) bounded by i<n loop",,high
ARR30-C,108,sqlite,ext/rtree/geopoly.c,653,FP,"GeoX(p,0) in-bounds",,high
ARR30-C,109,sqlite,ext/rtree/geopoly.c,654,FP,"GeoY(p,0) in-bounds",,high
ARR30-C,110,sqlite,ext/rtree/geopoly.c,656,FP,"GeoX(p,ii) bounded by ii<p->nVertex loop",,high
DCL00-C,111,sqlite,ext/rtree/geopoly.c,656,FP,"r is reassigned (r=GeoY(p,ii)); not const-eligible",,high
FLP34-C,112,sqlite,ext/rtree/geopoly.c,657,FP,"double->float narrowing of coordinate value, inherent to GeoCoord=float; advisory",,low
FLP34-C,113,sqlite,ext/rtree/geopoly.c,658,FP,float narrowing advisory,,low
ARR30-C,114,sqlite,ext/rtree/geopoly.c,659,FP,"GeoY(p,ii) bounded by ii<nVertex loop",,high
FLP34-C,115,sqlite,ext/rtree/geopoly.c,660,FP,float narrowing advisory,,low
FLP34-C,116,sqlite,ext/rtree/geopoly.c,661,FP,float narrowing advisory,,low
ARR30-C,117,sqlite,ext/rtree/geopoly.c,679,FP,"GeoX(pOut,0) write, pOut sized GEOPOLY_SZ(4), in-bounds",,high
ARR30-C,118,sqlite,ext/rtree/geopoly.c,680,FP,"GeoY(pOut,0) in-bounds",,high
ARR30-C,119,sqlite,ext/rtree/geopoly.c,681,FP,"GeoX(pOut,1) in-bounds (nVertex=4)",,high
ARR30-C,120,sqlite,ext/rtree/geopoly.c,682,FP,"GeoY(pOut,1) in-bounds",,high
ARR30-C,121,sqlite,ext/rtree/geopoly.c,683,FP,"GeoX(pOut,2) in-bounds",,high
ARR30-C,122,sqlite,ext/rtree/geopoly.c,684,FP,"GeoY(pOut,2) in-bounds",,high
ARR30-C,123,sqlite,ext/rtree/geopoly.c,685,FP,"GeoX(pOut,3) in-bounds (index 3 < 4)",,high
ARR30-C,124,sqlite,ext/rtree/geopoly.c,686,FP,"GeoY(pOut,3) in-bounds",,high
ARR38-C,125,sqlite,ext/rtree/geopoly.c,695,FP,"memset size sizeof(RtreeCoord)*4 compile-time constant, no wrap",,high
INT30-C,126,sqlite,ext/rtree/geopoly.c,695,FP,"sizeof(RtreeCoord)*4 constant size_t, no wrap",,high
INT32-C,127,sqlite,ext/rtree/geopoly.c,695,FP,"memset constant size, no overflow",,high
DCL13-C,128,sqlite,ext/rtree/geopoly.c,706,FP,argv signature fixed by callback typedef,,high
INT32-C,129,sqlite,ext/rtree/geopoly.c,712,FP,"4+8*p->nVertex blob size, bounded",,high
INT32-C,130,sqlite,ext/rtree/geopoly.c,712,FP,8*p->nVertex bounded,,high
DCL13-C,131,sqlite,ext/rtree/geopoly.c,733,FP,argv signature fixed by callback typedef,,high
EXP33-C,132,sqlite,ext/rtree/geopoly.c,741,FP,pBBox from sqlite3_aggregate_context NULL-checked before deref,,high
ARR38-C,133,sqlite,ext/rtree/geopoly.c,745,FP,"memcpy(pBBox->a,a,sizeof(RtreeCoord)*4) constant size into fixed a[4]",,high
INT30-C,134,sqlite,ext/rtree/geopoly.c,745,FP,"sizeof(RtreeCoord)*4 constant, no wrap",,high
INT32-C,135,sqlite,ext/rtree/geopoly.c,745,FP,"constant memcpy size, no overflow",,high
INT32-C,136,sqlite,ext/rtree/geopoly.c,764,FP,"4+8*p->nVertex blob size, bounded",,high
INT32-C,137,sqlite,ext/rtree/geopoly.c,764,FP,8*p->nVertex bounded,,high
FLP02-C,138,sqlite,ext/rtree/geopoly.c,790,FP,"x0==x1 && y0==y1 exact geometry-identity comparison, intentional",,low
FLP02-C,139,sqlite,ext/rtree/geopoly.c,790,FP,exact coordinate comparison intentional for collinearity test,,low
FLP02-C,140,sqlite,ext/rtree/geopoly.c,797,FP,"x0!=x1 vertical-segment test, exact comparison intentional",,low
FLP03-C,141,sqlite,ext/rtree/geopoly.c,802,FP,division guarded; x2!=x1 since x1==x2 case returns before line 802,,high
INT33-C,142,sqlite,ext/rtree/geopoly.c,802,FP,"division by (x2-x1) safe: x1==x2 branch returns earlier, x2-x1 nonzero here",,high
FLP02-C,143,sqlite,ext/rtree/geopoly.c,803,FP,"y0==y exact comparison for on-segment test, intentional",,low
DCL13-C,144,sqlite,ext/rtree/geopoly.c,818,FP,argv signature fixed by callback typedef,,high
ARR30-C,145,sqlite,ext/rtree/geopoly.c,830,FP,"GeoX(p1,ii) bounded by ii<p1->nVertex-1 loop",,high
ARR30-C,146,sqlite,ext/rtree/geopoly.c,830,FP,"GeoY(p1,ii) bounded by loop",,high
EXP30-C,147,sqlite,ext/rtree/geopoly.c,830,FP,GeoX/GeoY arguments are side-effect-free reads,,high
ARR30-C,148,sqlite,ext/rtree/geopoly.c,831,FP,"GeoX(p1,ii+1) with ii<nVertex-1 so ii+1<nVertex, in-bounds",,high
ARR30-C,149,sqlite,ext/rtree/geopoly.c,831,FP,"GeoY(p1,ii+1) in-bounds",,high
INT32-C,150,sqlite,ext/rtree/geopoly.c,831,FP,"ii+1 bounded by ii<nVertex-1, small, no overflow",,high
INT32-C,151,sqlite,ext/rtree/geopoly.c,831,FP,"ii+1 bounded, no overflow",,high
INT14-C,152,sqlite,ext/rtree/geopoly.c,833,FP,"cnt accumulates v(0..2) over nVertex iterations, only used in &1 parity; readability advisory",,low
INT32-C,153,sqlite,ext/rtree/geopoly.c,833,FP,"cnt+=v where v in {0,1,2}, bounded by vertex count, no overflow",,high
ARR30-C,154,sqlite,ext/rtree/geopoly.c,836,FP,"GeoX(p1,ii) after loop in-bounds",,high
ARR30-C,155,sqlite,ext/rtree/geopoly.c,836,FP,"GeoY(p1,ii) in-bounds",,high
EXP30-C,156,sqlite,ext/rtree/geopoly.c,836,FP,side-effect-free array-read arguments,,high
ARR30-C,157,sqlite,ext/rtree/geopoly.c,837,FP,"GeoX(p1,0) in-bounds",,high
ARR30-C,158,sqlite,ext/rtree/geopoly.c,837,FP,"GeoY(p1,0) in-bounds",,high
INT13-C,159,sqlite,ext/rtree/geopoly.c,841,FP,"(v+cnt)&1 parity test on small bounded values, benign",,high
INT14-C,160,sqlite,ext/rtree/geopoly.c,841,FP,"v used in arithmetic and bitwise parity test, readability advisory",,low
DCL13-C,161,sqlite,ext/rtree/geopoly.c,863,FP,argv signature fixed by callback typedef,,high
FLP02-C,162,sqlite,ext/rtree/geopoly.c,919,FP,"float equality comparison in geometry, intentional",,low
ARR36-C,163,sqlite,ext/rtree/geopoly.c,920,FP,"x0 and x1 are scalar GeoCoord function parameters, not pointers into different arrays; misread",,high
INT32-C,164,sqlite,ext/rtree/geopoly.c,929,FP,nSegment bounded by total vertices (<=~32M from blob-size-validated nVertex); cannot reach INT_MAX,,high
ARR00-C,165,sqlite,ext/rtree/geopoly.c,930,FP,"x0/y0/x1/y1 are local GeoCoord scalars not array pointers; swap-temp idiom, no pointer subtraction",,high
ARR00-C,166,sqlite,ext/rtree/geopoly.c,930,FP,swap idiom on local scalars t/x0/x1; no cross-array pointer subtraction,,high
ARR36-C,167,sqlite,ext/rtree/geopoly.c,930,FP,"y0/y1 scalar locals being swapped, not array pointers",,high
ARR36-C,168,sqlite,ext/rtree/geopoly.c,930,FP,"t/x1 scalar locals in the coordinate swap, not array pointers",,high
FLP03-C,169,sqlite,ext/rtree/geopoly.c,930,FP,division (y1-y0)/(x1-x0) guarded by x0==x1 early-return; denominator nonzero,,high
INT33-C,170,sqlite,ext/rtree/geopoly.c,930,FP,x1-x0 cannot be zero: x0==x1 returns early and swap only runs when x0>x1,,high
INT32-C,171,sqlite,ext/rtree/geopoly.c,936,FP,nEvent bounded by 2*(nVertex sums)<=~64M; allocation sized nVertex*2 covers it,,high
INT32-C,172,sqlite,ext/rtree/geopoly.c,941,FP,same bounded nEvent counter; far below INT_MAX,,high
INT30-C,173,sqlite,ext/rtree/geopoly.c,959,FP,pPoly->nVertex>=3 for any polygon from geopolyFuncParam; no unsigned underflow,,high
ARR30-C,174,sqlite,ext/rtree/geopoly.c,960,FP,GeoX index i bounded by validated nVertex-1; allocation matches,,high
EXP40-C,175,sqlite,ext/rtree/geopoly.c,960,FP,"&GeoX(p,i) into local GeoCoord *x; intentional pointer-walk, no const defect",,high
ARR30-C,176,sqlite,ext/rtree/geopoly.c,963,FP,"GeoX(pPoly,i) at loop tail uses i==nVertex-1, in-bounds",,high
EXP40-C,177,sqlite,ext/rtree/geopoly.c,963,FP,local GeoCoord* assignment; not a const violation,,high
DCL13-C,178,sqlite,ext/rtree/geopoly.c,970,FP,geopolyEventMerge relinks pLeft->pNext (mutates pointees); const would not apply,,high
DCL13-C,179,sqlite,ext/rtree/geopoly.c,970,FP,"pRight nodes relinked via pLast->pNext, traversal mutates list; not const",,high
DCL13-C,180,sqlite,ext/rtree/geopoly.c,992,TP,aEvent in geopolySortEventsByX only read (p=&aEvent[i]) never written through; const GeoEvent* would compile (DCL13),,med
ARR00-C,181,sqlite,ext/rtree/geopoly.c,997,FP,"nEvent is the function parameter (p->nEvent), fully initialized by caller",,high
EXP40-C,182,sqlite,ext/rtree/geopoly.c,998,FP,p=&aEvent[i] is a local read pointer; no const defect,,high
ARR30-C,183,sqlite,ext/rtree/geopoly.c,1000,FP,"a[50] indexed by j<mx, mx grows only to ~log2(nEvent)+1, bounded under 50",,high
ARR30-C,184,sqlite,ext/rtree/geopoly.c,1001,FP,"a[50] merge-bin access, j bounded by mx<50",,high
ARR30-C,185,sqlite,ext/rtree/geopoly.c,1002,FP,a[50] access guarded by j<mx loop bound,,high
INT32-C,186,sqlite,ext/rtree/geopoly.c,1005,FP,j+1 small merge-sort bin index (<50); cannot overflow,,high
ARR30-C,187,sqlite,ext/rtree/geopoly.c,1009,FP,"a[i] indexed by i<mx, mx<50; in-bounds",,high
DCL30-C,188,sqlite,ext/rtree/geopoly.c,1011,FP,"p is a GeoEvent* heap list node, not address of a local; no escape",,high
DCL13-C,189,sqlite,ext/rtree/geopoly.c,1017,FP,geopolySegmentMerge relinks pLeft->pNext (mutates nodes); not missing-const,,high
DCL13-C,190,sqlite,ext/rtree/geopoly.c,1017,FP,pRight list nodes relinked/traversed with mutation; not const,,high
DCL00-C,191,sqlite,ext/rtree/geopoly.c,1022,FP,r in geopolySegmentMerge is reassigned (r=pRight->C-pLeft->C); DCL00 misfire,,med
DCL13-C,192,sqlite,ext/rtree/geopoly.c,1042,FP,pList consumed/reassigned (pList=pList->pNext); parameter is modified,,high
ARR30-C,193,sqlite,ext/rtree/geopoly.c,1051,FP,"a[50] segment-merge bin indexed by i<mx, mx bounded by log2(nSegment)+1 <50",,high
ARR30-C,194,sqlite,ext/rtree/geopoly.c,1052,FP,a[50] bin access under i<mx guard,,high
ARR30-C,195,sqlite,ext/rtree/geopoly.c,1053,FP,bounded a[50] access,,high
INT32-C,196,sqlite,ext/rtree/geopoly.c,1056,FP,i+1 small bin index well under 50,,high
ARR30-C,197,sqlite,ext/rtree/geopoly.c,1060,FP,a[i] for i<mx<50; in-bounds,,high
DCL30-C,198,sqlite,ext/rtree/geopoly.c,1062,FP,"p is a GeoSegment* heap list node, not address of a local",,high
INT32-C,199,sqlite,ext/rtree/geopoly.c,1069,FP,"p1->nVertex,p2->nVertex each <=16M; sum+2 computed as sqlite3_int64, no overflow",,high
INT32-C,200,sqlite,ext/rtree/geopoly.c,1069,FP,int64 sum of two <=16M values; no overflow,,high
ARR39-C,201,sqlite,ext/rtree/geopoly.c,1080,FP,nByte computed in sqlite3_int64 with size_t sizeof operands; product <4GB fits int64,,high
ARR39-C,202,sqlite,ext/rtree/geopoly.c,1080,FP,int64 scaled allocation size bounded by validated vertex counts,,high
INT30-C,203,sqlite,ext/rtree/geopoly.c,1080,FP,"addition of three int64 sizeof products, all bounded; passed to sqlite3_malloc64",,high
INT30-C,204,sqlite,ext/rtree/geopoly.c,1080,FP,"sizeof(GeoEvent)*nVertex in int64; nVertex<=~32M, product <2GB",,high
INT30-C,205,sqlite,ext/rtree/geopoly.c,1081,FP,sizeof(GeoSegment)*nVertex bounded the same way; no wrap,,high
INT32-C,206,sqlite,ext/rtree/geopoly.c,1086,FP,"nVertex*2 index; nVertex<=~32M, *2 fits int and matches allocation",,high
FLP06-C,207,sqlite,ext/rtree/geopoly.c,1116,FP,"cSep initialized to char literal in geopolySvg, not integer arithmetic; FLP06 misfire",,high
PRE32-C,208,sqlite,ext/rtree/geopoly.c,1122,FP,"GEODEBUG expands to format-string args, not a preprocessor directive; PRE32 misfire",,high
PRE32-C,209,sqlite,ext/rtree/geopoly.c,1122,FP,"flagged content is printf format args, not a directive inside the macro call",,high
PRE32-C,210,sqlite,ext/rtree/geopoly.c,1135,FP,GEODEBUG debug-only macro; no UB from arguments,,high
PRE32-C,211,sqlite,ext/rtree/geopoly.c,1135,FP,format-string argument misread as preprocessor directive,,high
DCL13-C,212,sqlite,ext/rtree/geopoly.c,1194,FP,"argv is read-only vtab args; flag on already-const data, no actionable change",,high
DCL13-C,213,sqlite,ext/rtree/geopoly.c,1215,FP,context (sqlite3_context*) signature fixed by SQL function callback typedef,,high
DCL13-C,214,sqlite,ext/rtree/geopoly.c,1217,FP,argv signature fixed by sqlite3_value** SQL-callback typedef,,high
DCL13-C,215,sqlite,ext/rtree/geopoly.c,1239,FP,pAux signature fixed by xCreate/xConnect module typedef,,high
INT30-C,216,sqlite,ext/rtree/geopoly.c,1260,FP,"sizeof(Rtree)+nDb: nDb=strlen of a schema name, tiny; size_t addition, no practical wrap",,high
INT32-C,217,sqlite,ext/rtree/geopoly.c,1260,FP,nName*2 where nName=strlen of table name; bounded by schema-name length,,high
ARR38-C,218,sqlite,ext/rtree/geopoly.c,1264,FP,memset size matches the malloc64 of the same expression; bounded by names,,high
INT30-C,219,sqlite,ext/rtree/geopoly.c,1264,FP,bounded size_t addition of strlen-derived lengths,,high
INT32-C,220,sqlite,ext/rtree/geopoly.c,1264,FP,"memset arithmetic matches malloc64 of same expression, no overflow",,high
INT32-C,221,sqlite,ext/rtree/geopoly.c,1264,FP,nName*2 strlen-bounded; no overflow,,high
INT31-C,222,sqlite,ext/rtree/geopoly.c,1273,FP,"nDb is strlen result, >=0 small; signed-to-size_t conversion safe",,high
INT31-C,223,sqlite,ext/rtree/geopoly.c,1274,FP,"nName is strlen result, non-negative small; conversion safe",,high
INT31-C,224,sqlite,ext/rtree/geopoly.c,1275,FP,same strlen-derived nName; safe size_t conversion,,high
MEM31-C,225,sqlite,ext/rtree/geopoly.c,1283,FP,pSql finished via sqlite3_str_finish which frees the sqlite3_str; not leaked,,high
STR34-C,226,sqlite,ext/rtree/geopoly.c,1296,FP,*pzErr assigned from sqlite3_mprintf (char*); standard error-string idiom,,high
STR34-C,227,sqlite,ext/rtree/geopoly.c,1307,FP,same sqlite3_mprintf error-string assignment; no STR34 issue,,high
MEM31-C,228,sqlite,ext/rtree/geopoly.c,1308,FP,"pSql converted to zSql via sqlite3_str_finish before goto; consumed, no leak",,high
MEM31-C,229,sqlite,ext/rtree/geopoly.c,1312,FP,pSql already finished into zSql before this return; no live sqlite3_str leaks,,high
MSC07-C,230,sqlite,ext/rtree/geopoly.c,1314,FP,line 1312 returns SQLITE_OK; the geopolyInit_fail block after is reached via goto,,high
MEM31-C,231,sqlite,ext/rtree/geopoly.c,1319,FP,pSql already finished/freed before fail path; nothing leaked,,high
DCL13-C,232,sqlite,ext/rtree/geopoly.c,1366,FP,argv signature fixed by xUpdate/SQL-callback typedef,,high
INT30-C,233,sqlite,ext/rtree/geopoly.c,1414,FP,sizeof(RtreeConstraint)*4 compile-time constant product; no overflow,,high
INT32-C,234,sqlite,ext/rtree/geopoly.c,1414,FP,constant *4 of a sizeof; no overflow,,high
ARR38-C,235,sqlite,ext/rtree/geopoly.c,1419,FP,"memset size sizeof(RtreeConstraint)*4 constant, matches malloc",,high
INT30-C,236,sqlite,ext/rtree/geopoly.c,1419,FP,constant sizeof*4; no wrap,,high
INT32-C,237,sqlite,ext/rtree/geopoly.c,1419,FP,constant memset size; no overflow,,high
INT32-C,238,sqlite,ext/rtree/geopoly.c,1419,FP,constant sizeof multiplication; safe,,high
ARR38-C,239,sqlite,ext/rtree/geopoly.c,1420,FP,memset size sizeof(u32)*(iDepth+1); iDepth small bounded tree height; valid,,high
INT30-C,240,sqlite,ext/rtree/geopoly.c,1420,FP,sizeof(u32)*(iDepth+1) bounded; anQueue sized for iDepth+1; no wrap,,high
INT32-C,241,sqlite,ext/rtree/geopoly.c,1420,FP,bounded depth-based memset size; matches anQueue array,,high
INT32-C,242,sqlite,ext/rtree/geopoly.c,1420,FP,iDepth+1 small bounded tree depth; no overflow,,high
INT32-C,243,sqlite,ext/rtree/geopoly.c,1426,FP,p++ walks the 4-element RtreeConstraint array; bounded,,high
INT32-C,244,sqlite,ext/rtree/geopoly.c,1430,FP,constraint-array pointer walk; bounded by 4 entries,,high
INT32-C,245,sqlite,ext/rtree/geopoly.c,1434,FP,bounded constraint-pointer increment,,high
INT32-C,246,sqlite,ext/rtree/geopoly.c,1443,FP,bounded p++ over 4 constraints,,high
INT32-C,247,sqlite,ext/rtree/geopoly.c,1447,FP,bounded constraint-array walk,,high
INT32-C,248,sqlite,ext/rtree/geopoly.c,1451,FP,bounded p++ (4th constraint),,high
INT32-C,249,sqlite,ext/rtree/geopoly.c,1460,FP,iDepth+1 small bounded tree depth; no overflow,,high
EXP34-C,250,sqlite,ext/rtree/geopoly.c,1477,FP,nodeRelease handles NULL pRoot (null-checks before use),,high
MEM12-C,251,sqlite,ext/rtree/geopoly.c,1479,FP,on NOMEM aConstraint owned by cursor (freed by resetCursor/xClose); no double-tracked leak,,high
DCL13-C,252,sqlite,ext/rtree/geopoly.c,1495,FP,tab (sqlite3_vtab*) signature fixed by xBestIndex module typedef,,high
ARR00-C,253,sqlite,ext/rtree/geopoly.c,1502,FP,"ii bounded by pIdxInfo->nConstraint loop, initialized in for-init, not uninitialized",,high
INT30-C,254,sqlite,ext/rtree/geopoly.c,1576,FP,i+2 indexes the 4-element bbox/constraint setup with i bounded; within sized buffer,,high
INT32-C,255,sqlite,ext/rtree/geopoly.c,1576,FP,small bounded i+2; no overflow,,high
DCL13-C,256,sqlite,ext/rtree/geopoly.c,1606,FP,aData is sqlite3_value** fixed by xUpdate module typedef,,high
EXP34-C,257,sqlite,ext/rtree/geopoly.c,1690,FP,pLeaf set when rc==OK (ChooseLeaf); on alloc failure rc!=OK and call skipped,,high
EXP34-C,258,sqlite,ext/rtree/geopoly.c,1691,FP,nodeRelease tolerates NULL pLeaf (null-checks internally),,high
EXP34-C,259,sqlite,ext/rtree/geopoly.c,1713,FP,p guarded by (p=geopolyFuncParam(...))!=0 before member access,,high
INT32-C,260,sqlite,ext/rtree/geopoly.c,1713,FP,"4+8*p->nVertex with nVertex<=16M; 8*16M=134M fits int, no overflow",,high
INT32-C,261,sqlite,ext/rtree/geopoly.c,1713,FP,8*p->nVertex bounded by validated nVertex<=16M; fits int,,high
ARR00-C,262,sqlite,ext/rtree/geopoly.c,1720,FP,"jj is the for-loop counter bounded by nData; initialized, not uninitialized",,high
INT32-C,263,sqlite,ext/rtree/geopoly.c,1722,FP,"jj+2 binds parameter index, jj bounded by nData; no realistic overflow",,high
INT32-C,264,sqlite,ext/rtree/geopoly.c,1722,FP,bounded jj+2 parameter-index arithmetic,,high
CON03-C,265,sqlite,ext/rtree/geopoly.c,1762,FP,geopolyModule is a static const-data module table read once at init; no shared-mutable-state defect,,high
STR00-C,266,sqlite,ext/rtree/geopoly.c,1794,FP,aFunc[].nArg is signed char by design to hold -1 (variadic geopoly_svg); intentional,,high
ARR02-C,267,sqlite,ext/rtree/geopoly.c,1797,FP,aFunc[] implicit size from initializer is correct C idiom,,high
WIN04-C,268,sqlite,ext/rtree/geopoly.c,1797,FP,WIN04 EncodePointer not applicable; static const function-pointer table,,high
ARR02-C,269,sqlite,ext/rtree/geopoly.c,1815,FP,aAgg[] implicit-size initializer is valid C,,high
WIN04-C,270,sqlite,ext/rtree/geopoly.c,1815,FP,static const function-pointer table; EncodePointer not applicable,,high
ARR38-C,0,sqlite,ext/recover/sqlite3recover.c,348,FP,"memset size nByte from db page_count bounded by file size; recoverMalloc asserts nByte>0, uses malloc64",,high
INT30-C,1,sqlite,ext/recover/sqlite3recover.c,398,FP,"nElem*sizeof(u32) promotes to size_t; nElem bounded by actual db page count, no realistic wrap",,med
INT10-C,2,sqlite,ext/recover/sqlite3recover.c,420,FP,iPg is i64 page number >=1 (positive); modulo of positive operand well-defined,,high
INT13-C,3,sqlite,ext/recover/sqlite3recover.c,421,FP,"iBit = iPg%32 in [0,31], shift of (u32)1 by bounded amount is safe",,high
INT34-C,4,sqlite,ext/recover/sqlite3recover.c,421,FP,"shift amount iBit in [0,31] always valid for u32",,high
DCL13-C,5,sqlite,ext/recover/sqlite3recover.c,429,TP,"recoverBitmapQuery reads pMap only (nPg, aElem); const RecoverBitmap* would compile (DCL13)",,high
INT10-C,6,sqlite,ext/recover/sqlite3recover.c,433,FP,"iPg positive page number, modulo well-defined",,high
INT13-C,7,sqlite,ext/recover/sqlite3recover.c,434,FP,"iBit in [0,31], bitwise on bounded non-negative int",,high
INT34-C,8,sqlite,ext/recover/sqlite3recover.c,434,FP,"shift amount in [0,31] valid",,high
EXP30-C,9,sqlite,ext/recover/sqlite3recover.c,445,FP,"sqlite3_errcode and sqlite3_errmsg both only read db error state, ordering irrelevant",,high
DCL30-C,10,sqlite,ext/recover/sqlite3recover.c,468,FP,"returns pointer value of pStmt (assigned by prepare), not address of local",,high
STR34-C,11,sqlite,ext/recover/sqlite3recover.c,546,FP,"zSql passed as pointer to sqlite3_exec, not widened to integer; STR34 misfire",,high
DCL30-C,12,sqlite,ext/recover/sqlite3recover.c,597,FP,"returns heap pointer value z from sqlite3_vmprintf, not &z",,high
DCL13-C,13,sqlite,ext/recover/sqlite3recover.c,634,FP,argv signature fixed by SQLite scalar-function callback typedef; cannot add const,,high
EXP34-C,14,sqlite,ext/recover/sqlite3recover.c,646,FP,guard (iInt+1)*4<=nBlob with iInt>=0 means nBlob>=4 so pBlob non-NULL before deref,,high
INT14-C,15,sqlite,ext/recover/sqlite3recover.c,647,FP,"a is a pointer; a[i]<<n are reads on byte values, INT14 readability misfire",,high
DCL13-C,16,sqlite,ext/recover/sqlite3recover.c,670,FP,apArg signature fixed by scalar-function callback typedef,,high
EXP34-C,17,sqlite,ext/recover/sqlite3recover.c,675,FP,p = sqlite3_user_data registered with non-null (void*)p,,high
DCL13-C,18,sqlite,ext/recover/sqlite3recover.c,695,FP,apArg signature fixed by callback typedef,,high
EXP34-C,19,sqlite,ext/recover/sqlite3recover.c,707,FP,p from sqlite3_user_data always non-null,,high
INT31-C,20,sqlite,ext/recover/sqlite3recover.c,723,FP,nPg = column_bytes (>=0) and guarded by nPg==p->pgsz before memcmp,,high
INT32-C,21,sqlite,ext/recover/sqlite3recover.c,726,FP,"nPg equals page size (>=512) and nReserve is a single byte 0-255, so nPg-nReserve>0",,med
DCL13-C,22,sqlite,ext/recover/sqlite3recover.c,774,FP,argv signature fixed by scalar-function callback typedef,,high
EXP34-C,23,sqlite,ext/recover/sqlite3recover.c,791,FP,zNL from recoverUnusedString which always returns non-NULL,,high
EXP34-C,24,sqlite,ext/recover/sqlite3recover.c,795,FP,zCR from recoverUnusedString which always returns non-NULL,,high
INT32-C,25,sqlite,ext/recover/sqlite3recover.c,802,FP,nMax is strlen of a tiny fixed string (<=5); (nMax+64)*2 cannot overflow i64,,high
ARR38-C,26,sqlite,ext/recover/sqlite3recover.c,810,FP,zOut sized nAlloc covers 16-byte replace prefix,,high
INT32-C,27,sqlite,ext/recover/sqlite3recover.c,811,FP,iOut bounded by nAlloc (bounded by int nText); no overflow,,high
INT32-C,28,sqlite,ext/recover/sqlite3recover.c,814,FP,iOut bounded by nAlloc; no overflow,,high
INT31-C,29,sqlite,ext/recover/sqlite3recover.c,818,FP,"nNL is strlen of bounded zNL, dest zOut sized for full expansion",,high
INT32-C,30,sqlite,ext/recover/sqlite3recover.c,819,FP,iOut bounded by nAlloc,,high
INT31-C,31,sqlite,ext/recover/sqlite3recover.c,821,FP,"nCR strlen of bounded zCR, dest sized",,high
INT32-C,32,sqlite,ext/recover/sqlite3recover.c,822,FP,iOut bounded by nAlloc,,high
INT32-C,33,sqlite,ext/recover/sqlite3recover.c,830,FP,iOut bounded by nAlloc,,high
INT31-C,34,sqlite,ext/recover/sqlite3recover.c,831,FP,"nNL bounded, dest sized",,high
INT32-C,35,sqlite,ext/recover/sqlite3recover.c,831,FP,iOut bounded by nAlloc,,high
ARR38-C,36,sqlite,ext/recover/sqlite3recover.c,832,FP,12-byte copy into adequately-sized zOut suffix region,,high
INT32-C,37,sqlite,ext/recover/sqlite3recover.c,832,FP,iOut bounded by nAlloc,,high
INT32-C,38,sqlite,ext/recover/sqlite3recover.c,835,FP,iOut bounded by nAlloc,,high
INT31-C,39,sqlite,ext/recover/sqlite3recover.c,836,FP,"nCR bounded, dest sized",,high
INT32-C,40,sqlite,ext/recover/sqlite3recover.c,836,FP,iOut bounded by nAlloc,,high
ARR38-C,41,sqlite,ext/recover/sqlite3recover.c,837,FP,12-byte copy into sized suffix region,,high
INT32-C,42,sqlite,ext/recover/sqlite3recover.c,837,FP,iOut bounded by nAlloc,,high
STR34-C,43,sqlite,ext/recover/sqlite3recover.c,892,FP,"zSql passed as pointer to sqlite3_exec, not widened to int; STR34 misfire",,high
ARR02-C,44,sqlite,ext/recover/sqlite3recover.c,910,FP,"aPragma[] bounds set by initializer list, iterated via sizeof; safe const local table",,high
FIO42-C,45,sqlite,ext/recover/sqlite3recover.c,924,FP,"rc is sqlite3_open return code (int), db2 closed at 959; not an open() fd",,high
EXP34-C,46,sqlite,ext/recover/sqlite3recover.c,926,FP,db2 non-null after successful sqlite3_open (early return on error),,high
ARR00-C,47,sqlite,ext/recover/sqlite3recover.c,930,FP,ii initialized to 0 in the for-init; not uninitialized,,high
EXP34-C,48,sqlite,ext/recover/sqlite3recover.c,938,FP,db2 valid non-null handle after successful open,,high
EXP34-C,49,sqlite,ext/recover/sqlite3recover.c,946,FP,db2 valid non-null handle,,high
EXP34-C,50,sqlite,ext/recover/sqlite3recover.c,950,FP,db2 valid non-null handle passed to backup_init,,high
EXP34-C,51,sqlite,ext/recover/sqlite3recover.c,959,FP,db2 valid non-null handle passed to sqlite3_close,,high
ARR02-C,52,sqlite,ext/recover/sqlite3recover.c,982,FP,"aFunc[] bounds set by initializer, iterated via sizeof; safe dispatch table",,high
WIN04-C,53,sqlite,ext/recover/sqlite3recover.c,982,FP,"WIN04 EncodePointer; normal static dispatch table, not applicable",,high
EXP34-C,54,sqlite,ext/recover/sqlite3recover.c,996,FP,sqlite3_open_v2 always returns a usable handle per contract,,high
EXP34-C,55,sqlite,ext/recover/sqlite3recover.c,1004,FP,db non-null after open_v2 (SQLite contract returns handle even on error),,high
EXP34-C,56,sqlite,ext/recover/sqlite3recover.c,1011,FP,db non-null; create_function accepts it,,high
STR34-C,57,sqlite,ext/recover/sqlite3recover.c,1064,FP,zName passed to recoverStrlen (masks &0x7fffffff); no harmful char widening,,high
INT32-C,58,sqlite,ext/recover/sqlite3recover.c,1067,FP,nCol counts table_xinfo rows bounded by SQLITE_MAX_COLUMN; no realistic overflow,,med
INT32-C,59,sqlite,ext/recover/sqlite3recover.c,1068,FP,nByte sums column_bytes over bounded column count; no overflow,,med
INT30-C,60,sqlite,ext/recover/sqlite3recover.c,1070,FP,"nCol bounded by column limit; sizeof products small, no wrap",,med
INT30-C,61,sqlite,ext/recover/sqlite3recover.c,1070,FP,nCol*sizeof(RecoverColumn) bounded by column limit,,med
INT32-C,62,sqlite,ext/recover/sqlite3recover.c,1070,FP,nByte accumulation bounded by column count and name lengths,,med
EXP34-C,63,sqlite,ext/recover/sqlite3recover.c,1082,FP,csr = &pNew->aCol[nCol] reached only inside if(pNew); non-null,,high
INT31-C,64,sqlite,ext/recover/sqlite3recover.c,1082,FP,"nName = recoverStrlen (>=0), csr buffer sized to include nName+1",,high
ARR37-C,65,sqlite,ext/recover/sqlite3recover.c,1083,FP,csr advances within single malloc buffer sized by nByte; ARR37 idiom misfire,,high
EXP05-C,66,sqlite,ext/recover/sqlite3recover.c,1106,FP,no const cast on n (plain int); memcpy takes const src; EXP05 misfire,,high
INT31-C,67,sqlite,ext/recover/sqlite3recover.c,1106,FP,"n = column_bytes (>=0), z has that length, csr buffer sized for n+1",,high
ARR37-C,68,sqlite,ext/recover/sqlite3recover.c,1107,FP,csr advances within sized buffer; ARR37 idiom misfire,,high
EXP34-C,69,sqlite,ext/recover/sqlite3recover.c,1122,FP,"if malloc failed pNew==0 sets errCode, reprepare returns NULL and loop never runs",,med
EXP34-C,70,sqlite,ext/recover/sqlite3recover.c,1128,FP,"recoverFinalize handles NULL pStmt (db_handle(0)->0, finalize(0)->no-op)",,high
STR34-C,71,sqlite,ext/recover/sqlite3recover.c,1249,FP,zSql passed as pointer to sqlite3_exec; STR34 misfire,,high
DCL13-C,72,sqlite,ext/recover/sqlite3recover.c,1299,TP,"recoverInsertStmt reads pTab only (zTab, iRowidBind, bIntkey, aCol[]); const RecoverTable* would compile (DCL13)",,high
ARR00-C,73,sqlite,ext/recover/sqlite3recover.c,1329,FP,"nField is a function parameter, initialized by caller; not uninitialized",,high
DCL13-C,74,sqlite,ext/recover/sqlite3recover.c,1371,TP,recoverFindTable reads p->pTblList only; const sqlite3_recover* would compile (DCL13),,med
DCL30-C,75,sqlite,ext/recover/sqlite3recover.c,1374,FP,"returns heap pointer value pRet (list node), not address of local",,high
INT32-C,76,sqlite,ext/recover/sqlite3recover.c,1457,FP,"nField is max DB column count plus 4; used as loop count for bind string, no overflow reachable",,med
MEM31-C,77,sqlite,ext/recover/sqlite3recover.c,1581,FP,apVal[iField] freed in cleanup loops before return; on NOMEM rc set and value is 0,,high
INT30-C,78,sqlite,ext/recover/sqlite3recover.c,1659,FP,"nMaxField bounded by realistic column count; *sizeof(ptr) cannot wrap, recoverMalloc uses i64",,high
INT30-C,79,sqlite,ext/recover/sqlite3recover.c,1682,FP,p1->nMax bounded by schema column count; (nMax+1)*sizeof(ptr) cannot wrap,,high
INT32-C,80,sqlite,ext/recover/sqlite3recover.c,1682,FP,p1->nMax bounded by column count; nMax+1 cannot overflow int,,high
ARR00-C,81,sqlite,ext/recover/sqlite3recover.c,1716,FP,ii initialized to 0 at declaration before the loop; not uninitialized,,high
MEM30-C,82,sqlite,ext/recover/sqlite3recover.c,1720,FP,"recoverFinalize finalizes p1->pInsert but does not free p1; not use-after-free, reset by memset",,high
MEM30-C,83,sqlite,ext/recover/sqlite3recover.c,1721,FP,"pTbls finalized not freed, no use-after-free",,high
MEM30-C,84,sqlite,ext/recover/sqlite3recover.c,1722,FP,"pSel finalized not freed, no use-after-free",,high
MEM31-C,85,sqlite,ext/recover/sqlite3recover.c,1836,FP,recoverWriteDataStep apVal[iField] freed in loops; dup'd values tracked and freed,,med
MEM31-C,86,sqlite,ext/recover/sqlite3recover.c,1852,FP,apVal entries freed in the bNewCell loop and final cleanup; no leak on normal return,,med
MEM30-C,87,sqlite,ext/recover/sqlite3recover.c,1999,FP,recoverLostAndFoundCleanup frees sub-members of p->laf then nulls; laf embedded struct not freed,,high
MEM30-C,88,sqlite,ext/recover/sqlite3recover.c,2017,FP,"p->laf.apVal freed and nulled, laf struct embedded in p",,high
INT14-C,89,sqlite,ext/recover/sqlite3recover.c,2055,FP,"recoverGetU16 a[0]<<8 + a[1]: shift/add on u32 from 2 bytes, max 0xFFFF; readability misfire",,low
INT14-C,90,sqlite,ext/recover/sqlite3recover.c,2063,FP,"recoverGetU32 combines 4 bytes into u32, big-endian decode, intentional bit/arith mix",,low
INT14-C,91,sqlite,ext/recover/sqlite3recover.c,2074,FP,recoverGetVarint loop index i used as array index/increment; standard varint decode,,low
INT14-C,92,sqlite,ext/recover/sqlite3recover.c,2074,FP,"u is varint accumulator, bit-shift and add intentional",,low
INT14-C,93,sqlite,ext/recover/sqlite3recover.c,2074,FP,"a[i] byte access in varint, intentional",,low
INT30-C,94,sqlite,ext/recover/sqlite3recover.c,2074,FP,"u<<7 on u64 accumulator; max 8 iterations of 7-bit groups, cannot overflow u64",,high
INT30-C,95,sqlite,ext/recover/sqlite3recover.c,2077,FP,"u<<8 final varint byte; 64 bits exactly, by design no overflow",,high
EXP05-C,96,sqlite,ext/recover/sqlite3recover.c,2110,FP,"memset(aUsed,0,n) n is int page size, no const cast; aUsed non-const u8*",,high
EXP34-C,97,sqlite,ext/recover/sqlite3recover.c,2110,FP,aUsed=aTmp=&aPg[nMax]; aPg checked non-NULL; aUsed never null when reached,,high
INT31-C,98,sqlite,ext/recover/sqlite3recover.c,2110,FP,"n=pgsz2-nReserve, pgsz2>=512 nReserve small, n positive bounded <=65536; safe conversion",,high
INT31-C,99,sqlite,ext/recover/sqlite3recover.c,2111,FP,"iContent bounded [0,65536] checked iContent<=n before memset; positive, safe",,high
ARR38-C,100,sqlite,ext/recover/sqlite3recover.c,2123,FP,"memset(aUsed,0xFF,iContent) with iContent<=n<=65536 and aUsed sized n; valid",,high
INT32-C,101,sqlite,ext/recover/sqlite3recover.c,2142,FP,"nByte+=4 only when eType 0x05/0x02; nByte stays small, no overflow",,high
INT32-C,102,sqlite,ext/recover/sqlite3recover.c,2143,FP,"varint returns 1-9; nByte bounded small, no overflow",,high
INT32-C,103,sqlite,ext/recover/sqlite3recover.c,2143,FP,"iOff in [iContent,n], n<=65536, nByte small; iOff+nByte cannot overflow int",,high
INT32-C,104,sqlite,ext/recover/sqlite3recover.c,2146,FP,varint return added to small nByte,,high
INT32-C,105,sqlite,ext/recover/sqlite3recover.c,2146,FP,"iOff+nByte bounded by ~65536, no int overflow",,high
INT32-C,106,sqlite,ext/recover/sqlite3recover.c,2149,FP,"n-35 with n>=512 bounded page size, no overflow",,high
INT32-C,107,sqlite,ext/recover/sqlite3recover.c,2149,FP,((n-12)*64/255)-23 with n<=65536: (n-12)*64 max ~4.2M fits int,,high
INT32-C,108,sqlite,ext/recover/sqlite3recover.c,2149,FP,"(n-12)*64 max ~4.19M for n=65536, fits 32-bit int",,high
INT32-C,109,sqlite,ext/recover/sqlite3recover.c,2149,FP,"n-12 with n>=512, no overflow",,high
INT32-C,110,sqlite,ext/recover/sqlite3recover.c,2150,FP,"((n-12)*32/255)-23 bounded, fits int",,high
INT32-C,111,sqlite,ext/recover/sqlite3recover.c,2150,FP,(n-12)*32 max ~2.1M fits int,,high
INT32-C,112,sqlite,ext/recover/sqlite3recover.c,2150,FP,n-12 bounded,,high
INT10-C,113,sqlite,ext/recover/sqlite3recover.c,2151,FP,(nPayload-M)%(n-4): nPayload i64>=0 from decode; n-4>=508 positive; modulo well-defined,,med
INT32-C,114,sqlite,ext/recover/sqlite3recover.c,2151,FP,"M+((nPayload-M)%(n-4)): M small, modulo result < n-4 <65536; sum K bounded",,high
INT32-C,115,sqlite,ext/recover/sqlite3recover.c,2151,FP,"n-4 with n>=512, no overflow",,high
INT33-C,116,sqlite,ext/recover/sqlite3recover.c,2151,FP,"n-4 divisor: n>=508>0, never zero",,high
INT32-C,117,sqlite,ext/recover/sqlite3recover.c,2154,FP,"nByte+=nPayload only in branch nPayload<X where X~16k; bounded small, no overflow",,high
INT32-C,118,sqlite,ext/recover/sqlite3recover.c,2156,FP,"nByte+=K+4: K bounded by X<n, small, no overflow",,high
INT32-C,119,sqlite,ext/recover/sqlite3recover.c,2158,FP,nByte+=M+4: M small bounded,,high
INT32-C,120,sqlite,ext/recover/sqlite3recover.c,2158,FP,M+4 small bounded value,,high
ARR00-C,121,sqlite,ext/recover/sqlite3recover.c,2165,FP,iByte declared/initialized in for-init (iByte=iOff); not uninitialized,,high
API02-C,122,sqlite,ext/recover/sqlite3recover.c,2189,FP,recoverVfsCheckReservedLock signature fixed by sqlite3_io_methods typedef,,med
CON43-C,123,sqlite,ext/recover/sqlite3recover.c,2193,FP,"recoverVfsShmMap is a function (io_methods member), not a variable; CON43 misfire",,high
CON03-C,124,sqlite,ext/recover/sqlite3recover.c,2200,FP,recover_methods static io_methods table mutated only under RECOVER_MUTEX_ID; documented mutex,,med
EXP33-C,125,sqlite,ext/recover/sqlite3recover.c,2277,FP,aPg fully memset to 0 each block before xRead fills it; reads initialized bytes,,high
INT10-C,126,sqlite,ext/recover/sqlite3recover.c,2284,FP,"(nPayload-M)%(n-4) inside recoverIsValidPage; nPayload non-negative, n-4 positive, well-defined",,med
EXP05-C,127,sqlite,ext/recover/sqlite3recover.c,2285,FP,"nMax is a const int local (=65536), not a pointer; EXP05 misfire",,high
DCL40-C,128,sqlite,ext/recover/sqlite3recover.c,2317,FP,recoverVfsRead forward decl and definition have identical types; only param names differ,,high
EXP33-C,129,sqlite,ext/recover/sqlite3recover.c,2320,FP,recover_g static file-scope struct zero-initialized; reading after install sets it is intended,,high
ARR02-C,130,sqlite,ext/recover/sqlite3recover.c,2346,FP,aPreserve[] const int initializer; implicit size by initializer idiomatic and correct,,med
INT33-C,131,sqlite,ext/recover/sqlite3recover.c,2386,FP,pgsz divides only when nonzero: guarded by if(pgsz) before dbsz=dbFileSize/pgsz,,high
INT32-C,132,sqlite,ext/recover/sqlite3recover.c,2397,FP,"nByte read length (<=65536) used as nByte*2 for malloc; bounded, no overflow",,high
ARR00-C,133,sqlite,ext/recover/sqlite3recover.c,2399,FP,"aBuf/a indexed by fixed small offsets and aPreserve values <=68, all < nByte>=108 guard",,high
ARR38-C,134,sqlite,ext/recover/sqlite3recover.c,2400,FP,"memcpy(p->pPage1Disk,aBuf,nByte): pPage1Disk=&pPage1Cache[nByte], cache nByte*2, exact fit",,high
ARR36-C,135,sqlite,ext/recover/sqlite3recover.c,2405,FP,"detected_pgsz and nReserve are separate int members, not pointers; ARR36 misfire",,high
ARR00-C,136,sqlite,ext/recover/sqlite3recover.c,2409,FP,ii declared int and loop initializes ii=0; not uninitialized,,high
ARR30-C,137,sqlite,ext/recover/sqlite3recover.c,2410,FP,"aPreserve[ii] max 68; aHdr is u8[108]; &aHdr[68]+4=72<=108, in bounds",,high
EXP05-C,138,sqlite,ext/recover/sqlite3recover.c,2410,FP,&aHdr[aPreserve[ii]] is non-const u8* memcpy dest; no const cast,,high
STR31-C,139,sqlite,ext/recover/sqlite3recover.c,2412,FP,"memcpy(aBuf,aHdr,sizeof(aHdr)) copies binary header, not a C string",,high
INT30-C,140,sqlite,ext/recover/sqlite3recover.c,2413,FP,"nByte>=108 guaranteed by branch guard; nByte-sizeof(aHdr)>=0, no unsigned wrap",,high
INT32-C,141,sqlite,ext/recover/sqlite3recover.c,2413,FP,"memset nByte-sizeof(aHdr): nByte>=108, result non-negative bounded by nByte<=64KB",,high
ARR38-C,142,sqlite,ext/recover/sqlite3recover.c,2415,FP,"memcpy(p->pPage1Cache,aBuf,nByte): cache is nByte*2, in bounds",,high
PRE00-C,143,sqlite,ext/recover/sqlite3recover.c,2431,TP,RECOVER_VFS_WRAPPER(code) substitutes code twice (rc=code in if and else); param evaluated multiple times (PRE00),,high
PRE01-C,144,sqlite,ext/recover/sqlite3recover.c,2431,TP,macro parameter code not parenthesized in replacement text rc = code (PRE01),,high
PRE10-C,145,sqlite,ext/recover/sqlite3recover.c,2431,FP,macro body is a whole-function-body sequence ending in return; not a do-while expression-macro case,,high
PRE11-C,146,sqlite,ext/recover/sqlite3recover.c,2431,FP,RECOVER_VFS_WRAPPER does not end with semicolon; call sites add it; PRE11 misread,,high
PRE12-C,147,sqlite,ext/recover/sqlite3recover.c,2431,TP,"macro evaluates parameter code multiple times; inline function preferable (PRE12, same root as 143)",,med
DCL40-C,148,sqlite,ext/recover/sqlite3recover.c,2448,FP,recoverVfsWrite decl and def have identical parameter types; only names/formatting differ,,high
MSC37-C,149,sqlite,ext/recover/sqlite3recover.c,2448,FP,recoverVfsWrite body is RECOVER_VFS_WRAPPER expanding to return rc; macro provides return,,high
MSC37-C,150,sqlite,ext/recover/sqlite3recover.c,2455,FP,recoverVfsTruncate uses RECOVER_VFS_WRAPPER which returns rc,,high
MSC37-C,151,sqlite,ext/recover/sqlite3recover.c,2460,FP,recoverVfsSync RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,152,sqlite,ext/recover/sqlite3recover.c,2465,FP,recoverVfsFileSize RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,153,sqlite,ext/recover/sqlite3recover.c,2470,FP,recoverVfsLock RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,154,sqlite,ext/recover/sqlite3recover.c,2475,FP,recoverVfsUnlock RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,155,sqlite,ext/recover/sqlite3recover.c,2480,FP,recoverVfsCheckReservedLock RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,156,sqlite,ext/recover/sqlite3recover.c,2485,FP,recoverVfsFileControl RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,157,sqlite,ext/recover/sqlite3recover.c,2490,FP,recoverVfsSectorSize RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,158,sqlite,ext/recover/sqlite3recover.c,2495,FP,recoverVfsDeviceCharacteristics RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,159,sqlite,ext/recover/sqlite3recover.c,2500,FP,recoverVfsShmMap RECOVER_VFS_WRAPPER returns rc,,high
MSC37-C,160,sqlite,ext/recover/sqlite3recover.c,2507,FP,recoverVfsShmLock RECOVER_VFS_WRAPPER returns rc,,high
EXP33-C,161,sqlite,ext/recover/sqlite3recover.c,2514,FP,recover_g static struct zero-initialized; read after install; intended,,high
MSC37-C,162,sqlite,ext/recover/sqlite3recover.c,2521,FP,recoverVfsShmUnmap RECOVER_VFS_WRAPPER returns rc,,high
DCL13-C,163,sqlite,ext/recover/sqlite3recover.c,2528,FP,recoverVfsClose pFd dereferenced and passed to xClose which may mutate; signature fixed by io_methods typedef,,high
DCL13-C,164,sqlite,ext/recover/sqlite3recover.c,2539,FP,"recoverInstallWrapper writes pFd->pMethods=&recover_methods; object mutated, const wrong",,high
DCL13-C,165,sqlite,ext/recover/sqlite3recover.c,2539,FP,recoverInstallWrapper p is the mutable recover handle threaded everywhere; const misleading,,high
DCL13-C,166,sqlite,ext/recover/sqlite3recover.c,2551,FP,recoverUninstallWrapper p feeds file_control with p->zDb; recover handle kept non-const by API,,high
EXP33-C,167,sqlite,ext/recover/sqlite3recover.c,2553,FP,recover_g static zero-init; recoverStep reads after RECOVER_STATE_INIT installs; intended,,high
INT32-C,168,sqlite,ext/recover/sqlite3recover.c,2558,FP,"1 + (bool expression): bool is 0/1, sum 1 or 2; iVersion small, no overflow",,high
DCL13-C,169,sqlite,ext/recover/sqlite3recover.c,2571,FP,recoverUninstallWrapper p: recover handle param kept non-const by API convention,,high
EXP33-C,170,sqlite,ext/recover/sqlite3recover.c,2576,FP,recover_g zero-init static; intended use,,high
API00-C,171,sqlite,ext/recover/sqlite3recover.c,2721,FP,recoverInit handles zDb==0 (defaults to main) before use; not unvalidated,,high
API00-C,172,sqlite,ext/recover/sqlite3recover.c,2721,FP,zUri passed to recoverStrlen which handles NULL; memcpy guarded by nUri>0 && zUri,,high
DCL13-C,173,sqlite,ext/recover/sqlite3recover.c,2722,FP,recoverInit db stored into pRet->dbIn unmodified; sqlite3* handle conventionally non-const,,med
DCL13-C,174,sqlite,ext/recover/sqlite3recover.c,2726,FP,"pSqlCtx stored into pRet->pSqlCtx as void*; opaque pointer, const would not match field type",,med
INT30-C,175,sqlite,ext/recover/sqlite3recover.c,2738,FP,"nDb,nUri from recoverStrlen masked to 0x7fffffff; sizeof+lengths bounded, no realistic wrap",,high
ARR38-C,176,sqlite,ext/recover/sqlite3recover.c,2741,FP,"memset(pRet,0,nByte) nByte positive bounded; pRet checked non-NULL",,high
INT31-C,177,sqlite,ext/recover/sqlite3recover.c,2741,FP,nByte positive (sizeof + positive lengths); safe size_t conversion,,high
STR34-C,178,sqlite,ext/recover/sqlite3recover.c,2744,FP,"memcpy(pRet->zDb,zDb,nDb) copies nDb bytes of a char buffer; STR34 misfire on plain byte copy",,high
STR34-C,179,sqlite,ext/recover/sqlite3recover.c,2744,FP,pRet->zDb[nDb+1] addressing within allocated nByte region; STR34 misfire,,high
INT31-C,180,sqlite,ext/recover/sqlite3recover.c,2745,FP,nDb from recoverStrlen non-negative bounded; safe conversion in memcpy,,high
API00-C,181,sqlite,ext/recover/sqlite3recover.c,2759,FP,sqlite3_recover_init calls recoverInit which handles all null params; db opaque handle,,high
API00-C,182,sqlite,ext/recover/sqlite3recover.c,2759,FP,zUri null-handled downstream in recoverInit/recoverStrlen,,high
API00-C,183,sqlite,ext/recover/sqlite3recover.c,2771,FP,sqlite3_recover_init_sql passes through to recoverInit which null-handles db,,high
API00-C,184,sqlite,ext/recover/sqlite3recover.c,2771,FP,"xSql is a function pointer callback, NULL is the valid sentinel; not requiring validation",,high
API00-C,185,sqlite,ext/recover/sqlite3recover.c,2771,FP,"pSqlCtx is opaque user context, NULL valid; passed through unmodified",,high
API00-C,186,sqlite,ext/recover/sqlite3recover.c,2783,FP,sqlite3_recover_errmsg explicitly checks (p && ...) before dereferencing p,,high
DCL13-C,187,sqlite,ext/recover/sqlite3recover.c,2783,FP,sqlite3_recover_errmsg p only reads error state; public-API handle conventionally non-const,,high
API00-C,188,sqlite,ext/recover/sqlite3recover.c,2790,FP,sqlite3_recover_errcode checks p? before use,,high
DCL13-C,189,sqlite,ext/recover/sqlite3recover.c,2790,FP,sqlite3_recover_errcode p only read; public-API handle kept non-const by convention,,high
API00-C,190,sqlite,ext/recover/sqlite3recover.c,2797,FP,sqlite3_recover_config checks if(p==0) returns NOMEM before deref,,high
API00-C,191,sqlite,ext/recover/sqlite3recover.c,2866,FP,sqlite3_recover_run passes p to sqlite3_recover_step which checks p==0,,high
API00-C,192,sqlite,ext/recover/sqlite3recover.c,2881,FP,sqlite3_recover_finish checks if(p==0) before any deref,,high
API00-C,0,sqlite,ext/fts5/fts5_hash.c,90,FP,"Internal API; pConfig is trusted Fts5Config dereferenced per contract, not attacker-null",,high
API00-C,1,sqlite,ext/fts5/fts5_hash.c,90,FP,ppNew internal out-param always passed as &local; not validated by design,,high
DCL13-C,2,sqlite,ext/fts5/fts5_hash.c,90,TP,"pConfig only read (pConfig->eDetail), never written through; const would compile (DCL13)",,med
DCL13-C,3,sqlite,ext/fts5/fts5_hash.c,90,FP,pnByte stored into pNew->pnByte (non-const int* field) for later writes; cannot be const,,high
INT30-C,4,sqlite,ext/fts5/fts5_hash.c,104,FP,"nByte is sqlite3_int64; nSlot fixed 1024, product 8192, no wrap",,high
INT31-C,5,sqlite,ext/fts5/fts5_hash.c,111,FP,nByte=8192 well within size_t; (size_t) cast safe,,high
MEM12-C,6,sqlite,ext/fts5/fts5_hash.c,114,FP,NOMEM path frees pNew and sets *ppNew=0; no leak,,high
API00-C,7,sqlite,ext/fts5/fts5_hash.c,120,FP,Guarded by if(pHash) before use,,high
API00-C,8,sqlite,ext/fts5/fts5_hash.c,131,FP,"Internal API; pHash always valid from caller, contract-safe",,high
EXP33-C,9,sqlite,ext/fts5/fts5_hash.c,134,FP,pNext set at loop top before read; for-loop always assigns before use,,high
ARR38-C,10,sqlite,ext/fts5/fts5_hash.c,141,FP,nSlot power-of-two int; product with sizeof bounded allocation,,high
INT30-C,11,sqlite,ext/fts5/fts5_hash.c,141,FP,nSlot small power-of-two; ptr-sized product cannot wrap on real platforms,,high
INT32-C,12,sqlite,ext/fts5/fts5_hash.c,141,FP,product bounded; no overflow at realistic slot counts,,high
DCL00-C,13,sqlite,ext/fts5/fts5_hash.c,147,FP,h modified in loop body h=(h<<3)^h^p[i]; analyzer misread,,high
DCL02-C,14,sqlite,ext/fts5/fts5_hash.c,147,FP,Cosmetic similar-identifier heuristic; no defect,,high
INT32-C,15,sqlite,ext/fts5/fts5_hash.c,148,FP,"n=nKey>=1; n-1 is loop bound only, no overflow",,high
INT14-C,16,sqlite,ext/fts5/fts5_hash.c,149,FP,Readability heuristic on intended hash mixing,,high
INT30-C,17,sqlite,ext/fts5/fts5_hash.c,149,FP,Unsigned shift on hash accumulator; wrap intended and well-defined,,high
INT33-C,18,sqlite,ext/fts5/fts5_hash.c,151,FP,nSlot always >=1024; modulo never by zero,,high
DCL00-C,19,sqlite,ext/fts5/fts5_hash.c,156,FP,h modified in loop body; misread,,high
DCL02-C,20,sqlite,ext/fts5/fts5_hash.c,156,FP,Cosmetic identifier-similarity heuristic,,high
INT32-C,21,sqlite,ext/fts5/fts5_hash.c,157,FP,"n=nToken>=0 loop bound; n-1 only index start, no overflow",,high
INT14-C,22,sqlite,ext/fts5/fts5_hash.c,158,FP,Readability heuristic on hash mixing,,high
INT30-C,23,sqlite,ext/fts5/fts5_hash.c,158,FP,"Unsigned shift, defined wrap, intended hashing",,high
INT30-C,24,sqlite,ext/fts5/fts5_hash.c,160,FP,Unsigned shift on b mix; defined behavior,,high
INT33-C,25,sqlite,ext/fts5/fts5_hash.c,161,FP,nSlot always >=1024; modulo never by zero,,high
INT32-C,26,sqlite,ext/fts5/fts5_hash.c,168,FP,"nSlot doubles from 1024; needs ~2^30 entries to overflow int, memory exhausted first",,med
INT30-C,27,sqlite,ext/fts5/fts5_hash.c,173,FP,"nNew*sizeof via malloc64; bounded by realistic slot count, no wrap",,high
ARR38-C,28,sqlite,ext/fts5/fts5_hash.c,175,FP,memset size matches just-allocated apNew; bounded,,high
INT30-C,29,sqlite,ext/fts5/fts5_hash.c,175,FP,product no wrap at realistic sizes,,high
ARR30-C,30,sqlite,ext/fts5/fts5_hash.c,182,FP,"fts5EntryKey(p)=(char*)&p[1]; key in same allocation after struct, in-bounds by design",,high
DCL13-C,31,sqlite,ext/fts5/fts5_hash.c,195,TP,"pHash only read (eDetail), never written in fts5HashAddPoslistSize; const would compile (DCL13)",,med
DCL13-C,32,sqlite,ext/fts5/fts5_hash.c,197,FP,p2 dereferenced and written through (pPtr[nData++]); not const-eligible,,high
INT32-C,33,sqlite,ext/fts5/fts5_hash.c,206,FP,"nData bounded by p->nAlloc allocation size; +=1-2 bytes, no INT_MAX approach",,high
INT32-C,34,sqlite,ext/fts5/fts5_hash.c,208,FP,nData bounded by allocation; single increment,,high
INT32-C,35,sqlite,ext/fts5/fts5_hash.c,212,FP,"nData,iSzPoslist small offsets within allocation; no overflow",,high
INT32-C,36,sqlite,ext/fts5/fts5_hash.c,212,FP,bounded offsets within entry allocation,,high
INT32-C,37,sqlite,ext/fts5/fts5_hash.c,213,FP,nSz poslist size bounded by allocation; *2 far below INT_MAX/2,,med
INT31-C,38,sqlite,ext/fts5/fts5_hash.c,220,FP,nSz non-negative bounded size; size_t conversion safe,,high
INT32-C,39,sqlite,ext/fts5/fts5_hash.c,220,FP,iSzPoslist+nByte small offsets within allocation; no overflow,,high
INT32-C,40,sqlite,ext/fts5/fts5_hash.c,220,FP,iSzPoslist+1 small offset; no overflow,,high
INT32-C,41,sqlite,ext/fts5/fts5_hash.c,222,FP,nByte-1 is 0..8; nData bounded by allocation,,high
INT32-C,42,sqlite,ext/fts5/fts5_hash.c,226,FP,nData-p->nData both bounded entry sizes; small difference,,high
API00-C,43,sqlite,ext/fts5/fts5_hash.c,245,FP,Internal API; pHash trusted valid from caller,,high
API00-C,44,sqlite,ext/fts5/fts5_hash.c,245,FP,"pToken trusted from tokenizer; memcpy(...,0) safe; contract",,high
API00-C,45,sqlite,ext/fts5/fts5_hash.c,245,FP,iPos a bounded position int from caller; varint-encoded safely,,high
API00-C,46,sqlite,ext/fts5/fts5_hash.c,245,FP,nToken from tokenizer bounded by term-length cap; used in malloc64 safely,,med
ARR30-C,47,sqlite,ext/fts5/fts5_hash.c,264,FP,"fts5EntryKey in-allocation key access, in-bounds",,high
INT31-C,48,sqlite,ext/fts5/fts5_hash.c,267,FP,"nToken>=0; size_t conversion safe, memcmp bounded by matched nKey",,high
INT30-C,49,sqlite,ext/fts5/fts5_hash.c,277,FP,"sizeof+nToken+1 in sqlite3_int64 nByte; 64-bit, no wrap",,high
INT32-C,50,sqlite,ext/fts5/fts5_hash.c,277,FP,nToken+1 with nToken bounded by token limit; no int overflow,,high
EXP05-C,51,sqlite,ext/fts5/fts5_hash.c,290,FP,"(u8*)p cast for byte writes; p is malloc'd void*, no real const removed",,high
ARR30-C,52,sqlite,ext/fts5/fts5_hash.c,292,FP,fts5EntryKey in-allocation access,,high
INT31-C,53,sqlite,ext/fts5/fts5_hash.c,294,FP,nToken bounded; memcpy size safe into nToken+1-sized region,,high
INT32-C,54,sqlite,ext/fts5/fts5_hash.c,296,FP,nToken+1 bounded; no overflow,,high
INT32-C,55,sqlite,ext/fts5/fts5_hash.c,297,FP,nToken+1 bounded,,high
ARR39-C,56,sqlite,ext/fts5/fts5_hash.c,298,FP,nToken+1+sizeof is offset into just-sized allocation; in-bounds by construction,,high
INT30-C,57,sqlite,ext/fts5/fts5_hash.c,298,FP,"Addition computing nData offset; bounded by allocation, no wrap",,high
INT32-C,58,sqlite,ext/fts5/fts5_hash.c,298,FP,nToken+1 bounded,,high
INT32-C,59,sqlite,ext/fts5/fts5_hash.c,301,FP,nEntry++ pending-term count; bounded by memory long before INT_MAX,,med
EXP05-C,60,sqlite,ext/fts5/fts5_hash.c,304,FP,(u8*)p byte access cast on malloc'd block,,high
INT32-C,61,sqlite,ext/fts5/fts5_hash.c,304,FP,nData += varint(<=9); bounded by nAlloc invariant (assert),,high
INT32-C,62,sqlite,ext/fts5/fts5_hash.c,309,FP,nData+=1 within reserved poslist-size byte; bounded by allocation,,high
INT32-C,63,sqlite,ext/fts5/fts5_hash.c,326,FP,nAlloc*2 is sqlite3_int64 nNew; realistic sizes far below INT_MAX,,med
INT32-C,64,sqlite,ext/fts5/fts5_hash.c,336,FP,"nIncr -= p->nData; bounded entry size, no overflow",,high
MEM30-C,65,sqlite,ext/fts5/fts5_hash.c,336,FP,p reassigned to live realloc result pNew; not freed,,high
MEM30-C,66,sqlite,ext/fts5/fts5_hash.c,338,FP,p is live reallocated pointer; assert reads valid members,,high
MEM30-C,67,sqlite,ext/fts5/fts5_hash.c,338,FP,p points to valid reallocated block,,high
MEM30-C,68,sqlite,ext/fts5/fts5_hash.c,338,FP,live pointer,,high
EXP05-C,69,sqlite,ext/fts5/fts5_hash.c,340,FP,(u8*)p byte cast on live malloc'd block,,high
MEM30-C,70,sqlite,ext/fts5/fts5_hash.c,344,FP,p live after realloc reassignment; member read valid,,high
MEM30-C,71,sqlite,ext/fts5/fts5_hash.c,345,FP,live pointer,,high
MEM30-C,72,sqlite,ext/fts5/fts5_hash.c,346,FP,p passed to helper is live reallocated block,,high
INT32-C,73,sqlite,ext/fts5/fts5_hash.c,347,FP,nData += varint(<=9); bounded by 22-byte headroom invariant (assert),,high
MEM30-C,74,sqlite,ext/fts5/fts5_hash.c,347,FP,pPtr=(u8*)p set from live p; not freed,,high
MEM30-C,75,sqlite,ext/fts5/fts5_hash.c,347,FP,pPtr is live block pointer,,high
MEM30-C,76,sqlite,ext/fts5/fts5_hash.c,347,FP,"pPtr indexing within valid allocation, headroom guaranteed",,high
MEM30-C,77,sqlite,ext/fts5/fts5_hash.c,350,FP,p live; iSzPoslist assignment valid,,high
INT32-C,78,sqlite,ext/fts5/fts5_hash.c,352,FP,nData+=1 within reserved byte; bounded,,high
INT32-C,79,sqlite,ext/fts5/fts5_hash.c,366,FP,nData++ for column byte; within 22-byte headroom guarantee,,high
MEM30-C,80,sqlite,ext/fts5/fts5_hash.c,366,FP,pPtr live block; write within reserved headroom,,high
INT32-C,81,sqlite,ext/fts5/fts5_hash.c,367,FP,nData += varint(<=3 for col); within headroom invariant,,high
MEM30-C,82,sqlite,ext/fts5/fts5_hash.c,367,FP,pPtr live block passed by index,,high
MEM30-C,83,sqlite,ext/fts5/fts5_hash.c,367,FP,"pPtr live, in-bounds write",,high
MEM30-C,84,sqlite,ext/fts5/fts5_hash.c,367,FP,"pPtr live, headroom guaranteed by assert",,high
INT32-C,85,sqlite,ext/fts5/fts5_hash.c,378,FP,nData += varint(<=5 for pos); within headroom,,high
INT32-C,86,sqlite,ext/fts5/fts5_hash.c,378,FP,"iPos-p->iPos+2; positions bounded by FTS5 limits, no realistic overflow",,med
INT32-C,87,sqlite,ext/fts5/fts5_hash.c,378,FP,iPos-p->iPos both bounded column positions; no overflow in practice,,med
MEM30-C,88,sqlite,ext/fts5/fts5_hash.c,378,FP,pPtr live reallocated block,,high
MEM30-C,89,sqlite,ext/fts5/fts5_hash.c,378,FP,pPtr live,,high
MEM30-C,90,sqlite,ext/fts5/fts5_hash.c,378,FP,"pPtr live, in-bounds",,high
INT32-C,91,sqlite,ext/fts5/fts5_hash.c,387,FP,nIncr += p->nData; bounded entry size,,high
EXP40-C,92,sqlite,ext/fts5/fts5_hash.c,405,FP,ppOut points at local pRet for list head; legitimate pointer plumbing in merge,,high
DCL30-C,93,sqlite,ext/fts5/fts5_hash.c,409,FP,"p2 reassigned to traverse pRight list, not returning param address; merge-logic misread",,high
DCL30-C,94,sqlite,ext/fts5/fts5_hash.c,412,FP,p1 traverses list; no invalid address escape,,high
ARR30-C,95,sqlite,ext/fts5/fts5_hash.c,415,FP,fts5EntryKey in-allocation access,,high
ARR30-C,96,sqlite,ext/fts5/fts5_hash.c,416,FP,in-allocation key access,,high
INT31-C,97,sqlite,ext/fts5/fts5_hash.c,419,FP,"nMin=MIN(nKey,nKey) bounded positive; memcmp size safe",,high
STR34-C,98,sqlite,ext/fts5/fts5_hash.c,419,FP,memcmp does not per-element convert char to int; STR34 misfire,,high
STR34-C,99,sqlite,ext/fts5/fts5_hash.c,419,FP,memcmp misfire,,high
INT32-C,100,sqlite,ext/fts5/fts5_hash.c,421,FP,"nKey small term lengths; subtraction for ordering, no overflow",,high
DCL30-C,101,sqlite,ext/fts5/fts5_hash.c,427,FP,"p2 list traversal, not param-address escape",,high
DCL30-C,102,sqlite,ext/fts5/fts5_hash.c,432,FP,"p1 list traversal, not escape",,high
DCL30-C,103,sqlite,ext/fts5/fts5_hash.c,440,FP,"pRet heads a heap-allocated entry list, not automatic storage; misread",,high
DCL13-C,104,sqlite,ext/fts5/fts5_hash.c,448,TP,"pHash only read (nSlot, aSlot), never written in fts5HashEntrySort; const compiles (DCL13)",,med
ARR38-C,105,sqlite,ext/fts5/fts5_hash.c,461,FP,"memset size sizeof*32 constant; bounded, matches alloc",,high
EXP05-C,106,sqlite,ext/fts5/fts5_hash.c,461,FP,"No const cast; sizeof expression is size arg, EXP05 misfire",,high
ARR00-C,107,sqlite,ext/fts5/fts5_hash.c,463,FP,iSlot is for-loop control initialized (iSlot=0); not uninitialized,,high
ARR30-C,108,sqlite,ext/fts5/fts5_hash.c,467,FP,fts5EntryKey in-allocation access,,high
INT31-C,109,sqlite,ext/fts5/fts5_hash.c,467,FP,nTerm bounded; memcmp guarded by nKey>=nTerm check,,high
DCL30-C,110,sqlite,ext/fts5/fts5_hash.c,486,FP,"pList heads merged heap list, not automatic storage escape",,high
API00-C,111,sqlite,ext/fts5/fts5_hash.c,493,FP,Internal API; pHash trusted valid,,high
API00-C,112,sqlite,ext/fts5/fts5_hash.c,493,FP,pTerm trusted query term from caller,,high
API00-C,113,sqlite,ext/fts5/fts5_hash.c,493,FP,ppOut internal out-param always &local,,high
API00-C,114,sqlite,ext/fts5/fts5_hash.c,493,FP,pnDoclist internal out-param,,high
API00-C,115,sqlite,ext/fts5/fts5_hash.c,493,FP,nPre is FTS5-internal small prefix size; bounded,,med
API00-C,116,sqlite,ext/fts5/fts5_hash.c,493,FP,nTerm query-term length bounded,,high
STR34-C,117,sqlite,ext/fts5/fts5_hash.c,500,FP,fts5HashKey reads p[i] as u8 (caller cast); STR34 misfire,,high
ARR30-C,118,sqlite,ext/fts5/fts5_hash.c,505,FP,fts5EntryKey in-allocation access,,high
INT31-C,119,sqlite,ext/fts5/fts5_hash.c,506,FP,nTerm bounded; memcmp guarded by nTerm==p->nKey,,high
INT30-C,120,sqlite,ext/fts5/fts5_hash.c,510,FP,"sizeof+nTerm; nTerm bounded term length, no wrap",,high
INT32-C,121,sqlite,ext/fts5/fts5_hash.c,511,FP,p->nData-nHashPre; nData>=nHashPre by construction (data follows key),,high
INT32-C,122,sqlite,ext/fts5/fts5_hash.c,512,FP,"nPre+nList+10 in malloc64; nList bounded by entry size, nPre small; no realistic overflow",,med
INT32-C,123,sqlite,ext/fts5/fts5_hash.c,512,FP,bounded sizes,,med
WIN04-C,124,sqlite,ext/fts5/fts5_hash.c,512,FP,"WIN04 EncodePointer heuristic irrelevant; malloc result cast, no fn pointer stored",,high
INT32-C,125,sqlite,ext/fts5/fts5_hash.c,514,FP,nPre-nHashPre offset; nPre>=nHashPre by construction,,high
ARR30-C,126,sqlite,ext/fts5/fts5_hash.c,515,FP,pRet[nPre] write; allocation nPre+nList+10 so index in-bounds by construction,,med
EXP05-C,127,sqlite,ext/fts5/fts5_hash.c,515,FP,(u8*)p byte cast on valid block,,high
INT31-C,128,sqlite,ext/fts5/fts5_hash.c,515,FP,nList bounded by p->nData; memcpy within allocation,,high
INT32-C,129,sqlite,ext/fts5/fts5_hash.c,516,FP,nList += poslist size adjustment; bounded entry size,,high
API00-C,130,sqlite,ext/fts5/fts5_hash.c,530,FP,Internal API; p trusted valid,,high
DCL13-C,131,sqlite,ext/fts5/fts5_hash.c,538,TP,"pHash only read (nSlot, aSlot) in fts5HashCount, never written; const compiles (DCL13)",,med
ARR00-C,132,sqlite,ext/fts5/fts5_hash.c,541,FP,ii is for-loop control initialized (ii=0); not uninitialized,,high
API00-C,133,sqlite,ext/fts5/fts5_hash.c,554,FP,"Internal API; pHash trusted, asserts within",,high
API00-C,134,sqlite,ext/fts5/fts5_hash.c,559,FP,Internal API; p trusted valid scan handle,,high
API00-C,135,sqlite,ext/fts5/fts5_hash.c,564,FP,Internal API; p trusted,,high
DCL13-C,136,sqlite,ext/fts5/fts5_hash.c,564,TP,"p only read (p->pScan) in HashScanEof, never written; const compiles (DCL13)",,med
API00-C,137,sqlite,ext/fts5/fts5_hash.c,568,FP,Internal API; pHash trusted,,high
API00-C,138,sqlite,ext/fts5/fts5_hash.c,568,FP,pzTerm internal out-param always &local,,high
API00-C,139,sqlite,ext/fts5/fts5_hash.c,568,FP,pnTerm internal out-param,,high
API00-C,140,sqlite,ext/fts5/fts5_hash.c,568,FP,ppDoclist internal out-param,,high
API00-C,141,sqlite,ext/fts5/fts5_hash.c,568,FP,pnDoclist internal out-param,,high
EXP45-C,142,sqlite,ext/fts5/fts5_hash.c,576,FP,Assignment-in-if is idiomatic guarded null-check; value tested immediately,,high
ARR30-C,143,sqlite,ext/fts5/fts5_hash.c,577,FP,fts5EntryKey in-allocation access,,high
EXP34-C,144,sqlite,ext/fts5/fts5_hash.c,578,FP,p guarded by if(p=pHash->pScan); member access only when non-null,,high
STR34-C,145,sqlite,ext/fts5/fts5_hash.c,580,FP,*pzTerm assigned char* zKey; STR34 sign-extension heuristic irrelevant to pointer assign,,high
EXP40-C,146,sqlite,ext/fts5/fts5_hash.c,582,FP,"*ppDoclist is const u8** by signature; assigning const u8* correct, no modification",,high
INT30-C,147,sqlite,ext/fts5/fts5_hash.c,583,FP,"sizeof+nTerm; nTerm=p->nKey bounded term length, no wrap",,high
STR34-C,148,sqlite,ext/fts5/fts5_hash.c,585,FP,*pzTerm=0 null assignment; STR34 misfire,,high
ARR02-C,0,sqlite,ext/misc/normalize.c,106,FP,aiClass[] implicit bound equals its complete 256-entry initializer; size fully determined and safe,,med
ARR02-C,1,sqlite,ext/misc/normalize.c,133,FP,sqlite3UpperToLower[] implicit bound equals its complete 256-entry initializer; safe,,med
PRE00-C,2,sqlite,ext/misc/normalize.c,216,TP,sqlite3Toupper(x) macro expands x twice; genuine multiple-evaluation hazard (PRE12),,high
PRE12-C,3,sqlite,ext/misc/normalize.c,216,TP,same macro evaluates parameter x more than once; PRE12 multiple-evaluation,,high
PRE01-C,4,sqlite,ext/misc/normalize.c,242,TP,IdChar(C) uses (unsigned char)C unparenthesized; compound arg would mis-parse (PRE01),,high
PRE11-C,5,sqlite,ext/misc/normalize.c,291,TP,deliberate_fall_through macro body ends in a semicolon; factual PRE11 property,,med
CON43-C,6,sqlite,ext/misc/normalize.c,303,FP,"switch(aiClass[*z]) is a single dereference of a local string, not a TOCTOU double-fetch",,high
ARR30-C,7,sqlite,ext/misc/normalize.c,307,FP,sqlite3Isspace casts arg to (unsigned char); index 0-255 into 256-entry sqlite3CtypeMap,,high
EXP33-C,8,sqlite,ext/misc/normalize.c,309,FP,i is initialized to 1 in the for-loop init before being returned,,high
FIO23-C,9,sqlite,ext/misc/normalize.c,309,FP,"line is inside sqlite3GetToken returning token length, not main(); fclose(stdout) not required",,high
EXP30-C,10,sqlite,ext/misc/normalize.c,313,FP,c=z[i] then c read across && sequence point; no unsequenced modify/access,,high
EXP33-C,11,sqlite,ext/misc/normalize.c,313,FP,c assigned via (c=z[i]) in the loop condition before any read; not uninitialized,,high
EXP30-C,12,sqlite,ext/misc/normalize.c,345,FP,c assigned and read separated by && sequence point in the for condition,,high
INT32-C,13,sqlite,ext/misc/normalize.c,346,FP,i is sqlite3_int64 bounded by token/string length; cannot reach INT_MAX without >2GB string,,med
INT32-C,14,sqlite,ext/misc/normalize.c,356,FP,1+(z[1]=='=') yields at most 2; no overflow,,high
INT32-C,15,sqlite,ext/misc/normalize.c,431,FP,i is sqlite3_int64 bounded by string length; i+1 cannot overflow realistically,,med
INT32-C,16,sqlite,ext/misc/normalize.c,434,FP,i is sqlite3_int64 bounded by string length; i+1 cannot overflow realistically,,med
ARR30-C,17,sqlite,ext/misc/normalize.c,441,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,18,sqlite,ext/misc/normalize.c,451,FP,sqlite3Isxdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,19,sqlite,ext/misc/normalize.c,452,FP,sqlite3Isxdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,20,sqlite,ext/misc/normalize.c,455,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
INT32-C,21,sqlite,ext/misc/normalize.c,457,FP,i is sqlite3_int64 bounded by string length; i++ cannot reach INT_MAX,,med
ARR30-C,22,sqlite,ext/misc/normalize.c,458,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
INT32-C,23,sqlite,ext/misc/normalize.c,458,FP,i is sqlite3_int64 bounded by string length; i++ cannot overflow,,med
ARR30-C,24,sqlite,ext/misc/normalize.c,462,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,25,sqlite,ext/misc/normalize.c,463,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
INT32-C,26,sqlite,ext/misc/normalize.c,466,FP,i is sqlite3_int64 bounded by string length; i+=2 cannot overflow,,med
ARR30-C,27,sqlite,ext/misc/normalize.c,467,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,28,sqlite,ext/misc/normalize.c,470,FP,IdChar casts to (unsigned char); index bounded 0-255 into sqlite3CtypeMap,,high
EXP30-C,29,sqlite,ext/misc/normalize.c,477,FP,c assigned and read separated by && sequence point in the for condition,,high
ARR30-C,30,sqlite,ext/misc/normalize.c,483,FP,sqlite3Isdigit casts to (unsigned char); index bounded 0-255,,high
ARR30-C,31,sqlite,ext/misc/normalize.c,493,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
ARR30-C,32,sqlite,ext/misc/normalize.c,498,FP,sqlite3Isspace casts to (unsigned char); index bounded 0-255,,high
EXP30-C,33,sqlite,ext/misc/normalize.c,498,FP,(c=z[i]) then c read across && sequence point in while condition,,high
ARR30-C,34,sqlite,ext/misc/normalize.c,516,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
INT32-C,35,sqlite,ext/misc/normalize.c,520,FP,i is sqlite3_int64 bounded by string length; i++ cannot overflow,,med
ARR30-C,36,sqlite,ext/misc/normalize.c,530,FP,sqlite3Isxdigit casts to (unsigned char); index bounded 0-255,,high
INT32-C,37,sqlite,ext/misc/normalize.c,533,FP,i is sqlite3_int64 bounded by string length; i++ cannot overflow,,med
INT32-C,38,sqlite,ext/misc/normalize.c,535,FP,i is sqlite3_int64 bounded by string length; i++ cannot overflow,,med
ARR30-C,39,sqlite,ext/misc/normalize.c,551,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
INT32-C,40,sqlite,ext/misc/normalize.c,551,FP,i is sqlite3_int64 bounded by string length; i++ cannot overflow,,med
DCL15-C,41,sqlite,ext/misc/normalize.c,556,FP,sqlite3_normalize is the documented public API entry point and must have external linkage,,high
INT32-C,42,sqlite,ext/misc/normalize.c,568,FP,nZ is int64 strlen result; nZ+2 cannot overflow int64 for any real string,,med
INT32-C,43,sqlite,ext/misc/normalize.c,570,FP,i is int indexing zSql; overflow needs a >2GB SQL string,,low
EXP05-C,44,sqlite,ext/misc/normalize.c,571,TP,(unsigned char*)zSql casts away const on the input string; benign but a real const-cast (EXP05),,low
ARR00-C,45,sqlite,ext/misc/normalize.c,581,FP,the only free of z is immediately followed by return 0; z not used after free,,high
MEM30-C,46,sqlite,ext/misc/normalize.c,581,FP,free of z at 577 followed by return; no path reaches 581 with z freed,,high
ARR00-C,47,sqlite,ext/misc/normalize.c,587,FP,free at 577 followed by return; z live on the path reaching 587,,high
ARR30-C,48,sqlite,ext/misc/normalize.c,587,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
INT32-C,49,sqlite,ext/misc/normalize.c,587,FP,j-3 guarded by j>=3; no overflow,,high
MEM30-C,50,sqlite,ext/misc/normalize.c,587,FP,free at 577 followed by return; z not freed on pointer-arithmetic path at 587,,high
MEM30-C,51,sqlite,ext/misc/normalize.c,587,FP,free at 577 followed by return; z live when passed to strncmp at 587,,high
MEM30-C,52,sqlite,ext/misc/normalize.c,587,FP,free at 577 followed by return; z live at 587,,high
ARR00-C,53,sqlite,ext/misc/normalize.c,588,FP,free at 577 followed by return; z live at 588,,high
ARR30-C,54,sqlite,ext/misc/normalize.c,588,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
INT32-C,55,sqlite,ext/misc/normalize.c,588,FP,j-4 guarded by j>=4; no overflow,,high
MEM30-C,56,sqlite,ext/misc/normalize.c,588,FP,free at 577 followed by return; z live at 588,,high
MEM30-C,57,sqlite,ext/misc/normalize.c,588,FP,free at 577 followed by return; z live at 588,,high
MEM30-C,58,sqlite,ext/misc/normalize.c,588,FP,free at 577 followed by return; z live at 588,,high
ARR00-C,59,sqlite,ext/misc/normalize.c,593,FP,free at 577 followed by return; z live at 593,,high
MEM30-C,60,sqlite,ext/misc/normalize.c,593,FP,free at 577 followed by return; z live at 593,,high
ARR00-C,61,sqlite,ext/misc/normalize.c,597,FP,free at 577 followed by return; z live at 597,,high
ARR00-C,62,sqlite,ext/misc/normalize.c,597,FP,free at 577 followed by return; z live at 597,,high
ARR30-C,63,sqlite,ext/misc/normalize.c,597,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
ARR30-C,64,sqlite,ext/misc/normalize.c,597,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
INT32-C,65,sqlite,ext/misc/normalize.c,597,FP,j-1 guarded by j>0; no overflow,,high
MEM30-C,66,sqlite,ext/misc/normalize.c,597,FP,free at 577 followed by return; z live at 597,,high
MEM30-C,67,sqlite,ext/misc/normalize.c,597,FP,free at 577 followed by return; z live at 597,,high
MEM30-C,68,sqlite,ext/misc/normalize.c,597,FP,free at 577 followed by return; z live at 597,,high
EXP33-C,69,sqlite,ext/misc/normalize.c,598,FP,k is initialized in the for-loop init (k=0) before any read,,high
ARR00-C,70,sqlite,ext/misc/normalize.c,599,FP,free at 577 followed by return; z live at 599,,high
ARR30-C,71,sqlite,ext/misc/normalize.c,599,FP,sqlite3Tolower casts to (unsigned char); index bounded 0-255 into sqlite3UpperToLower,,high
INT32-C,72,sqlite,ext/misc/normalize.c,599,FP,i and k are bounded ints over the buffer; i+k cannot overflow without a >2GB buffer,,med
MEM30-C,73,sqlite,ext/misc/normalize.c,599,FP,free at 577 followed by return; z live at 599,,high
ARR00-C,74,sqlite,ext/misc/normalize.c,605,FP,free at 577 followed by return; z live at 605,,high
MEM30-C,75,sqlite,ext/misc/normalize.c,605,FP,free at 577 followed by return; z live at 605,,high
ARR00-C,76,sqlite,ext/misc/normalize.c,606,FP,free at 577 followed by return; z live at 606,,high
ARR00-C,77,sqlite,ext/misc/normalize.c,606,FP,free at 577 followed by return; z live at 606,,high
MEM30-C,78,sqlite,ext/misc/normalize.c,606,FP,free at 577 followed by return; z live at 606,,high
MEM30-C,79,sqlite,ext/misc/normalize.c,606,FP,free at 577 followed by return; z live at 606,,high
ARR00-C,80,sqlite,ext/misc/normalize.c,607,FP,free at 577 followed by return; z live at 607,,high
INT32-C,81,sqlite,ext/misc/normalize.c,615,FP,(int)(zIn-z)+3 bounded by buffer size; overflow needs a >2GB buffer,,low
ARR00-C,82,sqlite,ext/misc/normalize.c,616,TP,"when output starts with in( (e.g. input in(1)), strstr returns zIn==z and IdChar(zIn[-1]) reads z[-1]; the n&& guard is dead since n=(zIn-z)+3>=3 always; 1-byte heap-buffer-underflow read (ARR00)",,high
ARR30-C,83,sqlite,ext/misc/normalize.c,616,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
ARR30-C,84,sqlite,ext/misc/normalize.c,617,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
ARR30-C,85,sqlite,ext/misc/normalize.c,618,FP,IdChar casts to (unsigned char); index bounded 0-255,,high
ARR00-C,86,sqlite,ext/misc/normalize.c,619,FP,free at 577 followed by return; z live at 619,,high
ARR00-C,87,sqlite,ext/misc/normalize.c,620,FP,free at 577 followed by return; z live at 620,,high
ARR00-C,88,sqlite,ext/misc/normalize.c,621,FP,free at 577 followed by return; z live at 621,,high
INT32-C,89,sqlite,ext/misc/normalize.c,628,FP,j and k bounded ints; j+(5-k)+1 cannot overflow without a >2GB buffer,,med
INT32-C,90,sqlite,ext/misc/normalize.c,628,FP,j and k bounded ints; j+(5-k) cannot overflow without a >2GB buffer,,med
ARR38-C,91,sqlite,ext/misc/normalize.c,630,FP,memmove size j-(n+k) is >=1 (n+k indexes ')' < j) and dest fits realloc'd buffer,,high
EXP05-C,92,sqlite,ext/misc/normalize.c,630,FP,"z is declared char* (mutable), not const; no const to cast away",,high
INT31-C,93,sqlite,ext/misc/normalize.c,630,FP,j-(n+k) non-negative since n+k indexes ')' which is < j; size_t conversion safe,,high
MEM30-C,94,sqlite,ext/misc/normalize.c,630,FP,"z=sqlite3_realloc64(z,...) reassigns z before use; arithmetic on the new pointer",,high
MEM30-C,95,sqlite,ext/misc/normalize.c,630,FP,z reassigned by realloc before the memmove uses it; not the freed pointer,,high
ARR38-C,96,sqlite,ext/misc/normalize.c,632,FP,memmove (k>5 shrink) size j-(n+k) non-negative and within existing buffer,,high
EXP05-C,97,sqlite,ext/misc/normalize.c,632,FP,"z is char* (mutable), not const; nothing to cast away",,high
INT31-C,98,sqlite,ext/misc/normalize.c,632,FP,j-(n+k) non-negative; size_t conversion safe,,high
INT32-C,99,sqlite,ext/misc/normalize.c,634,FP,j and k bounded ints; j-k+5 cannot overflow without a >2GB buffer,,med
ARR00-C,100,sqlite,ext/misc/normalize.c,635,FP,free at 577 followed by return; z live at 635,,high
EXP05-C,101,sqlite,ext/misc/normalize.c,636,FP,"z is char* (mutable), not const; nothing to cast away",,high
ARR00-C,102,sqlite,ext/misc/normalize.c,638,FP,"z is heap memory from sqlite3_malloc64, not a local array; returning it is the contract",,high
DCL30-C,103,sqlite,ext/misc/normalize.c,638,FP,"z has heap storage (sqlite3_malloc64), not automatic; returning it is correct",,high
INT32-C,104,sqlite,ext/misc/normalize.c,662,FP,i indexes zIn in the CLI; i+1 overflow needs a >2GB file,,low
INT32-C,105,sqlite,ext/misc/normalize.c,663,FP,i indexes zIn in the CLI; i+1 overflow needs a >2GB file,,low
INT32-C,106,sqlite,ext/misc/normalize.c,672,FP,i indexes zIn in the CLI; i+1 overflow needs a >2GB file,,low
INT32-C,107,sqlite,ext/misc/normalize.c,673,FP,i indexes zIn in the CLI; i+1 overflow needs a >2GB file,,low
INT32-C,108,sqlite,ext/misc/normalize.c,676,FP,i indexes zIn in the CLI; i+1 overflow needs a >2GB file,,low
ERR00-C,109,sqlite,ext/misc/normalize.c,692,FP,fopen return IS checked at line 693 (if(in==0)),,high
FIO02-C,110,sqlite,ext/misc/normalize.c,692,FP,CLI utility intentionally opens filenames given on argv; documented purpose,,med
FIO05-C,111,sqlite,ext/misc/normalize.c,692,FP,CLI tool opening user-named files is intended functionality,,med
POS05-C,112,sqlite,ext/misc/normalize.c,692,FP,chroot jail not applicable to a standalone CLI normalizer utility,,med
WIN03-C,113,sqlite,ext/misc/normalize.c,692,FP,advisory Windows-only N-flag note; rb is correct portable mode,,low
ERR00-C,114,sqlite,ext/misc/normalize.c,697,TP,"fseek(in,0,SEEK_END) return value ignored; CLI does not detect seek failure (FIO)",,low
ERR33-C,115,sqlite,ext/misc/normalize.c,697,TP,fseek return ignored; on failure ftell yields a wrong size with no detection,,low
FIO14-C,116,sqlite,ext/misc/normalize.c,697,TP,SEEK_END on a binary stream is technically UB per C standard; used on rb stream,,low
FIO19-C,117,sqlite,ext/misc/normalize.c,697,TP,fseek/ftell used to compute file size (non-portable idiom); fstat recommended,,low
ERR00-C,118,sqlite,ext/misc/normalize.c,698,TP,ftell return assigned to sz without checking for -1; feeds realloc(sz+1) and fread size,,med
ERR33-C,119,sqlite,ext/misc/normalize.c,698,TP,"ftell return unchecked; if -1, sz=-1 propagates to realloc and fread as a huge size_t",,med
ERR07-C,120,sqlite,ext/misc/normalize.c,699,TP,rewind provides no error indication; CERT ERR07 prefers fseek,,low
DCL11-C,121,sqlite,ext/misc/normalize.c,702,FP,"sqlite3_int64 is typedef'd to long long by default, so %lld matches the argument type",,med
INT00-C,122,sqlite,ext/misc/normalize.c,702,FP,%lld with sqlite3_int64 is the SQLite-sanctioned idiom; correct under default config,,med
ERR00-C,123,sqlite,ext/misc/normalize.c,705,FP,fread return IS captured (got=) and checked at line 707 (if(got!=sz)),,high
ERR33-C,124,sqlite,ext/misc/normalize.c,705,FP,fread return value is checked at line 707 against sz,,high
FIO39-C,125,sqlite,ext/misc/normalize.c,705,FP,"fprintf writes to stderr/stdout while fread reads from in; different streams, FIO39 inapplicable",,high
INT31-C,126,sqlite,ext/misc/normalize.c,705,TP,"sz (from unchecked ftell, possibly -1) converted to size_t in fread; sz=-1 yields a huge size",,low
MEM30-C,127,sqlite,ext/misc/normalize.c,705,FP,zBuf is reassigned by sqlite3_realloc64 before fread; not a freed pointer,,high
ERR00-C,128,sqlite,ext/misc/normalize.c,706,TP,fclose(in) return value ignored; CERT ERR33 requires checking it,,low
ERR33-C,129,sqlite,ext/misc/normalize.c,706,TP,fclose return ignored; factual unchecked return,,low
FIO39-C,130,sqlite,ext/misc/normalize.c,708,FP,fprintf to stderr/stdout vs fread from in are different streams; FIO39 inapplicable,,high
INT00-C,131,sqlite,ext/misc/normalize.c,708,FP,%lld with sqlite3_int64 (long long) is correct under the default typedef,,med
PRE32-C,132,sqlite,ext/misc/normalize.c,708,FP,no preprocessor directives appear inside the fprintf argument list; misfire,,high
DCL11-C,133,sqlite,ext/misc/normalize.c,709,FP,sqlite3_int64 is long long by default so %lld matches; correct idiom,,med