sqc 0.4.84

rule,idx,project,file,line,verdict,reason,provenance,confidence
PRE01-C,0,sqlite,ext/fts5/fts5_index.c,299,FP,segid used only as function-call argument 'segid+(1<<16)'; comma-bounded so no precedence hazard,,
DCL13-C,1,sqlite,ext/fts5/fts5_index.c,567,FP,fts5IndexCorruptIter writes pIdx->rc but pIter only read; finding param pIter is read-only yet this is corruption-iter helper called directly — read-only so const-able,,
PRE00-C,2,sqlite,ext/fts5/fts5_index.c,604,FP,"ASSERT_SZLEAF_OK evaluates (x) multiple times but x is parenthesized pure pointer; debug-only assert, no side effects",,
PRE02-C,3,sqlite,ext/fts5/fts5_index.c,604,FP,macro body is a single assert(...) call; parenthesizing a statement is not applicable,,
PRE12-C,4,sqlite,ext/fts5/fts5_index.c,604,FP,x is a parenthesized side-effect-free pointer expression; multiple evaluation harmless,,
PRE00-C,5,sqlite,ext/fts5/fts5_index.c,616,FP,fts5LeafIsTermless evaluates parenthesized pure pointer (x) twice; no side effects possible,,
PRE12-C,6,sqlite,ext/fts5/fts5_index.c,616,FP,x is parenthesized side-effect-free pointer; double eval harmless,,
PRE00-C,7,sqlite,ext/fts5/fts5_index.c,618,FP,fts5LeafTermOff evaluates parenthesized pointer (x) twice; no side effects,,
PRE12-C,8,sqlite,ext/fts5/fts5_index.c,618,FP,x parenthesized pure pointer; double eval harmless,,
EXP34-C,9,sqlite,ext/fts5/fts5_index.c,713,FP,"fts5GetU16 derefs param aIn; pure leaf accessor, callers always pass a valid in-bounds buffer pointer",,
INT14-C,10,sqlite,ext/fts5/fts5_index.c,713,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
DCL13-C,11,sqlite,ext/fts5/fts5_index.c,721,TP,"fts5GetU64 reads a[0..7] only; raw big-endian decoder, never writes, plain static — const u8* compiles (sibling fts5GetU32 already const)",,
INT14-C,12,sqlite,ext/fts5/fts5_index.c,722,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT14-C,13,sqlite,ext/fts5/fts5_index.c,738,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
DCL13-C,14,sqlite,ext/fts5/fts5_index.c,790,TP,"fts5BufferCompareBlob reads pLeft->n/pLeft->p only via memcmp; SQLITE_DEBUG comparison helper, never written",,
EXP34-C,15,sqlite,ext/fts5/fts5_index.c,794,FP,fts5BufferCompareBlob (SQLITE_DEBUG only) memcmp on pLeft->p; only called from asserts with valid buffers,,
INT31-C,16,sqlite,ext/fts5/fts5_index.c,794,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,17,sqlite,ext/fts5/fts5_index.c,795,FP,"pLeft->n - nRight: Fts5Buffer.n in-memory buffer length, not blob-derived",,
DCL13-C,18,sqlite,ext/fts5/fts5_index.c,808,TP,"fts5BufferCompare reads pLeft->n/pLeft->p only via fts5Memcmp; never written, plain comparison fn",,
EXP34-C,19,sqlite,ext/fts5/fts5_index.c,810,FP,fts5BufferCompare derefs pLeft param; assert(nCmp<=0||pLeft->p!=0) and callers pass live Fts5Buffer,,
INT32-C,20,sqlite,ext/fts5/fts5_index.c,814,FP,pLeft->n - pRight->n: in-memory Fts5Buffer lengths,,
EXP33-C,21,sqlite,ext/fts5/fts5_index.c,819,FP,ret written by fts5GetVarint32 macro (passes &ret to sqlite3Fts5GetVarint32) before return; analyzer misses macro out-param write,,
EXP34-C,22,sqlite,ext/fts5/fts5_index.c,819,FP,fts5LeafFirstTermOff derefs pLeaf param; only called on a validated non-null leaf (fts5LeafRead rc-correlated),,
FIO42-C,23,sqlite,ext/fts5/fts5_index.c,866,FP,"sqlite3_blob_open is not open(); rc is an int status code, no file descriptor opened",,
INT14-C,24,sqlite,ext/fts5/fts5_index.c,881,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
EXP34-C,25,sqlite,ext/fts5/fts5_index.c,899,FP,pRet->p[nByte] in else of if(rc!=OK); in that branch rc==OK so NOMEM did not fire and pRet is non-null,,
INT32-C,26,sqlite,ext/fts5/fts5_index.c,905,FP,"p->nRead++: internal read counter, never near INT_MAX in practice",,
MEM12-C,27,sqlite,ext/fts5/fts5_index.c,910,FP,"'leaked' rc is an int return code, not a resource; pRet (heap) returned correctly",,
DCL30-C,28,sqlite,ext/fts5/fts5_index.c,931,FP,"pRet holds heap pointer from fts5DataRead (malloc), not automatic storage",,
STR34-C,29,sqlite,ext/fts5/fts5_index.c,941,FP,zSql is a char* SQL string passed to sqlite3_prepare_v3; no char-to-int widening occurs,,
DCL13-C,30,sqlite,ext/fts5/fts5_index.c,1005,TP,"fts5DataRemoveSegment reads pSeg->iSegid/nPgTombstone only; never written, not stored, plain static",,
INT32-C,31,sqlite,ext/fts5/fts5_index.c,1008,FP,iSegid+1 then FTS5_SEGMENT_ROWID i64 macro; iSegid bounded <=FTS5_MAX_SEGMENT (2000),,
INT32-C,32,sqlite,ext/fts5/fts5_index.c,1013,FP,"pSeg->nPgTombstone-1: tombstone page count, used as i64 rowid arg; bounded small",,
INT32-C,33,sqlite,ext/fts5/fts5_index.c,1035,FP,"--pStruct->nRef: refcount, bounded by live references",,
MEM30-C,34,sqlite,ext/fts5/fts5_index.c,1039,FP,"frees aLevel[i].aSeg then frees pStruct; reads of aLevel[i] occur before any free, correct ordering",,
EXP34-C,35,sqlite,ext/fts5/fts5_index.c,1046,FP,fts5StructureRef derefs pStruct param; callers hold a valid structure ref,,
INT32-C,36,sqlite,ext/fts5/fts5_index.c,1046,FP,pStruct->nRef++: refcount,,
API00-C,37,sqlite,ext/fts5/fts5_index.c,1049,FP,"sqlite3Fts5StructureRef: p is internal Fts5Index handle, caller-guaranteed non-NULL; refcount wrapper, no untrusted input",,
DCL13-C,38,sqlite,ext/fts5/fts5_index.c,1049,TP,"sqlite3Fts5StructureRef: p's own fields only read (p->pStruct); refcount bump is on *p->pStruct, not p — p is const-able",,
DCL13-C,39,sqlite,ext/fts5/fts5_index.c,1058,TP,sqlite3Fts5StructureTest reads p->pStruct for compare only; never written,,
ARR38-C,40,sqlite,ext/fts5/fts5_index.c,1079,FP,memcpy nByte=SZ_FTS5STRUCTURE(nLevel) copies p into freshly MallocZero'd pNew of same size; not blob-derived,,
INT30-C,41,sqlite,ext/fts5/fts5_index.c,1083,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
MEM30-C,42,sqlite,ext/fts5/fts5_index.c,1087,FP,cleanup loop frees each pNew->aLevel[i].aSeg then pNew; no access after free,,
ARR38-C,43,sqlite,ext/fts5/fts5_index.c,1092,FP,memcpy nByte=sizeof(seg)*nSeg into pLvl->aSeg allocated with that same nByte,,
INT32-C,44,sqlite,ext/fts5/fts5_index.c,1094,FP,p->nRef--: refcount,,
EXP34-C,45,sqlite,ext/fts5/fts5_index.c,1134,FP,"memcmp(&pData[i]) in fts5StructureDecode; pData is caller buffer (pData->p), non-null when rc==OK at call site 1283",,
INT32-C,46,sqlite,ext/fts5/fts5_index.c,1135,FP,i += 4 (cookie/magic skip): parse cursor over blob bounded by nData (int),,
INT32-C,47,sqlite,ext/fts5/fts5_index.c,1141,FP,"i += varint of nLevel: cursor advance; nLevel bounds-checked [0,2000] right after",,
INT32-C,48,sqlite,ext/fts5/fts5_index.c,1142,FP,"i += varint of nSegment: cursor advance; nSegment bounds-checked [0,2000] right after",,
INT32-C,49,sqlite,ext/fts5/fts5_index.c,1155,FP,i += varint(nWriteCounter): parse cursor advance bounded by blob size nData,,
INT32-C,50,sqlite,ext/fts5/fts5_index.c,1165,FP,i += varint(pLvl->nMerge): parse cursor advance bounded by blob size,,
INT32-C,51,sqlite,ext/fts5/fts5_index.c,1166,uncertain,"nTotal read via fts5GetVarint32 from structure blob (full u32 into int); only nTotal<nMerge checked, no upper bound before use",,
INT30-C,52,sqlite,ext/fts5/fts5_index.c,1169,uncertain,"nTotal read directly from blob via fts5GetVarint32 then multiplied by sizeof(Fts5StructureSegment); only guarded by nTotal<nMerge, not bounded to FTS5_MAX_SEGMENT, though 64-bit alloc and corruption checks make practical OOB unlikely",,
INT32-C,53,sqlite,ext/fts5/fts5_index.c,1171,uncertain,nSegment-=nTotal where nTotal is unbounded blob varint32; can wrap before the post-loop nSegment!=0 FTS5_CORRUPT check,,
INT32-C,54,sqlite,ext/fts5/fts5_index.c,1183,FP,i += varint(iSegid): parse cursor advance bounded by blob size,,
INT32-C,55,sqlite,ext/fts5/fts5_index.c,1184,uncertain,"pSeg->pgnoFirst from fts5GetVarint32 (full u32 into signed int); only pgnoLast<pgnoFirst checked, no INT_MAX bound",,
INT32-C,56,sqlite,ext/fts5/fts5_index.c,1185,uncertain,"pSeg->pgnoLast from fts5GetVarint32 (full u32 into signed int); only pgnoLast<pgnoFirst checked, can be near INT_MAX",,
INT32-C,57,sqlite,ext/fts5/fts5_index.c,1187,FP,i += varint(iOrigin1): parse cursor advance bounded by blob size,,
INT32-C,58,sqlite,ext/fts5/fts5_index.c,1188,FP,i += varint(iOrigin2): parse cursor advance bounded by blob size,,
INT32-C,59,sqlite,ext/fts5/fts5_index.c,1189,FP,i += varint(nPgTombstone): parse cursor advance bounded by blob size,,
INT32-C,60,sqlite,ext/fts5/fts5_index.c,1190,FP,i += varint(nEntryTombstone): parse cursor advance bounded by blob size,,
INT32-C,61,sqlite,ext/fts5/fts5_index.c,1191,FP,i += varint(nEntry): parse cursor advance bounded by blob size,,
ARR00-C,62,sqlite,ext/fts5/fts5_index.c,1199,FP,pLvl[-1] guarded by iLvl>0 condition on same line,,
ARR37-C,63,sqlite,ext/fts5/fts5_index.c,1199,FP,"pLvl[-1] = aLevel[iLvl-1], guarded by iLvl>0; aLevel is an allocated array, in-bounds",,
DCL30-C,64,sqlite,ext/fts5/fts5_index.c,1214,FP,pRet is heap structure from fts5StructureDecode; *ppOut=pRet returns valid heap address,,
INT32-C,65,sqlite,ext/fts5/fts5_index.c,1228,FP,nLevel+2: nLevel is pStruct->nLevel bounded <=FTS5_MAX_SEGMENT,,
MEM30-C,66,sqlite,ext/fts5/fts5_index.c,1232,FP,"standard realloc idiom: pStruct=sqlite3_realloc64(pStruct,..) reassigns before reuse",,
INT32-C,67,sqlite,ext/fts5/fts5_index.c,1233,FP,pStruct->nLevel++: level count bounded by FTS5_MAX_SEGMENT,,
MEM30-C,68,sqlite,ext/fts5/fts5_index.c,1233,FP,"memset uses the realloc'd pStruct after null-check, not the freed original",,
DCL13-C,69,sqlite,ext/fts5/fts5_index.c,1247,FP,fts5StructureExtendLevel writes through pStruct: pLvl=&pStruct->aLevel[iLvl] then pLvl->aSeg=aNew assigns into *pStruct,,
ARR00-C,70,sqlite,ext/fts5/fts5_index.c,1253,FP,"fts5StructureExtendLevel/AddLevel: iLvl/nExtra are internal indices into pStruct->aLevel bounded by nLevel; called with loop-derived levels, not blob values",,
ARR30-C,71,sqlite,ext/fts5/fts5_index.c,1253,FP,"fts5StructureExtendLevel/AddLevel: iLvl/nExtra are internal indices into pStruct->aLevel bounded by nLevel; called with loop-derived levels, not blob values",,
INT30-C,72,sqlite,ext/fts5/fts5_index.c,1257,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,73,sqlite,ext/fts5/fts5_index.c,1257,FP,"pLvl->nSeg + nExtra: nSeg bounded by structure, nExtra=1 in callers; nByte is i64",,
ARR38-C,74,sqlite,ext/fts5/fts5_index.c,1261,FP,memset zeroes aNew[nSeg..nSeg+nExtra) within realloc64(nSeg+nExtra) buffer,,
INT30-C,75,sqlite,ext/fts5/fts5_index.c,1261,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,76,sqlite,ext/fts5/fts5_index.c,1261,FP,sizeof(seg)*nExtra: nExtra small internal insert count (typically 1),,
INT30-C,77,sqlite,ext/fts5/fts5_index.c,1263,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
ARR30-C,78,sqlite,ext/fts5/fts5_index.c,1264,FP,"fts5StructureExtendLevel/AddLevel: iLvl/nExtra are internal indices into pStruct->aLevel bounded by nLevel; called with loop-derived levels, not blob values",,
INT31-C,79,sqlite,ext/fts5/fts5_index.c,1264,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
ARR38-C,80,sqlite,ext/fts5/fts5_index.c,1265,FP,"memset zeroes first nExtra slots of aNew, within realloc64(nSeg+nExtra) buffer",,
INT30-C,81,sqlite,ext/fts5/fts5_index.c,1265,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,82,sqlite,ext/fts5/fts5_index.c,1265,FP,sizeof(seg)*nExtra: nExtra small internal insert count,,
EXP34-C,83,sqlite,ext/fts5/fts5_index.c,1283,FP,pData->p after fts5DataRead guarded by if(p->rc==SQLITE_OK); invariant assert (pRet==0)==(rc!=OK) makes pData non-null,,
EXP33-C,84,sqlite,ext/fts5/fts5_index.c,1286,FP,iCookie written via &iCookie by fts5StructureDecode at line 1284 before read at 1286,,
EXP34-C,85,sqlite,ext/fts5/fts5_index.c,1296,FP,fts5StructureRelease(pRet) tolerates NULL (its body is if-guarded at 1035),,
DCL13-C,86,sqlite,ext/fts5/fts5_index.c,1386,TP,"fts5StructureCountSegments reads pStruct->nLevel/aLevel[].nSeg only; SQLITE_DEBUG assert helper, never written",,
ARR00-C,87,sqlite,ext/fts5/fts5_index.c,1390,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,88,sqlite,ext/fts5/fts5_index.c,1391,FP,"nSegment += aLevel[].nSeg: DEBUG-only count, bounded by FTS5_MAX_SEGMENT",,
PRE00-C,89,sqlite,ext/fts5/fts5_index.c,1399,TP,fts5BufferSafeAppendBlob evaluates pBuf 3x and nBlob 2x; side-effecting arg would misbehave,,
PRE01-C,90,sqlite,ext/fts5/fts5_index.c,1399,FP,"nBlob used in additive/argument contexts only ('n+nBlob', memcpy arg); no precedence break",,
PRE10-C,91,sqlite,ext/fts5/fts5_index.c,1399,TP,multi-statement brace block not wrapped in do-while; breaks in if/else without braces,,
PRE12-C,92,sqlite,ext/fts5/fts5_index.c,1399,TP,nBlob evaluated twice (assert + memcpy); side-effecting argument double-evaluated,,
PRE00-C,93,sqlite,ext/fts5/fts5_index.c,1405,TP,fts5BufferSafeAppendVarint evaluates pBuf multiple times; side-effecting arg hazard,,
PRE10-C,94,sqlite,ext/fts5/fts5_index.c,1405,TP,two-statement brace block not in do-while; dangling-else / trailing-semicolon hazard,,
PRE12-C,95,sqlite,ext/fts5/fts5_index.c,1405,TP,pBuf evaluated 3x in macro body,,
EXP34-C,96,sqlite,ext/fts5/fts5_index.c,1422,FP,"fts5StructureWrite derefs pStruct inside if(p->rc==OK); callers pass non-null pStruct, and NULL implies rc!=OK",,
ARR30-C,97,sqlite,ext/fts5/fts5_index.c,1435,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,98,sqlite,ext/fts5/fts5_index.c,1437,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,99,sqlite,ext/fts5/fts5_index.c,1438,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,100,sqlite,ext/fts5/fts5_index.c,1439,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR00-C,101,sqlite,ext/fts5/fts5_index.c,1442,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,102,sqlite,ext/fts5/fts5_index.c,1449,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ERR33-C,103,sqlite,ext/fts5/fts5_index.c,1477,TP,"fflush(stdout) return value ignored; valid per ERR33 (debug-only fts5PrintStructure, low severity)",,
DCL13-C,104,sqlite,ext/fts5/fts5_index.c,1484,TP,fts5SegmentSize reads pSeg->pgnoLast/pgnoFirst only; never written,,
INT32-C,105,sqlite,ext/fts5/fts5_index.c,1485,TP,"fts5SegmentSize: 1+pSeg->pgnoLast-pgnoFirst; pgnoLast read from untrusted %_data structure blob (fts5GetVarint32) with only pgnoLast>=pgnoFirst checked, no upper bound -> signed overflow UB for pgnoLast near INT_MAX (low impact: merge heuristic, pgno revalidated at page read)","TRUNK-VALIDATED: STILL PRESENT on sqlite-main 124f449319 (fts5SegmentSize unchanged; fts5StructureDecode still only checks pgnoLast>=pgnoFirst, no upper bound). Low-severity/contained (merge heuristic; pgno revalidated at page read). Upstream hardening candidate.",
ARR00-C,106,sqlite,ext/fts5/fts5_index.c,1500,FP,"iPromote indexes pStruct->aLevel[]; internal merge index bounded by nLevel, not blob-derived",,
ARR30-C,107,sqlite,ext/fts5/fts5_index.c,1500,FP,"iPromote indexes pStruct->aLevel[]; internal merge index bounded by nLevel, not blob-derived",,
ARR00-C,108,sqlite,ext/fts5/fts5_index.c,1503,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,109,sqlite,ext/fts5/fts5_index.c,1503,FP,"iPromote+1: loop start, iPromote is a level index bounded by nLevel",,
ARR00-C,110,sqlite,ext/fts5/fts5_index.c,1506,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,111,sqlite,ext/fts5/fts5_index.c,1506,FP,pLvl->nSeg-1: reverse loop bound over segment count,,
ARR00-C,112,sqlite,ext/fts5/fts5_index.c,1547,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
ARR30-C,113,sqlite,ext/fts5/fts5_index.c,1547,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
ARR00-C,114,sqlite,ext/fts5/fts5_index.c,1550,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
ARR30-C,115,sqlite,ext/fts5/fts5_index.c,1550,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
INT32-C,116,sqlite,ext/fts5/fts5_index.c,1551,TP,same 1+pgnoLast-pgnoFirst signed overflow in fts5StructurePromote; pgnoLast unbounded from structure blob -> INT32-C UB,TRUNK-VALIDATED: STILL PRESENT on sqlite-main 124f449319; same unbounded pgno overflow. Low-severity hardening candidate.,
INT32-C,117,sqlite,ext/fts5/fts5_index.c,1554,FP,iLvl-1: level index decrement in bounded scan,,
INT32-C,118,sqlite,ext/fts5/fts5_index.c,1593,FP,pLvl->iOff += varint(iLeafPgno): dlidx parse cursor bounded by page nn,,
INT32-C,119,sqlite,ext/fts5/fts5_index.c,1594,FP,pLvl->iOff += varint(iRowid): dlidx parse cursor bounded by page nn,,
INT32-C,120,sqlite,ext/fts5/fts5_index.c,1604,FP,iLeafPgno += (iOff-pLvl->iOff)+1: iOff bounded by pData->nn loop; page-number accumulation used as i64 rowid key,,
INT32-C,121,sqlite,ext/fts5/fts5_index.c,1605,FP,iOff += varint(iVal): cursor advance bounded by pData->nn,,
MEM05-C,122,sqlite,ext/fts5/fts5_index.c,1619,uncertain,recursion is real but depth bounded by tiny dlidx level count (nLvl); excessive-stack concern unlikely,,
MSC04-C,123,sqlite,ext/fts5/fts5_index.c,1619,TP,fts5DlidxIterNextR directly recurses (calls itself); bounded by pIter->nLvl,,
ARR00-C,124,sqlite,ext/fts5/fts5_index.c,1620,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
EXP34-C,125,sqlite,ext/fts5/fts5_index.c,1620,FP,fts5DlidxIterNextR derefs pIter param; recursive helper on caller-owned iterator,,
INT32-C,126,sqlite,ext/fts5/fts5_index.c,1625,FP,iLvl+1: dlidx recursion level index bounded by nLvl,,
ARR37-C,127,sqlite,ext/fts5/fts5_index.c,1626,FP,"pLvl[1]=aLvl[iLvl+1], guarded by (iLvl+1)<pIter->nLvl; allocated array, in-bounds",,
ARR37-C,128,sqlite,ext/fts5/fts5_index.c,1630,FP,"pLvl[1].iLeafPgno = aLvl[iLvl+1], guarded by (iLvl+1)<nLvl; in-bounds",,
EXP34-C,129,sqlite,ext/fts5/fts5_index.c,1656,FP,fts5DlidxIterFirst derefs pIter param; called on non-null iterator (fts5DlidxIterInit checks rc),,
DCL13-C,130,sqlite,ext/fts5/fts5_index.c,1663,TP,fts5DlidxIterEof reads p->rc only; never written,,
EXP34-C,131,sqlite,ext/fts5/fts5_index.c,1664,FP,fts5DlidxIterEof derefs pIter->aLvl after p->rc!=OK short-circuit; caller-owned iterator,,
DCL13-C,132,sqlite,ext/fts5/fts5_index.c,1667,FP,"fts5DlidxIterLast writes through pIter: pLvl=&pIter->aLvl[i] then pLvl->bEof=0, pChild->pData= assigned",,
EXP34-C,133,sqlite,ext/fts5/fts5_index.c,1671,FP,fts5DlidxIterLast derefs pIter param; caller-owned non-null iterator,,
INT32-C,134,sqlite,ext/fts5/fts5_index.c,1671,FP,"pIter->nLvl-1: dlidx level count, small",,
ARR00-C,135,sqlite,ext/fts5/fts5_index.c,1677,FP,pLvl[-1] guarded by enclosing if(i>0),,
ARR37-C,136,sqlite,ext/fts5/fts5_index.c,1677,FP,"pLvl[-1]=aLvl[i-1], guarded by i>0; allocated aLvl array, in-bounds",,
INT32-C,137,sqlite,ext/fts5/fts5_index.c,1707,FP,"nZero++: counts zero bytes within a page buffer, bounded by page size",,
INT32-C,138,sqlite,ext/fts5/fts5_index.c,1708,FP,ii++: byte cursor within page buffer bounded by page content,,
INT32-C,139,sqlite,ext/fts5/fts5_index.c,1710,FP,ii += varint(delta): cursor advance within page,,
INT32-C,140,sqlite,ext/fts5/fts5_index.c,1713,FP,iLeafPgno += nZero+1: nZero bounded by page byte count; page-number used as i64 rowid,,
MEM05-C,141,sqlite,ext/fts5/fts5_index.c,1722,uncertain,recursion bounded by small nLvl; stack-exhaustion risk negligible in practice,,
MSC04-C,142,sqlite,ext/fts5/fts5_index.c,1722,TP,fts5DlidxIterPrevR directly recurses; bounded by pIter->nLvl,,
ARR00-C,143,sqlite,ext/fts5/fts5_index.c,1723,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
EXP34-C,144,sqlite,ext/fts5/fts5_index.c,1723,FP,fts5DlidxIterPrevR derefs pIter param; recursive helper on caller-owned iterator,,
INT32-C,145,sqlite,ext/fts5/fts5_index.c,1728,FP,iLvl+1: dlidx recursion level index bounded by nLvl,,
ARR37-C,146,sqlite,ext/fts5/fts5_index.c,1729,FP,"pLvl[1]=aLvl[iLvl+1], guarded by (iLvl+1)<nLvl; in-bounds",,
ARR37-C,147,sqlite,ext/fts5/fts5_index.c,1733,FP,"pLvl[1].iLeafPgno=aLvl[iLvl+1], guarded by (iLvl+1)<nLvl; in-bounds",,
INT32-C,148,sqlite,ext/fts5/fts5_index.c,1773,FP,"i+1: SZ_FTS5DLIDXITER alloc count, loop index of dlidx levels (tiny)",,
INT32-C,149,sqlite,ext/fts5/fts5_index.c,1788,FP,"i+1: dlidx level count assignment, tiny",,
EXP34-C,150,sqlite,ext/fts5/fts5_index.c,1793,FP,fts5DlidxIterInit sets pIter->iSegid inside if(p->rc==OK); pIter non-null on that path (realloc NOMEM sets rc),,
MEM30-C,151,sqlite,ext/fts5/fts5_index.c,1795,FP,pIter=pNew points at live allocation; no free of pIter before this use,,
MEM30-C,152,sqlite,ext/fts5/fts5_index.c,1797,FP,pIter still live (assigned from pNew in loop); no preceding free,,
DCL13-C,153,sqlite,ext/fts5/fts5_index.c,1809,TP,fts5DlidxIterRowid returns pIter->aLvl[0].iRowid only; read-only,,
EXP34-C,154,sqlite,ext/fts5/fts5_index.c,1810,FP,fts5DlidxIterRowid derefs pIter param; caller-owned non-null iterator,,
DCL13-C,155,sqlite,ext/fts5/fts5_index.c,1812,TP,fts5DlidxIterPgno returns pIter->aLvl[0].iLeafPgno only; read-only,,
EXP34-C,156,sqlite,ext/fts5/fts5_index.c,1813,FP,fts5DlidxIterPgno derefs pIter param; caller-owned non-null iterator,,
EXP34-C,157,sqlite,ext/fts5/fts5_index.c,1824,FP,"fts5DataRelease(pIter->pLeaf): pIter is caller-owned Fts5SegIter, non-null",,
INT32-C,158,sqlite,ext/fts5/fts5_index.c,1826,FP,"pIter->iLeafPgno++: page number, bounded by pSeg->pgnoLast in this path",,
EXP34-C,159,sqlite,ext/fts5/fts5_index.c,1830,FP,pSeg->pgnoLast where pSeg=pIter->pSeg; pSeg set during seg-iter init on a valid segment,,
INT32-C,160,sqlite,ext/fts5/fts5_index.c,1842,FP,"pLeaf->nn+1: nn is blob byte size (int), pgsz-bounded leaf, +1 safe",,
INT32-C,161,sqlite,ext/fts5/fts5_index.c,1844,FP,iPgidxOff += varint(iEndofDoclist): iPgidxOff bounded by szLeaf (fts5GetU16 <=65535),,
EXP33-C,162,sqlite,ext/fts5/fts5_index.c,1860,FP,"nSz set by fts5FastGetVarint32(p,n,nSz) macro before use",,
INT14-C,163,sqlite,ext/fts5/fts5_index.c,1862,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT13-C,164,sqlite,ext/fts5/fts5_index.c,1863,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL13-C,165,sqlite,ext/fts5/fts5_index.c,1878,TP,fts5SegIterLoadNPos: flagged param p reads p->rc/p->pConfig only (pIter is the one mutated); p is const-able,,
EXP34-C,166,sqlite,ext/fts5/fts5_index.c,1880,FP,fts5SegIterLoadNPos derefs pIter->pLeaf inside if(p->rc==OK) with ASSERT_SZLEAF_OK; leaf valid in that state,,
ARR30-C,167,sqlite,ext/fts5/fts5_index.c,1881,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
INT32-C,168,sqlite,ext/fts5/fts5_index.c,1888,FP,iOff++: detail=none byte cursor bounded by iEod (<=szLeaf),,
INT32-C,169,sqlite,ext/fts5/fts5_index.c,1891,FP,iOff++: detail=none byte cursor bounded by iEod,,
EXP33-C,170,sqlite,ext/fts5/fts5_index.c,1898,FP,nSz set by fts5FastGetVarint32 macro before bit ops,,
INT13-C,171,sqlite,ext/fts5/fts5_index.c,1899,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,172,sqlite,ext/fts5/fts5_index.c,1900,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
EXP34-C,173,sqlite,ext/fts5/fts5_index.c,1908,FP,fts5SegIterLoadRowid derefs pIter->pLeaf; only reached with a loaded non-null leaf,,
ARR30-C,174,sqlite,ext/fts5/fts5_index.c,1911,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
EXP34-C,175,sqlite,ext/fts5/fts5_index.c,1941,FP,fts5SegIterLoadTerm derefs pIter->pLeaf; called only after a leaf is loaded (rc-correlated),,
EXP33-C,176,sqlite,ext/fts5/fts5_index.c,1945,FP,nNew written by fts5GetVarint32 macro at 1945 before use,,
INT32-C,177,sqlite,ext/fts5/fts5_index.c,1959,FP,"pLeaf->nn+1: blob byte size +1, pgsz-bounded",,
EXP33-C,178,sqlite,ext/fts5/fts5_index.c,1962,FP,nExtra written by fts5GetVarint32 macro at 1962 before += use,,
INT32-C,179,sqlite,ext/fts5/fts5_index.c,1962,FP,iPgidxOff += varint(nExtra): iPgidxOff bounded by szLeaf,,
INT32-C,180,sqlite,ext/fts5/fts5_index.c,1963,FP,iEndofDoclist+=nExtra consumed against n on the same leaf; bounded by szLeaf,,
DCL13-C,181,sqlite,ext/fts5/fts5_index.c,1973,TP,fts5SegIterSetNext: flagged param p reads p->pConfig->eDetail only (pIter->xNext is what is assigned); p const-able,,
EXP34-C,182,sqlite,ext/fts5/fts5_index.c,1974,FP,fts5SegIterSetNext derefs pIter param; caller-owned non-null iterator,,
EXP34-C,183,sqlite,ext/fts5/fts5_index.c,1989,FP,fts5SegIterAllocTombstone derefs pIter->pSeg; iterator initialized with non-null pSeg,,
DCL13-C,184,sqlite,ext/fts5/fts5_index.c,2012,FP,fts5SegIterInit stores pIter->pSeg=pSeg; pSeg escapes into non-const Fts5SegIter.pSeg field,,
ARR01-C,185,sqlite,ext/fts5/fts5_index.c,2026,FP,"sizeof(*pIter) is size of pointed-to struct (correct idiom), not sizeof(pIter); misclassification",,
INT32-C,186,sqlite,ext/fts5/fts5_index.c,2029,FP,pSeg->pgnoFirst-1: initial page index; result used as i64 leaf page no,,
INT32-C,187,sqlite,ext/fts5/fts5_index.c,2040,FP,szLeaf+1: szLeaf from fts5GetU16 (<=65535),,
EXP34-C,188,sqlite,ext/fts5/fts5_index.c,2064,FP,"fts5SegIterReverseInitPage derefs pIter->pLeaf; callers (HashInit 2903 if(pLeaf), MultiIterNew2 if pData->szLeaf>0) ensure pLeaf non-null",,
ARR30-C,189,sqlite,ext/fts5/fts5_index.c,2073,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
INT32-C,190,sqlite,ext/fts5/fts5_index.c,2087,FP,i += fts5GetPoslistSize(...): cursor in reverse-page scan bounded by n (szLeaf),,
INT32-C,191,sqlite,ext/fts5/fts5_index.c,2088,FP,i += nPos: nPos from poslist size field; cursor checked i>=n right after (loop bound),,
INT32-C,192,sqlite,ext/fts5/fts5_index.c,2091,FP,i += varint(iDelta): cursor advance bounded by n,,
INT32-C,193,sqlite,ext/fts5/fts5_index.c,2096,FP,nRowidOffset+8: internal aRowidOffset growth increment,,
INT30-C,194,sqlite,ext/fts5/fts5_index.c,2097,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,195,sqlite,ext/fts5/fts5_index.c,2097,FP,"nNew*sizeof(int): nNew=nRowidOffset+8 small growth, realloc64 size",,
INT14-C,196,sqlite,ext/fts5/fts5_index.c,2117,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,197,sqlite,ext/fts5/fts5_index.c,2124,FP,"pIter->iLeafPgno--: reverse page walk, bounded by iTermLeafPgno",,
INT32-C,198,sqlite,ext/fts5/fts5_index.c,2162,FP,pLeaf->nn+1: blob byte size +1,,
DCL13-C,199,sqlite,ext/fts5/fts5_index.c,2172,TP,fts5MultiIterIsEmpty: flagged param p reads p->rc only; read-only,,
INT32-C,200,sqlite,ext/fts5/fts5_index.c,2196,FP,"pIter->iRowidOffset--: index into aRowidOffset, guarded by >0",,
INT32-C,201,sqlite,ext/fts5/fts5_index.c,2201,FP,"iOff += nPos: within reverse page, nPos bounded by szLeaf region",,
ARR30-C,202,sqlite,ext/fts5/fts5_index.c,2227,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
INT32-C,203,sqlite,ext/fts5/fts5_index.c,2241,FP,"iOff += varint(iDelta): cursor advance, iOff checked <n",,
EXP33-C,204,sqlite,ext/fts5/fts5_index.c,2243,FP,iDelta written via &iDelta by sqlite3Fts5GetVarint at 2241 before use at 2243,,
INT32-C,205,sqlite,ext/fts5/fts5_index.c,2248,FP,iOff += varint(nKeep): cursor advance bounded by page,,
EXP05-C,206,sqlite,ext/fts5/fts5_index.c,2260,FP,"pList from sqlite3Fts5HashScanEntry is const u8*; cast to u8* feeds Fts5Data.p which fts5 treats as read-only in-memory hash buffer; idiomatic, no write-through-const defect",,
EXP05-C,207,sqlite,ext/fts5/fts5_index.c,2264,FP,"zTerm const char* cast to u8* only passed to sqlite3Fts5BufferSet which copies the bytes, no mutation",,
MSC07-C,208,sqlite,ext/fts5/fts5_index.c,2276,FP,code after 'return' is reached via 'goto next_none_eof' label; not dead code,,
ARR30-C,209,sqlite,ext/fts5/fts5_index.c,2308,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
INT14-C,210,sqlite,ext/fts5/fts5_index.c,2309,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
ARR36-C,211,sqlite,ext/fts5/fts5_index.c,2311,FP,"iOff<n compares two int offsets (iLeafOffset+nPos vs szLeaf), not pointers; misclassification",,
INT32-C,212,sqlite,ext/fts5/fts5_index.c,2317,FP,"iOff += varint(nKeep): cursor advance, iOff<n checked",,
INT32-C,213,sqlite,ext/fts5/fts5_index.c,2321,FP,"iOff += varint(iDelta): cursor advance, iOff<n checked",,
EXP05-C,214,sqlite,ext/fts5/fts5_index.c,2341,FP,"same as 2260: pList const-hash buffer assigned to pLeaf->p, never written through",,
INT32-C,215,sqlite,ext/fts5/fts5_index.c,2344,FP,nList+1: nList is in-memory hash-scan list length,,
EXP05-C,216,sqlite,ext/fts5/fts5_index.c,2345,FP,same as 2264: zTerm cast only for BufferSet copy,,
ARR30-C,217,sqlite,ext/fts5/fts5_index.c,2356,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
EXP30-C,218,sqlite,ext/fts5/fts5_index.c,2357,FP,iOff assigned then read across && which is a sequence point; no unsequenced modify/access,,
EXP45-C,219,sqlite,ext/fts5/fts5_index.c,2357,TP,intentional assignment-in-condition idiom (iOff = fts5LeafFirstRowidOff(pLeaf)) && ...; literal EXP45 violation though deliberate,,
INT32-C,220,sqlite,ext/fts5/fts5_index.c,2358,FP,iOff += varint(iRowid): iOff guarded iOff<pLeaf->szLeaf,,
INT32-C,221,sqlite,ext/fts5/fts5_index.c,2362,FP,"szLeaf + varint(iEndofDoclist): szLeaf<=65535, varint advance small; iEndofDoclist consumer-bounded",,
INT32-C,222,sqlite,ext/fts5/fts5_index.c,2368,FP,szLeaf + varint(iOff): szLeaf<=65535 plus small varint length,,
EXP33-C,223,sqlite,ext/fts5/fts5_index.c,2400,FP,nSz set by fts5FastGetVarint32 macro before use,,
INT13-C,224,sqlite,ext/fts5/fts5_index.c,2401,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,225,sqlite,ext/fts5/fts5_index.c,2402,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
PRE00-C,226,sqlite,ext/fts5/fts5_index.c,2408,TP,"SWAPVAL evaluates a and b multiple times; side-effecting lvalue args (e.g. SWAPVAL(T,*p++,...)) misbehave",,
PRE01-C,227,sqlite,ext/fts5/fts5_index.c,2408,FP,unparenthesized 'T' is a type-name token; cannot/should not be parenthesized,,
PRE10-C,228,sqlite,ext/fts5/fts5_index.c,2408,TP,multi-statement brace block not wrapped in do-while,,
PRE12-C,229,sqlite,ext/fts5/fts5_index.c,2408,TP,a and b each evaluated twice; side effects double-applied,,
PRE00-C,230,sqlite,ext/fts5/fts5_index.c,2410,TP,fts5IndexSkipVarint evaluates a and iOff multiple times; iOff also incremented via a[iOff++],,
PRE01-C,231,sqlite,ext/fts5/fts5_index.c,2410,TP,unparenthesized 'a' used as subscript base a[iOff++]; caller passing 'x+1' yields 'x+1[iOff]' bug,,
PRE02-C,232,sqlite,ext/fts5/fts5_index.c,2410,FP,macro body is a statement block; replacement-list parenthesization not applicable,,
PRE10-C,233,sqlite,ext/fts5/fts5_index.c,2410,TP,multi-statement brace block not wrapped in do-while,,
PRE12-C,234,sqlite,ext/fts5/fts5_index.c,2410,TP,iOff evaluated multiple times; pre-increment side effect in a[iOff++],,
EXP34-C,235,sqlite,ext/fts5/fts5_index.c,2421,FP,fts5SegIterReverse derefs pIter->pDlidx/pSeg; caller-owned iterator at first rowid,,
ARR30-C,236,sqlite,ext/fts5/fts5_index.c,2441,FP,fts5IndexSkipVarint advances at most 9 bytes (iOff<iOff+9) over pLeaf->p which is over-allocated by FTS5_DATA_PADDING=20 trailing zero bytes; bounded overread within padding,,
EXP34-C,237,sqlite,ext/fts5/fts5_index.c,2441,FP,"fts5IndexSkipVarint(pLeaf->p): pLeaf=pIter->pLeaf, current leaf non-null in else (no-dlidx) branch",,
EXP34-C,238,sqlite,ext/fts5/fts5_index.c,2453,FP,pSeg->pgnoLast where pSeg=pIter->pSeg; valid segment on the iterator,,
INT32-C,239,sqlite,ext/fts5/fts5_index.c,2453,FP,iLeafPgno+1 loop start: bounded by pSeg->pgnoLast in for-condition,,
INT32-C,240,sqlite,ext/fts5/fts5_index.c,2491,FP,iOff += varint(iRowid): iOff guarded iOff>pLast->szLeaf -> corrupt,,
INT32-C,241,sqlite,ext/fts5/fts5_index.c,2495,FP,pLast->nn+1: blob byte size +1,,
EXP34-C,242,sqlite,ext/fts5/fts5_index.c,2512,FP,fts5SegIterLoadDlidx derefs pIter->pSeg->iSegid; ONETERM iterator with valid pSeg,,
EXP34-C,243,sqlite,ext/fts5/fts5_index.c,2523,FP,pLeaf->szLeaf where pLeaf=pIter->pLeaf; current leaf non-null in this state,,
EXP34-C,244,sqlite,ext/fts5/fts5_index.c,2552,FP,fts5LeafSeek derefs pIter->pLeaf->p with assert(p->rc==OK); seek only entered when pLeaf set (2729 if(pIter->pLeaf)),,
EXP33-C,245,sqlite,ext/fts5/fts5_index.c,2565,FP,iTermOff written by fts5GetVarint32 macro before read,,
ARR36-C,246,sqlite,ext/fts5/fts5_index.c,2567,FP,iOff>n compares int offset iTermOff vs int n=szLeaf; not pointers; misclassification,,
EXP34-C,247,sqlite,ext/fts5/fts5_index.c,2586,FP,"pTerm[nMatch+i]: pTerm is search param, assert(pTerm && nTerm) at 2703 / caller contract",,
ARR36-C,248,sqlite,ext/fts5/fts5_index.c,2601,FP,iPgidx>=n compares int offsets; not pointers; misclassification,,
ARR36-C,249,sqlite,ext/fts5/fts5_index.c,2610,FP,iOff>=n compares int offsets (iTermOff vs n); not pointers; misclassification,,
ARR36-C,250,sqlite,ext/fts5/fts5_index.c,2658,FP,iPgidx>=n compares int offsets; not pointers; misclassification,,
INT32-C,251,sqlite,ext/fts5/fts5_index.c,2659,FP,pLeaf->nn+1: blob byte size +1,,
EXP33-C,252,sqlite,ext/fts5/fts5_index.c,2662,FP,nExtra written by fts5GetVarint32 macro before use,,
DCL13-C,253,sqlite,ext/fts5/fts5_index.c,2694,FP,fts5SegIterSeekInit stores pIter->pSeg=pSeg; pSeg escapes into non-const field,,
INT13-C,254,sqlite,ext/fts5/fts5_index.c,2698,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,255,sqlite,ext/fts5/fts5_index.c,2702,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
ARR01-C,256,sqlite,ext/fts5/fts5_index.c,2704,FP,sizeof(*pIter) dereferences first; correct sizeof-of-pointee idiom; misclassification,,
EXP34-C,257,sqlite,ext/fts5/fts5_index.c,2704,FP,"passing pIter to fts5SegIterAllocTombstone; pIter is the caller-provided out-param struct, non-null",,
INT32-C,258,sqlite,ext/fts5/fts5_index.c,2726,FP,iPg-1: iPg from %_idx (>=pgnoFirst); page index,,
INT13-C,259,sqlite,ext/fts5/fts5_index.c,2733,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,260,sqlite,ext/fts5/fts5_index.c,2736,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,261,sqlite,ext/fts5/fts5_index.c,2742,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,262,sqlite,ext/fts5/fts5_index.c,2749,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL13-C,263,sqlite,ext/fts5/fts5_index.c,2793,FP,fts5SegIterNextInit stores pIter->pSeg=pSeg; pSeg escapes into non-const field,,
ARR01-C,264,sqlite,ext/fts5/fts5_index.c,2816,FP,sizeof(*pIter) is pointee struct size (correct idiom); misclassification,,
EXP34-C,265,sqlite,ext/fts5/fts5_index.c,2816,FP,"memset(pIter) in fts5SegIterNextInit; pIter is caller-provided out-param struct, non-null",,
INT32-C,266,sqlite,ext/fts5/fts5_index.c,2829,FP,iPgidxOff += varint(iTermOff): iPgidxOff starts at szLeaf (<=65535),,
INT13-C,267,sqlite,ext/fts5/fts5_index.c,2863,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
EXP05-C,268,sqlite,ext/fts5/fts5_index.c,2871,FP,"pList declared const u8* from HashScanEntry, cast to u8* for pLeaf->p; in-memory hash data never mutated through it",,
INT13-C,269,sqlite,ext/fts5/fts5_index.c,2901,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT32-C,270,sqlite,ext/fts5/fts5_index.c,2932,FP,p->nRef--: refcount,,
ARR00-C,271,sqlite,ext/fts5/fts5_index.c,2935,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
DCL13-C,272,sqlite,ext/fts5/fts5_index.c,2965,TP,"fts5AssertComparisonResult reads pIter->aSeg/bRev only; called directly (not a callback), never written",,
DCL13-C,273,sqlite,ext/fts5/fts5_index.c,2966,TP,"fts5AssertComparisonResult reads p1->pLeaf/term/iRowid only; not a fn-ptr callback, never written",,
DCL13-C,274,sqlite,ext/fts5/fts5_index.c,2967,TP,fts5AssertComparisonResult reads p2->pLeaf/term/iRowid only; never written,,
DCL13-C,275,sqlite,ext/fts5/fts5_index.c,2968,TP,fts5AssertComparisonResult reads pRes->iFirst/bTermEq in asserts only; never written,,
EXP34-C,276,sqlite,ext/fts5/fts5_index.c,2970,FP,fts5AssertComparisonResult (SQLITE_DEBUG) derefs pIter; assert helper with non-null args,,
INT32-C,277,sqlite,ext/fts5/fts5_index.c,2981,FP,"p1->term.n - p2->term.n: DEBUG-only assert, in-memory term lengths",,
DCL13-C,278,sqlite,ext/fts5/fts5_index.c,3006,TP,fts5AssertMultiIterSetup: flagged param p reads p->rc only; never written,,
EXP34-C,279,sqlite,ext/fts5/fts5_index.c,3008,FP,fts5AssertMultiIterSetup (SQLITE_DEBUG) derefs pIter inside if(p->rc==OK); non-null assert helper,,
INT32-C,280,sqlite,ext/fts5/fts5_index.c,3026,FP,i+1: DEBUG assert loop pairing index bounded by nSeg,,
INT32-C,281,sqlite,ext/fts5/fts5_index.c,3027,FP,"pIter->nSeg + i: DEBUG assert aFirst[] index, nSeg small",,
INT32-C,282,sqlite,ext/fts5/fts5_index.c,3033,FP,i*2+1: DEBUG assert tree index bounded by nSeg,,
DCL13-C,283,sqlite,ext/fts5/fts5_index.c,3051,FP,fts5MultiIterDoCompare writes through pIter: pRes=&pIter->aFirst[iOut] then pRes->iFirst/bTermEq assigned,,
ARR00-C,284,sqlite,ext/fts5/fts5_index.c,3057,FP,iOut indexes pIter->aFirst[] merge-tree slot; internal index bounded by tree node count,,
INT32-C,285,sqlite,ext/fts5/fts5_index.c,3063,FP,"(iOut-nSeg/2)*2: tournament-tree index, nSeg small segment count",,
INT32-C,286,sqlite,ext/fts5/fts5_index.c,3064,FP,i1+1: sibling index in tournament tree,,
INT32-C,287,sqlite,ext/fts5/fts5_index.c,3066,FP,iOut*2: tournament-tree child index bounded by nSeg,,
INT32-C,288,sqlite,ext/fts5/fts5_index.c,3067,FP,iOut*2+1: tournament-tree child index bounded by nSeg,,
ARR36-C,289,sqlite,ext/fts5/fts5_index.c,3080,FP,"i1/i2 are int array indices into aFirst[], compared as ints; not pointers; misclassification",,
INT32-C,290,sqlite,ext/fts5/fts5_index.c,3117,FP,"iLeafPgno-1: page index, iLeafPgno guarded <=pgnoLast above",,
INT32-C,291,sqlite,ext/fts5/fts5_index.c,3130,FP,iOff += varint(iRowid): iOff guarded 4<=iOff<n,,
EXP34-C,292,sqlite,ext/fts5/fts5_index.c,3216,FP,fts5MultiIterAdvanced derefs pIter param; caller-owned multi-iterator,,
INT32-C,293,sqlite,ext/fts5/fts5_index.c,3216,FP,"(nSeg+iChanged)/2: aFirst[] tree index, nSeg small",,
EXP45-C,294,sqlite,ext/fts5/fts5_index.c,3218,TP,"intentional assignment-in-condition idiom: if((iEq = fts5MultiIterDoCompare(pIter,i))); literal EXP45 violation",,
INT32-C,295,sqlite,ext/fts5/fts5_index.c,3222,FP,"nSeg+iEq: aFirst[] tree index, counts small",,
ARR00-C,296,sqlite,ext/fts5/fts5_index.c,3242,FP,iChanged indexes pIter->aSeg[]; internal segment index bounded by nSeg,,
ARR30-C,297,sqlite,ext/fts5/fts5_index.c,3242,FP,iChanged indexes pIter->aSeg[]; internal segment index bounded by nSeg,,
EXP34-C,298,sqlite,ext/fts5/fts5_index.c,3242,FP,fts5MultiIterAdvanceRowid derefs pIter->aSeg; caller-owned multi-iterator,,
INT14-C,299,sqlite,ext/fts5/fts5_index.c,3248,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT14-C,300,sqlite,ext/fts5/fts5_index.c,3250,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,301,sqlite,ext/fts5/fts5_index.c,3250,FP,"nSeg+iChanged: aFirst[] tree index, counts small",,
INT13-C,302,sqlite,ext/fts5/fts5_index.c,3269,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL30-C,303,sqlite,ext/fts5/fts5_index.c,3273,FP,"pNew points into heap-allocated pIter->aSeg[] array, not a local object",,
EXP34-C,304,sqlite,ext/fts5/fts5_index.c,3281,FP,fts5MultiIterSetEof derefs pIter->aSeg; caller-owned multi-iterator,,
PRE01-C,305,sqlite,ext/fts5/fts5_index.c,3290,FP,"TOMBSTONE_KEYSIZE: pPg used only as 'pPg->p[0]'; member access binds tighter, no precedence break",,
PRE00-C,306,sqlite,ext/fts5/fts5_index.c,3292,TP,TOMBSTONE_NSLOT evaluates pPg multiple times (nn twice plus nested TOMBSTONE_KEYSIZE),,
PRE01-C,307,sqlite,ext/fts5/fts5_index.c,3292,FP,TOMBSTONE_NSLOT: pPg used only via 'pPg->nn'/member access; no precedence hazard,,
PRE12-C,308,sqlite,ext/fts5/fts5_index.c,3292,TP,pPg evaluated multiple times across nn and nested keysize macro,,
ARR30-C,309,sqlite,ext/fts5/fts5_index.c,3305,FP,TOMBSTONE_KEYSIZE/NSLOT read pPg->p[] on Fts5Data tombstone pages over-allocated by FTS5_DATA_PADDING=20; slot index is % nSlot-bounded with max byte <= nn-1; small-page reads fall within trailing padding,,
INT10-C,310,sqlite,ext/fts5/fts5_index.c,3307,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT33-C,311,sqlite,ext/fts5/fts5_index.c,3307,FP,"nSlot=TOMBSTONE_NSLOT macro is >=1 by construction ((nn-8)/szKey with nn>16, else 1)",,
ARR37-C,312,sqlite,ext/fts5/fts5_index.c,3314,FP,aSlot=&p[8]; iSlot<nSlot=(nn-8)/keysize so 8+iSlot*key<nn; in-bounds within pHash->p,,
ARR37-C,313,sqlite,ext/fts5/fts5_index.c,3315,FP,aSlot[iSlot] with iSlot<nSlot sized from pHash->nn; in-bounds,,
INT32-C,314,sqlite,ext/fts5/fts5_index.c,3316,FP,nCollide--: tombstone probe counter init=nSlot (page slot count),,
INT10-C,315,sqlite,ext/fts5/fts5_index.c,3317,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT32-C,316,sqlite,ext/fts5/fts5_index.c,3317,FP,iSlot+1: hash slot index immediately %nSlot,,
INT33-C,317,sqlite,ext/fts5/fts5_index.c,3317,FP,same nSlot>=1 from TOMBSTONE_NSLOT macro,,
ARR37-C,318,sqlite,ext/fts5/fts5_index.c,3321,FP,u64 aSlot=&p[8]; iSlot<nSlot=(nn-8)/8 so offset<nn; in-bounds,,
ARR37-C,319,sqlite,ext/fts5/fts5_index.c,3322,FP,aSlot[iSlot] u64 path; iSlot<nSlot sized from nn; in-bounds,,
INT32-C,320,sqlite,ext/fts5/fts5_index.c,3323,FP,nCollide--: tombstone probe counter bounded by nSlot,,
INT10-C,321,sqlite,ext/fts5/fts5_index.c,3324,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT32-C,322,sqlite,ext/fts5/fts5_index.c,3324,FP,iSlot+1: hash slot index immediately %nSlot,,
INT33-C,323,sqlite,ext/fts5/fts5_index.c,3324,FP,same nSlot>=1 from TOMBSTONE_NSLOT macro,,
DCL13-C,324,sqlite,ext/fts5/fts5_index.c,3336,FP,fts5MultiIterIsDeleted writes sub-object via pIter: pArray->apTombstone[iPg]=fts5DataRead(...) through pIter->aSeg[],,
EXP34-C,325,sqlite,ext/fts5/fts5_index.c,3337,FP,fts5MultiIterIsDeleted derefs pIter->aFirst; caller-owned multi-iterator,,
INT33-C,326,sqlite,ext/fts5/fts5_index.c,3343,FP,pArray->nTombstone only set when nTomb>0; array allocated only in that case,,
EXP34-C,327,sqlite,ext/fts5/fts5_index.c,3379,FP,fts5MultiIterNext assert(pIter->base.bEof==0); caller-owned multi-iterator,,
EXP34-C,328,sqlite,ext/fts5/fts5_index.c,3417,FP,fts5MultiIterNext2 assert(pIter->bSkipEmpty); caller-owned multi-iterator,,
INT30-C,329,sqlite,ext/fts5/fts5_index.c,3456,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
DCL30-C,330,sqlite,ext/fts5/fts5_index.c,3464,FP,pNew from sqlite3Fts5MallocZero (heap); returning it is correct,,
ARR30-C,331,sqlite,ext/fts5/fts5_index.c,3475,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
DCL13-C,332,sqlite,ext/fts5/fts5_index.c,3497,TP,fts5IndexColsetTest reads pColset->nCol/aiCol[] only; never written,,
EXP34-C,333,sqlite,ext/fts5/fts5_index.c,3499,FP,fts5IndexColsetTest derefs pColset->nCol; only invoked when caller has a non-null colset,,
EXP33-C,334,sqlite,ext/fts5/fts5_index.c,3517,FP,iVal written by fts5GetVarint32 macro at 3517 before use,,
INT32-C,335,sqlite,ext/fts5/fts5_index.c,3518,uncertain,"iVal += pCtx->iRead-2: column-delta accumulation from poslist varint32 (blob), no bound; consumed as column id (low impact)",,
ARR30-C,336,sqlite,ext/fts5/fts5_index.c,3521,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,337,sqlite,ext/fts5/fts5_index.c,3521,FP,iVal+2-pCtx->iWrite: column-id delta output to grown buffer; column id not a memory index,,
EXP33-C,338,sqlite,ext/fts5/fts5_index.c,3544,FP,iCol set by fts5FastGetVarint32 macro before use,,
ARR30-C,339,sqlite,ext/fts5/fts5_index.c,3547,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT14-C,340,sqlite,ext/fts5/fts5_index.c,3555,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
ARR30-C,341,sqlite,ext/fts5/fts5_index.c,3559,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,342,sqlite,ext/fts5/fts5_index.c,3564,FP,i++: poslist byte cursor in filter callback bounded by nChunk,,
ARR30-C,343,sqlite,ext/fts5/fts5_index.c,3571,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT14-C,344,sqlite,ext/fts5/fts5_index.c,3589,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,345,sqlite,ext/fts5/fts5_index.c,3597,FP,pgno+1: pgnoSave init from current page number,,
DCL31-C,346,sqlite,ext/fts5/fts5_index.c,3601,FP,"xChunk is a function-pointer parameter being invoked, not an undeclared function",,
INT32-C,347,sqlite,ext/fts5/fts5_index.c,3602,FP,"nRem -= nChunk: nRem=nPos (poslist size <=szLeaf), nChunk<=nRem",,
INT32-C,348,sqlite,ext/fts5/fts5_index.c,3610,FP,pgno++: leaf page walk bounded by data availability/pgnoLast,,
INT32-C,349,sqlite,ext/fts5/fts5_index.c,3614,FP,"pData->szLeaf - 4: szLeaf from fts5GetU16, fts5LeafRead ensures szLeaf>=region",,
INT32-C,350,sqlite,ext/fts5/fts5_index.c,3641,FP,pBuf->n + pSeg->nPos: buffer pre-grown to n+nPos+padding via fts5BufferGrow,,
DCL13-C,351,sqlite,ext/fts5/fts5_index.c,3677,TP,fts5IndexExtractColset reads pColset->nCol/aiCol[] only; never written,,
ARR30-C,352,sqlite,ext/fts5/fts5_index.c,3692,FP,"poslist scan: inner while(*p++ & 0x80) terminates within FTS5_DATA_PADDING trailing zeros (varint <=9 bytes, padding=20); outer loop bounded by p<pEnd",,
INT32-C,353,sqlite,ext/fts5/fts5_index.c,3694,FP,i++: colset index bounded by pColset->nCol,,
ARR30-C,354,sqlite,ext/fts5/fts5_index.c,3704,FP,"poslist scan: inner while(*p++ & 0x80) terminates within FTS5_DATA_PADDING trailing zeros (varint <=9 bytes, padding=20); outer loop bounded by p<pEnd",,
ARR36-C,355,sqlite,ext/fts5/fts5_index.c,3704,FP,p<pEnd where pEnd=&pPos[nPos]; same buffer end-pointer compare; not different arrays,,
INT14-C,356,sqlite,ext/fts5/fts5_index.c,3705,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
ARR30-C,357,sqlite,ext/fts5/fts5_index.c,3714,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR36-C,358,sqlite,ext/fts5/fts5_index.c,3716,FP,"p>=pEnd, both derived from pPos/nPos same buffer; legitimate end compare",,
INT13-C,359,sqlite,ext/fts5/fts5_index.c,3723,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL13-C,360,sqlite,ext/fts5/fts5_index.c,3735,FP,"fts5IterSetOutputs_None reads pSeg only but signature fixed by xSetOutputs typedef void(*)(Fts5Iter*,Fts5SegIter*)",,
ARR30-C,361,sqlite,ext/fts5/fts5_index.c,3817,FP,detail=col output loop: aiCol advance bounded by aiCol==aiColEnd check; outer while bounded by a<pEnd,,
INT32-C,362,sqlite,ext/fts5/fts5_index.c,3818,FP,iPrev += a++[0]-2: single-byte column-id delta; loop bounded a<pEnd; used only for colset match,,
INT32-C,363,sqlite,ext/fts5/fts5_index.c,3820,FP,aiCol++: pointer walk bounded by aiColEnd,,
EXP34-C,364,sqlite,ext/fts5/fts5_index.c,3866,FP,fts5IterSetOutputCb derefs pIter->pIndex inside if(*pRc==OK) with assert(pIter!=0||rc!=OK); non-null when rc==OK,,
ARR00-C,365,sqlite,ext/fts5/fts5_index.c,3901,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,366,sqlite,ext/fts5/fts5_index.c,3901,FP,"pIter->nSeg-1: segment-iter count, small",,
EXP45-C,367,sqlite,ext/fts5/fts5_index.c,3903,TP,"intentional assignment-in-condition idiom: if((iEq = fts5MultiIterDoCompare(pIter,iIter))); literal EXP45 violation",,
DCL13-C,368,sqlite,ext/fts5/fts5_index.c,3937,FP,fts5MultiIterNew stores pNew->pColset=pColset; pColset escapes into non-const Fts5Iter.pColset field,,
INT13-C,369,sqlite,ext/fts5/fts5_index.c,3956,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT32-C,370,sqlite,ext/fts5/fts5_index.c,3956,FP,nSeg += boolean(hash present): adds 0 or 1 to bounded segment count,,
ARR00-C,371,sqlite,ext/fts5/fts5_index.c,3958,FP,"iLevel indexes pStruct->aLevel[]; bounded by nLevel via MIN/caller, internal invariant",,
INT13-C,372,sqlite,ext/fts5/fts5_index.c,3966,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,373,sqlite,ext/fts5/fts5_index.c,3967,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,374,sqlite,ext/fts5/fts5_index.c,3969,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,375,sqlite,ext/fts5/fts5_index.c,3977,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
ARR37-C,376,sqlite,ext/fts5/fts5_index.c,3982,FP,pLvl++ bounded by pLvl<pEnd=&aLevel[nLevel]; classic in-bounds iteration,,
ARR00-C,377,sqlite,ext/fts5/fts5_index.c,3983,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,378,sqlite,ext/fts5/fts5_index.c,3983,FP,pLvl->nSeg-1: segment count index,,
ARR00-C,379,sqlite,ext/fts5/fts5_index.c,3994,FP,"iLevel indexes pStruct->aLevel[]; bounded by nLevel via MIN/caller, internal invariant",,
INT32-C,380,sqlite,ext/fts5/fts5_index.c,3995,FP,nSeg-1: segment-iter count index,,
DCL30-C,381,sqlite,ext/fts5/fts5_index.c,4051,FP,pNew is heap-allocated iterator; *ppOut=pNew stores valid heap address,,
DCL13-C,382,sqlite,ext/fts5/fts5_index.c,4061,TP,fts5MultiIterEof reads p->rc only; never written,,
EXP34-C,383,sqlite,ext/fts5/fts5_index.c,4064,FP,fts5MultiIterEof derefs pIter inside (p->rc!=OK || ...); short-circuits when rc set (pIter NULL implies rc!=OK),,
DCL13-C,384,sqlite,ext/fts5/fts5_index.c,4074,TP,fts5MultiIterRowid returns pIter->aSeg[].iRowid only; read-only,,
EXP34-C,385,sqlite,ext/fts5/fts5_index.c,4075,FP,fts5MultiIterRowid derefs pIter->aSeg with assert; callers gate on !fts5MultiIterEof,,
EXP34-C,386,sqlite,ext/fts5/fts5_index.c,4092,FP,fts5MultiIterNextFrom derefs pIter->bRev after eof check; caller-owned iterator,,
DCL13-C,387,sqlite,ext/fts5/fts5_index.c,4101,TP,fts5MultiIterTerm reads pIter->aSeg[].term only; never written,,
EXP34-C,388,sqlite,ext/fts5/fts5_index.c,4102,FP,fts5MultiIterTerm derefs pIter->aSeg; caller-owned iterator pointing at a valid entry,,
DCL13-C,389,sqlite,ext/fts5/fts5_index.c,4116,TP,fts5AllocateSegid reads pStruct->nSegment/nLevel/aLevel[].aSeg[].iSegid only; never written,,
ENV01-C,390,sqlite,ext/fts5/fts5_index.c,4125,FP,aUsed[] sized by compile-time constant FTS5_MAX_SEGMENT; unrelated to environment variables,,
MEM05-C,391,sqlite,ext/fts5/fts5_index.c,4125,FP,"aUsed[] size is compile-time constant, not a VLA or runtime allocation",,
ARR00-C,392,sqlite,ext/fts5/fts5_index.c,4130,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,393,sqlite,ext/fts5/fts5_index.c,4131,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT10-C,394,sqlite,ext/fts5/fts5_index.c,4134,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT14-C,395,sqlite,ext/fts5/fts5_index.c,4134,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT13-C,396,sqlite,ext/fts5/fts5_index.c,4141,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT14-C,397,sqlite,ext/fts5/fts5_index.c,4141,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,398,sqlite,ext/fts5/fts5_index.c,4142,FP,iSegid += 1 + i*32: i indexes aUsed[] (<=63 elems); result bounded <=FTS5_MAX_SEGMENT,,
EXP33-C,399,sqlite,ext/fts5/fts5_index.c,4146,FP,iSeg is the for-loop init variable (for(iSeg=0;...)) inside SQLITE_DEBUG block; always initialized,,
ARR37-C,400,sqlite,ext/fts5/fts5_index.c,4194,FP,pOld[i] for i<nOld; nOld is pOld buffer length; in-bounds,,
DCL13-C,401,sqlite,ext/fts5/fts5_index.c,4201,FP,"fts5WriteDlidxClear writes through pWriter: pDlidx=&pWriter->aDlidx[i] then pDlidx->bPrevValid=0, buf zeroed",,
INT30-C,402,sqlite,ext/fts5/fts5_index.c,4232,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT30-C,403,sqlite,ext/fts5/fts5_index.c,4237,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,404,sqlite,ext/fts5/fts5_index.c,4237,FP,nLvl - pWriter->nDlidx: writer-side dlidx level counts (in-memory),,
ARR38-C,405,sqlite,ext/fts5/fts5_index.c,4238,FP,memset zeroes aDlidx[nDlidx..nLvl) within realloc64'd aDlidx of nLvl writers,,
INT14-C,406,sqlite,ext/fts5/fts5_index.c,4287,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,407,sqlite,ext/fts5/fts5_index.c,4287,FP,"bFlag + (iBtPage<<1): writer page number, in-memory, i64 expression",,
INT32-C,408,sqlite,ext/fts5/fts5_index.c,4333,FP,pWriter->nEmpty++: writer empty-page counter,,
EXP33-C,409,sqlite,ext/fts5/fts5_index.c,4342,FP,iRowid written via &iRowid by fts5GetVarint at 4340/4341 before return,,
INT32-C,410,sqlite,ext/fts5/fts5_index.c,4373,FP,i+2: writer pgidx loop index,,
ARR00-C,411,sqlite,ext/fts5/fts5_index.c,4397,FP,pDlidx[-1] selected only when i!=0 via ternary (i==0 ? ... : pDlidx[-1]),,
ARR02-C,412,sqlite,ext/fts5/fts5_index.c,4411,FP,"zero[]={0,0,0,0} has explicit initializer; size fully determined (4); style-only, no OOB",,
INT32-C,413,sqlite,ext/fts5/fts5_index.c,4439,FP,pPage->pgno++: writer page number counter,,
INT32-C,414,sqlite,ext/fts5/fts5_index.c,4442,FP,pWriter->nLeafWritten++: writer leaf counter,,
INT32-C,415,sqlite,ext/fts5/fts5_index.c,4480,FP,"pPgidx->n += PutVarint(...): writer pgidx buffer length, in-memory bounded by pgsz",,
INT32-C,416,sqlite,ext/fts5/fts5_index.c,4481,FP,"pPage->buf.n - pPage->iPrevPgidx: writer page buffer offsets, monotonic in-memory",,
INT32-C,417,sqlite,ext/fts5/fts5_index.c,4486,FP,pPgidx->n += 2: writer buffer length (dead #if 0 branch),,
INT32-C,418,sqlite,ext/fts5/fts5_index.c,4520,FP,"nTerm - nPrefix: nPrefix=fts5PrefixCompress<=nMin<=nTerm, writer side",,
INT32-C,419,sqlite,ext/fts5/fts5_index.c,4521,FP,"nTerm - nPrefix: same, non-negative writer-side prefix",,
INT32-C,420,sqlite,ext/fts5/fts5_index.c,4586,FP,"pgsz - pPage->buf.n - pPage->pgidx.n: writer page residual, in-memory bounded by pgsz",,
INT32-C,421,sqlite,ext/fts5/fts5_index.c,4594,FP,"n -= nCopy: writer remaining bytes, nCopy<=n by loop",,
INT32-C,422,sqlite,ext/fts5/fts5_index.c,4618,FP,pLeaf->pgno-1: writer final leaf page count,,
DCL13-C,423,sqlite,ext/fts5/fts5_index.c,4681,FP,fts5TrimSegments writes through pIter: pSeg=&pIter->aSeg[i] then pSeg->pSeg->pgnoFirst/pgnoLast assigned,,
EXP34-C,424,sqlite,ext/fts5/fts5_index.c,4685,FP,fts5TrimSegments derefs pIter->nSeg; called at 4904 in else branch where iterator is valid,,
INT32-C,425,sqlite,ext/fts5/fts5_index.c,4717,FP,pData->szLeaf-iOff: iOff validated <=szLeaf at line 4705 (corrupt otherwise),,
INT32-C,426,sqlite,ext/fts5/fts5_index.c,4729,FP,pData->szLeaf - pSeg->iEndofDoclist: guarded iEndofDoclist<szLeaf at 4726,,
INT32-C,427,sqlite,ext/fts5/fts5_index.c,4730,FP,"buf.n-1-nDiff-4: nDiff>=0 (iEndofDoclist<szLeaf), buf.n bounded by page build",,
INT32-C,428,sqlite,ext/fts5/fts5_index.c,4732,FP,pData->nn - pSeg->iPgidxOff: guarded iPgidxOff<=nn at 4727,,
ARR00-C,429,sqlite,ext/fts5/fts5_index.c,4766,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
EXP34-C,430,sqlite,ext/fts5/fts5_index.c,4766,FP,pStruct=*ppStruct deref in fts5IndexMergeLevel; caller fts5IndexMerge passes a live structure,,
INT32-C,431,sqlite,ext/fts5/fts5_index.c,4785,FP,"iLvl+1: output level index in merge, bounded by nLevel",,
INT32-C,432,sqlite,ext/fts5/fts5_index.c,4788,FP,pLvlOut->nSeg-1: output segment count index,,
INT32-C,433,sqlite,ext/fts5/fts5_index.c,4791,FP,pSeg->pgnoLast+1: writer next-page init from prior output segment (in-memory),,
INT32-C,434,sqlite,ext/fts5/fts5_index.c,4802,FP,iLvl+1: merge output level index,,
ARR00-C,435,sqlite,ext/fts5/fts5_index.c,4804,FP,"iLvl indexes aLevel[]/aLvl[]; internal structure/dlidx level index bounded by nLevel, caller passes loop-bounded value",,
INT32-C,436,sqlite,ext/fts5/fts5_index.c,4805,FP,iLvl+1: merge output level index,,
INT32-C,437,sqlite,ext/fts5/fts5_index.c,4811,FP,"pLvlOut->nSeg++: output segment count, bounded by structure",,
INT32-C,438,sqlite,ext/fts5/fts5_index.c,4814,FP,"pStruct->nSegment++: total segment count, bounded by FTS5_MAX_SEGMENT",,
INT32-C,439,sqlite,ext/fts5/fts5_index.c,4822,FP,pLvl->nSeg-1: input segment count index,,
EXP34-C,440,sqlite,ext/fts5/fts5_index.c,4830,FP,fts5MultiIterNext(pIter): loop body only entered when fts5MultiIterEof==0; eof short-circuits on rc so pIter non-null here,,
EXP34-C,441,sqlite,ext/fts5/fts5_index.c,4832,FP,"pIter->aSeg in merge loop; reached only when eof==0 (rc==OK), and MultiIterNew post-check ties non-null to rc==OK",,
EXP34-C,442,sqlite,ext/fts5/fts5_index.c,4837,FP,fts5MultiIterTerm(pIter) in merge loop body; pIter non-null on the rc==OK path,,
EXP34-C,443,sqlite,ext/fts5/fts5_index.c,4857,FP,fts5MultiIterRowid(pIter) in merge loop body; pIter non-null on the rc==OK path,,
INT30-C,444,sqlite,ext/fts5/fts5_index.c,4892,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,445,sqlite,ext/fts5/fts5_index.c,4892,FP,"pLvl->nSeg - nInput: nInput=nMerge<=nSeg (asserted), in-memory counts",,
INT31-C,446,sqlite,ext/fts5/fts5_index.c,4893,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,447,sqlite,ext/fts5/fts5_index.c,4895,FP,pStruct->nSegment -= nInput: in-memory segment counts,,
INT32-C,448,sqlite,ext/fts5/fts5_index.c,4896,FP,pLvl->nSeg -= nInput: in-memory segment counts,,
INT32-C,449,sqlite,ext/fts5/fts5_index.c,4899,FP,pLvlOut->nSeg--: output segment count,,
INT32-C,450,sqlite,ext/fts5/fts5_index.c,4900,FP,pStruct->nSegment--: total segment count,,
EXP34-C,451,sqlite,ext/fts5/fts5_index.c,4904,FP,"fts5TrimSegments(p,pIter) in else of eof; assert(pIter!=0||p->rc!=OK) and pIter valid here",,
EXP34-C,452,sqlite,ext/fts5/fts5_index.c,4908,FP,fts5MultiIterFree(pIter) tolerates NULL (if(pIter) guard at 3199),,
DCL13-C,453,sqlite,ext/fts5/fts5_index.c,4921,TP,fts5IndexFindDeleteMerge: flagged param p reads p->pConfig only; never written (pStruct also read-only),,
ARR00-C,454,sqlite,ext/fts5/fts5_index.c,4928,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,455,sqlite,ext/fts5/fts5_index.c,4933,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP34-C,456,sqlite,ext/fts5/fts5_index.c,4976,FP,"pStruct->nLevel in fts5IndexMerge; pStruct=*ppStruct from caller, assert(nLevel>0)",,
ARR00-C,457,sqlite,ext/fts5/fts5_index.c,4977,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
DCL30-C,458,sqlite,ext/fts5/fts5_index.c,5004,FP,pStruct is heap structure object; *ppStruct=pStruct stores heap address,,
INT33-C,459,sqlite,ext/fts5/fts5_index.c,5029,FP,p->nWorkUnit set unconditionally to constant FTS5_WORK_UNIT (nonzero),,
INT32-C,460,sqlite,ext/fts5/fts5_index.c,5031,FP,"nWorkUnit*nWork*nLevel: nWorkUnit config const, nWork bounded by write delta, nLevel<=2000",,
INT32-C,461,sqlite,ext/fts5/fts5_index.c,5048,FP,iLvl+1: crisis-merge level index,,
INT32-C,462,sqlite,ext/fts5/fts5_index.c,5049,FP,iLvl++: crisis-merge level index bounded by nLevel,,
DCL30-C,463,sqlite,ext/fts5/fts5_index.c,5051,FP,pStruct is heap structure object; *ppStruct=pStruct stores heap address,,
API00-C,464,sqlite,ext/fts5/fts5_index.c,5064,FP,"sqlite3Fts5IndexCloseReader: p is internal Fts5Index handle, p->rc error model via fts5IndexReturn; caller-guaranteed",,
EXP33-C,465,sqlite,ext/fts5/fts5_index.c,5083,FP,dummy written via &dummy by fts5GetVarint32 macro at 5083 (and reused as scratch); analyzer misses macro write,,
INT32-C,466,sqlite,ext/fts5/fts5_index.c,5088,FP,"ret+i: varint-size accumulation, both bounded by nMax",,
DCL13-C,467,sqlite,ext/fts5/fts5_index.c,5139,TP,"fts5SecureDeleteOverflow reads pSeg->pgnoLast/iSegid only; never written, not stored",,
ARR02-C,468,sqlite,ext/fts5/fts5_index.c,5169,FP,"aEmpty[]={0,0,0,4} has explicit initializer; size determined (4); style-only, no OOB",,
INT32-C,469,sqlite,ext/fts5/fts5_index.c,5195,FP,i1=pLeaf->szLeaf (u16 page offset <=64KB) plus 1-9 byte varint return; no 32-bit overflow,,
INT32-C,470,sqlite,ext/fts5/fts5_index.c,5200,FP,"pLeaf->nn-pLeaf->szLeaf both u16 page sizes; result <=64KB, malloc size cannot overflow int",,
ARR00-C,471,sqlite,ext/fts5/fts5_index.c,5202,FP,"scalar offset arithmetic (iFirst-nShift / iNextOff-iOff) within a single leaf buffer, mis-flagged as cross-array pointer subtraction; rebuild path guarded by FTS5_CORRUPT on bad varints",,
INT31-C,472,sqlite,ext/fts5/fts5_index.c,5204,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,473,sqlite,ext/fts5/fts5_index.c,5204,FP,"memcpy size pLeaf->nn-i1; i1>=szLeaf and i1<nn guarded at 5203, both u16 page offsets",,
INT32-C,474,sqlite,ext/fts5/fts5_index.c,5205,FP,i2 accumulates within <=64KB footer buffer; bounded by page size,,
INT32-C,475,sqlite,ext/fts5/fts5_index.c,5212,FP,"szLeaf-nShift; nShift=iNext-4 and iNext<szLeaf guarded at 5176, all u16 page offsets",,
INT31-C,476,sqlite,ext/fts5/fts5_index.c,5213,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,477,sqlite,ext/fts5/fts5_index.c,5213,FP,nPg-4; nPg=szLeaf-nShift bounded by page size (u16),,
INT32-C,478,sqlite,ext/fts5/fts5_index.c,5218,FP,nPg+=nIdx; both bounded by page size <=64KB,,
INT32-C,479,sqlite,ext/fts5/fts5_index.c,5255,FP,"nPg-iPgIdx = nn-szLeaf, both u16 page sizes",,
INT32-C,480,sqlite,ext/fts5/fts5_index.c,5256,FP,((i64)nIdx)+16 already widened to i64; nIdx<=64KB,,
INT31-C,481,sqlite,ext/fts5/fts5_index.c,5258,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,482,sqlite,ext/fts5/fts5_index.c,5298,FP,"iStart is a u16 page offset (<64KB) from fts5GetU16; cannot 32-bit overflow (the real risk would be an OOB read, not signed overflow)",,
INT32-C,483,sqlite,ext/fts5/fts5_index.c,5306,FP,iStart=iSOP bounded by loop cond iSOP<pSeg->iLeafOffset (page offset); +varint <=64KB,,
INT32-C,484,sqlite,ext/fts5/fts5_index.c,5310,FP,"iNextOff page offset bounded by iEndofDoclist; <=64KB, no INT_MAX risk",,
INT32-C,485,sqlite,ext/fts5/fts5_index.c,5311,FP,iNextOff page offset bounded by iEndofDoclist; <=64KB,,
INT32-C,486,sqlite,ext/fts5/fts5_index.c,5315,FP,iSOP page offset + varint return; bounded by page size,,
INT32-C,487,sqlite,ext/fts5/fts5_index.c,5317,FP,iSOP+(nPos/2); iSOP page offset and loop bounded by iLeafOffset; nPos read from page but values <=64KB,,
INT32-C,488,sqlite,ext/fts5/fts5_index.c,5318,FP,iStart page offset + varint return; bounded by page size,,
INT32-C,489,sqlite,ext/fts5/fts5_index.c,5322,FP,iSOP+pSeg->nPos; both within-page quantities <=64KB,,
INT32-C,490,sqlite,ext/fts5/fts5_index.c,5335,FP,pSeg->iLeafPgno+1; bounded internal page number (segment page count),,
INT32-C,491,sqlite,ext/fts5/fts5_index.c,5350,FP,iKeyOff+=iVal; footer key offsets bounded by page size <=64KB,,
INT32-C,492,sqlite,ext/fts5/fts5_index.c,5366,FP,iOff+=PutVarint return(<=9); iOff page offset bounded by page,,
INT32-C,493,sqlite,ext/fts5/fts5_index.c,5367,FP,iOff++ page offset within <=64KB page,,
INT32-C,494,sqlite,ext/fts5/fts5_index.c,5371,FP,iNextOff+=varint return; page offset bounded by page size,,
INT32-C,495,sqlite,ext/fts5/fts5_index.c,5372,FP,iOff+=PutVarint return(<=9); bounded page offset,,
INT32-C,496,sqlite,ext/fts5/fts5_index.c,5389,FP,iKeyOff+=iVal footer offsets bounded by page; guarded by (iKeyOff+iVal)>(u32)iStart break at 5388,,
INT32-C,497,sqlite,ext/fts5/fts5_index.c,5408,FP,iNextOff+=varint; page offset; followed by FTS5_CORRUPT_IDX bound check at 5419,,
INT32-C,498,sqlite,ext/fts5/fts5_index.c,5409,FP,iNextOff+=varint; page offset bounded by page; checked at 5419,,
INT32-C,499,sqlite,ext/fts5/fts5_index.c,5412,FP,iKeyOff+=varint; footer offset bounded by page,,
INT32-C,500,sqlite,ext/fts5/fts5_index.c,5414,FP,iKeyOff+=varint; footer offset bounded by page,,
INT32-C,501,sqlite,ext/fts5/fts5_index.c,5423,FP,iOff+=PutVarint return(<=9); bounded page offset,,
INT32-C,502,sqlite,ext/fts5/fts5_index.c,5425,FP,iOff+=PutVarint return(<=9); bounded page offset,,
INT32-C,503,sqlite,ext/fts5/fts5_index.c,5429,FP,memcpy size nPrefix2-nPrefix; guarded nPrefix2>nPrefix at 5428 and nPrefix2>term.n -> CORRUPT at 5426; bounded,,
INT32-C,504,sqlite,ext/fts5/fts5_index.c,5430,FP,"iOff+=(nPrefix2-nPrefix); guarded as above, bounded",,
INT32-C,505,sqlite,ext/fts5/fts5_index.c,5433,FP,iOff+=nSuffix2; nSuffix2 guarded (iNextOff+nSuffix2)>iPgIdx -> CORRUPT at 5419,,
INT32-C,506,sqlite,ext/fts5/fts5_index.c,5434,FP,"iNextOff+=nSuffix2; same guard at 5419, bounded by page",,
INT32-C,507,sqlite,ext/fts5/fts5_index.c,5443,FP,"pSeg->iLeafPgno-1; bounded internal page number, loop guard iPgno>iTermLeafPgno",,
INT32-C,508,sqlite,ext/fts5/fts5_index.c,5455,FP,pTerm->nn-pTerm->szLeaf both u16 page sizes,,
ARR37-C,509,sqlite,ext/fts5/fts5_index.c,5461,FP,aTermIdx=&p[szLeaf]; iTermIdx kept <nTermIdx=nn-szLeaf by guard; within padded blob buffer,,
INT32-C,510,sqlite,ext/fts5/fts5_index.c,5464,FP,iTermIdx+=nByte; footer offset bounded by nTermIdx (page size); loop break at 5463,,
INT31-C,511,sqlite,ext/fts5/fts5_index.c,5471,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,512,sqlite,ext/fts5/fts5_index.c,5493,FP,nPg-iNextOff both page offsets <=64KB,,
ARR00-C,513,sqlite,ext/fts5/fts5_index.c,5494,FP,"scalar offset arithmetic (iFirst-nShift / iNextOff-iOff) within a single leaf buffer, mis-flagged as cross-array pointer subtraction; rebuild path guarded by FTS5_CORRUPT on bad varints",,
ARR36-C,514,sqlite,ext/fts5/fts5_index.c,5494,FP,"nShift=iNextOff-iOff subtracts two int offsets, not pointers; misclassification",,
INT32-C,515,sqlite,ext/fts5/fts5_index.c,5494,FP,iNextOff-iOff both page offsets <=64KB,,
EXP05-C,516,sqlite,ext/fts5/fts5_index.c,5500,FP,"nMove is a const int value (size arg to memmove), not a const-pointer cast-away; finding misidentifies it",,
INT32-C,517,sqlite,ext/fts5/fts5_index.c,5502,FP,iPgIdx-=nShift; both page offsets bounded by page size,,
INT32-C,518,sqlite,ext/fts5/fts5_index.c,5509,FP,iKeyIn+=iVal; footer offsets bounded by page,,
INT32-C,519,sqlite,ext/fts5/fts5_index.c,5511,FP,iKeyIn-(nShift); page offset arithmetic bounded by page,,
INT32-C,520,sqlite,ext/fts5/fts5_index.c,5512,FP,nPg+=PutVarint return(<=9); page offset bounded by page,,
EXP34-C,521,sqlite,ext/fts5/fts5_index.c,5555,FP,"sqlite3_step(pStmt) inside if(p->rc==OK); prepare leaves rc set + pStmt=0 on failure, so pStmt non-null when rc==OK",,
INT32-C,522,sqlite,ext/fts5/fts5_index.c,5558,FP,"pConfig->iCookie++ internal schema-cookie counter, not attacker size arithmetic",,
EXP34-C,523,sqlite,ext/fts5/fts5_index.c,5565,FP,"fts5MultiIterRowid(pIter) inside if(fts5MultiIterEof==0); eof short-circuits on rc, pIter non-null",,
EXP34-C,524,sqlite,ext/fts5/fts5_index.c,5567,FP,fts5MultiIterNextFrom(pIter) inside eof==0 block; pIter non-null on rc==OK path,,
EXP34-C,525,sqlite,ext/fts5/fts5_index.c,5572,FP,fts5MultiIterRowid(pIter) guarded by p->rc==OK && eof==0; pIter non-null,,
EXP34-C,526,sqlite,ext/fts5/fts5_index.c,5574,FP,pIter->aSeg under p->rc==OK && eof==0; pIter non-null,,
EXP34-C,527,sqlite,ext/fts5/fts5_index.c,5579,FP,fts5MultiIterFree(pIter) tolerates NULL,,
ARR30-C,528,sqlite,ext/fts5/fts5_index.c,5644,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
EXP34-C,529,sqlite,ext/fts5/fts5_index.c,5656,FP,pDoclist[iOff] from sqlite3Fts5HashScanEntry; non-null doclist pointer while iterating hash entries,,
INT14-C,530,sqlite,ext/fts5/fts5_index.c,5656,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,531,sqlite,ext/fts5/fts5_index.c,5693,FP,pBuf->n+=PutVarint return; output leaf buffer offset bounded by pgsz (preallocated nSpace),,
INT32-C,532,sqlite,ext/fts5/fts5_index.c,5698,FP,pBuf->n+=PutVarint return; bounded by pgsz output buffer,,
INT32-C,533,sqlite,ext/fts5/fts5_index.c,5706,FP,pBuf->n++ output buffer offset bounded by pgsz,,
INT32-C,534,sqlite,ext/fts5/fts5_index.c,5709,FP,pBuf->n++ output buffer offset bounded by pgsz,,
INT32-C,535,sqlite,ext/fts5/fts5_index.c,5725,FP,"nCopy+=nPos; doclist sizes from in-memory hash being flushed, bounded by pending data",,
ARR30-C,536,sqlite,ext/fts5/fts5_index.c,5730,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,537,sqlite,ext/fts5/fts5_index.c,5738,FP,pgsz-pBuf->n-pPgidx->n all bounded by pgsz config value,,
INT32-C,538,sqlite,ext/fts5/fts5_index.c,5741,FP,nCopy-iPos both bounded by poslist size within page,,
ARR37-C,539,sqlite,ext/fts5/fts5_index.c,5743,FP,"pPoslist=&pDoclist[iOff]; iPos in [0,nCopy) bounded by iPos>=nCopy break; in-bounds",,
ARR30-C,540,sqlite,ext/fts5/fts5_index.c,5746,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR37-C,541,sqlite,ext/fts5/fts5_index.c,5746,FP,pPoslist[iPos] appended with iPos<nCopy; within doclist buffer,,
INT32-C,542,sqlite,ext/fts5/fts5_index.c,5747,FP,"iPos+=n; n=fts5PoslistPrefix(...,nSpace) bounded by nSpace<=pgsz",,
EXP34-C,543,sqlite,ext/fts5/fts5_index.c,5770,FP,"pStruct->nLevel under if(iSegid) under if(HashNotEmpty); iSegid==0 when rc!=OK and pStruct NULL implies rc!=OK, so unreachable with NULL",,
INT32-C,544,sqlite,ext/fts5/fts5_index.c,5785,FP,pStruct->nSegment++ internal segment counter bounded by FTS5 structure limits,,
INT32-C,545,sqlite,ext/fts5/fts5_index.c,5792,FP,"pgnoLast+p->nContentlessDelete; internal page count + delete counter, not blob arithmetic",,
EXP34-C,546,sqlite,ext/fts5/fts5_index.c,5827,FP,fts5IndexOptimizeStruct derefs pStruct param; caller guards with if(pStruct) at 5901,,
INT30-C,547,sqlite,ext/fts5/fts5_index.c,5855,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,548,sqlite,ext/fts5/fts5_index.c,5855,FP,nByte already i64; nLevel<=FTS5_MAX_LEVEL bounded; structure level count,,
INT30-C,549,sqlite,ext/fts5/fts5_index.c,5861,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,550,sqlite,ext/fts5/fts5_index.c,5862,FP,pStruct->nLevel+1 then MIN with FTS5_MAX_LEVEL; bounded structure level,,
INT32-C,551,sqlite,ext/fts5/fts5_index.c,5866,FP,"pNew->nLevel-1; nLevel>=1 (MIN with FTS5_MAX_LEVEL), bounded",,
ARR00-C,552,sqlite,ext/fts5/fts5_index.c,5874,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,553,sqlite,ext/fts5/fts5_index.c,5874,FP,pStruct->nLevel-1 loop bound; nLevel bounded by FTS5_MAX_LEVEL,,
ARR00-C,554,sqlite,ext/fts5/fts5_index.c,5875,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
API00-C,555,sqlite,ext/fts5/fts5_index.c,5890,FP,"sqlite3Fts5IndexOptimize: internal Fts5Index handle, entry assert(p->rc==SQLITE_OK), p->rc model; not untrusted input",,
API00-C,556,sqlite,ext/fts5/fts5_index.c,5926,FP,"sqlite3Fts5IndexMerge: internal Fts5Index handle, p->rc error model; caller-guaranteed non-NULL",,
INT32-C,557,sqlite,ext/fts5/fts5_index.c,5939,FP,"nMerge*-1; SMALLEST_INT32 case explicitly handled at 5939, nMerge is user merge-count arg not blob",,
DCL13-C,558,sqlite,ext/fts5/fts5_index.c,5964,FP,"fts5AppendPoslist reads pMulti only but signature fixed by xAppend typedef void(*)(Fts5Index*,u64,Fts5Iter*,Fts5Buffer*)",,
INT32-C,559,sqlite,ext/fts5/fts5_index.c,5968,FP,nData+9+9+pad; nData=pMulti->base.nData a single poslist size bounded by page,,
ARR30-C,560,sqlite,ext/fts5/fts5_index.c,5971,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,561,sqlite,ext/fts5/fts5_index.c,5972,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,562,sqlite,ext/fts5/fts5_index.c,5972,FP,nData*2 poslist-size varint; nData a single within-page poslist size <=64KB,,
ARR30-C,563,sqlite,ext/fts5/fts5_index.c,5973,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT14-C,564,sqlite,ext/fts5/fts5_index.c,5988,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
EXP33-C,565,sqlite,ext/fts5/fts5_index.c,5989,FP,iDelta written via &iDelta by fts5GetVarint at 5988 before use,,
EXP33-C,566,sqlite,ext/fts5/fts5_index.c,5994,FP,nPos written by fts5GetVarint32 macro at 5994 before use,,
INT13-C,567,sqlite,ext/fts5/fts5_index.c,5995,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL13-C,568,sqlite,ext/fts5/fts5_index.c,6009,TP,"fts5DoclistIterInit reads pBuf->n/pBuf->p only (pIter is mutated); plain static, pBuf const-able",,
ARR01-C,569,sqlite,ext/fts5/fts5_index.c,6012,FP,sizeof(*pIter) is pointee size (correct idiom); misclassification,,
EXP34-C,570,sqlite,ext/fts5/fts5_index.c,6032,FP,piLastRowid deref is inside #if 0 (dead code); not compiled,,
ARR30-C,571,sqlite,ext/fts5/fts5_index.c,6033,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
PRE00-C,572,sqlite,ext/fts5/fts5_index.c,6038,TP,fts5MergeAppendDocid evaluates pBuf/iRowid/iLastRowid multiple times; side-effecting args hazard,,
PRE02-C,573,sqlite,ext/fts5/fts5_index.c,6038,FP,macro body is a statement block; replacement-list parenthesization not applicable,,
PRE10-C,574,sqlite,ext/fts5/fts5_index.c,6038,TP,multi-statement brace block not wrapped in do-while,,
PRE12-C,575,sqlite,ext/fts5/fts5_index.c,6038,TP,pBuf evaluated multiple times (and iLastRowid read then assigned),,
MEM33-C,576,sqlite,ext/fts5/fts5_index.c,6049,FP,"Fts5Buffer has a u8* pointer member, not a flexible array; struct assignment is valid",,
INT32-C,577,sqlite,ext/fts5/fts5_index.c,6059,FP,i+varint return; i bounded by pBuf->n (in-memory rowid-list buffer),,
DCL13-C,578,sqlite,ext/fts5/fts5_index.c,6072,FP,fts5MergeRowidLists passes &aBuf[0] to non-const fts5NextRowid and signature fixed by xMerge typedef,,
INT32-C,579,sqlite,ext/fts5/fts5_index.c,6085,FP,"p1->n+p2->n; in-memory doclist buffer sizes from this query's own merge, bounded",,
ARR30-C,580,sqlite,ext/fts5/fts5_index.c,6093,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,581,sqlite,ext/fts5/fts5_index.c,6098,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
EXP34-C,582,sqlite,ext/fts5/fts5_index.c,6124,FP,"fts5PrefixMergerInsertByRowid derefs p->iter; p is &aMerger[i] stack element, non-null",,
EXP34-C,583,sqlite,ext/fts5/fts5_index.c,6138,FP,"fts5PrefixMergerInsertByPosition derefs p->iPos; p is &aMerger[i] stack element, non-null",,
PRE00-C,584,sqlite,ext/fts5/fts5_index.c,6159,FP,"fts5PrefixMergerNextPosition: p is parenthesized pure pointer, multiple member reads have no side effects",,
PRE12-C,585,sqlite,ext/fts5/fts5_index.c,6159,FP,p parenthesized side-effect-free pointer; multiple eval harmless,,
EXP33-C,586,sqlite,ext/fts5/fts5_index.c,6173,FP,"aMerger appears only inside sizeof(aMerger) in the assert at 6173; no element read, and memset zeroes it at 6174 before use",,
ARR38-C,587,sqlite,ext/fts5/fts5_index.c,6174,FP,memset aMerger size (nBuf+1) guarded by preceding assert nBuf+1<=array len; in-bounds,,
INT30-C,588,sqlite,ext/fts5/fts5_index.c,6174,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,589,sqlite,ext/fts5/fts5_index.c,6174,FP,"memset sizeof(PrefixMerger)*(nBuf+1); nBuf<=FTS5_MERGE_NLIST-1=15, asserted at 6173",,
ARR00-C,590,sqlite,ext/fts5/fts5_index.c,6175,FP,"aMerger[nBuf]: aMerger is fixed PrefixMerger[16]; nBuf is prefix-count bounded, asserted nBuf+1<=array size, memset sized to nBuf+1",,
ARR30-C,591,sqlite,ext/fts5/fts5_index.c,6175,FP,"aMerger[nBuf]: aMerger is fixed PrefixMerger[16]; nBuf is prefix-count bounded, asserted nBuf+1<=array size, memset sized to nBuf+1",,
ARR00-C,592,sqlite,ext/fts5/fts5_index.c,6178,FP,aMerger[] is memset to 0 over (nBuf+1) elements immediately before use (line ~6174); not uninitialized; index bounded by nBuf+1<=FTS5_MERGE_NLIST(16),,
ARR00-C,593,sqlite,ext/fts5/fts5_index.c,6179,FP,aMerger[] is memset to 0 over (nBuf+1) elements immediately before use (line ~6174); not uninitialized; index bounded by nBuf+1<=FTS5_MERGE_NLIST(16),,
INT32-C,594,sqlite,ext/fts5/fts5_index.c,6180,FP,"nOut+=aBuf[i].n; aBuf are this query's own merge buffers, bounded",,
INT32-C,595,sqlite,ext/fts5/fts5_index.c,6183,FP,"nOut+=p1->n+9+10*nBuf; nBuf<=15, buffer sizes bounded by accumulated query data",,
INT32-C,596,sqlite,ext/fts5/fts5_index.c,6218,FP,nTmp+=nPoslist+10; poslist sizes summed across <=15 inputs; bounded by accumulated data,,
INT32-C,597,sqlite,ext/fts5/fts5_index.c,6219,FP,nMerge++ bounded by number of input lists (<=nBuf+1<=16),,
INT32-C,598,sqlite,ext/fts5/fts5_index.c,6232,FP,"nTmp+nMerge*10; nMerge<=16, nTmp bounded by summed poslists",,
INT32-C,599,sqlite,ext/fts5/fts5_index.c,6256,FP,nPoslist-iOff both within-poslist offsets bounded by page-derived sizes,,
ARR30-C,600,sqlite,ext/fts5/fts5_index.c,6265,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,601,sqlite,ext/fts5/fts5_index.c,6265,FP,"(tmp.n+nTail)*2 poslist-size varint; guarded tmp.n+nTail<=nTmp at 6261 CORRUPT check, bounded",,
ARR30-C,602,sqlite,ext/fts5/fts5_index.c,6266,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR30-C,603,sqlite,ext/fts5/fts5_index.c,6268,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
ARR00-C,604,sqlite,ext/fts5/fts5_index.c,6273,FP,aMerger[] is memset to 0 over (nBuf+1) elements immediately before use (line ~6174); not uninitialized; index bounded by nBuf+1<=FTS5_MERGE_NLIST(16),,
DCL00-C,605,sqlite,ext/fts5/fts5_index.c,6283,FP,pI=&pThis->iter is used to mutate the target via fts5DoclistIterNext(pI); const would be wrong,,
DCL02-C,606,sqlite,ext/fts5/fts5_index.c,6283,FP,"'pI' vs 'p1' are distinct identifiers in different scopes; cosmetic similarity heuristic, no defect",,
ARR30-C,607,sqlite,ext/fts5/fts5_index.c,6284,FP,"fts5BufferSafeAppend* writes into a Fts5Buffer pre-sized by the caller (fts5BufferGrow/BufferSize); space-assert is debug-only, idiomatic caller-reserved write, not a blob-indexed read",,
INT32-C,608,sqlite,ext/fts5/fts5_index.c,6284,FP,"pI->nPoslist+pI->nSize; doclist-iter fields from this query's buffers, bounded by page",,
MEM30-C,609,sqlite,ext/fts5/fts5_index.c,6294,FP,fts5BufferFree(p1) frees p1->p (buffer bytes) not the struct; *p1=out reassigns buffer contents,,
EXP34-C,610,sqlite,ext/fts5/fts5_index.c,6347,FP,"fts5MultiIterNext2(p1) in fts5VisitEntries loop; body only on eof==0 (rc==OK), p1 non-null then",,
EXP34-C,611,sqlite,ext/fts5/fts5_index.c,6349,FP,p1->aSeg in fts5VisitEntries loop body; reached only on rc==OK path so p1 non-null,,
INT31-C,612,sqlite,ext/fts5/fts5_index.c,6359,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
DCL31-C,613,sqlite,ext/fts5/fts5_index.c,6362,FP,"xVisit is a function-pointer parameter being invoked, not an undeclared function",,
EXP34-C,614,sqlite,ext/fts5/fts5_index.c,6364,FP,fts5MultiIterFree(p1) tolerates NULL,,
DCL13-C,615,sqlite,ext/fts5/fts5_index.c,6451,FP,"fts5TokendataMerge writes through aOut (output array): pOut=&aOut[i1+i2] then memcpy(pOut,...)",,
INT32-C,616,sqlite,ext/fts5/fts5_index.c,6458,FP,"i1+i2 array index into output; bounded by n1+n2 (input map sizes), internal token-map merge",,
INT32-C,617,sqlite,ext/fts5/fts5_index.c,6486,FP,"nMapAlloc*2 token-map growth; reaching INT_MAX requires ~2^31 matched positions, impractical",,
INT30-C,618,sqlite,ext/fts5/fts5_index.c,6487,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
MEM30-C,619,sqlite,ext/fts5/fts5_index.c,6500,FP,pT->aMap reassigned to aNew after realloc before use; not the freed pointer,,
MEM30-C,620,sqlite,ext/fts5/fts5_index.c,6501,FP,"pT->aMap is the realloc'd aNew, not freed memory",,
MEM30-C,621,sqlite,ext/fts5/fts5_index.c,6502,FP,"pT->aMap is the realloc'd aNew, not freed memory",,
MEM30-C,622,sqlite,ext/fts5/fts5_index.c,6503,FP,"pT->aMap is the realloc'd aNew, not freed memory",,
INT32-C,623,sqlite,ext/fts5/fts5_index.c,6504,FP,"pT->nMap++ token-map count, bounded by total matched positions in query",,
DCL13-C,624,sqlite,ext/fts5/fts5_index.c,6514,FP,"fts5TokendataIterSortMap writes through pT: memcpy(pT->aMap, a1, ...) overwrites pT->aMap memory",,
INT30-C,625,sqlite,ext/fts5/fts5_index.c,6516,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
ARR00-C,626,sqlite,ext/fts5/fts5_index.c,6524,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,627,sqlite,ext/fts5/fts5_index.c,6526,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,628,sqlite,ext/fts5/fts5_index.c,6527,FP,pT->nMap-i1 merge-sort bound; nMap internal count,,
INT32-C,629,sqlite,ext/fts5/fts5_index.c,6528,FP,pT->nMap-i1-n1 merge-sort bound; internal counts,,
INT32-C,630,sqlite,ext/fts5/fts5_index.c,6529,FP,i1+n1 merge index; bounded by nMap,,
ARR38-C,631,sqlite,ext/fts5/fts5_index.c,6535,FP,memcpy nMap*sizeof(map) into pT->aMap allocated for nMap entries,,
EXP43-C,632,sqlite,ext/fts5/fts5_index.c,6535,FP,"memcpy(pT->aMap,a1,..) guarded by if(a1!=pT->aMap); a1 is either pT->aMap (excluded) or freshly-malloc'd aTmp, so regions never overlap",,
INT30-C,633,sqlite,ext/fts5/fts5_index.c,6535,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,634,sqlite,ext/fts5/fts5_index.c,6535,FP,"nMap*sizeof(map); copy size, nMap internal count (see 6486 for growth)",,
ARR00-C,635,sqlite,ext/fts5/fts5_index.c,6542,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,636,sqlite,ext/fts5/fts5_index.c,6543,FP,ii-1 SQLITE_DEBUG-only loop index; ii>=1,,
ARR00-C,637,sqlite,ext/fts5/fts5_index.c,6560,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
DCL13-C,638,sqlite,ext/fts5/fts5_index.c,6591,FP,prefixIterSetupTokendataCb reads p1 only but signature fixed by xVisit callback typedef passed to fts5VisitEntries,,
INT32-C,639,sqlite,ext/fts5/fts5_index.c,6600,FP,nNew-1; nNew is term length passed by visitor (term size on page <=64KB); also nNew>=1 implied,,
INT32-C,640,sqlite,ext/fts5/fts5_index.c,6602,FP,nNew-1 blob-append length; term size bounded by page,,
INT32-C,641,sqlite,ext/fts5/fts5_index.c,6647,FP,"i*nMerge buffer index; loop bounded by doclist.n drained, i*nMerge<nBuf asserted at 6649",,
ARR00-C,642,sqlite,ext/fts5/fts5_index.c,6650,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,643,sqlite,ext/fts5/fts5_index.c,6710,FP,s.nMerge*8 constant computation (15*8=120); fixed config-derived value,,
INT30-C,644,sqlite,ext/fts5/fts5_index.c,6715,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT33-C,645,sqlite,ext/fts5/fts5_index.c,6737,FP,s.nMerge=FTS5_MERGE_NLIST-1 constant in the only branch reaching this modulo,,
ARR00-C,646,sqlite,ext/fts5/fts5_index.c,6743,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP33-C,647,sqlite,ext/fts5/fts5_index.c,6748,FP,"pData is being assigned by fts5IdxMalloc at 6748, not dereferenced uninitialized; checked for NULL at 6751",,
INT30-C,648,sqlite,ext/fts5/fts5_index.c,6748,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
API00-C,649,sqlite,ext/fts5/fts5_index.c,6777,FP,"sqlite3Fts5IndexBeginWrite: internal Fts5Index handle, entry assert(p->rc==SQLITE_OK), p->rc model",,
INT32-C,650,sqlite,ext/fts5/fts5_index.c,6796,FP,"p->nPendingRow++ pending-row counter, flushed before overflow practical",,
API00-C,651,sqlite,ext/fts5/fts5_index.c,6804,FP,"sqlite3Fts5IndexSync: internal Fts5Index handle, p->rc error model via fts5IndexReturn",,
API00-C,652,sqlite,ext/fts5/fts5_index.c,6817,FP,"sqlite3Fts5IndexRollback: internal Fts5Index handle, returns fts5IndexReturn(p); caller-guaranteed",,
API00-C,653,sqlite,ext/fts5/fts5_index.c,6829,FP,"sqlite3Fts5IndexReinit: internal Fts5Index handle, p->rc model; called from sqlite3Fts5IndexOpen",,
MEM05-C,654,sqlite,ext/fts5/fts5_index.c,6831,FP,"uFts union sized by SZ_FTS5STRUCTURE(1), a compile-time constant; not a VLA",,
EXP33-C,655,sqlite,ext/fts5/fts5_index.c,6837,FP,uFts: only &uFts.sFts (address-of) is taken at 6837; union zeroed by memset at 6838 before any field read,,
API00-C,656,sqlite,ext/fts5/fts5_index.c,6854,FP,"sqlite3Fts5IndexOpen: pConfig is internal Fts5Config supplied by fts5 module constructor path, not untrusted input",,
EXP34-C,657,sqlite,ext/fts5/fts5_index.c,6865,FP,"p->pConfig=pConfig inside if(rc==OK); MallocZero failure sets rc, so p non-null when rc==OK",,
EXP34-C,658,sqlite,ext/fts5/fts5_index.c,6867,FP,"pConfig->zName: pConfig is the function input param to sqlite3Fts5IndexOpen, caller-provided non-null",,
API00-C,659,sqlite,ext/fts5/fts5_index.c,6895,FP,sqlite3Fts5IndexClose: explicitly NULL-tolerant (if(p){...}); no unchecked deref,,
API00-C,660,sqlite,ext/fts5/fts5_index.c,6920,FP,"sqlite3Fts5IndexCharlenToBytelen: buffer reader (const char* p + int nByte); indexing bounds-guarded by nByte, not a handle",,
EXP34-C,661,sqlite,ext/fts5/fts5_index.c,6951,FP,"pIn[i] in fts5IndexCharlen; pIn is param, loop bounded by i<nIn, callers pass valid utf-8 buffer",,
INT32-C,662,sqlite,ext/fts5/fts5_index.c,6954,FP,nChar++ utf8 char count bounded by nIn input byte length,,
API00-C,663,sqlite,ext/fts5/fts5_index.c,6969,FP,"sqlite3Fts5IndexWrite: internal Fts5Index handle, p->rc error model; caller-guaranteed non-NULL",,
DCL13-C,664,sqlite,ext/fts5/fts5_index.c,6970,FP,"sqlite3Fts5IndexWrite passes p to non-const sink sqlite3Fts5HashWrite(p->pHash,...); handle hash is mutated",,
STR34-C,665,sqlite,ext/fts5/fts5_index.c,6989,FP,pToken passed as char* arg; callee CharlenToBytelen casts to (unsigned char) before compare,,
DCL13-C,666,sqlite,ext/fts5/fts5_index.c,7008,TP,"fts5IsTokendataPrefix reads pBuf->n/pBuf->p[] only via memcmp; plain static helper, const-able",,
INT31-C,667,sqlite,ext/fts5/fts5_index.c,7014,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
ARR00-C,668,sqlite,ext/fts5/fts5_index.c,7015,FP,pBuf->p[nToken] guarded by short-circuit (pBuf->n==nToken || pBuf->p[nToken]==0); nToken<=pBuf->n,,
ARR30-C,669,sqlite,ext/fts5/fts5_index.c,7015,FP,pBuf->p[nToken] guarded by short-circuit (pBuf->n==nToken || pBuf->p[nToken]==0); nToken<=pBuf->n,,
MEM30-C,670,sqlite,ext/fts5/fts5_index.c,7033,FP,pIndex read into local before fts5MultiIterFree(pIter); Fts5Index object not freed by that call,,
EXP40-C,671,sqlite,ext/fts5/fts5_index.c,7046,FP,"pIn is a non-const Fts5TokenDataIter* parameter; pRet=pIn assigns non-const to non-const, no const violation",,
INT32-C,672,sqlite,ext/fts5/fts5_index.c,7050,FP,pIn->nIterAlloc*2 iterator-array growth; nIter bounded by segment count,,
INT32-C,673,sqlite,ext/fts5/fts5_index.c,7051,FP,nAlloc+1 in SZ macro; nAlloc bounded by iterator count,,
ARR38-C,674,sqlite,ext/fts5/fts5_index.c,7057,FP,memset nByte zeroes the realloc(nByte) buffer pNew; sizes match,,
INT31-C,675,sqlite,ext/fts5/fts5_index.c,7057,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
EXP34-C,676,sqlite,ext/fts5/fts5_index.c,7066,FP,"pRet->apIter in else of if(p->rc); on rc==OK pRet is pIn or freshly alloc'd pNew (realloc taken when pIn==0), never NULL",,
INT32-C,677,sqlite,ext/fts5/fts5_index.c,7066,FP,pRet->nIter++ iterator count bounded by segments scanned,,
DCL30-C,678,sqlite,ext/fts5/fts5_index.c,7070,FP,pRet is heap-allocated tokendata iter; returning it is correct,,
EXP34-C,679,sqlite,ext/fts5/fts5_index.c,7085,FP,pT=pIter->pTokenDataIter; documented precondition pTokenDataIter!=0 for this iterator,,
ARR00-C,680,sqlite,ext/fts5/fts5_index.c,7090,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP34-C,681,sqlite,ext/fts5/fts5_index.c,7090,FP,pT->nIter loop; pT established non-null by tokendata iterator invariant,,
INT30-C,682,sqlite,ext/fts5/fts5_index.c,7124,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,683,sqlite,ext/fts5/fts5_index.c,7124,FP,pT->nIter*(sizeof+sizeof); nIter bounded by number of tokendata iterators (segment count),,
INT32-C,684,sqlite,ext/fts5/fts5_index.c,7138,FP,"nByte+=p->base.nData; sum of poslist sizes for one rowid across iterators, bounded",,
INT32-C,685,sqlite,ext/fts5/fts5_index.c,7143,FP,"nByte+nHit*10; nHit bounded by nIter, nByte by summed poslists",,
INT32-C,686,sqlite,ext/fts5/fts5_index.c,7149,FP,(nMapAlloc+nByte)*2 growth; sizes bounded by query position counts; impractical to reach INT_MAX,,
INT30-C,687,sqlite,ext/fts5/fts5_index.c,7151,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,688,sqlite,ext/fts5/fts5_index.c,7188,FP,pT->nMap++ token-map count; capacity ensured at 7148,,
ARR00-C,689,sqlite,ext/fts5/fts5_index.c,7210,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
DCL13-C,690,sqlite,ext/fts5/fts5_index.c,7234,TP,fts5TokendataSetTermIfEof reads pTerm->n/pTerm->p (copies FROM); pTerm never written,,
EXP34-C,691,sqlite,ext/fts5/fts5_index.c,7236,FP,pIter->pIndex->rc guarded by if(pIter && pIter->aSeg[0].pLeaf==0); pIter non-null,,
DCL13-C,692,sqlite,ext/fts5/fts5_index.c,7248,FP,fts5SetupTokendataIter stores pNew->pColset=pColset; pColset escapes into non-const Fts5Iter.pColset field,,
ARR30-C,693,sqlite,ext/fts5/fts5_index.c,7261,FP,"while(p->rc==SQLITE_OK) segment-iteration loop terminated by rc/EOF, not an array access on pNewIter",,
INT32-C,694,sqlite,ext/fts5/fts5_index.c,7262,FP,pSet->nIter-1 index; nIter>=1 when pSet non-null (just-appended iterator),,
EXP34-C,695,sqlite,ext/fts5/fts5_index.c,7269,FP,pStruct->nSegment inside while(p->rc==OK); fts5StructureRead NULL implies rc!=OK so loop not entered,,
EXP34-C,696,sqlite,ext/fts5/fts5_index.c,7281,FP,pNew->aSeg[0] after if(p->rc){break} at 7276; fts5MultiIterAlloc NOMEM sets rc and is caught by that break,,
ARR00-C,697,sqlite,ext/fts5/fts5_index.c,7283,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,698,sqlite,ext/fts5/fts5_index.c,7284,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,699,sqlite,ext/fts5/fts5_index.c,7294,FP,"bSeek.n-1; bSeek built from term buffer, n>=1 (appended at least nul or token)",,
ARR37-C,700,sqlite,ext/fts5/fts5_index.c,7312,FP,pNewIter++ over aSeg[] of pNew allocated with nSegment slots; loop sums to nSegment,,
ARR00-C,701,sqlite,ext/fts5/fts5_index.c,7328,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
API00-C,702,sqlite,ext/fts5/fts5_index.c,7386,FP,"sqlite3Fts5IndexQuery: internal Fts5Index handle, p->rc error model; caller-guaranteed",,
INT13-C,703,sqlite,ext/fts5/fts5_index.c,7398,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
EXP34-C,704,sqlite,ext/fts5/fts5_index.c,7405,FP,"memcpy(&buf.p[1],pToken,nToken) guarded by if(nToken>0); buf.p non-null (assert+BufferSize==0), pToken non-null per caller contract when nToken>0",,
INT13-C,705,sqlite,ext/fts5/fts5_index.c,7412,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,706,sqlite,ext/fts5/fts5_index.c,7427,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,707,sqlite,ext/fts5/fts5_index.c,7428,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT32-C,708,sqlite,ext/fts5/fts5_index.c,7429,FP,1+pConfig->nPrefix; SQLITE_DEBUG-only; nPrefix bounded config value (<=FTS5_MAX_PREFIX_INDEXES),,
INT13-C,709,sqlite,ext/fts5/fts5_index.c,7432,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
STR34-C,710,sqlite,ext/fts5/fts5_index.c,7433,FP,pToken passed as char* to fts5IndexCharlen; no widening at call site,,
INT32-C,711,sqlite,ext/fts5/fts5_index.c,7443,FP,"nToken+1; nToken is query term length (caller-supplied query, not on-disk), bounded",,
INT13-C,712,sqlite,ext/fts5/fts5_index.c,7449,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT32-C,713,sqlite,ext/fts5/fts5_index.c,7450,FP,nToken+1 query term length; bounded,,
INT13-C,714,sqlite,ext/fts5/fts5_index.c,7456,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT32-C,715,sqlite,ext/fts5/fts5_index.c,7457,FP,nToken+1 query term length; bounded,,
API00-C,716,sqlite,ext/fts5/fts5_index.c,7488,FP,sqlite3Fts5IterNext: pIndexIter is internal iterator handle from sqlite3Fts5IndexQuery; pIter->pIndex->rc model,,
API00-C,717,sqlite,ext/fts5/fts5_index.c,7503,FP,"sqlite3Fts5IterNextScan: internal iterator handle, p->rc model via pIter->pIndex; caller-guaranteed",,
API00-C,718,sqlite,ext/fts5/fts5_index.c,7527,FP,"sqlite3Fts5IterNextFrom: internal iterator handle, pIter->pIndex->rc model; caller-guaranteed",,
API00-C,719,sqlite,ext/fts5/fts5_index.c,7541,FP,"sqlite3Fts5IterTerm: internal iterator handle, delegates to fts5MultiIterTerm; result checked",,
EXP33-C,720,sqlite,ext/fts5/fts5_index.c,7544,FP,n written via &n by fts5MultiIterTerm at 7543 before read; and assert short-circuits so n read only when set,,
INT32-C,721,sqlite,ext/fts5/fts5_index.c,7545,FP,"n-1 term length; n=fts5MultiIterTerm length, term size bounded by page; assert_nc z||n<=1",,
INT32-C,722,sqlite,ext/fts5/fts5_index.c,7565,FP,nToken+1 query token length; bounded,,
INT31-C,723,sqlite,ext/fts5/fts5_index.c,7574,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,724,sqlite,ext/fts5/fts5_index.c,7575,FP,nToken+1 query token length; bounded,,
API00-C,725,sqlite,ext/fts5/fts5_index.c,7602,FP,sqlite3Fts5IterToken: internal iterator handle; asserts caller-guaranteed invariant,,
INT13-C,726,sqlite,ext/fts5/fts5_index.c,7612,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT14-C,727,sqlite,ext/fts5/fts5_index.c,7612,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,728,sqlite,ext/fts5/fts5_index.c,7612,FP,(((i64)iCol)<<32)+iOff already widened to i64; iCol/iOff caller API args,,
STR34-C,729,sqlite,ext/fts5/fts5_index.c,7620,FP,"*ppOut assignment is a pointer (const char*) store, not a char-to-integer widening",,
INT32-C,730,sqlite,ext/fts5/fts5_index.c,7629,FP,(i1+i2)/2 binary-search midpoint; bounded by nMap,,
INT32-C,731,sqlite,ext/fts5/fts5_index.c,7632,FP,iTest+1 binary-search index bounded by nMap,,
INT32-C,732,sqlite,ext/fts5/fts5_index.c,7640,FP,iTest+1 binary-search index bounded by nMap,,
EXP40-C,733,sqlite,ext/fts5/fts5_index.c,7652,FP,"*ppOut is const char* (ppOut is const char**); assigning a const char* value, not modifying a const object",,
INT32-C,734,sqlite,ext/fts5/fts5_index.c,7652,FP,"pointer+1 (term.p+1) skipping prefix byte; not integer overflow, term buffer",,
STR34-C,735,sqlite,ext/fts5/fts5_index.c,7652,FP,"*ppOut is assigned a char* pointer, not a widened char value",,
EXP40-C,736,sqlite,ext/fts5/fts5_index.c,7656,FP,"same as 7652: *ppOut slot holds const char*, writing the pointer not the pointed-to const data",,
STR34-C,737,sqlite,ext/fts5/fts5_index.c,7656,FP,*ppOut is assigned a char* pointer; no sign extension of a byte,,
API00-C,738,sqlite,ext/fts5/fts5_index.c,7668,FP,sqlite3Fts5IndexIterClearTokendata: NULL-tolerant (if(pIter && ...)); no unchecked deref,,
API00-C,739,sqlite,ext/fts5/fts5_index.c,7684,FP,"sqlite3Fts5IndexIterWriteTokendata: internal iterator handle, pIter->pIndex->rc model; caller-guaranteed",,
INT13-C,740,sqlite,ext/fts5/fts5_index.c,7692,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT14-C,741,sqlite,ext/fts5/fts5_index.c,7692,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,742,sqlite,ext/fts5/fts5_index.c,7692,FP,(((i64)iCol)<<32)+iOff already i64; API args,,
ARR00-C,743,sqlite,ext/fts5/fts5_index.c,7709,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT31-C,744,sqlite,ext/fts5/fts5_index.c,7711,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
API00-C,745,sqlite,ext/fts5/fts5_index.c,7737,FP,"sqlite3Fts5IndexGetAverages: internal Fts5Index handle, p->rc model; caller-guaranteed",,
ARR38-C,746,sqlite,ext/fts5/fts5_index.c,7742,FP,memset anSize for sizeof(i64)*nCol; caller passes buffer of nCol i64,,
INT30-C,747,sqlite,ext/fts5/fts5_index.c,7742,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,748,sqlite,ext/fts5/fts5_index.c,7742,FP,sizeof(i64)*nCol; nCol=pConfig->nCol bounded column count,,
EXP34-C,749,sqlite,ext/fts5/fts5_index.c,7744,FP,"pData->nn in if(p->rc==SQLITE_OK && pData->nn); && short-circuits, pData non-null when rc==OK (fts5DataRead invariant)",,
INT32-C,750,sqlite,ext/fts5/fts5_index.c,7747,FP,"i+=varint; i bounded by pData->nn (averages record size, small)",,
API00-C,751,sqlite,ext/fts5/fts5_index.c,7761,FP,"sqlite3Fts5IndexSetAverages: internal Fts5Index handle, entry assert(p->rc==SQLITE_OK), p->rc model",,
API00-C,752,sqlite,ext/fts5/fts5_index.c,7771,FP,sqlite3Fts5IndexReads: internal Fts5Index handle; trivial accessor return p->nRead,,
DCL13-C,753,sqlite,ext/fts5/fts5_index.c,7771,TP,"sqlite3Fts5IndexReads body is return p->nRead; p read-only, not passed anywhere — const Fts5Index* compiles",,
API00-C,754,sqlite,ext/fts5/fts5_index.c,7782,FP,sqlite3Fts5IndexSetCookie: internal Fts5Index handle; caller-guaranteed non-NULL,,
DCL13-C,755,sqlite,ext/fts5/fts5_index.c,7782,TP,"sqlite3Fts5IndexSetCookie reads p->pConfig/rc/zDataTbl only, returns local rc (never sets p->rc); p const-able",,
FIO42-C,756,sqlite,ext/fts5/fts5_index.c,7791,FP,"no open() here; rc is an int SQLite status code, nothing to close()",,
EXP34-C,757,sqlite,ext/fts5/fts5_index.c,7795,FP,sqlite3_blob_write(pBlob) inside if(rc==OK) after blob_open; pBlob set on success,,
EXP34-C,758,sqlite,ext/fts5/fts5_index.c,7796,FP,sqlite3_blob_close(pBlob) inside if(rc==OK); pBlob non-null on the success path,,
API00-C,759,sqlite,ext/fts5/fts5_index.c,7802,FP,"sqlite3Fts5IndexLoadConfig: internal Fts5Index handle, p->rc model via fts5IndexReturn",,
API00-C,760,sqlite,ext/fts5/fts5_index.c,7816,FP,"sqlite3Fts5IndexGetOrigin: internal Fts5Index handle, p->rc model; caller-guaranteed",,
ARR30-C,761,sqlite,ext/fts5/fts5_index.c,7843,FP,TOMBSTONE_KEYSIZE/NSLOT read pPg->p[] on Fts5Data tombstone pages over-allocated by FTS5_DATA_PADDING=20; slot index is % nSlot-bounded with max byte <= nn-1; small-page reads fall within trailing padding,,
EXP34-C,762,sqlite,ext/fts5/fts5_index.c,7845,FP,fts5GetU32(&pPg->p[4]) in fts5IndexTombstoneAddToPage; pPg is a caller-validated tombstone page (non-null),,
INT10-C,763,sqlite,ext/fts5/fts5_index.c,7846,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT33-C,764,sqlite,ext/fts5/fts5_index.c,7846,FP,nSlot=TOMBSTONE_NSLOT >=1 by construction,,
ARR37-C,765,sqlite,ext/fts5/fts5_index.c,7862,FP,aSlot=&p[8]; iSlot<nSlot=(nn-8)/keysize; 8+iSlot*key<nn; in-bounds,,
INT10-C,766,sqlite,ext/fts5/fts5_index.c,7863,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT32-C,767,sqlite,ext/fts5/fts5_index.c,7863,FP,iSlot+1 mod nSlot; bounded by nSlot (tombstone slot count),,
INT33-C,768,sqlite,ext/fts5/fts5_index.c,7863,FP,nSlot=TOMBSTONE_NSLOT >=1 by construction,,
INT32-C,769,sqlite,ext/fts5/fts5_index.c,7864,FP,"nCollide-- bounded by nSlot, loop terminates at 0",,
ARR37-C,770,sqlite,ext/fts5/fts5_index.c,7866,FP,"fts5PutU32 at aSlot[iSlot], iSlot<nSlot sized from page nn; in-bounds",,
ARR37-C,771,sqlite,ext/fts5/fts5_index.c,7869,FP,"u64 aSlot[iSlot], iSlot<nSlot from nn; in-bounds",,
INT10-C,772,sqlite,ext/fts5/fts5_index.c,7870,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT32-C,773,sqlite,ext/fts5/fts5_index.c,7870,FP,iSlot+1 mod nSlot; bounded by nSlot,,
INT33-C,774,sqlite,ext/fts5/fts5_index.c,7870,FP,nSlot=TOMBSTONE_NSLOT >=1 by construction,,
INT32-C,775,sqlite,ext/fts5/fts5_index.c,7871,FP,nCollide-- bounded by nSlot,,
ARR37-C,776,sqlite,ext/fts5/fts5_index.c,7873,FP,fts5PutU64 at aSlot[iSlot] with iSlot<nSlot; in-bounds,,
DCL13-C,777,sqlite,ext/fts5/fts5_index.c,7893,TP,fts5IndexTombstoneRehash reads pSeg->nPgTombstone/iSegid only; pSeg never written,,
DCL13-C,778,sqlite,ext/fts5/fts5_index.c,7894,TP,pData1 read-only in fts5IndexTombstoneRehash; const compiles (benign non-const alias cascade),,
EXP34-C,779,sqlite,ext/fts5/fts5_index.c,7905,FP,"apOut[ii]->p[0] in Rehash; caller calls Rehash only if(p->rc==OK) (8042), and on rc==OK every apOut[ii] was allocated",,
ARR30-C,780,sqlite,ext/fts5/fts5_index.c,7921,FP,TOMBSTONE_KEYSIZE/NSLOT read pPg->p[] on Fts5Data tombstone pages over-allocated by FTS5_DATA_PADDING=20; slot index is % nSlot-bounded with max byte <= nn-1; small-page reads fall within trailing padding,,
INT32-C,781,sqlite,ext/fts5/fts5_index.c,7922,FP,"nSlotIn=(nn-8)/szKeyIn; nn bounded by the page allocation, no overflow reachable",,
INT33-C,782,sqlite,ext/fts5/fts5_index.c,7922,FP,"szKeyIn=TOMBSTONE_KEYSIZE is 4 or 8, never 0",,
ARR37-C,783,sqlite,ext/fts5/fts5_index.c,7930,FP,"aSlot[iIn], iIn<nSlotIn=(pData->nn-8)/szKeyIn; offset<nn; self-consistent with blob",,
ARR37-C,784,sqlite,ext/fts5/fts5_index.c,7933,FP,"u64 aSlot[iIn], iIn<nSlotIn sized from pData->nn; in-bounds",,
INT33-C,785,sqlite,ext/fts5/fts5_index.c,7938,FP,nOut output-page count always >=1 (set to 1 or nPgTombstone*2+1),,
INT32-C,786,sqlite,ext/fts5/fts5_index.c,7980,FP,"pgsz-8; pgsz config page size, bounded",,
EXP34-C,787,sqlite,ext/fts5/fts5_index.c,8007,FP,"pData1->p[4] in case nPgTombstone==1; caller passed non-null pPg (checked at 8085), assert(pData1) at 8008",,
INT32-C,788,sqlite,ext/fts5/fts5_index.c,8010,FP,nElem*4 from tombstone header: when nSlot>nSlotPerPage the result is discarded (nOut=0) and nSlot recomputed bounded; overflowed value never reaches an allocation,,
INT32-C,789,sqlite,ext/fts5/fts5_index.c,8015,FP,nPgTombstone*2+1; nPgTombstone internal structure field (page count),,
INT30-C,790,sqlite,ext/fts5/fts5_index.c,8028,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,791,sqlite,ext/fts5/fts5_index.c,8029,FP,szPage=8+nSlot*szKey; only overflows on the 8010 path which is discarded; recompute path uses bounded nSlotPerPage,,
INT30-C,792,sqlite,ext/fts5/fts5_index.c,8032,FP,count is a program-managed struct field/config/power-of-two (not a direct blob value) and allocation uses 64-bit sqlite3_realloc64/MallocZero,,
INT32-C,793,sqlite,ext/fts5/fts5_index.c,8061,FP,"nOut*2+1 retry growth; nOut starts small (page count derived), practical bound",,
INT32-C,794,sqlite,ext/fts5/fts5_index.c,8080,FP,"p->nContentlessDelete++ delete counter, flushed periodically",,
INT33-C,795,sqlite,ext/fts5/fts5_index.c,8083,FP,modulo guarded by if(pSeg->nPgTombstone>0),,
ARR30-C,796,sqlite,ext/fts5/fts5_index.c,8098,FP,TOMBSTONE_KEYSIZE/NSLOT read pPg->p[] on Fts5Data tombstone pages over-allocated by FTS5_DATA_PADDING=20; slot index is % nSlot-bounded with max byte <= nn-1; small-page reads fall within trailing padding,,
EXP34-C,797,sqlite,ext/fts5/fts5_index.c,8109,FP,"apHash[iRowid%nHash] inside if(nHash); nHash>0 set together with non-null apHash, both zeroed on rc",,
INT10-C,798,sqlite,ext/fts5/fts5_index.c,8109,FP,"modulo operands are non-negative (rowid/segid count), no negative-dividend sign issue",,
INT33-C,799,sqlite,ext/fts5/fts5_index.c,8109,FP,apHash[iRowid%nHash] reached only inside if(nHash),,
EXP34-C,800,sqlite,ext/fts5/fts5_index.c,8119,FP,"fts5IndexFreeArray(apHash,nHash) checks if(ap) internally; NULL tolerated",,
API00-C,801,sqlite,ext/fts5/fts5_index.c,8127,FP,"sqlite3Fts5IndexContentlessDelete: internal Fts5Index handle, p->rc model; caller-guaranteed",,
ARR00-C,802,sqlite,ext/fts5/fts5_index.c,8133,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
INT32-C,803,sqlite,ext/fts5/fts5_index.c,8133,FP,pStruct->nLevel-1 loop bound; bounded by FTS5_MAX_LEVEL,,
ARR00-C,804,sqlite,ext/fts5/fts5_index.c,8135,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
API00-C,805,sqlite,ext/fts5/fts5_index.c,8160,FP,"sqlite3Fts5IndexEntryCksum: buffer reader (const char* pTerm + int nTerm); loop bounded by nTerm, no deref when empty",,
INT14-C,806,sqlite,ext/fts5/fts5_index.c,8170,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT32-C,807,sqlite,ext/fts5/fts5_index.c,8170,FP,"(ret<<3)+iCol checksum on u64 ret; iCol small, defined wrap acceptable in checksum",,
INT32-C,808,sqlite,ext/fts5/fts5_index.c,8171,FP,(ret<<3)+iPos checksum on u64; not security-relevant arithmetic,,
INT13-C,809,sqlite,ext/fts5/fts5_index.c,8202,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT14-C,810,sqlite,ext/fts5/fts5_index.c,8202,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT13-C,811,sqlite,ext/fts5/fts5_index.c,8214,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,812,sqlite,ext/fts5/fts5_index.c,8234,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
STR34-C,813,sqlite,ext/fts5/fts5_index.c,8234,FP,(z[i] & 0x80)==0x00 masks off sign-extended high bits before compare; result correct,,
EXP34-C,814,sqlite,ext/fts5/fts5_index.c,8238,FP,pIter->iRowid guarded by while(rc==OK && ALWAYS(pIter!=0) && ...); explicit non-null check,,
EXP34-C,815,sqlite,ext/fts5/fts5_index.c,8254,FP,sqlite3Fts5IterNext(pIter) inside loop where ALWAYS(pIter!=0) holds,,
EXP34-C,816,sqlite,ext/fts5/fts5_index.c,8257,FP,fts5IterClose(pIter) tolerates NULL,,
INT14-C,817,sqlite,ext/fts5/fts5_index.c,8272,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
STR00-C,818,sqlite,ext/fts5/fts5_index.c,8272,FP,z[i] high bit sign-extends but is masked by &0x80/&0xE0; comparison against small constant is correct,,
STR00-C,819,sqlite,ext/fts5/fts5_index.c,8275,FP,masked bit test (z[i] & 0xE0)==0xC0; sign-extended bits discarded by mask,,
STR00-C,820,sqlite,ext/fts5/fts5_index.c,8276,FP,masked bit test; sign extension cannot affect masked low-byte comparison,,
STR00-C,821,sqlite,ext/fts5/fts5_index.c,8279,FP,"masked bit test (z[i+1] & 0xC0); high bits discarded, correct",,
STR00-C,822,sqlite,ext/fts5/fts5_index.c,8280,FP,masked bit test; sign extension irrelevant after &0xF0,,
STR00-C,823,sqlite,ext/fts5/fts5_index.c,8283,FP,masked bit test; mask discards sign-extended bits,,
STR00-C,824,sqlite,ext/fts5/fts5_index.c,8284,FP,masked bit test (z[i+1] & 0xC0); correct under sign extension,,
STR00-C,825,sqlite,ext/fts5/fts5_index.c,8285,FP,masked bit test (z[i+2] & 0xC0); correct under sign extension,,
EXP34-C,826,sqlite,ext/fts5/fts5_index.c,8316,FP,"memcmp(pPrev->p,z,n) in fts5TestTerm (debug test); z is the term param supplied non-null by caller",,
INT31-C,827,sqlite,ext/fts5/fts5_index.c,8316,FP,"source value is a non-negative int byte/element count (page size, token len, or struct count), not a truncation of a wider blob i64; sign-conversion to size_t is lossless here",,
INT32-C,828,sqlite,ext/fts5/fts5_index.c,8321,FP,pPrev->n-1 SQLITE_DEBUG-only term length; n>=1 after fts5BufferSet,,
INT13-C,829,sqlite,ext/fts5/fts5_index.c,8331,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,830,sqlite,ext/fts5/fts5_index.c,8351,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
INT13-C,831,sqlite,ext/fts5/fts5_index.c,8357,FP,intentional bit manipulation on flag mask / page-number / segid; signedness not a defect,,
DCL13-C,832,sqlite,ext/fts5/fts5_index.c,8390,TP,"fts5IndexIntegrityCheckEmpty reads pSeg->iSegid only; never written, plain static",,
EXP33-C,833,sqlite,ext/fts5/fts5_index.c,8425,FP,nIncr written by fts5GetVarint32 macro at 8425 before use,,
EXP33-C,834,sqlite,ext/fts5/fts5_index.c,8433,FP,nByte written by fts5GetVarint32 macro at 8433 before use,,
EXP33-C,835,sqlite,ext/fts5/fts5_index.c,8441,FP,nKeep written by fts5GetVarint32 macro at 8441 before use,,
INT32-C,836,sqlite,ext/fts5/fts5_index.c,8470,FP,pSeg->pgnoFirst-1; internal page number from structure record,,
EXP34-C,837,sqlite,ext/fts5/fts5_index.c,8482,FP,"sqlite3_step(pStmt) in while(p->rc==OK && ...); PrepareStmt sets rc+pStmt=0 on failure, pStmt non-null when rc==OK",,
EXP33-C,838,sqlite,ext/fts5/fts5_index.c,8484,FP,pLeaf assigned by fts5LeafRead at 8495 and NULL-checked at 8496 before any use at 8502,,
EXP33-C,839,sqlite,ext/fts5/fts5_index.c,8527,FP,nTerm written by fts5GetVarint32 macro at 8527 before use,,
INT32-C,840,sqlite,ext/fts5/fts5_index.c,8527,FP,"iOff+=varint; iOff bounded by szLeaf, guarded iOff>=szLeaf at 8524",,
INT32-C,841,sqlite,ext/fts5/fts5_index.c,8529,FP,"nTerm-nIdxTerm; nTerm from page varint, nIdxTerm column bytes; both bounded; only used as comparison result",,
INT32-C,842,sqlite,ext/fts5/fts5_index.c,8541,FP,iIdxPrevLeaf+1; internal leaf page number,,
INT32-C,843,sqlite,ext/fts5/fts5_index.c,8559,FP,iPrevLeaf+1 loop bound; internal leaf page number,,
ARR30-C,844,sqlite,ext/fts5/fts5_index.c,8576,FP,"ASSERT_SZLEAF_OK is an assert(); compiled out under NDEBUG in release, no array access generated",,
EXP33-C,845,sqlite,ext/fts5/fts5_index.c,8582,FP,iRowid written via &iRowid by fts5GetVarint at 8581 before read at 8582,,
ARR00-C,846,sqlite,ext/fts5/fts5_index.c,8647,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
ARR00-C,847,sqlite,ext/fts5/fts5_index.c,8648,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP33-C,848,sqlite,ext/fts5/fts5_index.c,8678,FP,n written via &n by fts5MultiIterTerm at 8675 before use at 8678,,
EXP34-C,849,sqlite,ext/fts5/fts5_index.c,8687,FP,"pIter->aSeg in integrity-check loop body; entered only when fts5MultiIterEof==0 (rc==OK), pIter non-null",,
INT14-C,850,sqlite,ext/fts5/fts5_index.c,8739,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT14-C,851,sqlite,ext/fts5/fts5_index.c,8742,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
INT14-C,852,sqlite,ext/fts5/fts5_index.c,8748,FP,readability-only finding (bitwise and arithmetic on same var); no integer defect,,
DCL13-C,853,sqlite,ext/fts5/fts5_index.c,8781,TP,fts5DebugStructure reads p->nLevel/aLevel[] only (debug); never written through p,,
ARR00-C,854,sqlite,ext/fts5/fts5_index.c,8785,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP34-C,855,sqlite,ext/fts5/fts5_index.c,8785,FP,p->nLevel in fts5DebugStructure (TEST/DEBUG only); caller passes non-null decoded structure,,
ARR00-C,856,sqlite,ext/fts5/fts5_index.c,8790,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
EXP34-C,857,sqlite,ext/fts5/fts5_index.c,8829,FP,fts5DebugStructure(p) after if(rc!=OK)return; fts5StructureDecode leaves p non-null when rc==OK,,
EXP34-C,858,sqlite,ext/fts5/fts5_index.c,8830,FP,fts5StructureRelease(p) tolerates NULL,,
EXP33-C,859,sqlite,ext/fts5/fts5_index.c,8871,FP,iVal written by fts5GetVarint32 macro at 8871 before use,,
INT32-C,860,sqlite,ext/fts5/fts5_index.c,8900,FP,"n-iOff MIN arg; SQLITE_TEST/FTS5_DEBUG-only decode; n input bytes, iOff bounded by n",,
EXP33-C,861,sqlite,ext/fts5/fts5_index.c,8904,FP,iDelta written via &iDelta by sqlite3Fts5GetVarint at 8903 before use,,
DCL13-C,862,sqlite,ext/fts5/fts5_index.c,8957,TP,fts5BufferAppendTerm reads pTerm->n/pTerm->p[] only (pBuf is the written buffer); pTerm const-able,,
INT32-C,863,sqlite,ext/fts5/fts5_index.c,8959,FP,pTerm->n*2+1 buffer-grow; SQLITE_TEST/DEBUG-only; term size bounded by page,,
ARR00-C,864,sqlite,ext/fts5/fts5_index.c,8961,FP,standard for-loop with index initialized in init-clause (for(x=0;x<bound;x++) or reverse); analyzer 'uninitialized variable' claim is incorrect; bound is a validated structure counter (nLevel/nSeg/nMap/nIter/nTombstone),,
DCL13-C,865,sqlite,ext/fts5/fts5_index.c,8981,FP,fts5DecodeFunction: apVal read-only but signature fixed by sqlite3 xFunc callback (sqlite3_create_function),,
EXP05-C,866,sqlite,ext/fts5/fts5_index.c,9006,FP,a is a writable u8* malloc'd buffer (memcpy dest); not a const cast-away. const source aBlob only read,,
EXP34-C,867,sqlite,ext/fts5/fts5_index.c,9006,FP,"memcpy(a,aBlob,n) guarded by if(n>0); sqlite3_value_blob returns non-null for a non-empty blob (TEST/DEBUG only)",,
INT32-C,868,sqlite,ext/fts5/fts5_index.c,9030,FP,(n-8)/szKey; SQLITE_TEST/DEBUG-only fts5_decode; n input blob bytes bounded,,
INT33-C,869,sqlite,ext/fts5/fts5_index.c,9030,FP,"szKey=(aBlob[0]==4||aBlob[0]==8)?aBlob[0]:8, never 0",,
ARR30-C,870,sqlite,ext/fts5/fts5_index.c,9039,FP,"fts5DecodeFunction (fts5_decode) is #if SQLITE_TEST||SQLITE_FTS5_DEBUG only, not in release; aBlob is the function blob param (size n), tool mis-linked to unrelated aBlob[2] at line 4155; aBlob[8+ii*szKey] with nSlot=(n-8)/szKey stays within [0,n)",,
ARR37-C,871,sqlite,ext/fts5/fts5_index.c,9040,FP,aSlot=&aBlob[8]; ii<nSlot=(n-8)/szKey; offset<n; aBlob is padded copy; in-bounds (debug fn),,
ARR30-C,872,sqlite,ext/fts5/fts5_index.c,9042,FP,"fts5DecodeFunction (fts5_decode) is #if SQLITE_TEST||SQLITE_FTS5_DEBUG only, not in release; aBlob is the function blob param (size n), tool mis-linked to unrelated aBlob[2] at line 4155; aBlob[8+ii*szKey] with nSlot=(n-8)/szKey stays within [0,n)",,
ARR37-C,873,sqlite,ext/fts5/fts5_index.c,9043,FP,"u64 aSlot[ii], ii<nSlot sized from n; within padded aBlob copy (debug fn)",,
EXP33-C,874,sqlite,ext/fts5/fts5_index.c,9066,FP,"iTermOff assigned on both branches (9067 if, 9069 else) before read at 9071",,
EXP33-C,875,sqlite,ext/fts5/fts5_index.c,9067,FP,iTermOff written by fts5GetVarint32 macro at 9067,,
INT32-C,876,sqlite,ext/fts5/fts5_index.c,9067,FP,iPgidxOff+=varint; DEBUG-only decode; offset bounded by n,,
INT32-C,877,sqlite,ext/fts5/fts5_index.c,9071,FP,iTermOff-4; DEBUG-only decode; iTermOff page offset bounded,,
EXP33-C,878,sqlite,ext/fts5/fts5_index.c,9078,FP,nAppend written by fts5GetVarint32 macro at 9078 before use,,
EXP33-C,879,sqlite,ext/fts5/fts5_index.c,9088,FP,nIncr written by fts5GetVarint32 macro at 9088 before use,,
INT32-C,880,sqlite,ext/fts5/fts5_index.c,9088,FP,iPgidxOff+=varint; DEBUG-only decode; bounded by n,,
INT32-C,881,sqlite,ext/fts5/fts5_index.c,9089,FP,iTermOff+=nIncr; DEBUG-only decode; checked iTermOff>szLeaf -> CORRUPT at 9093,,
ARR36-C,882,sqlite,ext/fts5/fts5_index.c,9096,FP,"iTermOff-iOff subtracts two int offsets (length arg), not pointers; misclassification",,
INT32-C,883,sqlite,ext/fts5/fts5_index.c,9096,FP,iTermOff-iOff; DEBUG-only decode; both page offsets,,
INT32-C,884,sqlite,ext/fts5/fts5_index.c,9143,FP,iOff-4; DEBUG-only decode; iOff checked >n -> CORRUPT at 9139,,
INT32-C,885,sqlite,ext/fts5/fts5_index.c,9147,FP,"(iTermOff?:szLeaf)-iOff; DEBUG-only decode; bounded, checked +iOff>n at 9148",,
EXP33-C,886,sqlite,ext/fts5/fts5_index.c,9159,FP,nByte written by fts5GetVarint32 macro at 9159 before use,,
INT32-C,887,sqlite,ext/fts5/fts5_index.c,9160,FP,iPgidxPrev+=nByte; DEBUG-only decode; iEnd checked >szLeaf at 9169,,
INT32-C,888,sqlite,ext/fts5/fts5_index.c,9165,FP,iPgidxPrev+nByte; DEBUG-only decode; checked iEnd>szLeaf at 9169,,
INT32-C,889,sqlite,ext/fts5/fts5_index.c,9175,FP,iOff+=varint; DEBUG-only decode; nByte>term.n -> CORRUPT at 9176,,
INT32-C,890,sqlite,ext/fts5/fts5_index.c,9182,FP,iOff+=varint; DEBUG-only decode; iOff+nByte>n -> CORRUPT at 9183,,
INT32-C,891,sqlite,ext/fts5/fts5_index.c,9188,FP,iOff+=nByte; DEBUG-only decode; bounded by prior CORRUPT check,,
ARR00-C,892,sqlite,ext/fts5/fts5_index.c,9192,FP,scalar offset math into a[] inside debug fts5_decode; loop validates iOff+nByte>n -> FTS5_CORRUPT; debug-only function,,
ARR36-C,893,sqlite,ext/fts5/fts5_index.c,9192,FP,"iEnd-iOff subtracts two int offsets, not pointers; misclassification",,
INT32-C,894,sqlite,ext/fts5/fts5_index.c,9192,FP,iOff+=fts5DecodeDoclist return; DEBUG-only decode; bounded by iEnd,,
DCL13-C,895,sqlite,ext/fts5/fts5_index.c,9216,FP,fts5RowidFunction: apVal read-only but signature fixed by sqlite3 xFunc callback (sqlite3_create_function),,
DCL13-C,896,sqlite,ext/fts5/fts5_index.c,9266,FP,fts5structConnectMethod: pAux unused but signature fixed by sqlite3_module xConnect callback,,
DCL13-C,897,sqlite,ext/fts5/fts5_index.c,9269,FP,fts5structConnectMethod: pzErr unused but signature fixed by sqlite3_module xConnect callback,,
DCL13-C,898,sqlite,ext/fts5/fts5_index.c,9293,FP,fts5structBestIndexMethod: tab unused but signature fixed by sqlite3_module xBestIndex callback,,
FLP34-C,899,sqlite,ext/fts5/fts5_index.c,9299,FP,(double)100 is an exact integer-literal cast; no range/precision loss,,
DCL13-C,900,sqlite,ext/fts5/fts5_index.c,9326,FP,fts5structOpenMethod: p unused but signature fixed by sqlite3_module xOpen callback,,
INT32-C,901,sqlite,ext/fts5/fts5_index.c,9355,FP,pCsr->iSeg++ vtab cursor segment index; bounded by structure nSeg,,
INT32-C,902,sqlite,ext/fts5/fts5_index.c,9356,FP,pCsr->iRowid++ vtab cursor rowid counter; bounded by row output,,
INT32-C,903,sqlite,ext/fts5/fts5_index.c,9358,FP,pCsr->iLevel++ vtab cursor level index; bounded by nLevel,,
DCL13-C,904,sqlite,ext/fts5/fts5_index.c,9372,FP,fts5structEofMethod: cur cast to non-const Fts5StructVcsr*; signature fixed by sqlite3_module xEof callback,,
DCL13-C,905,sqlite,ext/fts5/fts5_index.c,9378,FP,fts5structRowidMethod: cur cast to non-const cursor; signature fixed by sqlite3_module xRowid callback,,
DCL13-C,906,sqlite,ext/fts5/fts5_index.c,9391,FP,fts5structColumnMethod: cur cast to non-const cursor; signature fixed by sqlite3_module xColumn callback,,
DCL13-C,907,sqlite,ext/fts5/fts5_index.c,9446,FP,fts5structFilterMethod: argv (sqlite3_value**) signature fixed by sqlite3_module xFilter callback,,
API00-C,908,sqlite,ext/fts5/fts5_index.c,9481,FP,"sqlite3Fts5IndexInit: db is internal sqlite3* connection from module registration path, not untrusted input",,
MSC37-C,909,sqlite,ext/fts5/fts5_index.c,9481,FP,sqlite3Fts5IndexInit returns rc on every path (ends with 'return rc;'),,
API00-C,910,sqlite,ext/fts5/fts5_index.c,9538,FP,"sqlite3Fts5IndexReset: internal Fts5Index handle, p->rc model via fts5IndexReturn; caller-guaranteed",,