sqc 0.4.84

Software Code Quality - CERT C compliance checker
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
rule,idx,project,file,line,verdict,reason,provenance,confidence
PRE01-C,0,sqlite,src/pager.c,118,FP,"PAGERTRACE(X) at L118 is inside #if 0 dead block; X expands as call args sqlite3DebugPrintf X, parenthesizing is not applicable to a varargs call-spread, contract-safe",,high
PRE10-C,1,sqlite,src/pager.c,118,FP,PAGERTRACE multistatement is in #if 0 dead code and the live definition L120 is empty; not a real if-without-braces hazard,,high
PRE01-C,2,sqlite,src/pager.c,131,FP,"PAGERID(p) uses p->fd; macro arg always a Pager* lvalue, no precedence hazard reachable in-tree",,high
API01-C,3,sqlite,src/pager.c,670,FP,"API01 struct layout heuristic; dbFileVers[16] is fixed 16-byte version cookie always memcpy'd with sizeof, never overflowed, pMmapFreelist not corruptible",,med
PRE00-C,4,sqlite,src/pager.c,727,FP,"PAGER_INCR(v) is v++ only under SQLITE_TEST and called on plain counters; double-eval cosmetic, no side-effecting arg in-tree",,high
PRE01-C,5,sqlite,src/pager.c,727,FP,PAGER_INCR param v always a simple lvalue counter; parenthesization moot,,high
ARR02-C,6,sqlite,src/pager.c,757,FP,"aJournalMagic[] is a file-scope initialized const array; implicit bound is the correct idiom, size fixed at 8 by initializer",,high
PRE01-C,7,sqlite,src/pager.c,765,FP,JOURNAL_PG_SZ(pPager) arg always a Pager* lvalue; no precedence issue reachable,,high
PRE01-C,8,sqlite,src/pager.c,771,FP,JOURNAL_HDR_SZ(pPager) arg always a Pager* lvalue; no precedence issue reachable,,high
DCL13-C,9,sqlite,src/pager.c,805,FP,"sqlite3PagerDirectReadOk reads pPager->fd/pPCache but does not modify *pPager; however signature must match xGet-family convention - still const-eligible read-only, but it is public API matching pager.h prototype so const cannot be added without header churn; declaration-rule low value, treat as FP misfire on a read-only-but-fixed-signature param",,high
EXP40-C,10,sqlite,src/pager.c,848,FP,"assert_pager_state: Pager*p assigned to Pager*pPager both non-const, no const cast away; EXP40 misread",,high
DCL03-C,11,sqlite,src/pager.c,899,FP,"assert(!MEMDB) where MEMDB=pPager->memDb is a runtime field read, not a constant expression; static_assert impossible",,high
API00-C,12,sqlite,src/pager.c,992,FP,"print_pager_state is SQLITE_DEBUG-only debugger helper; p is a valid Pager* by contract, no untrusted path",,high
DCL13-C,13,sqlite,src/pager.c,992,FP,"print_pager_state only reads p members; const-eligible but debug-only helper, low-value declaration misfire",,med
EXP33-C,14,sqlite,src/pager.c,995,FP,"static char zRet[1024] has static storage duration, zero-initialized by C standard; EXP33 false",,high
ARR00-C,15,sqlite,src/pager.c,1030,FP,"zRet is static char[1024] (static storage), not a local automatic array; returning it is valid, not dangling",,high
EXP34-C,16,sqlite,src/pager.c,1046,FP,"setGetterMethod: pPager guaranteed non-null by all callers (internal); reads pPager->errCode after construction, no untrusted null",,high
DCL13-C,17,sqlite,src/pager.c,1066,FP,"subjRequiresPage pPg only read (pPg->pPager,pgno); const-eligible declaration misfire, no modification",,med
EXP34-C,18,sqlite,src/pager.c,1067,FP,"pPg->pPager deref: pPg always a live cache page from caller, never null on this path",,high
EXP34-C,19,sqlite,src/pager.c,1071,FP,pPager deref after pPg->pPager assignment; pPager non-null since pPg is a valid page header,,high
INT32-C,20,sqlite,src/pager.c,1074,FP,"i+1 is bounded savepoint loop index i<nSavepoint (small int); cannot overflow in practice, INT32 misfire",,high
DCL13-C,21,sqlite,src/pager.c,1087,FP,"pageInJournal reads pPager->pInJournal only; SQLITE_DEBUG helper, const-eligible misfire",,high
DCL13-C,22,sqlite,src/pager.c,1087,FP,pageInJournal reads pPg->pgno only; const-eligible misfire,,high
EXP34-C,23,sqlite,src/pager.c,1088,FP,"pPg->pgno deref: pPg is a valid page passed by debug caller, not null",,high
DCL03-C,24,sqlite,src/pager.c,1195,FP,"assert(!MEMDB) runtime field read, not constant expr; static_assert N/A",,high
INT13-C,25,sqlite,src/pager.c,1208,FP,"dc is device-characteristics bitmask int; & with SQLITE_IOCAP flags is standard idiom, value never negative",,med
DCL03-C,26,sqlite,src/pager.c,1218,FP,"assert(SQLITE_IOCAP_ATOMIC512==(512>>8)) IS a constant expression but it is a compile-time invariant check that is genuinely better as static_assert - however SQLite deliberately uses assert here for C89 portability; low-value style, FP in spirit",,high
DCL03-C,27,sqlite,src/pager.c,1219,FP,"same compile-time constant assert; portability choice, not a defect",,high
INT13-C,28,sqlite,src/pager.c,1220,FP,"dc bitmask & with flag constants; standard, value is a characteristics mask not arithmetic-negative",,med
DCL13-C,29,sqlite,src/pager.c,1240,FP,"pager_datahash pData is read-only loop over bytes; const-eligible but it is SQLITE_CHECK_PAGES debug-only, misfire",,high
DCL13-C,30,sqlite,src/pager.c,1248,FP,"pager_pagehash pPage read-only; debug-only, const-eligible misfire",,high
EXP34-C,31,sqlite,src/pager.c,1249,FP,"pPage->pPager deref: debug hash helper, pPage valid by contract",,high
EXP34-C,32,sqlite,src/pager.c,1252,FP,pPage->pPager deref again; same valid-by-contract page,,high
EXP34-C,33,sqlite,src/pager.c,1306,FP,"zSuper[0]='\0' write: caller always passes a real buffer (pTmpSpace or zSuperPtr), never null on reachable paths",,high
EXP33-C,34,sqlite,src/pager.c,1309,FP,"szJ assigned by sqlite3OsFileSize before use in short-circuit && chain; if that call fails rc!=OK short-circuits, szJ read only after success",,high
EXP33-C,35,sqlite,src/pager.c,1311,FP,len assigned by read32bits in the same && chain before len>=nSuper test; short-circuit guarantees init before read,,high
EXP33-C,36,sqlite,src/pager.c,1324,FP,cksum read at L1314 only reached after earlier && terms succeed; cksum then read32bits-initialized before the L1323 loop uses it,,high
DCL00-C,37,sqlite,src/pager.c,1357,FP,"c at L1357 is a per-record open flag, written in the exists branch; DCL00 const-suggestion is style noise, value is reassigned across iterations conceptually",,high
INT32-C,38,sqlite,src/pager.c,1359,FP,"(c-1)/HDR+1)*HDR: c is journalOff (i64, bounded by file size); journalHdrOffset asserts offset>=c and gap<HDR, no real overflow for legitimate offsets",,high
INT33-C,39,sqlite,src/pager.c,1359,FP,JOURNAL_HDR_SZ=sectorSize is validated >=32 and power-of-two in readJournalHdr before reaching journalHdrOffset; never zero,,high
INT10-C,40,sqlite,src/pager.c,1361,FP,"offset%JOURNAL_HDR_SZ in an assert; sectorSize is a positive power-of-two, modulo well-defined and non-negative (i64 offset>=0)",,high
INT33-C,41,sqlite,src/pager.c,1361,FP,same assert modulo; sectorSize validated non-zero power-of-two,,high
DCL13-C,42,sqlite,src/pager.c,1388,FP,"zeroJournalHdr reads pPager fields and calls Os methods via pPager->jfd; does not reassign pPager, but mutates pPager state through it - actually only reads pPager scalars, modifies via jfd pointee; declaration misfire, low value",,high
ARR00-C,43,sqlite,src/pager.c,1455,FP,ii at L1455 is the for-loop counter initialized in the same for(ii=0;...) statement at L1455; not uninitialized - ARR00 misread the loop header,,high
ARR01-C,44,sqlite,src/pager.c,1487,FP,"aJournalMagic is file-scope const u8 array (L757), NOT a decayed parameter; sizeof()=8 correct",,high
EXP05-C,45,sqlite,src/pager.c,1487,FP,"memcpy(zHeader,aJournalMagic,sizeof(aJournalMagic)): no const cast-away, aJournalMagic stays const source; EXP05 misfire",,high
ARR01-C,46,sqlite,src/pager.c,1488,FP,"put32bits(&zHeader[sizeof(aJournalMagic)],...) sizeof of real array=8, correct offset 8",,high
ARR01-C,47,sqlite,src/pager.c,1490,FP,"memset(zHeader,0,sizeof(aJournalMagic)+4): real array sizeof=8, writes 12 bytes into pageSize-sized zHeader, bounded",,high
EXP05-C,48,sqlite,src/pager.c,1490,FP,"no const cast-away; sizeof of const array used as size value, source const preserved",,high
INT30-C,49,sqlite,src/pager.c,1490,FP,sizeof(aJournalMagic)+4 = 8+4 compile-time constant 12; cannot wrap,,high
INT32-C,50,sqlite,src/pager.c,1490,FP,memset size sizeof(aJournalMagic)+4=12 constant into zHeader(pageSize>=512); no overflow,,high
ARR01-C,51,sqlite,src/pager.c,1497,FP,JOURNAL_HDR_SZ(pPager)=pPager->sectorSize; pPager is a real struct pointer not decayed array; ARR01 misread the macro,,high
ARR01-C,52,sqlite,src/pager.c,1517,FP,sizeof(aJournalMagic) of real 8-byte array; offset constant,,high
ARR30-C,53,sqlite,src/pager.c,1517,FP,"zHeader is pPager->pTmpSpace (pageSize bytes, not a VLA); writes at offset 28 (sizeof+20) bounded by nHeader<=pageSize; ARR30 misread allocation",,high
INT30-C,54,sqlite,src/pager.c,1517,FP,sizeof(aJournalMagic)+4=12 compile-time constant; no wrap,,high
ARR01-C,55,sqlite,src/pager.c,1520,FP,real array sizeof=8; offset constant,,high
INT30-C,56,sqlite,src/pager.c,1520,FP,sizeof(aJournalMagic)+8=16 constant; no wrap,,high
ARR01-C,57,sqlite,src/pager.c,1522,FP,real array sizeof=8,,high
INT30-C,58,sqlite,src/pager.c,1522,FP,sizeof(aJournalMagic)+12=20 constant; no wrap,,high
ARR01-C,59,sqlite,src/pager.c,1525,FP,real array sizeof=8,,high
INT30-C,60,sqlite,src/pager.c,1525,FP,sizeof(aJournalMagic)+16=24 constant; no wrap,,high
ARR01-C,61,sqlite,src/pager.c,1532,FP,real array sizeof=8,,high
EXP05-C,62,sqlite,src/pager.c,1532,FP,"&zHeader[sizeof+20]: zHeader is char* into pTmpSpace, no const cast-away; EXP05 misfire",,high
INT30-C,63,sqlite,src/pager.c,1532,FP,sizeof(aJournalMagic)+20=28 constant; no wrap,,high
INT32-C,64,sqlite,src/pager.c,1532,FP,"memset(&zHeader[28],0,nHeader-28): nHeader clamped to JOURNAL_HDR_SZ and >=28 since min sectorSize 32 capped; bounded subtraction, value non-negative because nHeader>=28 always (sector>=32, header layout); no overflow on legit input",,high
ARR01-C,65,sqlite,src/pager.c,1533,FP,real array sizeof=8,,high
INT30-C,66,sqlite,src/pager.c,1533,FP,sizeof(aJournalMagic)+20=28 constant,,high
EXP33-C,67,sqlite,src/pager.c,1643,FP,"iPageSize assigned by read32bits(...,&iPageSize) in && chain at L1634 before any use; short-circuit init",,high
EXP33-C,68,sqlite,src/pager.c,1652,FP,"iSectorSize assigned by read32bits(...,&iSectorSize) at L1633 in same chain before use",,high
INT14-C,69,sqlite,src/pager.c,1654,FP,"iPageSize range/power-of-two checks mix bitwise ((iPageSize-1)&iPageSize) and compare; deliberate power-of-two test idiom, readability rule only",,med
INT14-C,70,sqlite,src/pager.c,1654,FP,iSectorSize same power-of-two validation idiom; readability noise,,med
INT32-C,71,sqlite,src/pager.c,1749,FP,"nSuper+20 where nSuper is strlen of zSuper (a path, bounded by mxPathname); journalOff i64, no real overflow",,high
EXP33-C,72,sqlite,src/pager.c,1762,FP,jrnlSize assigned by sqlite3OsFileSize at L1761 inside the if-condition before the jrnlSize>journalOff compare; short-circuit init,,high
EXP34-C,73,sqlite,src/pager.c,1773,FP,"sqlite3PagerDataVersion returns pPager->iDataVersion; pPager non-null by public-API contract, all callers hold a valid pager",,high
API00-C,74,sqlite,src/pager.c,1781,FP,"same function; pPager validated by contract, returns a field read",,high
DCL13-C,75,sqlite,src/pager.c,1781,FP,"pPager read-only here but signature is fixed public API in pager.h; const-add would need header change, low-value declaration misfire",,high
ARR00-C,76,sqlite,src/pager.c,1792,FP,"releaseAllSavepoints ii is the for-loop counter init at L1792 for(ii=0;...); not uninitialized, ARR00 misread loop",,high
DCL13-C,77,sqlite,src/pager.c,1809,FP,"addToSavepointBitvecs reads pPager->aSavepoint and mutates via sqlite3BitvecSet on pointees; declaration misfire, low value",,high
ARR00-C,78,sqlite,src/pager.c,1813,FP,addToSavepointBitvecs ii is for-loop counter at L1813; not uninitialized,,high
DCL03-C,79,sqlite,src/pager.c,1874,FP,assert((PAGER_JOURNALMODE_MEMORY&5)!=1) is a compile-time invariant; SQLite uses runtime assert by convention; style-only,,high
DCL03-C,80,sqlite,src/pager.c,1875,FP,same compile-time mode-bit assert; convention,,high
DCL03-C,81,sqlite,src/pager.c,1876,FP,same,,high
DCL03-C,82,sqlite,src/pager.c,1877,FP,same,,high
DCL03-C,83,sqlite,src/pager.c,1878,FP,same,,high
DCL03-C,84,sqlite,src/pager.c,1879,FP,same,,high
INT13-C,85,sqlite,src/pager.c,1880,FP,"iDc is device-characteristics bitmask; & with IOCAP flag is standard, mask not arithmetic-signed",,med
INT13-C,86,sqlite,src/pager.c,1948,FP,"rc & 0xff masks an SQLite error code int; standard low-byte extraction idiom, well-defined for the small positive codes used",,med
DCL13-C,87,sqlite,src/pager.c,1981,FP,"pagerFlushOnCommit-region pPager read-only; declaration misfire on internal helper, low value",,high
DCL13-C,88,sqlite,src/pager.c,2240,FP,"pager_cksum reads pPager->cksumInit/pageSize only; const-eligible but signature stable, low-value misfire",,high
INT32-C,89,sqlite,src/pager.c,2245,FP,"i-=200 where i=pageSize-200, pageSize is a validated power-of-two 512..65536; bounded loop, decrements to <=0 termination, no overflow",,high
INT14-C,90,sqlite,src/pager.c,2302,FP,"isMainJrnl is a 0/1 flag (asserted (isMainJrnl&~1)==0) used in *pOffset+=...+isMainJrnl*4; arithmetic on a bounded bit, readability noise",,med
INT32-C,91,sqlite,src/pager.c,2328,FP,"(*pOffset)+4: pOffset is a journal byte offset i64 bounded by journal file size; legitimate journals far below i64 max, no real overflow",,high
INT14-C,92,sqlite,src/pager.c,2330,FP,"pPager INT14 bitwise+arithmetic - pPager is a pointer, this is a misclassified finding, no real defect",,low
INT32-C,93,sqlite,src/pager.c,2330,FP,"isMainJrnl*4 where isMainJrnl is 0/1 (asserted); product is 0 or 4, cannot overflow",,high
EXP33-C,94,sqlite,src/pager.c,2337,FP,"pgno assigned by read32bits(jfd,*pOffset,&pgno) at L2326 before any use; rc-checked, short-circuit init",,high
INT32-C,95,sqlite,src/pager.c,2345,FP,"(*pOffset)-4 to read checksum; pOffset advanced by pageSize+4 just above so >=4, no underflow on real records",,high
EXP33-C,96,sqlite,src/pager.c,2347,FP,"cksum assigned by read32bits(jfd,(*pOffset)-4,&cksum) at L2345 before compare at L2347; init before use",,high
PRE32-C,97,sqlite,src/pager.c,2407,FP,PAGERTRACE is empty macro in live build (L120); arg is a normal printf-style tuple with no preprocessor directive; PRE32 misread the multi-line arg,,high
PRE32-C,98,sqlite,src/pager.c,2407,FP,"the PAGERTRACE argument contains no #directive, just a parenthesized format+args list; PRE32 false match on multiline",,high
EXP34-C,99,sqlite,src/pager.c,2462,FP,"sqlite3PcacheMakeDirty(pPg) reached only after rc=sqlite3PagerGet(...,&pPg,1) returns SQLITE_OK at L2461 guaranteeing pPg non-null; EXP34 misses the rc check",,high
ARR01-C,100,sqlite,src/pager.c,2484,FP,"sizeof(pPager)... pager_delsuper pVfs=pPager->pVfs; pPager is real struct pointer not decayed array; szOsFile sized via pVfs, ARR01 misread",,high
DCL13-C,101,sqlite,src/pager.c,2534,FP,"pager_delsuper reads pPager->pVfs only; const-eligible but internal-helper declaration misfire, low value",,high
INT32-C,102,sqlite,src/pager.c,2549,FP,"2*(i64)pVfs->szOsFile: szOsFile is a small VFS-defined struct size (hundreds of bytes), explicit i64 cast prevents overflow; no real wrap",,high
INT32-C,103,sqlite,src/pager.c,2556,FP,"((u8*)pSuper)+pVfs->szOsFile is pointer arithmetic within a 2*szOsFile allocation; in-bounds by construction, not integer overflow",,high
INT32-C,104,sqlite,src/pager.c,2567,FP,"1+(i64)pVfs->mxPathname: mxPathname small (e.g. 512), explicit i64 cast; no overflow",,high
STR34-C,105,sqlite,src/pager.c,2577,FP,"*zFree is the leading nul byte zFree[0]=0 just written; signed-char read into larger type but value is 0, sign-extension benign; STR34 theoretical",,med
STR34-C,106,sqlite,src/pager.c,2577,FP,"zFree[4] region (zSuperJournal) holds file bytes; reads are via strlen/OsAccess on a path string, not arithmetic sign-extension; STR34 theoretical noise",,med
ARR37-C,107,sqlite,src/pager.c,2578,FP,"zSuperJournal[nSuperJournal+2] - the subscript is on zSuperJournal which IS a char* into the zFree buffer; allocation zFree=Malloc(4+nSuperJournal+nSuperPtr+2) and zSuperPtr=&zSuperJournal[nSuperJournal+2] is in-bounds (nSuperPtr bytes remain); not an out-of-array access, pointer-into-buffer idiom",,high
STR34-C,108,sqlite,src/pager.c,2578,FP,zSuperJournal points into a heap buffer of size 4+nSuperJournal+nSuperPtr+2; reading char value is benign and no sign-extension memory-safety bug,,med
STR34-C,109,sqlite,src/pager.c,2578,FP,zSuperJournal[nSuperJournal+2] is the address used to derive zSuperPtr inside the allocated block; syntactic STR34 misfire not a defect,,med
ARR37-C,110,sqlite,src/pager.c,2581,FP,zSuperJournal is a valid pointer into the malloc'd zFree block sized to hold nSuperJournal+... bytes; subscript is in-bounds,,med
ARR37-C,111,sqlite,src/pager.c,2582,FP,zSuperJournal[nSuperJournal+1] is the trailing nul slot inside the 4+nSuperJournal+nSuperPtr+2 allocation; in-bounds write,,med
ARR37-C,112,sqlite,src/pager.c,2612,FP,zSuperPtr was filled by readSuperJournal into nSuperPtr-sized region inside zFree; zSuperPtr[0] read is in-bounds,,med
EXP34-C,113,sqlite,src/pager.c,2612,FP,"zSuper is the function param non-null by contract (caller passes &pTmpSpace[4]); compared via strcmp only, no unguarded deref defect",,med
ARR37-C,114,sqlite,src/pager.c,2618,FP,zJournal walks nul-terminated child-journal names within the buffer bounded by while((zJournal-zSuperJournal)<nSuperJournal); pointer arithmetic intended and bounded,,med
INT32-C,115,sqlite,src/pager.c,2670,FP,"szPage is pageSize (512..65536) and nPage is Pgno bounded by mxPgno; i64 product cannot overflow 64-bit for realistic page counts, contract-bounded",,med
INT31-C,116,sqlite,src/pager.c,2676,FP,"szPage is pPager->pageSize, always a power of two in 512..SQLITE_MAX_PAGE_SIZE, positive; size_t conversion is safe",,med
INT32-C,117,sqlite,src/pager.c,2680,FP,newSize-szPage guarded by branch (currentSize+szPage)<=newSize so newSize>=szPage; no overflow,,med
API00-C,118,sqlite,src/pager.c,2694,FP,sqlite3SectorSize is internal helper; pFile guaranteed open by callers (setSectorSize asserts isOpen); contract non-null,,med
DCL03-C,119,sqlite,src/pager.c,2699,FP,assert() of a compile-time constant relationship is standard SQLite debug idiom not a static_assert candidate defect; harmless,,med
EXP34-C,120,sqlite,src/pager.c,2729,FP,pPager null-deref guarded by surrounding asserts and never-null caller contract in readDbPage,,med
INT32-C,121,sqlite,src/pager.c,2835,FP,1+(i64)pPager->pVfs->mxPathname; mxPathname is small VFS-bounded int (e.g. 512); i64 promotion makes overflow impossible,,med
INT33-C,122,sqlite,src/pager.c,2871,FP,JOURNAL_PG_SZ(pPager) = pageSize+8 which is always >=520; cannot be zero,,med
INT33-C,123,sqlite,src/pager.c,2890,FP,JOURNAL_PG_SZ(pPager) = pageSize+8 always nonzero; div-by-zero impossible,,med
DCL03-C,124,sqlite,src/pager.c,2942,FP,assert() of constant in DEBUG build; established SQLite idiom not a real DCL03 defect,,med
INT32-C,125,sqlite,src/pager.c,2974,FP,1+(i64)mxPathname identical bounded-small VFS value as 121; no overflow,,med
EXP34-C,126,sqlite,src/pager.c,2983,FP,zSuper=&pPager->pTmpSpace[4] then read; pTmpSpace allocated >= pageSize; zSuper non-null by construction,,med
EXP34-C,127,sqlite,src/pager.c,3022,FP,pPg is the function param of readDbPage; non-null by caller contract and asserts,,med
EXP34-C,128,sqlite,src/pager.c,3028,FP,pPager=pPg->pPager dereferenced after asserts establishing valid pager; contract-safe,,med
PRE32-C,129,sqlite,src/pager.c,3070,FP,PAGERTRACE is a printf-style trace macro/no-op; the argument is a parenthesized format list not a real preprocessor-directive-in-macro-arg UB,,med
PRE32-C,130,sqlite,src/pager.c,3070,FP,"same PAGERTRACE trace call; format string contains no actual # preprocessor directive, analyzer misparse",,med
DCL13-C,131,sqlite,src/pager.c,3084,FP,pPg->pData is written via put32bits and pPg->pPager read; param object reached through is mutated so const is wrong,,med
INT32-C,132,sqlite,src/pager.c,3090,FP,"((char*)pPg->pData)+24 is pointer arithmetic into a page buffer >=512 bytes; offset 24 in-bounds, not integer overflow",,med
INT32-C,133,sqlite,src/pager.c,3095,FP,((char*)pPg->pData)+92 offset within page buffer (>=512); in-bounds pointer arithmetic,,med
INT32-C,134,sqlite,src/pager.c,3096,FP,((char*)pPg->pData)+96 offset within page buffer (>=512); in-bounds,,med
EXP20-C,135,sqlite,src/pager.c,3120,FP,refcount==1 here is a deliberate exact-equality test (drop page only when sole reference); not a boolean misuse,,med
EXP33-C,136,sqlite,src/pager.c,3193,FP,p is the loop variable of for(p=pList;...) initialized in the for-init; only under SQLITE_DEBUG assert loop; not uninitialized,,med
EXP34-C,137,sqlite,src/pager.c,3193,FP,p iterates a non-null pList (assert pList) with p->pDirty guard in the condition; no null deref,,med
EXP40-C,138,sqlite,src/pager.c,3204,FP,**ppNext=&pList is the standard list-compaction unlink idiom in pagerWalFrames; not const circumvention,,med
DCL30-C,139,sqlite,src/pager.c,3206,FP,"p is a local PgHdr* iterator not an out-param escaping the function; DCL30 misfire, no dangling address returned",,med
ARR30-C,140,sqlite,src/pager.c,3216,FP,aStat is u32 aStat[4]; PAGER_STAT_WRITE is a fixed enum constant (1) < 4; in-bounds,,med
INT33-C,141,sqlite,src/pager.c,3305,FP,"pPager->pageSize is power-of-two 512..max, never zero by SetPagesize contract; no div-by-zero",,med
DCL13-C,142,sqlite,src/pager.c,3406,FP,"pSavepoint fields (iOffset/iHdrOffset/iSubRec/nOrig/aWalData) are only read; const would be valid here -- but signature is part of pager-internal API; treating as FP per fixed-API note... reads only, leaning FP because pInSavepoint pointee is mutated via Bitvec ops downstream",,med
INT33-C,143,sqlite,src/pager.c,3479,FP,JOURNAL_PG_SZ(pPager)=pageSize+8 always nonzero,,med
INT32-C,144,sqlite,src/pager.c,3494,FP,"iSubRec*(4+pageSize): iSubRec bounded by nSubRec (sub-journal record count) and pageSize<=65536; i64 product safe in practice, contract-bounded",,med
API00-C,145,sqlite,src/pager.c,3518,FP,sqlite3PagerSetCachesize internal API; pPager non-null by caller contract throughout pager,,med
DCL13-C,146,sqlite,src/pager.c,3518,FP,"pPager passed to sqlite3PcacheSetCachesize which mutates the pcache it owns; pager state effectively modified, const wrong",,med
API00-C,147,sqlite,src/pager.c,3526,FP,sqlite3PagerSetSpillsize internal API; pPager non-null by contract,,med
DCL13-C,148,sqlite,src/pager.c,3526,FP,pPager forwarded to PcacheSetSpillsize mutating owned cache; const inappropriate,,med
EXP34-C,149,sqlite,src/pager.c,3535,FP,"pPager->szMmap is assigned (write) then pagerFixMaplimit; param mutated, not a null-deref defect",,med
API00-C,150,sqlite,src/pager.c,3549,FP,sqlite3PagerSetMmapLimit internal API; pPager non-null by contract and szMmap is written,,med
API00-C,151,sqlite,src/pager.c,3557,FP,sqlite3PagerShrink internal API; pPager non-null by contract,,med
DCL13-C,152,sqlite,src/pager.c,3557,FP,pPager forwarded to PcacheShrink which mutates owned cache; const wrong,,med
API00-C,153,sqlite,src/pager.c,3612,FP,sqlite3PagerSetFlags internal API; pPager non-null by contract; many fields written,,med
EXP34-C,154,sqlite,src/pager.c,3617,FP,pPager->tempFile etc are written throughout SetFlags after this point; not an unguarded null deref,,med
DCL13-C,155,sqlite,src/pager.c,3685,FP,"pPager fields written (sqlite3_opentemp_count aside, pVfs used to open); object used for mutation, const wrong",,med
INT32-C,156,sqlite,src/pager.c,3692,FP,sqlite3_opentemp_count is a test-only diagnostic counter under SQLITE_TEST; incremented for analysis; INT_MAX wrap irrelevant,,med
API00-C,157,sqlite,src/pager.c,3723,FP,sqlite3PagerSetBusyHandler internal API; pPager non-null by contract; fields written,,med
API00-C,158,sqlite,src/pager.c,3723,FP,xBusyHandler may legitimately be NULL (clearing handler); stored not dereferenced; no defect,,med
DCL13-C,159,sqlite,src/pager.c,3726,FP,pBusyHandlerArg stored into pPager->pBusyHandlerArg (a void*); storing into non-const field makes const param wrong,,med
ARR37-C,160,sqlite,src/pager.c,3732,FP,"ap=(void**)&pPager->xBusyHandler is a deliberate type-pun to pass {handler,arg} pair to FileControlHint; ap[0] in-bounds of struct layout, asserted",,med
ARR37-C,161,sqlite,src/pager.c,3733,FP,ap[1] is pBusyHandlerArg adjacent in struct; deliberate verified by assert ap[1]==pBusyHandlerArg; intended,,med
API00-C,162,sqlite,src/pager.c,3767,FP,sqlite3PagerSetPagesize internal API; pPager non-null by contract; many fields written,,med
API00-C,163,sqlite,src/pager.c,3767,FP,"pPageSize is dereferenced (read *pPageSize and written back); non-null by caller contract, not validated but contract-safe",,med
EXP34-C,164,sqlite,src/pager.c,3782,FP,pPager->memDb/dbSize read after asserts; pager non-null by contract in SetPagesize,,med
INT33-C,165,sqlite,src/pager.c,3810,FP,"pageSize asserted power-of-two 512..MAX (line 3781), nonzero; no div-by-zero",,med
INT33-C,166,sqlite,src/pager.c,3812,FP,pageSize same asserted nonzero power-of-two; no div-by-zero,,med
MEM30-C,167,sqlite,src/pager.c,3818,FP,"*pPageSize=pPager->pageSize: pageSize is an int member, nothing freed; the prior sqlite3PageFree was on pTmpSpace not pageSize; no use-after-free",,med
MEM30-C,168,sqlite,src/pager.c,3820,FP,pPager->nReserve assignment: nReserve is an i16 member never freed; MEM30 misfire,,med
API00-C,169,sqlite,src/pager.c,3836,FP,sqlite3PagerTempSpace internal API; pPager non-null by contract; returns pTmpSpace,,med
DCL13-C,170,sqlite,src/pager.c,3836,FP,"returns pPager->pTmpSpace; reading a pointer member is const-valid but this is fixed pager API surface -- reads only, lean FP as analyzer-noise on internal API",,med
API00-C,171,sqlite,src/pager.c,3847,FP,sqlite3PagerMaxPageCount internal API; pPager non-null by contract; mxPgno written when mxPage>0,,med
EXP33-C,172,sqlite,src/pager.c,3876,FP,saved_cnt is a file-scope static (zero-initialized by C) used only in SQLITE_TEST io-error harness; set in disable before use in enable,,med
API00-C,173,sqlite,src/pager.c,3897,FP,sqlite3PagerReadFileheader internal btree-only API; pPager non-null by contract; pDest memset first,,med
INT31-C,174,sqlite,src/pager.c,3899,FP,"N is the header byte count (small fixed value passed by btree, e.g. 100); memset size positive and small; no truncation defect",,med
API00-C,175,sqlite,src/pager.c,3925,FP,sqlite3PagerPagecount internal API; pPager non-null by contract,,med
API00-C,176,sqlite,src/pager.c,3925,FP,pnPage is an out-param dereferenced by contract (caller passes &var); not validated but contract-safe,,med
DCL13-C,177,sqlite,src/pager.c,3925,FP,reads pPager->dbSize only; const would compile but this is fixed pager API; analyzer noise on read-only internal accessor,,med
DCL13-C,178,sqlite,src/pager.c,3987,FP,pPg only read for pgno in PagerPagenumber; const valid but fixed public API signature; DCL13 noise,,med
DCL13-C,179,sqlite,src/pager.c,3999,FP,sqlite3PagerRef forwards pPg... actually pPager param at 3999 is assertTruncateConstraint (DEBUG) reading pcache; mutates via iterate callback; const inappropriate,,med
API00-C,180,sqlite,src/pager.c,4017,FP,sqlite3PagerTruncateImage internal API; pPager non-null by contract; dbSize written,,med
EXP34-C,181,sqlite,src/pager.c,4080,FP,p=pPager->pMmapFreelist checked in if(pPager->pMmapFreelist) before deref; guarded,,med
INT32-C,182,sqlite,src/pager.c,4105,FP,pPager->nMmapOut++ is a bounded outstanding-mmap-page counter (limited by cache/refs); cannot reach INT_MAX in practice,,med
EXP34-C,183,sqlite,src/pager.c,4116,FP,pPg is param of pagerReleaseMapPage; non-null by caller contract (returned by AcquireMapPage),,med
EXP34-C,184,sqlite,src/pager.c,4117,FP,pPager=pPg->pPager; pPg non-null by contract; pPager always set in AcquireMapPage,,med
INT32-C,185,sqlite,src/pager.c,4117,FP,nMmapOut-- balances the ++ in AcquireMapPage; counter stays >=0 by pairing invariant; no INT_MIN underflow,,med
DCL13-C,186,sqlite,src/pager.c,4128,FP,"sqlite3PagerClose path... 4128 is pagerFreeMapHdrs; pPager iterated/freed, mutated; const wrong",,med
DCL13-C,187,sqlite,src/pager.c,4142,FP,"databaseIsUnmoved reads pPager but calls OsFileControl with pager-owned fd; effectively used for IO, fixed internal API; noise",,med
API00-C,188,sqlite,src/pager.c,4176,FP,sqlite3PagerClose public API; pPager non-null by contract; object freed at end,,med
API00-C,189,sqlite,src/pager.c,4176,FP,db may legitimately be NULL (assert db||pagerUseWal==0 handles it); used guarded under if(db&&...); not unvalidated deref,,med
MEM30-C,190,sqlite,src/pager.c,4194,FP,"a=pTmp aliases pPager->pTmpSpace; pTmp is freed later at line 4226 sqlite3PageFree(pTmp); at 4194 it is still live, no use-after-free",,med
API00-C,191,sqlite,src/pager.c,4239,FP,sqlite3PagerPagenumber NDEBUG/TEST-only API; pPg non-null by contract,,med
DCL13-C,192,sqlite,src/pager.c,4239,FP,reads pPg->pgno only; fixed public API signature; DCL13 noise on read-only accessor,,med
API00-C,193,sqlite,src/pager.c,4247,FP,sqlite3PagerRef public API; pPg non-null by contract,,med
INT13-C,194,sqlite,src/pager.c,4304,FP,"iDc is device-characteristics bitmask from OsDeviceCharacteristics; & SAFE_APPEND tests a flag; int vs unsigned is cosmetic, values are nonneg flag bits",,med
ARR01-C,195,sqlite,src/pager.c,4329,FP,"aJournalMagic is a real file-scope static u8 array (8 bytes), not a decayed parameter; sizeof yields 8 correctly",,med
INT30-C,196,sqlite,src/pager.c,4329,FP,"sizeof(aJournalMagic)+4 = 12, a compile-time constant array size for zHeader; no runtime wrap",,med
MEM05-C,197,sqlite,src/pager.c,4329,FP,"u8 zHeader[sizeof(aJournalMagic)+4] is a fixed 12-byte stack array (compile-time const), not a runtime VLA",,med
ARR01-C,198,sqlite,src/pager.c,4331,FP,aJournalMagic is a real array; sizeof is 8; not a decayed-pointer sizeof bug,,med
EXP05-C,199,sqlite,src/pager.c,4331,FP,"memcpy(zHeader,aJournalMagic,sizeof(aJournalMagic)) does not cast away const; EXP05 misparse of sizeof",,med
ARR01-C,200,sqlite,src/pager.c,4332,FP,"aJournalMagic real array, sizeof correct (8); same as 195/198",,med
INT13-C,201,sqlite,src/pager.c,4355,FP,"iDc bitmask flag test (&SEQUENTIAL); cosmetic signedness, flag bits nonneg",,med
INT13-C,202,sqlite,src/pager.c,4367,FP,iDc bitmask flag test (&SAFE_APPEND); cosmetic signedness,,med
EXP00-C,203,sqlite,src/pager.c,4370,FP,syncFlags|(cond?DATAONLY:0) precedence is unambiguous (| of two clear operands); cosmetic EXP00,,med
INT13-C,204,sqlite,src/pager.c,4377,FP,iDc bitmask flag test (&SAFE_APPEND); cosmetic signedness,,med
ARR01-C,205,sqlite,src/pager.c,4488,FP,"line 4488 memcpy(&dbFileVers,&pData[24],sizeof(pPager->dbFileVers)); sizeof a struct member not a decayed param; correct size",,med
ARR30-C,206,sqlite,src/pager.c,4493,FP,aStat[PAGER_STAT_WRITE] with fixed enum index (1) into u32[4]; in-bounds,,med
PRE32-C,207,sqlite,src/pager.c,4498,FP,"PAGERTRACE trace macro; parenthesized format args, no real preprocessor directive UB",,med
PRE32-C,208,sqlite,src/pager.c,4498,FP,same PAGERTRACE STORE trace; no actual # directive in argument,,med
EXP34-C,209,sqlite,src/pager.c,4506,FP,pList non-null guaranteed (assert pList in pagerWalFrames; loop precondition); member access safe,,med
DCL13-C,210,sqlite,src/pager.c,4520,FP,"sqlite3PagerFlush... 4520 openSubJournal mutates pPager->sjfd via JournalOpen; pPager modified, const wrong",,med
EXP34-C,211,sqlite,src/pager.c,4548,FP,pPg param of subjournalPage; non-null by caller contract,,med
EXP34-C,212,sqlite,src/pager.c,4549,FP,"pPager=pPg->pPager dereferenced; pPg non-null by contract, pPager always set",,med
ARR30-C,213,sqlite,src/pager.c,4643,FP,aStat[PAGER_STAT_SPILL] fixed enum index (3) into u32[4]; in-bounds,,med
API00-C,214,sqlite,src/pager.c,4686,FP,sqlite3PagerFlush internal API; pPager non-null by contract,,med
API00-C,215,sqlite,src/pager.c,4735,FP,sqlite3PagerOpen public API; pVfs non-null by caller contract (sqlite3 core always passes a VFS),,med
API00-C,216,sqlite,src/pager.c,4735,FP,"sqlite3PagerOpen is an internal API; *ppPager=0 written at 4766 and contract requires non-null caller-supplied out-pointer, no untrusted deref",,high
API00-C,217,sqlite,src/pager.c,4735,FP,"xReinit stored into pPager->xReiniter at 5076 only; never dereferenced here, NULL is valid (function pointer slot)",,high
INT13-C,218,sqlite,src/pager.c,4754,FP,"INT13 signed-bitwise on flags bitfield; flags is an internal API flag word not attacker data and value range is small, no UB",,high
INT13-C,219,sqlite,src/pager.c,4769,FP,same INT13 misfire on flags & PAGER_MEMORY; bounded internal flag bits,,high
INT32-C,220,sqlite,src/pager.c,4786,FP,"nPathname = pVfs->mxPathname+1; mxPathname is a small VFS constant (e.g. 512/1024), no realistic overflow",,high
INT32-C,221,sqlite,src/pager.c,4787,FP,2*(i64)nPathname computed in 64-bit (cast to i64 first); nPathname bounded by mxPathname so no overflow,,high
STR34-C,222,sqlite,src/pager.c,4803,FP,"STR34 misfire; reading zFilename[strlen+1] as char to walk URI args, no sign-extension-to-int defect that affects logic",,high
STR34-C,223,sqlite,src/pager.c,4803,FP,"same STR34 misfire on URI-arg walk; bytes compared against 0 only, sign irrelevant",,high
DCL03-C,224,sqlite,src/pager.c,4869,FP,"DCL03 assert(SQLITE_PTRSIZE==sizeof(Pager*)) is a compile-time invariant check; acceptable assert idiom, not a bug",,high
EXP34-C,225,sqlite,src/pager.c,4871,FP,pPager assigned from sqlite3MallocZero at 4870 and null-checked at 4886 (returns NOMEM) before deref at 4890,,high
INT32-C,226,sqlite,src/pager.c,4874,FP,"(u64)journalFileSize*2 done in u64; journalFileSize=ROUND8(sqlite3JournalSize(pVfs)) is a small VFS-fixed size, not overflowing",,high
ARR39-C,227,sqlite,src/pager.c,4890,FP,"ARR39 misfire; pPtr is u8* so pPtr += ROUND8(sizeof(*pPager)) is correct byte arithmetic, no double-scaling",,high
ARR38-C,228,sqlite,src/pager.c,4902,FP,"memcpy(pPtr,zPathname,nPathname) into buffer sized (u64)nPathname+1 reserved at 4877; nPathname re-derived via Strlen30 of bounded path",,high
INT31-C,229,sqlite,src/pager.c,4904,FP,"nUriByte is int but assert(nUriByte>=1) at 4809 and it equals a pointer-difference within the allocated filename block; positive, fits size_t",,high
ARR38-C,230,sqlite,src/pager.c,4914,FP,"memcpy zJournal: buffer reserved as nPathname+8+1 at 4879, copies nPathname then 8 bytes; bounded by allocation",,high
ARR38-C,231,sqlite,src/pager.c,4928,FP,"memcpy zWal: buffer reserved as nPathname+4+1 at 4881, copies nPathname then 4 bytes; bounded by allocation",,high
INT13-C,232,sqlite,src/pager.c,4950,FP,"INT13 signed-bitwise on fout (VFS xOpen out-flags); small flag word, no UB",,high
INT13-C,233,sqlite,src/pager.c,4951,FP,same INT13 on fout&SQLITE_OPEN_READONLY; bounded flag bits,,high
DCL03-C,234,sqlite,src/pager.c,4965,FP,DCL03 assert(SQLITE_DEFAULT_PAGE_SIZE<=SQLITE_MAX_DEFAULT_PAGE_SIZE) compile-time invariant; acceptable,,high
DCL03-C,235,sqlite,src/pager.c,4976,FP,DCL03 assert(SQLITE_IOCAP_ATOMIC512==(512>>8)) compile-time invariant; acceptable,,high
DCL03-C,236,sqlite,src/pager.c,4977,FP,DCL03 assert(SQLITE_IOCAP_ATOMIC64K==(65536>>8)) compile-time invariant; acceptable,,high
DCL03-C,237,sqlite,src/pager.c,4978,FP,DCL03 assert(SQLITE_MAX_DEFAULT_PAGE_SIZE<=65536) compile-time invariant; acceptable,,high
INT13-C,238,sqlite,src/pager.c,4980,FP,"INT13 on iDc (device characteristics flag word) bitwise; bounded flag bits, no UB",,high
INT13-C,239,sqlite,src/pager.c,4988,FP,same INT13 on iDc & SQLITE_IOCAP_IMMUTABLE; bounded flag bits,,high
DCL03-C,240,sqlite,src/pager.c,5055,FP,DCL03 assert(PAGER_LOCKINGMODE_EXCLUSIVE==1) compile-time invariant; acceptable,,high
INT14-C,241,sqlite,src/pager.c,5061,FP,INT14 readability flag on SQLITE_DEFAULT_SYNCHRONOUS used in (val+1)|PAGER_CACHESPILL; correct intentional idiom,,high
DCL30-C,242,sqlite,src/pager.c,5081,FP,"DCL30 misfire; *ppPager=pPager stores a heap pointer (returned to caller), not the address of a local",,high
API00-C,243,sqlite,src/pager.c,5090,FP,"sqlite3_database_file_object: zName is the VFS filename embedded in the Pager block; contract guarantees a valid embedded name, internal use",,high
ARR00-C,244,sqlite,src/pager.c,5093,FP,ARR00 zName[-1]: intentional walk backwards over the \0\0\0\0 prefix embedded before the filename in the Pager alloc block; in-bounds by construction,,high
ARR00-C,245,sqlite,src/pager.c,5093,FP,same intentional zName[-2] backward scan over embedded prefix; in-bounds,,high
ARR00-C,246,sqlite,src/pager.c,5093,FP,same intentional zName[-3] backward scan; in-bounds,,high
ARR00-C,247,sqlite,src/pager.c,5093,FP,same intentional zName[-4] backward scan; in-bounds (4-byte zero prefix guaranteed present),,high
ARR39-C,248,sqlite,src/pager.c,5096,FP,"ARR39 misfire; zName is char*, zName-4-sizeof(Pager*) is correct byte address of the embedded Pager* pointer",,high
INT30-C,249,sqlite,src/pager.c,5096,FP,"INT30 misfire; pointer subtraction within a single allocated object, not unsigned integer underflow",,high
EXP05-C,250,sqlite,src/pager.c,5098,FP,EXP05 cast (Pager**)p drops const to read back the embedded pointer; deliberate and the pointed-to bytes are not modified,,med
DCL03-C,251,sqlite,src/pager.c,5269,FP,DCL03 assert in PagerSharedLock guarding internal state invariants; acceptable assert idiom,,high
INT13-C,252,sqlite,src/pager.c,5337,FP,INT13 on fout journal-open flags; bounded flag bits,,high
ARR01-C,253,sqlite,src/pager.c,5407,FP,"ARR01 sizeof(pPager->dbFileVers) is sizeof a fixed char[16] member, not a decayed parameter; correct",,high
MEM05-C,254,sqlite,src/pager.c,5407,FP,"MEM05 dbFileVers is char[sizeof(member)] = fixed 16-byte stack array, not a runtime-sized VLA",,high
DCL03-C,255,sqlite,src/pager.c,5453,FP,DCL03 assert(!MEMDB) state invariant; acceptable,,high
INT13-C,256,sqlite,src/pager.c,5567,FP,INT13 on flags bitwise in a getter; bounded internal flag bits,,high
ARR30-C,257,sqlite,src/pager.c,5572,FP,"aStat[PAGER_STAT_HIT]=aStat[0], array size 4 constant index; in-bounds",,high
ARR30-C,258,sqlite,src/pager.c,5619,FP,"aStat[PAGER_STAT_MISS]=aStat[1], constant index into size-4 array; in-bounds",,high
MSC07-C,259,sqlite,src/pager.c,5629,FP,"MSC07 label pager_acquire_err reached via goto, not unreachable code after the return at 5627",,high
INT13-C,260,sqlite,src/pager.c,5656,FP,INT13 on flags bitwise; bounded internal flag bits,,high
DCL30-C,261,sqlite,src/pager.c,5696,FP,DCL30 misfire in PagerBegin; pPg is a local PgHdr* not assigned through a parameter to escape,,high
DCL13-C,262,sqlite,src/pager.c,5711,FP,"DCL13 pPager const: pager_open_journal mutates pPager fields (pInJournal,nRec,eState) so const would be wrong; FP",,low
API00-C,263,sqlite,src/pager.c,5726,FP,"sqlite3PagerGet internal dispatcher; pPager guaranteed valid by caller, xGet dispatch, no untrusted deref",,high
API00-C,264,sqlite,src/pager.c,5726,FP,"ppPage out-pointer contract-required non-null; written by getter, not validated locally by design",,high
MSC37-C,265,sqlite,src/pager.c,5726,FP,"MSC37 misfire; PagerGet returns pPager->xGet(...) on the live path (#else branch compiled), always returns a value",,high
DCL11-C,266,sqlite,src/pager.c,5734,FP,DCL11 %u vs Pgno in a #if 0 disabled debug printf (line 5732-5740 dead); not compiled,,high
ERR33-C,267,sqlite,src/pager.c,5735,FP,ERR33 fflush in #if 0 disabled debug block; not compiled,,high
DCL11-C,268,sqlite,src/pager.c,5738,FP,DCL11 %u vs Pgno in #if 0 disabled debug printf; not compiled,,high
DCL11-C,269,sqlite,src/pager.c,5738,FP,DCL11 %02x vs int rc in #if 0 disabled debug printf; not compiled,,high
ERR33-C,270,sqlite,src/pager.c,5739,FP,ERR33 fflush in #if 0 disabled debug block; not compiled,,high
API00-C,271,sqlite,src/pager.c,5759,FP,"sqlite3PagerLookup asserts pPager!=0 at 5761; internal API, non-null by contract",,high
DCL13-C,272,sqlite,src/pager.c,5759,FP,"DCL13 pPager const in Lookup: passed to sqlite3PcacheFetch which may mutate cache via pPager->pPCache; const inappropriate, FP",,med
API00-C,273,sqlite,src/pager.c,5784,FP,sqlite3PagerUnrefNotNull asserts pPg!=0 at 5786; internal contract non-null,,high
EXP34-C,274,sqlite,src/pager.c,5785,FP,"pPg deref at 5785/5787 guarded by assert(pPg!=0); UnrefNotNull contract is non-null, NULL handled by sqlite3PagerUnref wrapper",,high
INT14-C,275,sqlite,src/pager.c,5785,FP,INT14 readability flag on pPg flags & PGHDR_MMAP; intentional flag test idiom,,high
API00-C,276,sqlite,src/pager.c,5799,FP,sqlite3PagerUnrefPageOne asserts pPg!=0 at 5801; internal contract non-null,,high
EXP34-C,277,sqlite,src/pager.c,5992,FP,"pPg=pPager (alias) deref at 5992 in pagerAddPageToRollbackJournal; pPg is the dirty page, non-null by caller chain (pager_write)",,high
EXP34-C,278,sqlite,src/pager.c,5996,FP,"pPager=pPg->pPager deref at 5996; pPager always set on a cached page, non-null",,high
PRE32-C,279,sqlite,src/pager.c,6023,FP,"PRE32 IOTRACE trace macro with multi-arg; benign trace macro, args are expressions not preprocessor directives affecting it",,high
PRE32-C,280,sqlite,src/pager.c,6023,FP,"same PRE32 IOTRACE misfire; the parenthesized arg list is the trace string, no UB",,high
PRE32-C,281,sqlite,src/pager.c,6026,FP,"PRE32 PAGERTRACE trace macro misfire; debug-only trace, no UB",,high
PRE32-C,282,sqlite,src/pager.c,6026,FP,same PRE32 PAGERTRACE misfire; trace macro arg list,,high
INT32-C,283,sqlite,src/pager.c,6031,FP,"INT32 nRec++ overflow: nRec counts journalled pages, bounded by dbSize/mxPgno (max ~2^31 pages) and journal IO limits long before INT_MAX wrap; not reachable",,high
EXP34-C,284,sqlite,src/pager.c,6049,FP,"pPg deref at 6049 in pager_write; pPg non-null, CHECK_PAGE asserts validity",,high
EXP34-C,285,sqlite,src/pager.c,6056,FP,pPager=pPg->pPager deref at 6056; non-null on a valid page,,high
PRE32-C,286,sqlite,src/pager.c,6102,FP,"PRE32 PAGERTRACE trace macro misfire; debug trace, no UB",,high
PRE32-C,287,sqlite,src/pager.c,6102,FP,same PRE32 misfire,,high
DCL13-C,288,sqlite,src/pager.c,6140,FP,"DCL13 pPg const in PagerIswriteable: only reads pPg->flags; const would be valid BUT signature parallels other PgHdr* APIs and pcache contract, low-value/borderline; treat as FP misfire on read-only debug fn",,low
EXP34-C,289,sqlite,src/pager.c,6147,FP,pPg deref at 6147 in pagerWriteLargeSector; pPg non-null from sqlite3PagerWrite caller,,high
EXP34-C,290,sqlite,src/pager.c,6148,FP,pPager=pPg->pPager deref at 6148; non-null,,high
INT14-C,291,sqlite,src/pager.c,6148,FP,INT14 readability on pPager in pageSize division; intentional,,high
INT33-C,292,sqlite,src/pager.c,6148,FP,INT33 div by pPager->pageSize: pageSize is always a power-of-two >=512 set at open (never 0); no div-by-zero reachable,,high
DCL03-C,293,sqlite,src/pager.c,6154,FP,DCL03 assert(!MEMDB) invariant; acceptable,,high
INT14-C,294,sqlite,src/pager.c,6162,FP,INT14 readability flag on pPg; intentional,,high
INT14-C,295,sqlite,src/pager.c,6162,FP,INT14 readability on nPagePerSector in & ~(nPagePerSector-1); intentional power-of-two mask idiom,,high
INT32-C,296,sqlite,src/pager.c,6162,FP,"INT32 ((pPg->pgno-1)&~(nPagePerSector-1))+1 cannot overflow; pgno bounded by mxPgno, masked value <= pgno",,high
INT32-C,297,sqlite,src/pager.c,6166,FP,"INT32 (pPg->pgno-pg1)+1; pg1<=pgno (asserted 6173) so result is small positive, no overflow",,high
EXP33-C,298,sqlite,src/pager.c,6178,FP,EXP33 pPage uninit: pPage is assigned in every branch before use inside the loop body at 6178; only read after a successful PagerGet,,high
EXP34-C,299,sqlite,src/pager.c,6184,FP,pPage deref at 6184 only after rc==SQLITE_OK from PagerGet which sets *ppPage; non-null,,high
DCL03-C,300,sqlite,src/pager.c,6205,FP,DCL03 assert in writeLargeSector loop region invariant; acceptable,,high
EXP34-C,301,sqlite,src/pager.c,6235,FP,pPg deref at 6235 in sqlite3PagerWrite; pPg non-null by API contract (asserts follow),,high
EXP34-C,302,sqlite,src/pager.c,6237,FP,pPager=pPg->pPager deref at 6237; non-null,,high
API00-C,303,sqlite,src/pager.c,6258,FP,sqlite3PagerIswriteable internal NDEBUG-only fn; pPg non-null by contract,,high
DCL13-C,304,sqlite,src/pager.c,6258,FP,"DCL13 pPg const in Iswriteable: reads flags only, const valid; borderline but parallels PgHdr* API family, FP misfire",,low
API00-C,305,sqlite,src/pager.c,6283,FP,sqlite3PagerDontWrite; pPg non-null by API contract,,high
EXP34-C,306,sqlite,src/pager.c,6369,FP,"pPgHdr deref at 6369: only inside DIRECT_MODE after rc==SQLITE_OK and PagerGet success; ALWAYS(rc==OK) guards, non-null",,high
ARR30-C,307,sqlite,src/pager.c,6372,FP,"aStat[PAGER_STAT_WRITE]=aStat[2], constant index size-4 array; in-bounds",,high
EXP36-C,308,sqlite,src/pager.c,6378,FP,"EXP36 cast char* zBuf to const void* for memcpy source/OsWrite; void* has no alignment requirement, no actual misalignment",,med
ARR01-C,309,sqlite,src/pager.c,6379,FP,"ARR01 sizeof(pPager->dbFileVers) is sizeof a fixed char[16] member; correct, not a decayed param",,high
API00-C,310,sqlite,src/pager.c,6400,FP,sqlite3PagerSync; pPager non-null by internal contract,,high
API00-C,311,sqlite,src/pager.c,6400,FP,"zSuper may be NULL legitimately (single-txn); passed as void* to FileControl which handles it, not blindly derefed here",,high
DCL13-C,312,sqlite,src/pager.c,6400,FP,"DCL13 pPager const in PagerSync: calls OsFileControl/OsSync via pPager->fd which mutate file state; const inappropriate, FP",,high
EXP05-C,313,sqlite,src/pager.c,6402,FP,"EXP05 (void*)zSuper drops const to pass through generic FileControl arg; deliberate, callee treats read-only",,high
DCL03-C,314,sqlite,src/pager.c,6406,FP,DCL03 assert invariant; acceptable,,high
API00-C,315,sqlite,src/pager.c,6423,FP,"sqlite3PagerExclusiveLock; pPager non-null by contract, reads errCode first",,high
API00-C,316,sqlite,src/pager.c,6465,FP,zSuper may be NULL legitimately in CommitPhaseOne; only used in trace/compare paths that tolerate NULL,,high
PRE32-C,317,sqlite,src/pager.c,6485,FP,PRE32 PAGERTRACE trace macro misfire,,high
PRE32-C,318,sqlite,src/pager.c,6485,FP,same PRE32 misfire,,high
EXP34-C,319,sqlite,src/pager.c,6508,FP,pList deref at 6508 (pList->pDirty=0): only when pList==pPageOne after PagerGet; rc asserted OK so pPageOne non-null,,high
EXP34-C,320,sqlite,src/pager.c,6514,FP,"sqlite3PagerUnref(pPageOne) at 6514 explicitly checks NULL (if(pPg) in Unref wrapper); analyzer claims it does not check, false",,high
STR34-C,321,sqlite,src/pager.c,6525,FP,"STR34 zSuper sign-extension misfire; super-journal name compared/copied as bytes, sign irrelevant",,high
EXP30-C,322,sqlite,src/pager.c,6563,FP,EXP30 pPg modified/accessed: this is the disabled bBatch/atomic-write region using pPg local for a single PcacheDirtyList read and pDirty test; no double-modify across sequence point,,high
EXP30-C,323,sqlite,src/pager.c,6566,FP,"EXP30 same misfire on pPg in the atomic-write commit branch; single read of pDirty, no UB",,high
EXP45-C,324,sqlite,src/pager.c,6566,FP,line 6566 the assignment-in-if 'pPg=sqlite3PcacheDirtyList(...)' is an idiomatic intentional assign+test guarded by || short-circuit; not a defect,,high
INT31-C,325,sqlite,src/pager.c,6624,FP,"szPage=(int)pPager->pageSize is a 512..65536 page size cast to int then memset; positive bounded value, no negative/overflow",,high
INT32-C,326,sqlite,src/pager.c,6626,FP,line 6626 (i64)dbSize*pageSize already cast to i64 before subtract; dbSize/pageSize internal bounded values write-offset computation safe,,high
INT13-C,327,sqlite,src/pager.c,6636,FP,"rc&0xFF on SQLite error code (low byte = primary result) is the standard SQLITE_IOERR family test; signedness irrelevant, value always small positive",,high
INT13-C,328,sqlite,src/pager.c,6804,FP,same rc&0xFF idiom in PagerRollback assert path; safe by construction,,high
API00-C,329,sqlite,src/pager.c,6818,FP,sqlite3PagerIsreadonly internal accessor; callers (btree) always pass live pPager; no untrusted input,,high
DCL13-C,330,sqlite,src/pager.c,6818,TP,sqlite3PagerIsreadonly only reads pPager->readOnly never writes; const Pager* would compile cleanly,,high
API00-C,331,sqlite,src/pager.c,6826,FP,sqlite3PagerRefcount (DEBUG-only) internal accessor; pPager always valid,,high
DCL13-C,332,sqlite,src/pager.c,6826,TP,sqlite3PagerRefcount only reads pPager->pPCache and passes to PcacheRefCount which does not mutate via this param; const valid,,med
API00-C,333,sqlite,src/pager.c,6835,FP,sqlite3PagerMemUsed internal accessor; pPager always valid,,high
ARR39-C,334,sqlite,src/pager.c,6836,FP,"line 6836 perPageSize is plain int arithmetic (pageSize+nExtra+sizeof...) not pointer arithmetic; ARR39 misread, no pointer scaling",,high
INT30-C,335,sqlite,src/pager.c,6837,FP,sizeof(PgHdr)+5*sizeof(void*) is compile-time constant tens of bytes; cannot wrap,,high
INT32-C,336,sqlite,src/pager.c,6838,FP,"perPageSize*pagecount+MallocSize is internal cache accounting; values bounded by cache size, not attacker input",,high
INT32-C,337,sqlite,src/pager.c,6838,FP,"same multiplication; bounded internal cache page count, not untrusted",,high
API00-C,338,sqlite,src/pager.c,6846,FP,sqlite3PagerPageRefcount internal accessor; pPage always valid live page handle,,high
API00-C,339,sqlite,src/pager.c,6854,FP,sqlite3PagerStats (TEST-only) internal; pPager valid,,high
DCL13-C,340,sqlite,src/pager.c,6854,TP,sqlite3PagerStats (TEST-only) only reads pPager members into static a[]; const Pager* would compile,,med
ARR30-C,341,sqlite,src/pager.c,6862,FP,aStat[PAGER_STAT_HIT] index is compile-time constant 0 into size-4 array; in bounds,,high
ARR30-C,342,sqlite,src/pager.c,6863,FP,aStat[PAGER_STAT_MISS] constant index 1 into size-4 array; in bounds,,high
ARR30-C,343,sqlite,src/pager.c,6866,FP,aStat[PAGER_STAT_WRITE] constant index 2 into size-4 array; in bounds,,high
ARR00-C,344,sqlite,src/pager.c,6867,FP,sqlite3PagerStats returns 'static int a[11]' which has static storage duration not local stack; not dangling,,high
API00-C,345,sqlite,src/pager.c,6882,FP,sqlite3PagerCacheStat callers (DBSTATUS) pass valid pPager; internal,,high
API00-C,346,sqlite,src/pager.c,6882,FP,pnVal always points to a caller stack u64 in status.c; internal contract,,high
API00-C,347,sqlite,src/pager.c,6882,FP,eStat validated by assert to be one of 4 enum values before use; not arbitrary,,high
DCL03-C,348,sqlite,src/pager.c,6890,FP,"assert(eStat==...) is a runtime precondition check on a parameter value, not a compile-time-constant assertion suited to static_assert",,high
DCL03-C,349,sqlite,src/pager.c,6891,FP,assert(CACHE_HIT+1==CACHE_MISS) — DCL03 candidate but adjacent asserts mix runtime; treat as enum-relationship; arguably static but SQLite house style uses assert; low-value FP,,high
DCL03-C,350,sqlite,src/pager.c,6892,FP,assert(PAGER_STAT_HIT==0 && ...) compile-time-constant relation; SQLite intentionally uses runtime assert here; not a defect,,high
INT32-C,351,sqlite,src/pager.c,6895,FP,"eStat-=CACHE_HIT after assert constrains eStat to 0..3; no overflow, no wrap",,high
ARR00-C,352,sqlite,src/pager.c,6896,FP,aStat[eStat] index bounded 0..3 by the four-value assert above; in bounds,,high
ARR30-C,353,sqlite,src/pager.c,6896,FP,same eStat index guarded by assert; safe,,high
ARR00-C,354,sqlite,src/pager.c,6898,FP,"aStat[eStat] in reset branch, same bounded eStat; safe",,high
ARR30-C,355,sqlite,src/pager.c,6898,FP,same; eStat constrained by assert to valid range,,high
API00-C,356,sqlite,src/pager.c,6905,FP,sqlite3PagerIsMemdb internal accessor; pPager always valid,,high
DCL13-C,357,sqlite,src/pager.c,6905,TP,sqlite3PagerIsMemdb only reads pPager->tempFile/memVfs; const Pager* compiles,,high
INT30-C,358,sqlite,src/pager.c,6934,FP,"line 6934 sizeof(PagerSavepoint)*nSavepoint passed to Realloc; nSavepoint is savepoint nesting depth (internal, bounded by SQL nesting) not attacker file bytes",,high
INT32-C,359,sqlite,src/pager.c,6934,FP,"same multiplication; nSavepoint not untrusted, Realloc handles size; product bounded",,high
ARR38-C,360,sqlite,src/pager.c,6939,FP,"memset(&aNew[nCurrent],0,(nSavepoint-nCurrent)*sizeof) sized to freshly realloc'd region nCurrent..nSavepoint; matches allocation exactly",,high
INT30-C,361,sqlite,src/pager.c,6939,FP,(nSavepoint-nCurrent) guarded by assert nSavepoint>nCurrent (line 6927) so positive small; no wrap,,high
INT32-C,362,sqlite,src/pager.c,6939,FP,memset size matches the grown portion of the realloc above; not overflowing,,high
INT32-C,363,sqlite,src/pager.c,6939,FP,"same product; nSavepoint-nCurrent small positive (asserted), sizeof const; no overflow",,high
INT32-C,364,sqlite,src/pager.c,6939,FP,nSavepoint-nCurrent positive by assert nSavepoint>nCurrent at 6927,,high
INT32-C,365,sqlite,src/pager.c,6959,FP,"ii+1 where ii<nSavepoint loop bound; nSavepoint small int savepoint depth, no realistic overflow",,high
API00-C,366,sqlite,src/pager.c,7007,FP,sqlite3PagerSavepoint internal; pPager valid from btree layer,,high
API00-C,367,sqlite,src/pager.c,7007,FP,iSavepoint guarded by iSavepoint<pPager->nSavepoint check (line 7017) before any array use,,high
INT32-C,368,sqlite,src/pager.c,7025,FP,line 7025 nNew=iSavepoint+(0 or 1) where iSavepoint<nSavepoint (small); no overflow,,high
ARR00-C,369,sqlite,src/pager.c,7026,FP,line 7026 ii is the for-loop counter initialized to nNew on this same line (for(ii=nNew;...)); not uninitialized — analyzer misread,,high
INT32-C,370,sqlite,src/pager.c,7051,FP,nNew-1 only evaluated when nNew!=0 (ternary guards nNew==0?0:&aSavepoint[nNew-1]); safe,,high
API00-C,371,sqlite,src/pager.c,7100,FP,sqlite3PagerVfs internal accessor; pPager valid,,high
DCL13-C,372,sqlite,src/pager.c,7100,TP,sqlite3PagerVfs only reads pPager->pVfs; const Pager* compiles,,high
API00-C,373,sqlite,src/pager.c,7109,FP,sqlite3PagerFile internal accessor; pPager valid,,high
DCL13-C,374,sqlite,src/pager.c,7109,TP,sqlite3PagerFile only reads pPager->fd; const Pager* compiles,,high
API00-C,375,sqlite,src/pager.c,7117,FP,sqlite3PagerJrnlFile internal accessor; pPager valid,,high
DCL13-C,376,sqlite,src/pager.c,7117,TP,sqlite3PagerJrnlFile reads pPager->pWal/jfd only and passes member pWal (not pPager) to WalFile; const Pager* compiles,,med
MSC37-C,377,sqlite,src/pager.c,7117,FP,MSC37 false: both #ifdef branches of sqlite3PagerJrnlFile end in a return statement; no fall-through path,,high
API00-C,378,sqlite,src/pager.c,7128,FP,sqlite3PagerJournalname internal accessor; pPager valid,,high
DCL13-C,379,sqlite,src/pager.c,7128,TP,sqlite3PagerJournalname only reads pPager->zJournal; const Pager* compiles,,high
API00-C,380,sqlite,src/pager.c,7158,FP,sqlite3PagerMovepage internal autovacuum function; pPager/pPg valid live handles (asserts nRef>0),,high
PRE32-C,381,sqlite,src/pager.c,7203,FP,"PAGERTRACE is a no-op or printf-style macro; the args are a normal printf format+args, the '#ifdef'-style ?: are C ternaries not preprocessor directives — analyzer misclassified",,high
PRE32-C,382,sqlite,src/pager.c,7203,FP,"same PAGERTRACE arg; the (cond)?1:0 is a C conditional expression, no preprocessor directive present",,high
EXP34-C,383,sqlite,src/pager.c,7281,FP,line 7281 pPgHdr dereferenced only after rc==SQLITE_OK early-return at 7274; sqlite3PagerGet sets pPgHdr non-NULL when returning OK,,high
API00-C,384,sqlite,src/pager.c,7296,FP,sqlite3PagerRekey internal; pPg valid dirty page handle (assert pgno!=iNew),,high
API00-C,385,sqlite,src/pager.c,7305,FP,sqlite3PagerGetData internal accessor; pPg valid (assert nRef>0 || memDb),,high
DCL13-C,386,sqlite,src/pager.c,7305,TP,sqlite3PagerGetData only reads pPg->pData/pPager->memDb; const DbPage* compiles,,high
EXP34-C,387,sqlite,src/pager.c,7306,FP,line 7306 pPg deref guarded by assert(pPg->nRef>0||pPg->pPager->memDb); caller contract ensures non-null,,high
API00-C,388,sqlite,src/pager.c,7314,FP,sqlite3PagerGetExtra internal accessor; pPg valid,,high
DCL13-C,389,sqlite,src/pager.c,7314,TP,sqlite3PagerGetExtra only reads pPg->pExtra; const DbPage* compiles,,high
EXP34-C,390,sqlite,src/pager.c,7315,FP,line 7315 pPg->pExtra read; pPg non-null by caller contract (live page handle),,high
API00-C,391,sqlite,src/pager.c,7328,FP,"sqlite3PagerLockingMode internal; pPager valid, eMode asserted valid",,high
DCL03-C,392,sqlite,src/pager.c,7332,FP,"assert(PAGER_LOCKINGMODE_QUERY<0) compile-time constant — SQLite house style uses runtime assert; low-value, not a defect",,high
DCL03-C,393,sqlite,src/pager.c,7333,FP,assert(NORMAL>=0 && EXCLUSIVE>=0) constant relation; runtime assert intentional,,high
API00-C,394,sqlite,src/pager.c,7361,FP,"sqlite3PagerSetJournalMode internal; pPager valid, eMode asserted valid",,high
DCL03-C,395,sqlite,src/pager.c,7398,FP,assert(TRUNCATE&5==1) constant; SQLite intentionally runtime-asserts these bit relations,,high
DCL03-C,396,sqlite,src/pager.c,7399,FP,assert(PERSIST&5==1) constant relation; intentional runtime assert,,high
DCL03-C,397,sqlite,src/pager.c,7400,FP,assert(DELETE&5==0) constant relation; intentional,,high
DCL03-C,398,sqlite,src/pager.c,7401,FP,assert(MEMORY&5==4) constant relation; intentional,,high
DCL03-C,399,sqlite,src/pager.c,7402,FP,assert(OFF&5==0) constant relation; intentional,,high
DCL03-C,400,sqlite,src/pager.c,7403,FP,assert(WAL&5==5) constant relation; intentional,,high
API00-C,401,sqlite,src/pager.c,7451,FP,sqlite3PagerGetJournalMode internal accessor; pPager valid,,high
DCL13-C,402,sqlite,src/pager.c,7451,TP,sqlite3PagerGetJournalMode only reads pPager->journalMode; const Pager* compiles,,high
API00-C,403,sqlite,src/pager.c,7473,FP,sqlite3PagerJournalSizeLimit internal; pPager valid (writes journalSizeLimit so not const),,high
API00-C,404,sqlite,src/pager.c,7487,FP,sqlite3PagerBackupPtr internal accessor; pPager valid,,high
DCL13-C,405,sqlite,src/pager.c,7487,FP,"sqlite3PagerBackupPtr returns &pPager->pBackup (sqlite3_backup**); a const Pager* would make this 'sqlite3_backup *const*' mismatching the non-const return type, so const would NOT compile",,high
API00-C,406,sqlite,src/pager.c,7495,FP,sqlite3PagerClearCache internal vacuum function; pPager valid,,high
API00-C,407,sqlite,src/pager.c,7510,FP,sqlite3PagerCheckpoint internal; pPager valid,,high
MSC04-C,408,sqlite,src/pager.c,7510,TP,"sqlite3PagerCheckpoint->sqlite3_exec(""PRAGMA table_list"") at 7528 can re-enter via step->VdbeExec->Checkpoint->BtreeCheckpoint->PagerCheckpoint; indirect recursion factually exists (bounded by the pWal==0 guard)",,med
DCL13-C,409,sqlite,src/pager.c,7511,FP,sqlite3PagerCheckpoint writes via sqlite3_exec/WalCheckpoint side effects and is not const-eligible; param also passed to non-const APIs,,high
API00-C,410,sqlite,src/pager.c,7541,FP,sqlite3PagerWalCallback internal accessor; pPager valid,,high
DCL13-C,411,sqlite,src/pager.c,7541,TP,sqlite3PagerWalCallback only reads pPager->pWal; const Pager* compiles,,high
DCL13-C,412,sqlite,src/pager.c,7549,TP,sqlite3PagerWalSupported only reads pPager->fd->pMethods/noLock/exclusiveMode; const Pager* compiles,,med
API00-C,413,sqlite,src/pager.c,7631,FP,sqlite3PagerOpenWal pbOpen is OUT param written via *pbOpen=1; callers per asserts pass valid pointer; not untrusted,,high
EXP34-C,414,sqlite,src/pager.c,7655,FP,line 7655 *pbOpen=1 only in else-branch reached when assert(pbOpen==0||*pbOpen==0) plus asserts guarantee pbOpen non-null in that path (pbOpen required when not temp/wal),,high
API00-C,415,sqlite,src/pager.c,7670,FP,sqlite3PagerCloseWal internal; pPager valid,,high
API00-C,416,sqlite,src/pager.c,7727,FP,sqlite3PagerWalDb internal; pPager valid (writes dbWal so not const),,high
API00-C,417,sqlite,src/pager.c,7727,FP,db param stored into pPager->dbWal and passed to WalDb; internal valid handle,,high
API00-C,418,sqlite,src/pager.c,7740,FP,sqlite3PagerSnapshotGet internal; pPager valid,,high
DCL13-C,419,sqlite,src/pager.c,7740,TP,sqlite3PagerSnapshotGet only reads pPager->pWal; const Pager* compiles,,high
API00-C,420,sqlite,src/pager.c,7753,FP,sqlite3PagerSnapshotOpen internal; pPager valid,,high
DCL13-C,421,sqlite,src/pager.c,7754,TP,"sqlite3PagerSnapshotOpen only reads pPager->pWal and passes it onward; pPager itself unmodified, const Pager* compiles",,med
API00-C,422,sqlite,src/pager.c,7770,FP,sqlite3PagerSnapshotRecover internal; pPager valid,,high
DCL13-C,423,sqlite,src/pager.c,7770,TP,sqlite3PagerSnapshotRecover only reads pPager->pWal; const Pager* compiles,,high
API00-C,424,sqlite,src/pager.c,7792,FP,sqlite3PagerSnapshotCheck internal; pPager valid,,high
DCL13-C,425,sqlite,src/pager.c,7792,TP,sqlite3PagerSnapshotCheck only reads pPager->pWal; const Pager* compiles,,high
API00-C,426,sqlite,src/pager.c,7806,FP,sqlite3PagerSnapshotUnlock internal; pPager valid (assert pWal),,high
DCL13-C,427,sqlite,src/pager.c,7806,TP,sqlite3PagerSnapshotUnlock only reads pPager->pWal; const Pager* compiles,,high
API00-C,428,sqlite,src/pager.c,7822,FP,sqlite3PagerWalFramesize internal (ZIPVFS); pPager valid,,high
DCL13-C,429,sqlite,src/pager.c,7822,TP,sqlite3PagerWalFramesize only reads pPager->pWal; const Pager* compiles,,high
API00-C,430,sqlite,src/pager.c,7829,FP,sqlite3PagerWalSystemErrno internal (SEH); pPager valid,,high
DCL13-C,431,sqlite,src/pager.c,7829,TP,sqlite3PagerWalSystemErrno only reads pPager->pWal; const Pager* compiles,,high
ARR30-C,FN,sqlite,src/pager.c,1335,FN,readSuperJournal guard len>=nSuper admits len=nSuper-1 but writes 2-byte terminator zSuper[len]/zSuper[len+1]; zSuper[len+1] hits index nSuper needing nSuper+1 bytes (nSuper=mxPathname+1 into pTmpSpace; caller 2974 uses &pTmpSpace[4]). Reachable as 1-5 byte OOB heap write with custom VFS mxPathname==2^k-1 and pageSize==that power-of-two; default VFS safe,FN-hunt,low