rule,idx,project,file,line,verdict,reason,provenance,confidence
API00-C,0,sqlite,src/where.c,54,FP,"internal accessor; pWInfo non-null guaranteed by planner caller, not untrusted input",,
DCL13-C,1,sqlite,src/where.c,54,TP,"sqlite3WhereOutputRowCount reads only pWInfo->nRowOut; pure accessor, const-compiles",,
API00-C,2,sqlite,src/where.c,62,FP,sqlite3WhereIsDistinct internal accessor; pWInfo guaranteed by caller,,
DCL13-C,3,sqlite,src/where.c,62,TP,reads only pWInfo->eDistinct; pure read-only accessor,,
API00-C,4,sqlite,src/where.c,74,FP,internal accessor; pWInfo guaranteed non-null by caller,,
DCL13-C,5,sqlite,src/where.c,74,TP,sqlite3WhereIsOrdered reads only pWInfo->nOBSat; read-only accessor,,
DCL13-C,6,sqlite,src/where.c,101,TP,sqlite3WhereOrderByLimitOptLabel reads pWInfo->bOrderedInnerLoop/a[]/iContinue only,,
API00-C,7,sqlite,src/where.c,124,FP,"v is the codegen target handle, guaranteed non-null by caller",,
DCL13-C,8,sqlite,src/where.c,124,TP,sqlite3WhereMinMaxOptEarlyOut reads pWInfo fields only; emits via separate Vdbe* v,,
ARR30-C,9,sqlite,src/where.c,130,FP,'a' is unrelated array indexed by bounded loop var i; misattributed to local tRowcnt a[2] at line 2284,,
API00-C,10,sqlite,src/where.c,143,FP,internal accessor; pWInfo guaranteed by caller,,
DCL13-C,11,sqlite,src/where.c,143,TP,sqlite3WhereContinueLabel reads only pWInfo->iContinue,,
API00-C,12,sqlite,src/where.c,152,FP,internal accessor; pWInfo guaranteed by caller,,
DCL13-C,13,sqlite,src/where.c,152,TP,sqlite3WhereBreakLabel reads only pWInfo->iBreak,,
API00-C,14,sqlite,src/where.c,173,FP,internal accessor; pWInfo guaranteed by caller,,
DCL13-C,15,sqlite,src/where.c,173,TP,"sqlite3WhereOkOnePass memcpy reads pWInfo->aiCurOnePass (source) and pWInfo->eOnePass; pWInfo read-only, writes go to aiCur out-param",,
ARR38-C,16,sqlite,src/where.c,174,FP,"memcpy(aiCur, pWInfo->aiCurOnePass, sizeof(int)*2) is fixed 2-int copy into 2-int caller buffer",,
EXP34-C,17,sqlite,src/where.c,174,FP,pWInfo is a non-null planner struct established by caller (sqlite3WhereOkOnePass param); memcpy from pWInfo->aiCurOnePass,,
API00-C,18,sqlite,src/where.c,189,FP,internal accessor; pWInfo guaranteed by caller,,
DCL13-C,19,sqlite,src/where.c,189,TP,sqlite3WhereUsesDeferredSeek reads only pWInfo->bDeferredSeek,,
EXP34-C,20,sqlite,src/where.c,190,FP,pWInfo param established non-null by caller; simple member read,,
DCL13-C,21,sqlite,src/where.c,196,TP,"whereOrMove pSrc is the memcpy source, read-only; const WhereOrSet* compiles",,
ARR01-C,22,sqlite,src/where.c,198,FP,"sizeof(pDest->a[0]) is element-type sizeof, not decayed-pointer sizeof",,
ARR38-C,23,sqlite,src/where.c,198,FP,"memcpy size pDest->n*sizeof(a[0]); pDest->a is fixed N_OR_COST array, n<=N_OR_COST",,
INT30-C,24,sqlite,src/where.c,198,FP,"pDest->n is term count bounded by nTerm; size_t multiply, sqlite alloc idiom",,
INT32-C,25,sqlite,src/where.c,198,FP,"pDest->n is WhereOrSet count, bounded by N_OR_COST (small fixed cap); memcpy size cannot overflow",,
ARR30-C,26,sqlite,src/where.c,230,FP,"pSet->a[i] bounded by i<pSet->n (WhereOrSet, N_OR_COST cap); misattributed to a[2]@2284",,
DCL13-C,27,sqlite,src/where.c,245,TP,sqlite3WhereGetMask reads only pMaskSet->n/ix[]; read-only,,
API00-C,28,sqlite,src/where.c,263,FP,sqlite3WhereMalloc internal allocator; pWInfo->pParse->db guaranteed by caller,,
EXP33-C,29,sqlite,src/where.c,265,FP,pBlock assigned by sqlite3DbMallocRawNN on line 265 before any use; not uninitialized,,
EXP34-C,30,sqlite,src/where.c,265,FP,pWInfo param non-null; pWInfo->pParse->db is the live connection,,
INT30-C,31,sqlite,src/where.c,265,FP,"nByte is WhereInfo arena request, bounded; sqlite3DbMallocRawNN handles overflow downstream",,
API00-C,32,sqlite,src/where.c,274,FP,sqlite3WhereRealloc internal; pWInfo guaranteed by caller,,
INT32-C,33,sqlite,src/where.c,295,FP,pMaskSet->n bounded by ArraySize(ix) per asserted comment; one cursor per FROM table (<=64),,
EXP34-C,34,sqlite,src/where.c,303,FP,"p param to whereRightSubexprIsColumn; p->pRight read, but p itself is caller-supplied Expr (non-null in planner)",,
DCL13-C,35,sqlite,src/where.c,321,TP,"indexInAffinityOk reads pTerm->pExpr/eOperator/u.x only; pExpr extracted as Expr*, const-compiles",,
INT14-C,36,sqlite,src/where.c,327,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,37,sqlite,src/where.c,362,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP34-C,38,sqlite,src/where.c,382,FP,pX set by whereRightSubexprIsColumn()!=0 guard at 378 before deref at 382,,
EXP33-C,39,sqlite,src/where.c,396,FP,zCollName assigned on both branches (401 / 410) before use at 413,,
EXP33-C,40,sqlite,src/where.c,404,FP,pColl assigned at 409 before use at 410; only reached on the else branch that sets it,,
EXP30-C,41,sqlite,src/where.c,417,FP,"(pX = pTerm->pExpr->pRight, ALWAYS(pX!=0)) comma operator is sequenced; no unsequenced modify/access",,
INT32-C,42,sqlite,src/where.c,427,FP,"k is WhereTerm index, bounded by WHERE-clause term count (structural)",,
ARR00-C,43,sqlite,src/where.c,433,FP,"ii is initialized loop counter (for ii=1; ii<pScan->nEquiv), not uninitialized",,
DCL30-C,44,sqlite,src/where.c,440,FP,returns pTerm from heap-backed WhereClause->a[] not automatic storage,,
DCL13-C,45,sqlite,src/where.c,487,FP,whereScanInit stores pWC into pScan->pWC/pOrigWC which are non-const WhereClause* fields,,
DCL13-C,46,sqlite,src/where.c,491,TP,"pIdx only read (aiColumn/pTable/azColl/aColExpr); not stored as pointer, const-compiles",,
ARR30-C,47,sqlite,src/where.c,512,FP,pIdx->aColExpr->a[j] bounded by index column count; misattributed to a[2]@2284,,
API00-C,48,sqlite,src/where.c,549,FP,sqlite3WhereFindTerm internal; pWC guaranteed non-null by planner caller,,
INT13-C,49,sqlite,src/where.c,565,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
DCL30-C,50,sqlite,src/where.c,567,FP,returns p which walks pWC->a[] heap WhereTerm not a local,,
DCL13-C,51,sqlite,src/where.c,585,TP,findIndexCol reads pList->nExpr/a[].pExpr only; pExpr passed onward as Expr*,,
DCL13-C,52,sqlite,src/where.c,587,TP,findIndexCol reads pIdx->azColl/aiColumn only; read-only,,
ARR00-C,53,sqlite,src/where.c,591,FP,iCol indexes pIdx->azColl; caller guarantees iCol<nColumn (index column scan),,
ARR30-C,54,sqlite,src/where.c,591,FP,pIdx->azColl[iCol] bounded by index column count,,
EXP34-C,55,sqlite,src/where.c,593,FP,pList param non-null in planner (caller ExprList); loop bound pList->nExpr,,
ARR30-C,56,sqlite,src/where.c,594,FP,pList->a[i] bounded by i<pList->nExpr; misattributed to a[2]@2284,,
EXP34-C,57,sqlite,src/where.c,596,FP,p set by sqlite3ExprSkipCollateAndLikely and guarded ALWAYS(p!=0) at 595,,
ARR00-C,58,sqlite,src/where.c,597,FP,"iCol indexes pIdx->aiColumn, bounded by index column count",,
ARR30-C,59,sqlite,src/where.c,597,FP,pIdx->aiColumn[iCol] bounded by index column count,,
ARR30-C,60,sqlite,src/where.c,600,FP,pList->a[i] bounded by i<pList->nExpr; misattributed to a[2]@2284,,
EXP34-C,61,sqlite,src/where.c,601,FP,pColl from sqlite3ExprNNCollSeq (NonNull variant guarantees non-null),,
DCL13-C,62,sqlite,src/where.c,613,TP,indexColumnNotNull reads pIdx->aiColumn/pTable->aCol only; pure read-only,,
ARR00-C,63,sqlite,src/where.c,617,FP,iCol guarded by assert(iCol>=0 && iCol<pIdx->nColumn) at line 616,,
DCL13-C,64,sqlite,src/where.c,638,TP,isDistinctRedundant reads pTabList->nSrc/a[0].iCursor/pSTab only; read-only,,
EXP34-C,65,sqlite,src/where.c,658,FP,pDistinct param non-null ExprList supplied by caller; loop bound pDistinct->nExpr,,
ARR30-C,66,sqlite,src/where.c,659,FP,pDistinct->a[i] bounded by i<pDistinct->nExpr; misattributed to a[2]@2284,,
EXP34-C,67,sqlite,src/where.c,661,FP,p guarded by NEVER(p==0) continue at 660 before deref at 661,,
INT32-C,68,sqlite,src/where.c,701,FP,"LogEst arithmetic; sqlite3LogEst returns small i16 base-2 log, -33 cannot overflow",,
DCL13-C,69,sqlite,src/where.c,717,TP,"translateColumnToCopy reads pParse->pVdbe/db only; mutates the Vdbe (not pParse), const-compiles",,
PRE32-C,70,sqlite,src/where.c,729,FP,plain printf with string literal+args; no # ## or directive in args,,
EXP34-C,71,sqlite,src/where.c,734,FP,pOp from sqlite3VdbeGetOp; mallocFailed bail at 726 (OOM idiom) guarantees valid op array,,
INT32-C,72,sqlite,src/where.c,742,FP,"pOp->p2 and iRegister are VDBE register numbers, bounded by program size",,
DCL13-C,73,sqlite,src/where.c,773,TP,whereTraceIndexInfoInputs reads pTab->zName only (debug),,
DCL13-C,74,sqlite,src/where.c,796,TP,whereTraceIndexInfoOutputs reads p->aConstraint/Usage/idxNum only (debug),,
DCL13-C,75,sqlite,src/where.c,797,TP,whereTraceIndexInfoOutputs reads pTab->zName only (debug),,
ARR00-C,76,sqlite,src/where.c,879,FP,"pIdx is a linked-list iterator (for pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext), not an array bound",,
DCL13-C,77,sqlite,src/where.c,945,TP,explainAutomaticIndex reads pIdx->pTable/nColumn/aiColumn only; read-only,,
MEM31-C,78,sqlite,src/where.c,954,FP,pStr from sqlite3_str_new is consumed by sqlite3_str_finish at line 966 which frees the sqlite3_str wrapper; not a leak,,
MSC04-C,79,sqlite,src/where.c,986,TP,constructAutomaticIndex part of where-codegen cycle re-entering WhereBegin,,
DCL13-C,80,sqlite,src/where.c,988,FP,"constructAutomaticIndex iterates pWC->a via non-const pTerm and pWC feeds builder; mutation context, not safely const",,
INT14-C,81,sqlite,src/where.c,1052,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,82,sqlite,src/where.c,1092,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,83,sqlite,src/where.c,1108,FP,nKeyCol bounded by pTable->nCol (<=SQLITE_MAX_COLUMN); asserted to fit u16 at line 1112,,
INT32-C,84,sqlite,src/where.c,1114,FP,nKeyCol+HasRowid bounded by column count; passed to index allocator,,
INT32-C,85,sqlite,src/where.c,1179,FP,"pParse->nTab is cursor counter, bounded by query complexity far below INT_MAX",,
INT32-C,86,sqlite,src/where.c,1180,FP,nKeyCol+1 bounded by table column count,,
INT32-C,87,sqlite,src/where.c,1185,FP,"pParse->nMem register counter, bounded by query size",,
INT32-C,88,sqlite,src/where.c,1227,FP,"regBase+n: register base plus nEq term count, both bounded by query",,
MSC04-C,89,sqlite,src/where.c,1273,TP,sqlite3ConstructBloomFilter in where-codegen indirect cycle,,
EXP34-C,90,sqlite,src/where.c,1284,FP,pWInfo param non-null; pWInfo->pParse is established by the planner,,
EXP34-C,91,sqlite,src/where.c,1285,FP,pParse derived from pWInfo->pParse (non-null); pParse->pVdbe read,,
INT32-C,92,sqlite,src/where.c,1311,FP,"pParse->nMem register counter, bounded by query size",,
ARR30-C,93,sqlite,src/where.c,1323,FP,pTabList->a[iSrc] where iSrc=pLevel->iFrom is a valid FROM-clause index; misattributed to a[2]@2284,,
EXP34-C,94,sqlite,src/where.c,1323,FP,"pTabList = pWInfo->pTabList (non-null); indexed by pLevel->iFrom, valid src item",,
FLP30-C,95,sqlite,src/where.c,1337,FP,pTerm is WhereTerm* pointer loop var misclassified as float,,
INT32-C,96,sqlite,src/where.c,1357,FP,"r1+jj: temp register base plus nEq loop index, bounded",,
INT32-C,97,sqlite,src/where.c,1363,FP,"addrTop+1: VDBE address (program counter), bounded by program size",,
DCL13-C,98,sqlite,src/where.c,1399,FP,termFromWhereClause returns &p->a[iTerm] (non-const WhereTerm*) derived from pWC; cannot be const,,
ARR30-C,99,sqlite,src/where.c,1402,FP,p->a[iTerm] guarded by if(iTerm<p->nTerm) immediately above,,
INT32-C,100,sqlite,src/where.c,1403,FP,"iTerm -= p->nTerm: walks WhereClause chain, iTerm bounded by total term count",,
DCL13-C,101,sqlite,src/where.c,1414,TP,allocateIndexInfo reads pWInfo->pParse/pOrderBy/wctrlFlags only; pWInfo itself read-only,,
DCL13-C,102,sqlite,src/where.c,1415,FP,allocateIndexInfo writes pTerm->wtFlags (TERM_OK) through pWC->a; pWC effectively mutated,,
ARR30-C,103,sqlite,src/where.c,1479,FP,pOrderBy->a[i] bounded by i<n (n=pOrderBy->nExpr); misattributed to a[2]@2284,,
EXP33-C,104,sqlite,src/where.c,1480,FP,pE2 assigned in the if-condition at 1499 (short-circuit) before use at 1500,,
ARR30-C,105,sqlite,src/where.c,1488,FP,pOrderBy->a[i] bounded by i<n; misattributed to a[2]@2284,,
INT14-C,106,sqlite,src/where.c,1488,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP30-C,107,sqlite,src/where.c,1498,FP,"(pE2 = pExpr->pLeft)->op: assignment value is used; sequenced, no UB",,
EXP45-C,108,sqlite,src/where.c,1499,TP,"genuine assignment in if-condition: 'pE2 = pExpr->pLeft' (deliberate sqlite idiom, but a real instance)",,
EXP34-C,109,sqlite,src/where.c,1500,FP,pE2 deref only after 1499 && chain confirmed pE2->op==TK_COLUMN (so pE2 non-null),,
EXP33-C,110,sqlite,src/where.c,1502,FP,zColl assigned at 1508/1509 before use at 1510 on the same guarded path,,
INT32-C,111,sqlite,src/where.c,1520,FP,2+bSortByGroup: bSortByGroup is 0/1 boolean flag,,
INT32-C,112,sqlite,src/where.c,1522,FP,1-bSortByGroup: bSortByGroup is 0/1 boolean flag,,
ARR39-C,113,sqlite,src/where.c,1531,FP,"sizeof-scaled malloc size arithmetic for sqlite3_index_info allocation, correct sizing",,
EXP33-C,114,sqlite,src/where.c,1531,FP,pIdxInfo assigned by sqlite3DbMallocZero at 1531; not uninitialized,,
INT30-C,115,sqlite,src/where.c,1531,FP,"sizeof+counts for sqlite3_index_info alloc; nOrderBy/nTerm small, standard alloc sizing",,
EXP33-C,116,sqlite,src/where.c,1532,FP,pIdxCons assigned via pointer arithmetic at 1540 before use; not uninitialized,,
EXP34-C,117,sqlite,src/where.c,1532,FP,pIdxInfo null-checked at 1535 (return); pIdxCons derives from non-null pIdxInfo,,
INT30-C,118,sqlite,src/where.c,1532,FP,"sizeof addition of struct sizes, constant-bounded",,
EXP33-C,119,sqlite,src/where.c,1533,FP,pIdxOrderBy assigned via pointer arithmetic at 1541 before use; not uninitialized,,
EXP34-C,120,sqlite,src/where.c,1533,FP,pIdxOrderBy derives from non-null pIdxInfo (null-checked at 1535),,
INT30-C,121,sqlite,src/where.c,1533,FP,sizeof*nOrderBy; nOrderBy bounded by ORDER BY term count,,
ARR37-C,122,sqlite,src/where.c,1542,FP,"pIdxOrderBy points to allocated array of nOrderBy entries; valid element addressing, not non-array pointer",,
EXP05-C,123,sqlite,src/where.c,1550,TP,"genuine const cast '(Table*)pTab': pTab is const Table* param, cast to non-const for sqlite3PrimaryKeyIndex",,
INT32-C,124,sqlite,src/where.c,1564,FP,"i+p->nTerm: term offset accumulator, bounded by total WHERE term count",,
INT13-C,125,sqlite,src/where.c,1579,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
DCL03-C,126,sqlite,src/where.c,1590,TP,assert(WO_EQ==SQLITE_INDEX_CONSTRAINT_EQ) compile-time constant; static_assert candidate,,
DCL03-C,127,sqlite,src/where.c,1591,TP,assert of two macro constants equal; compile-time; static_assert candidate,,
DCL03-C,128,sqlite,src/where.c,1592,TP,assert of two macro constants equal; compile-time; static_assert candidate,,
DCL03-C,129,sqlite,src/where.c,1593,TP,assert of two macro constants equal; compile-time; static_assert candidate,,
DCL03-C,130,sqlite,src/where.c,1594,TP,assert of two macro constants equal; compile-time; static_assert candidate,,
INT13-C,131,sqlite,src/where.c,1597,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,132,sqlite,src/where.c,1601,FP,1<<j guarded by if(j<16); within int width,,
INT34-C,133,sqlite,src/where.c,1601,FP,1<<j guarded by if(j<16); within int width,,
ARR30-C,134,sqlite,src/where.c,1613,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
EXP34-C,135,sqlite,src/where.c,1613,FP,pOrderBy non-null whenever nOrderBy>0 (set together at 1476-1518); loop bound nOrderBy,,
ARR37-C,136,sqlite,src/where.c,1618,FP,"pIdxOrderBy[j] indexes allocated nOrderBy array, bounded by j<nOrderBy",,
ARR30-C,137,sqlite,src/where.c,1619,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
ARR37-C,138,sqlite,src/where.c,1619,FP,"pIdxOrderBy[j] indexes allocated nOrderBy array, bounded by j<nOrderBy",,
DCL30-C,139,sqlite,src/where.c,1625,FP,pIdxInfo from sqlite3DbMallocZero heap not automatic storage,,
MEM30-C,140,sqlite,src/where.c,1655,FP,freeIdxStr frees member idxStr; sqlite3DbFree at 1655 frees distinct object pIdxInfo once; no double-free,,
INT32-C,141,sqlite,src/where.c,1799,FP,"(iMin+iSample)/2 binary search midpoint over sample array (nSample*nField), bounded",,
INT32-C,142,sqlite,src/where.c,1800,FP,"iTest/nField: nField>=1 always (index has >=1 column), no INT_MIN/-1; bounded operands",,
INT33-C,143,sqlite,src/where.c,1800,FP,"nField=MIN(pRec->nField,pIdx->nColumn); index has >=1 col, non-zero in stat4 path",,
ARR36-C,144,sqlite,src/where.c,1805,FP,"'iTest < nField' is integer comparison; iTest/nField are ints, not pointers",,
INT10-C,145,sqlite,src/where.c,1805,FP,"nField>=1 in stat4 sample search; iTest,nField non-negative so % well-defined",,
INT32-C,146,sqlite,src/where.c,1805,FP,(iTest%nField)+1: bounded by nField (index column count),,
INT33-C,147,sqlite,src/where.c,1805,FP,"nField>=1 in stat4 sample search; iTest,nField non-negative so % well-defined",,
INT32-C,148,sqlite,src/where.c,1809,FP,"iTest+1: iTest is sample-array index, bounded by nSample*nField",,
INT32-C,149,sqlite,src/where.c,1815,FP,"n-1: n is sample field count >=1, bounded by index columns",,
INT32-C,150,sqlite,src/where.c,1816,FP,"iTest+1: sample-array index, bounded",,
ARR36-C,151,sqlite,src/where.c,1817,FP,'iTest' integer comparison misclassified as cross-array pointer compare,,
INT32-C,152,sqlite,src/where.c,1818,FP,"n-1: field count, bounded",,
INT32-C,153,sqlite,src/where.c,1819,FP,"iTest+1: sample-array index, bounded",,
INT32-C,154,sqlite,src/where.c,1823,FP,"n-1: field count, bounded",,
INT32-C,155,sqlite,src/where.c,1826,FP,"iSample/nField: nField>=1 (index column), no INT_MIN/-1; operands bounded by sample array",,
INT33-C,156,sqlite,src/where.c,1826,FP,"nField>=1; same stat4 search, divisor non-zero",,
INT32-C,157,sqlite,src/where.c,1846,FP,"iCol+1: iCol is index column number, bounded by nField",,
ARR36-C,158,sqlite,src/where.c,1885,FP,comparing tRowcnt elements within same aSample[].anLt arrays; integer values not pointers,,
ARR36-C,159,sqlite,src/where.c,1888,FP,"subtraction of integer anLt[] element values, not pointers from different arrays",,
INT32-C,160,sqlite,src/where.c,1891,FP,"iGap*2: iGap is tRowcnt row-count difference (unsigned), used in /3 estimate; bounded by table rows",,
INT32-C,161,sqlite,src/where.c,1896,FP,"nField-1: index field count >=1, bounded by column count",,
DCL13-C,162,sqlite,src/where.c,1916,TP,whereRangeAdjust reads pTerm->truthProb/wtFlags only; pure read-only,,
API00-C,163,sqlite,src/where.c,1933,FP,sqlite3IndexColumnAffinity internal; pIdx guaranteed by caller (also mutates pIdx->zColAff via helper),,
ARR00-C,164,sqlite,src/where.c,1938,FP,iCol guarded by assert(iCol>=0 && iCol<pIdx->nColumn) at line 1934,,
ARR00-C,165,sqlite,src/where.c,1939,FP,iCol guarded by assert at line 1934 (zColAff[iCol]),,
DCL13-C,166,sqlite,src/where.c,1982,TP,whereRangeSkipScanEst reads pLower->pExpr->pRight only; pExpr is Expr* so const-compiles,,
DCL13-C,167,sqlite,src/where.c,1983,TP,whereRangeSkipScanEst reads pUpper->pExpr->pRight only; const-compiles,,
EXP34-C,168,sqlite,src/where.c,2016,FP,pVal is output of sqlite3Stat4Column at 2014 (populated on rc==SQLITE_OK before compare),,
EXP34-C,169,sqlite,src/where.c,2020,FP,"pVal populated by sqlite3Stat4Column at 2014 on rc==OK; stat4 path, not null at compare",,
INT32-C,170,sqlite,src/where.c,2024,FP,"nUpper-nLower: both counts of samples compared, bounded by sample count",,
PRE32-C,171,sqlite,src/where.c,2036,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT32-C,172,sqlite,src/where.c,2037,FP,"nAdjust*-1: trace-only; nAdjust is LogEst difference, tiny",,
INT14-C,173,sqlite,src/where.c,2156,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,174,sqlite,src/where.c,2157,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,175,sqlite,src/where.c,2175,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,176,sqlite,src/where.c,2177,FP,"nOut-- : nOut is LogEst (i16 base-2 log), decrement of small value cannot reach INT_MIN",,
INT32-C,177,sqlite,src/where.c,2194,FP,"nOut-- : nOut is LogEst (i16 base-2 log estimate), bounded small value",,
EXP33-C,178,sqlite,src/where.c,2207,FP,nNew assigned at 2202 (this branch) or 2210; set on all paths before use,,
PRE32-C,179,sqlite,src/where.c,2215,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT32-C,180,sqlite,src/where.c,2243,FP,nOut -= 0/1/2: subtracting boolean sum from LogEst row estimate,,
PRE32-C,181,sqlite,src/where.c,2248,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT32-C,182,sqlite,src/where.c,2306,FP,"nEq-1: nEq is index equality-constraint count, bounded by index columns, >=1 here",,
PRE32-C,183,sqlite,src/where.c,2313,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT32-C,184,sqlite,src/where.c,2314,FP,"nEq-1: index nEq count, bounded",,
ARR00-C,185,sqlite,src/where.c,2315,FP,a is tRowcnt a[2] (size 2); a[1] is a valid index (sqc miscounted as a[1]),,
DCL13-C,186,sqlite,src/where.c,2341,TP,whereInScanEst reads pList->nExpr/a[].pExpr only; read-only,,
ARR30-C,187,sqlite,src/where.c,2355,FP,pList->a[i] bounded by i<pList->nExpr; misattributed to a[2]@2284,,
API00-C,188,sqlite,src/where.c,2375,FP,"sqlite3WhereTermPrint debug-only; pTerm null-checked already, internal",,
EXP33-C,189,sqlite,src/where.c,2388,FP,"zLeft is a char[50] OUTPUT buffer written by sqlite3_snprintf, not read uninitialized",,
API00-C,190,sqlite,src/where.c,2425,FP,sqlite3WhereClausePrint debug-only; pWC guaranteed by caller,,
ARR30-C,191,sqlite,src/where.c,2428,FP,bounded planner-array access; misattributed to local a[2]@2284,,
INT32-C,192,sqlite,src/where.c,2453,FP,1+(nSrc+3)/4: nSrc is FROM-clause table count (<=64); debug-print only,,
INT14-C,193,sqlite,src/where.c,2454,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT13-C,194,sqlite,src/where.c,2456,FP,nb is int holding a positive nibble-count; bitwise on signed flag/count value is intended sqlite idiom,,
INT32-C,195,sqlite,src/where.c,2456,FP,(Bitmask)1<<(nb*4): Bitmask is u64; nb derived from nSrc<=64 so shift <64; debug-only,,
INT34-C,196,sqlite,src/where.c,2456,uncertain,"((Bitmask)1)<<(nb*4): nb=1+(nSrc+3)/4; if nSrc near BMS(64), nb*4 can reach ~68 > 63 (debug-only print path)",,
STR34-C,197,sqlite,src/where.c,2470,FP,zName[i]!=char literal compare in debug block; no sign-extend to larger int,,
ARR30-C,198,sqlite,src/where.c,2471,FP,zName[i] backward scan bounded; 'sqlite_autoindex_' prefix matched at 2469 guarantees '_' present,,
EXP34-C,199,sqlite,src/where.c,2471,FP,zName set non-null at 2468 ((zName=...)!=0); 'sqlite_autoindex_' prefix guarantees a '_' exists for the backscan,,
INT32-C,200,sqlite,src/where.c,2471,FP,"i-- : i walks autoindex name string backwards from strlen, bounded, terminates at '_'",,
API00-C,201,sqlite,src/where.c,2510,FP,sqlite3ShowWhereLoopList debug-only; p already const and null-checked in loop,,
MEM30-C,202,sqlite,src/where.c,2535,FP,"single free of u.vtab.idxStr guarded by needFree, then nulled at 2537; no use-after-free",,
MEM30-C,203,sqlite,src/where.c,2536,FP,"needFree=0 is a flag assignment, not a use of freed idxStr",,
MEM30-C,204,sqlite,src/where.c,2539,FP,frees u.btree.pIndex->zColAff (distinct member) before freeing pIndex at 2540; not the freed pointer,,
MEM30-C,205,sqlite,src/where.c,2540,FP,"db is the allocator context passed to sqlite3DbFreeNN, not a freed heap object",,
MEM30-C,206,sqlite,src/where.c,2541,FP,pIndex nulled after free; flag/null assignment is not a use-after-free,,
MEM30-C,207,sqlite,src/where.c,2553,FP,aLTerm freed then reassigned to aLTermSpace (distinct embedded stack buffer); not use of freed mem,,
MEM30-C,208,sqlite,src/where.c,2554,FP,nLSlot reset to ArraySize(aLTermSpace) after reassignment; no freed-pointer access,,
MEM30-C,209,sqlite,src/where.c,2556,FP,"db passed to whereLoopClearUnion is the allocator handle, never freed",,
INT13-C,210,sqlite,src/where.c,2567,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT14-C,211,sqlite,src/where.c,2567,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,212,sqlite,src/where.c,2567,FP,"n+7 rounded up to multiple of 8: n is requested aLTerm slot count, bounded by term count",,
ARR01-C,213,sqlite,src/where.c,2568,FP,"sizeof(p->aLTerm[0]) is element-type sizeof, not decayed-pointer sizeof",,
INT30-C,214,sqlite,src/where.c,2568,FP,"sizeof(aLTerm[0])*n; n is term slot count, small",,
ARR01-C,215,sqlite,src/where.c,2570,FP,sizeof(p->aLTerm[0]) is element-type sizeof,,
ARR38-C,216,sqlite,src/where.c,2570,FP,memcpy size sizeof(aLTerm[0])*p->nLSlot copies old slots into newly-allocated larger buffer,,
INT30-C,217,sqlite,src/where.c,2570,FP,"sizeof*nLSlot; nLSlot is allocated slot count, small",,
INT32-C,218,sqlite,src/where.c,2570,FP,"sizeof*p->nLSlot: nLSlot is allocated term-slot count, bounded by WHERE term count",,
EXP43-C,219,sqlite,src/where.c,2588,FP,pTo and pFrom are distinct WhereLoop objects (caller passes different loops); no overlap,,
ARR01-C,220,sqlite,src/where.c,2589,FP,sizeof(pTo->aLTerm[0]) is element-type sizeof,,
ARR38-C,221,sqlite,src/where.c,2589,FP,memcpy bounded by pTo->nLTerm; pTo->aLTerm resized to fit pFrom->nLTerm before copy,,
EXP43-C,222,sqlite,src/where.c,2589,FP,pTo->aLTerm and pFrom->aLTerm are distinct buffers (separate loops); no real overlap,,
INT30-C,223,sqlite,src/where.c,2589,FP,sizeof*nLTerm; nLTerm small term count,,
INT32-C,224,sqlite,src/where.c,2589,FP,"pTo->nLTerm*sizeof: nLTerm is loop term count, bounded by WHERE term count",,
MEM30-C,225,sqlite,src/where.c,2624,FP,db is allocator arg to sqlite3DbNNFreeNN freeing pWInfo; db itself not freed,,
INT14-C,226,sqlite,src/where.c,2702,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
PRE32-C,227,sqlite,src/where.c,2706,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,228,sqlite,src/where.c,2715,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
DCL13-C,229,sqlite,src/where.c,2740,FP,"whereLoopFindLesser reassigns ppPrev (ppPrev=&p->pNextLoop); param pointer is modified, cannot be const",,
EXP40-C,230,sqlite,src/where.c,2908,FP,WhereLoop **ppTail = &p->pNextLoop is ordinary linked-list traversal; no const qualifier involved,,
DCL13-C,231,sqlite,src/where.c,2946,FP,exprNodePatternLengthEst is a Walker xExprCallback; signature fixed by function-pointer type,,
ARR30-C,232,sqlite,src/where.c,2961,FP,"while((c=*(z++))!=0) is standard NUL-terminated string scan, terminates on NUL",,
INT32-C,233,sqlite,src/where.c,2966,FP,"sz++ : counts non-wildcard chars in LIKE/GLOB pattern, bounded by SQL string length << INT_MAX",,
EXP33-C,234,sqlite,src/where.c,2985,FP,"Walker w: the fields read by sqlite3WalkExpr (u.sz, eCode, callbacks) are all set at 2985-2988; standard partial-init idiom",,
DCL13-C,235,sqlite,src/where.c,3033,FP,whereLoopOutputAdjust writes pTerm->wtFlags |= TERM_HEURTRUTH through pWC->a; pWC effectively mutated,,
INT14-C,236,sqlite,src/where.c,3038,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
DCL13-C,237,sqlite,src/where.c,3143,TP,whereRangeVectorLen reads pIdx->nColumn/aiColumn/aSortOrder/pTable only; read-only,,
DCL13-C,238,sqlite,src/where.c,3145,TP,whereRangeVectorLen reads pTerm->pExpr fields only; pExpr passed onward as Expr*,,
ARR00-C,239,sqlite,src/where.c,3175,FP,"nEq is the equality-constraint count (<= index columns); i+nEq indexes index-structure arrays, planner-bounded",,
INT32-C,240,sqlite,src/where.c,3187,FP,"i+nEq: index column loop index plus equality count, both bounded by index columns",,
PRE01-C,241,sqlite,src/where.c,3197,TP,"macro ApplyCostMultiplier(C,T) expands C += T with unparenthesized params",,
MEM05-C,242,sqlite,src/where.c,3214,FP,"whereLoopAddBtreeIndex recursion bounded by index column count (<=nColumn), small finite",,
MSC04-C,243,sqlite,src/where.c,3214,TP,whereLoopAddBtreeIndex calls itself directly (confirmed self-call),,
PRE32-C,244,sqlite,src/where.c,3245,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT14-C,245,sqlite,src/where.c,3249,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,246,sqlite,src/where.c,3286,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,247,sqlite,src/where.c,3297,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP43-C,248,sqlite,src/where.c,3313,FP,"whereLoopResize(db,pNew,n) takes no overlapping buffers; internal memcpy copies fresh malloc vs old",,
PRE32-C,249,sqlite,src/where.c,3386,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,250,sqlite,src/where.c,3387,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,251,sqlite,src/where.c,3391,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,252,sqlite,src/where.c,3392,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,253,sqlite,src/where.c,3397,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,254,sqlite,src/where.c,3398,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT14-C,255,sqlite,src/where.c,3438,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP43-C,256,sqlite,src/where.c,3441,FP,whereLoopResize call has no overlapping restrict-qualified buffers,,
INT32-C,257,sqlite,src/where.c,3528,FP,"aiRowLogEst[nEq]-[nEq-1]: LogEst stat values difference, tiny; nEq bounded",,
INT33-C,258,sqlite,src/where.c,3554,FP,"szTabRow is table row-size cost estimate, always >=1; LogEst cost arithmetic",,
EXP43-C,259,sqlite,src/where.c,3566,FP,"sqlite3LogEstAdd is a pure value function (LogEst by value); no pointers, no overlap",,
INT30-C,260,sqlite,src/where.c,3571,FP,"LogEst (i16 base-2 log) addition, tiny values, intended",,
INT30-C,261,sqlite,src/where.c,3572,FP,"LogEst addition, tiny values, intended",,
INT30-C,262,sqlite,src/where.c,3591,FP,"LogEst addition, tiny values, intended",,
EXP43-C,263,sqlite,src/where.c,3626,FP,whereLoopResize call; no overlapping memory regions,,
PRE32-C,264,sqlite,src/where.c,3645,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
DCL13-C,265,sqlite,src/where.c,3659,TP,indexMightHelpWithOrderBy read-only predicate; reads pBuilder->pWInfo->pOrderBy only,,
DCL13-C,266,sqlite,src/where.c,3660,TP,indexMightHelpWithOrderBy reads pIndex->bUnordered/nKeyCol/aiColumn/aColExpr only,,
ARR00-C,267,sqlite,src/where.c,3669,FP,"ii is initialized loop counter (for ii=0; ii<pOB->nExpr), not uninitialized",,
EXP34-C,268,sqlite,src/where.c,3669,FP,pOB set by (pOB = pBuilder->pWInfo->pOrderBy)==0 ) return 0 guard at 3668,,
ARR30-C,269,sqlite,src/where.c,3670,FP,pOB->a[ii] bounded by ii<pOB->nExpr; misattributed to a[2]@2284,,
EXP34-C,270,sqlite,src/where.c,3672,FP,pExpr guarded by NEVER(pExpr==0) continue at 3671,,
ARR00-C,271,sqlite,src/where.c,3676,FP,jj is initialized loop counter (for jj=0; jj<pIndex->nKeyCol),,
ARR30-C,272,sqlite,src/where.c,3682,FP,aColExpr->a[jj] bounded by jj<pIndex->nKeyCol; misattributed to a[2]@2284,,
EXP34-C,273,sqlite,src/where.c,3682,FP,aColExpr set by (aColExpr = pIndex->aColExpr)!=0 guard at 3679,,
MEM05-C,274,sqlite,src/where.c,3694,FP,whereUsablePartialIndex recursion bounded by partial-index expr-tree depth (SQLITE_LIMIT_EXPR_DEPTH),,
ARR30-C,275,sqlite,src/where.c,3737,FP,bounded planner-array access; misattributed to local a[2]@2284,,
DCL13-C,276,sqlite,src/where.c,3773,FP,whereIsCoveringIndexWalkCallback is a Walker xExprCallback; signature fixed by function-pointer type,,
DCL13-C,277,sqlite,src/where.c,3826,TP,whereIsCoveringIndex reads pWInfo->pSelect only; passes pSelect not pWInfo onward,,
DCL13-C,278,sqlite,src/where.c,3827,TP,whereIsCoveringIndex reads pIdx fields; stored into ck.pIdx which is const Index*; const-compiles,,
MEM05-C,279,sqlite,src/where.c,3909,FP,"wherePartIdxExpr recursion bounded by expression tree depth, capped by parser depth limit",,
EXP34-C,280,sqlite,src/where.c,3955,FP,pMask non-null in else branch (pItem==0): asserted XOR invariant pMask!=0||pItem!=0 at 3918,,
INT34-C,281,sqlite,src/where.c,3955,FP,"(Bitmask)1<<iColumn guarded by iColumn<(BMS-1), i.e. <63",,
INT14-C,282,sqlite,src/where.c,4020,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,283,sqlite,src/where.c,4091,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,284,sqlite,src/where.c,4116,FP,"iSortIdx++ : counts indices considered for a table, bounded by index count",,
INT14-C,285,sqlite,src/where.c,4162,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,286,sqlite,src/where.c,4162,FP,"2*(flag!=0): multiplying 0/1 boolean by 2, used in LogEst cost",,
INT14-C,287,sqlite,src/where.c,4183,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
PRE32-C,288,sqlite,src/where.c,4193,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,289,sqlite,src/where.c,4194,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,290,sqlite,src/where.c,4201,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,291,sqlite,src/where.c,4202,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,292,sqlite,src/where.c,4206,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,293,sqlite,src/where.c,4207,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,294,sqlite,src/where.c,4214,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,295,sqlite,src/where.c,4215,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
INT33-C,296,sqlite,src/where.c,4239,FP,szTabRow row-size estimate >=1; cost formula divisor non-zero,,
ARR00-C,297,sqlite,src/where.c,4250,FP,ii is initialized loop counter (for ii=0; ii<pWC2->nTerm),,
ARR30-C,298,sqlite,src/where.c,4251,FP,pWC2->a[ii] bounded by ii<pWC2->nTerm; misattributed to a[2]@2284,,
DCL13-C,299,sqlite,src/where.c,4306,TP,isLimitTerm reads pTerm->eOperator/eMatchOp only; pure read-only,,
DCL13-C,300,sqlite,src/where.c,4317,TP,allConstraintsUsed reads aUsage[].argvIndex only; read-only,,
EXP34-C,301,sqlite,src/where.c,4379,FP,pTerm from termFromWhereClause returns &pWC->a[valid iTermOffset] built at 1569; non-null,,
INT14-C,302,sqlite,src/where.c,4379,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR38-C,303,sqlite,src/where.c,4388,FP,"memset(pUsage, 0, sizeof(pUsage[0])*nConstraint); pUsage allocated for nConstraint entries",,
INT30-C,304,sqlite,src/where.c,4388,FP,sizeof(pUsage[0])*nConstraint; vtab constraint count small,,
INT32-C,305,sqlite,src/where.c,4388,FP,"sizeof(pUsage[0])*nConstraint: nConstraint is index-info constraint count, bounded by WHERE terms",,
FLP03-C,306,sqlite,src/where.c,4393,FP,SQLITE_BIG_DBL/(double)2 compile-time constant division; no runtime exception,,
FLP34-C,307,sqlite,src/where.c,4393,FP,constant double init; no runtime range concern,,
ARR38-C,308,sqlite,src/where.c,4415,FP,memset bounded by nConstraint with assert(pNew->nLSlot>=nConstraint) at 4414,,
INT14-C,309,sqlite,src/where.c,4415,FP,sizeof(aLTerm[0])*nConstraint; bounded constraint count,,
INT30-C,310,sqlite,src/where.c,4415,FP,sizeof(aLTerm[0])*nConstraint; bounded constraint count,,
INT32-C,311,sqlite,src/where.c,4415,FP,sizeof(aLTerm[0])*nConstraint: nConstraint bounded by term count; asserted nLSlot>=nConstraint,,
INT14-C,312,sqlite,src/where.c,4420,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT13-C,313,sqlite,src/where.c,4443,FP,1<<i guarded by i<16,,
INT32-C,314,sqlite,src/where.c,4443,FP,1<<i: guarded by i<16 immediately preceding,,
INT34-C,315,sqlite,src/where.c,4443,FP,1<<i guarded by i<16,,
INT13-C,316,sqlite,src/where.c,4445,FP,"1<<iTerm: iTerm is vtab constraint slot, bounded by nConstraint (small); omitMask path",,
INT32-C,317,sqlite,src/where.c,4445,FP,1<<iTerm: iTerm is argv index bounded by nConstraint (<INT bits in practice); vtab term mask,,
INT34-C,318,sqlite,src/where.c,4445,FP,"1<<iTerm: iTerm is vtab constraint slot, bounded by nConstraint (small); omitMask path",,
INT32-C,319,sqlite,src/where.c,4487,FP,"mxTerm+1: mxTerm is max term index, bounded by nConstraint",,
MEM30-C,320,sqlite,src/where.c,4518,FP,single free of u.vtab.idxStr after whereLoopInsert copied it; guarded by needFree,,
MEM30-C,321,sqlite,src/where.c,4519,FP,"needFree=0 flag assignment, not a use of freed pointer",,
PRE32-C,322,sqlite,src/where.c,4521,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
MEM30-C,323,sqlite,src/where.c,4523,FP,"line accesses pNew->prereq (bitmask field), never freed; idxStr free is unrelated",,
DCL13-C,324,sqlite,src/where.c,4543,FP,"sqlite3_vtab_collation is public API (sqlite3.h); signature fixed by ABI, cannot add const",,
API00-C,325,sqlite,src/where.c,4563,FP,sqlite3_vtab_in public xBestIndex API; pIdxInfo guaranteed by vtab framework,,
DCL13-C,326,sqlite,src/where.c,4563,FP,sqlite3_vtab_in writes pHidden->mHandleIn AND is public API; signature fixed,,
INT13-C,327,sqlite,src/where.c,4566,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,328,sqlite,src/where.c,4568,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
API00-C,329,sqlite,src/where.c,4583,FP,sqlite3_vtab_rhs_value public API; pIdxInfo guaranteed by vtab framework,,
DCL13-C,330,sqlite,src/where.c,4584,FP,sqlite3_vtab_rhs_value writes pH->aRhs[] AND is public API; signature fixed,,
ARR00-C,331,sqlite,src/where.c,4594,FP,iCons bounds-checked at line 4591 (iCons<0||iCons>=nConstraint takes error branch); access is in else,,
ARR00-C,332,sqlite,src/where.c,4596,FP,iCons guarded by check at line 4591,,
EXP34-C,333,sqlite,src/where.c,4599,FP,iCons bounds-checked at 4591; termFromWhereClause returns valid non-null term,,
ARR00-C,334,sqlite,src/where.c,4600,FP,iCons guarded by check at line 4591,,
ARR00-C,335,sqlite,src/where.c,4604,FP,iCons guarded by check at line 4591,,
DCL30-C,336,sqlite,src/where.c,4606,FP,*ppVal set to pH->aRhs[iCons] a heap sqlite3_value not address of local,,
API00-C,337,sqlite,src/where.c,4618,FP,sqlite3_vtab_distinct public API; pIdxInfo guaranteed by vtab framework,,
DCL13-C,338,sqlite,src/where.c,4618,FP,"sqlite3_vtab_distinct is public API; signature fixed by ABI, cannot add const",,
API00-C,339,sqlite,src/where.c,4633,FP,sqlite3VtabUsesAllSchemas internal; pParse guaranteed non-null by caller,,
PRE32-C,340,sqlite,src/where.c,4760,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
MEM05-C,341,sqlite,src/where.c,4800,FP,"whereLoopAddOr recursion bounded by OR-subterm nesting depth, parser-capped",,
MSC04-C,342,sqlite,src/where.c,4800,TP,whereLoopAddOr calls itself directly (confirmed self-call),,
INT14-C,343,sqlite,src/where.c,4820,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,344,sqlite,src/where.c,4841,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
PRE32-C,345,sqlite,src/where.c,4856,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
EXP33-C,346,sqlite,src/where.c,4873,FP,sCur.n set to 0 at 4854 before testcase read at 4873; sCur.a[] populated via pOrSet,,
ARR30-C,347,sqlite,src/where.c,4887,FP,sPrev.a[i]/sCur.a[j] bounded by i<sPrev.n / j<sCur.n (WhereOrSet); misattributed to a[2]@2284,,
EXP30-C,348,sqlite,src/where.c,4887,FP,args sPrev.a[i] and sCur.a[j] plus pure sqlite3LogEstAdd calls have no conflicting side effects,,
INT14-C,349,sqlite,src/where.c,4887,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR30-C,350,sqlite,src/where.c,4888,FP,sPrev.a[i]/sCur.a[j] bounded by WhereOrSet n; misattributed to a[2]@2284,,
ARR30-C,351,sqlite,src/where.c,4889,FP,sPrev.a[i]/sCur.a[j] bounded by WhereOrSet n; misattributed to a[2]@2284,,
ARR30-C,352,sqlite,src/where.c,4913,FP,sSum.a[i] bounded by i<sSum.n; misattributed to a[2]@2284,,
ARR30-C,353,sqlite,src/where.c,4914,FP,sSum.a[i] bounded by i<sSum.n; misattributed to a[2]@2284,,
ARR30-C,354,sqlite,src/where.c,4915,FP,sSum.a[i] bounded by i<sSum.n; misattributed to a[2]@2284,,
ARR37-C,355,sqlite,src/where.c,4952,FP,pItem iterates real array pTabList->a (for pItem=pTabList->a; pItem<pEnd); valid array increment,,
INT30-C,356,sqlite,src/where.c,4955,FP,"iPlanLimit u32 planner budget counter, bounded increment, intended",,
INT14-C,357,sqlite,src/where.c,4988,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR37-C,358,sqlite,src/where.c,4998,FP,"&pItem[1] addresses next element of SrcList->a array, bounded by p<pEnd",,
DCL13-C,359,sqlite,src/where.c,5068,TP,wherePathMatchSubqueryOB reads pWInfo->wctrlFlags only; writes go to *pRevMask/*pOBSat,,
DCL13-C,360,sqlite,src/where.c,5069,TP,wherePathMatchSubqueryOB reads pLoop->u.btree.pOrderBy/wsFlags only; read-only,,
DCL13-C,361,sqlite,src/where.c,5072,TP,wherePathMatchSubqueryOB reads pOrderBy->a[]/nExpr only; read-only,,
EXP34-C,362,sqlite,src/where.c,5083,FP,pLoop param non-null (caller); pLoop->u.btree.pOrderBy asserted non-null at 5084,,
ARR30-C,363,sqlite,src/where.c,5087,FP,pSubOB->a[jSub] bounded by jSub<pSubOB->nExpr; misattributed to a[2]@2284,,
ARR30-C,364,sqlite,src/where.c,5091,FP,pSubOB->a[jSub] bounded by jSub<pSubOB->nExpr; misattributed to a[2]@2284,,
EXP34-C,365,sqlite,src/where.c,5092,FP,pWInfo param established non-null by caller,,
ARR30-C,366,sqlite,src/where.c,5094,FP,pSubOB->a[jSub] bounded by jSub<pSubOB->nExpr; misattributed to a[2]@2284,,
DCL13-C,367,sqlite,src/where.c,5139,TP,"wherePathSatisfiesOrderBy reads pPath->aLoop[] only; predicate, read-only",,
DCL13-C,368,sqlite,src/where.c,5142,TP,wherePathSatisfiesOrderBy reads pLast as candidate loop pointer; read-only,,
EXP34-C,369,sqlite,src/where.c,5164,FP,pWInfo param non-null; db = pWInfo->pParse->db,,
INT14-C,370,sqlite,src/where.c,5199,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,371,sqlite,src/where.c,5199,FP,MASKBIT(nOrderBy)-1: nOrderBy bounded by BMS-1 (<=63) checked at line 5197,,
EXP34-C,372,sqlite,src/where.c,5207,FP,pLoop initialized =0 at 5159; deref at 5207 guarded by if(iLoop>0) so a prior iteration assigned it (5209/5212),,
INT14-C,373,sqlite,src/where.c,5232,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR30-C,374,sqlite,src/where.c,5233,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
EXP34-C,375,sqlite,src/where.c,5235,FP,pOBExpr guarded by NEVER(pOBExpr==0) continue at 5234,,
ARR30-C,376,sqlite,src/where.c,5251,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
EXP30-C,377,sqlite,src/where.c,5276,FP,"single assignment of pIndex in condition then tested with ||; sequenced, no UB",,
EXP33-C,378,sqlite,src/where.c,5276,FP,pIndex assigned in the if-condition (pIndex = pLoop->u.btree.pIndex)==0 before use,,
EXP34-C,379,sqlite,src/where.c,5276,FP,return 0 taken when pIndex==0; deref only on non-null path,,
INT14-C,380,sqlite,src/where.c,5332,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,381,sqlite,src/where.c,5332,FP,"j+1: j is nEq loop index, bounded by index columns",,
ARR30-C,382,sqlite,src/where.c,5375,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
ARR30-C,383,sqlite,src/where.c,5391,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
EXP34-C,384,sqlite,src/where.c,5392,FP,pColl from sqlite3ExprNNCollSeq (NonNull variant) guarantees non-null,,
INT32-C,385,sqlite,src/where.c,5395,FP,"j+1: j is index-column loop index, bounded",,
ARR30-C,386,sqlite,src/where.c,5405,FP,"pOrderBy->a[i] (i from matched loop, i<nOrderBy); misattributed to a[2]@2284",,
ARR30-C,387,sqlite,src/where.c,5410,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
ARR30-C,388,sqlite,src/where.c,5415,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
EXP33-C,389,sqlite,src/where.c,5447,FP,p assigned at 5450 (p = pOrderBy->a[i].pExpr) before use at 5451,,
ARR30-C,390,sqlite,src/where.c,5450,FP,pOrderBy->a[i] bounded by i<nOrderBy; misattributed to a[2]@2284,,
INT32-C,391,sqlite,src/where.c,5462,FP,"MASKBIT(i)-1: i bounded by nOrderBy (<BMS), ALWAYS(i<BMS) guard",,
INT13-C,392,sqlite,src/where.c,5463,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
API00-C,393,sqlite,src/where.c,5494,FP,internal accessor; pWInfo guaranteed by caller,,
DCL13-C,394,sqlite,src/where.c,5494,TP,sqlite3WhereIsSorted reads only pWInfo->wctrlFlags/sorted; pure accessor,,
DCL13-C,395,sqlite,src/where.c,5502,TP,wherePathName reads pPath->aLoop[]->cId/pLast->cId only (debug); read-only,,
ARR00-C,396,sqlite,src/where.c,5505,FP,"nLoop is a function parameter (path length), not an uninitialized variable",,
ARR30-C,397,sqlite,src/where.c,5505,FP,zName[i] with i<nLoop; nLoop<=join-table count (BMS=64) < 65; debug-only WHERETRACE path,,
INT32-C,398,sqlite,src/where.c,5506,FP,"i++ : counts loop levels into zName[65], bounded by nLoop (<=BMS)",,
ARR00-C,399,sqlite,src/where.c,5508,FP,zName is declared 'static char zName[65]' (line 5503); not destroyed on return,,
EXP33-C,400,sqlite,src/where.c,5508,FP,static char zName[65] is zero-initialized by C standard and explicitly written in the loop; debug-only,,
DCL13-C,401,sqlite,src/where.c,5518,TP,whereSortingCost reads pWInfo->pSelect/wctrlFlags/iLimit only; read-only,,
EXP34-C,402,sqlite,src/where.c,5545,FP,pWInfo param non-null; pWInfo->pSelect asserted non-null at 5545,,
INT14-C,403,sqlite,src/where.c,5548,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,404,sqlite,src/where.c,5548,FP,"nExpr+59: result-column count plus constant, fed to LogEst; bounded by column count",,
INT32-C,405,sqlite,src/where.c,5552,FP,LogEst((nOrderBy-nSorted)*100/nOrderBy)-66: nOrderBy/nSorted bounded by BMS; LogEst tiny,,
INT33-C,406,sqlite,src/where.c,5552,FP,"reached only when nSorted>0 and nSorted<=nOrderBy, so nOrderBy>0",,
EXP34-C,407,sqlite,src/where.c,5642,FP,pWInfo param non-null; pWInfo->nLevel read,,
EXP33-C,408,sqlite,src/where.c,5652,FP,pWLoop assigned in for-init before first use; not uninitialized,,
EXP34-C,409,sqlite,src/where.c,5652,FP,pWLoop assigned in for-init (pWLoop=pWInfo->pLoops) and loop condition guards null,,
INT14-C,410,sqlite,src/where.c,5683,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT14-C,411,sqlite,src/where.c,5696,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT13-C,412,sqlite,src/where.c,5699,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
EXP34-C,413,sqlite,src/where.c,5845,FP,pWInfo param non-null; pParse=pWInfo->pParse,,
PRE32-C,414,sqlite,src/where.c,5847,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
EXP34-C,415,sqlite,src/where.c,5848,FP,pParse derived from non-null pWInfo->pParse,,
INT30-C,416,sqlite,src/where.c,5881,FP,WherePath array alloc; nLoop bounded by table count <= BMS,,
INT30-C,417,sqlite,src/where.c,5882,FP,sizeof(LogEst)*nOrderBy; ORDER BY term count small,,
INT32-C,418,sqlite,src/where.c,5882,FP,nSpace += sizeof(LogEst)*nOrderBy: nOrderBy bounded by ORDER BY column count,,
ARR38-C,419,sqlite,src/where.c,5900,FP,"memset(aSortCost,0,sizeof(LogEst)*nOrderBy); aSortCost sits in nSpace allocation sized for nOrderBy",,
INT30-C,420,sqlite,src/where.c,5900,FP,sizeof(LogEst)*nOrderBy; bounded,,
INT32-C,421,sqlite,src/where.c,5900,FP,sizeof(LogEst)*nOrderBy: nOrderBy bounded by ORDER BY column count,,
INT14-C,422,sqlite,src/where.c,5937,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR36-C,423,sqlite,src/where.c,5966,FP,"'isOrdered<nOrderBy' is integer comparison (i8 vs int), not pointer compare",,
EXP34-C,424,sqlite,src/where.c,5967,FP,aSortCost allocated at 5899 exactly when nOrderBy>0; index isOrdered<nOrderBy implies nOrderBy>0 so non-null,,
INT14-C,425,sqlite,src/where.c,5976,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
PRE32-C,426,sqlite,src/where.c,5978,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,427,sqlite,src/where.c,5979,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
ARR36-C,428,sqlite,src/where.c,5980,FP,"'nOrderBy-isOrdered' is integer subtraction, not pointer subtraction",,
INT14-C,429,sqlite,src/where.c,6008,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
ARR36-C,430,sqlite,src/where.c,6017,FP,"'rCost>mxCost' is LogEst integer comparison, not pointer compare",,
INT32-C,431,sqlite,src/where.c,6070,FP,"iLoop+1: iLoop is join-level index, bounded by nLoop (<=BMS); debug-print",,
INT32-C,432,sqlite,src/where.c,6088,FP,"iLoop+1: join-level index, bounded; debug-print",,
ARR38-C,433,sqlite,src/where.c,6100,FP,"memcpy sizeof(WhereLoop*)*iLoop; pTo->aLoop has nLoop slots, iLoop<nLoop",,
EXP43-C,434,sqlite,src/where.c,6100,FP,pTo and pFrom are distinct WherePath entries in aTo/aFrom arrays; no overlap,,
INT30-C,435,sqlite,src/where.c,6100,FP,sizeof(WhereLoop*)*iLoop; loop index bounded by nLevel<=BMS,,
EXP33-C,436,sqlite,src/where.c,6129,FP,pTo assigned in for-init before use; not uninitialized,,
EXP34-C,437,sqlite,src/where.c,6129,FP,pTo assigned in for-init (pTo=aTo) and loop-bounded; debug-only block,,
INT32-C,438,sqlite,src/where.c,6134,FP,"iLoop+1: join-level index, bounded by nLoop",,
INT14-C,439,sqlite,src/where.c,6170,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP34-C,440,sqlite,src/where.c,6172,FP,pWLoop = pFrom->aLoop[iLoop] (valid WhereLoop entry) just before deref at 6172,,
EXP33-C,441,sqlite,src/where.c,6181,uncertain,"notUsed passed uninitialized to wherePathSatisfiesOrderBy which does *pRevMask|=...; the other call site (5959) zeroes revMask first. Result discarded so effect-free, but technically reads indeterminate value",,
INT32-C,442,sqlite,src/where.c,6182,FP,"nLoop-1: nLoop is join level count, bounded by BMS",,
INT13-C,443,sqlite,src/where.c,6203,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,444,sqlite,src/where.c,6204,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,445,sqlite,src/where.c,6209,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,446,sqlite,src/where.c,6210,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
EXP34-C,447,sqlite,src/where.c,6296,FP,pWInfo param non-null; loop bound pWInfo->nLevel,,
ARR30-C,448,sqlite,src/where.c,6297,FP,pWInfo->a[i] (WhereLevel) bounded by i<pWInfo->nLevel (<=64); misattributed to a[2]@2284,,
DCL13-C,449,sqlite,src/where.c,6340,FP,whereShortCut is a WhereLoop builder; pBuilder->pNew etc. are written,,
DCL13-C,450,sqlite,src/where.c,6463,TP,showAllWhereLoops reads pWInfo->pLoops only (debug); read-only,,
INT10-C,451,sqlite,src/where.c,6470,FP,divisor sizeof(zLabel)-1 is constant 62; i non-negative loop counter,,
INT30-C,452,sqlite,src/where.c,6470,FP,divisor sizeof(zLabel)-1 is constant 62; i non-negative loop counter,,
INT33-C,453,sqlite,src/where.c,6470,FP,divisor sizeof(zLabel)-1 is constant 62; i non-negative loop counter,,
EXP34-C,454,sqlite,src/where.c,6529,FP,pWInfo param non-null (precondition); assert pWInfo->nLevel>=2,,
INT14-C,455,sqlite,src/where.c,6535,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
EXP33-C,456,sqlite,src/where.c,6543,FP,whereOmitNoopJoin loop locals (pTerm/pEnd/pItem/pLoop/m1) all set before use in the loop body,,
ARR30-C,457,sqlite,src/where.c,6547,FP,pWInfo->a[i] bounded by i<nLevel; misattributed to a[2]@2284,,
FLP30-C,458,sqlite,src/where.c,6557,FP,pTerm is WhereTerm* pointer loop var misclassified as float,,
INT32-C,459,sqlite,src/where.c,6574,FP,"MASKBIT(i)-1: i is FROM-term level index, bounded by nLevel (<=BMS)",,
FLP30-C,460,sqlite,src/where.c,6578,FP,pTerm is WhereTerm* pointer loop var misclassified as float,,
INT30-C,461,sqlite,src/where.c,6585,FP,(nLevel-1-i)*sizeof(WhereLevel) memmove; nLevel bounded by table count,,
ARR30-C,462,sqlite,src/where.c,6586,FP,pWInfo->a[i] bounded by i<nLevel; misattributed to a[2]@2284,,
INT31-C,463,sqlite,src/where.c,6586,FP,"nByte is computed positive WhereLevel-shift byte count, non-negative here",,
INT32-C,464,sqlite,src/where.c,6586,FP,i+1 used for memmove of WhereLevel array; i bounded by nLevel,,
EXP34-C,465,sqlite,src/where.c,6618,FP,pWInfo const param non-null; assert nLevel>=2,,
ARR30-C,466,sqlite,src/where.c,6621,FP,pWInfo->a[i] bounded by i<nLevel; misattributed to a[2]@2284,,
PRE32-C,467,sqlite,src/where.c,6636,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
FLP34-C,468,sqlite,src/where.c,6639,FP,int LogEstToInt to double in debug WHERETRACE; bounded value no range loss,,
FLP34-C,469,sqlite,src/where.c,6640,FP,int LogEstToInt to double in debug WHERETRACE; bounded value no range loss,,
DCL13-C,470,sqlite,src/where.c,6662,TP,whereAddIndexedExpr reads pTabItem->iCursor/fg.jointype only; writes go to new IndexedExpr,,
EXP33-C,471,sqlite,src/where.c,6670,FP,pExpr assigned at 6673/6675 before use at 6679 (else-path continues),,
ARR30-C,472,sqlite,src/where.c,6673,FP,pWInfo->a[i] bounded by i<nLevel; misattributed to a[2]@2284,,
ARR00-C,473,sqlite,src/where.c,6718,FP,ii is initialized loop counter (for ii=0; ii<pTabList->nSrc),,
EXP34-C,474,sqlite,src/where.c,6718,FP,pWInfo param non-null; loop bound pWInfo->pTabList->nSrc,,
ARR30-C,475,sqlite,src/where.c,6719,FP,pTabList->a[ii] bounded by ii<pTabList->nSrc; misattributed to a[2]@2284,,
API00-C,476,sqlite,src/where.c,6818,FP,"sqlite3WhereBegin main entry; pParse is caller-guaranteed parse context, not untrusted input",,
MSC04-C,477,sqlite,src/where.c,6818,TP,sqlite3WhereBegin<->WhereCodeOneLoopStart->WhereBegin OR-subclause mutual recursion,,
DCL13-C,478,sqlite,src/where.c,6822,FP,sqlite3WhereBegin reassigns pOrderBy=0 and stores into pWInfo->pOrderBy (non-const field),,
INT30-C,479,sqlite,src/where.c,6888,FP,"nByteWInfo+sizeof allocation sizing, bounded",,
INT32-C,480,sqlite,src/where.c,6908,FP,"offsetof difference: compile-time constant struct offsets, cannot overflow",,
EXP08-C,481,sqlite,src/where.c,6909,FP,&pWInfo->nOBSat with offsetof byte-difference as the SIZE arg to memset; no pointer arithmetic added to struct ptr,,
ARR38-C,482,sqlite,src/where.c,6910,FP,memset of pWInfo->a flexarray; WhereInfo allocated with trailing nTabList WhereLevel space,,
INT30-C,483,sqlite,src/where.c,6910,FP,sizeof+nTabList*sizeof; nTabList bounded by table count,,
INT32-C,484,sqlite,src/where.c,6910,FP,sizeof(WhereLoop)+nTabList*sizeof(WhereLevel): nTabList bounded by join table count (<=64),,
INT14-C,485,sqlite,src/where.c,6919,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,486,sqlite,src/where.c,6919,FP,(char*)pWInfo+nByteWInfo: pointer arithmetic into just-allocated block; nByteWInfo bounded,,
MEM30-C,487,sqlite,src/where.c,6937,FP,"db is the live connection handle passed to OptimizationEnabled, never freed",,
ARR30-C,488,sqlite,src/where.c,6970,FP,pWInfo->a[ii] (WhereLevel) bounded by nLevel; misattributed to a[2]@2284,,
EXP33-C,489,sqlite,src/where.c,7013,FP,pX assigned at 7015 (pX = pT->pExpr) before use at 7016,,
MEM30-C,490,sqlite,src/where.c,7029,FP,"db is allocator/connection handle, not a freed object",,
PRE32-C,491,sqlite,src/where.c,7081,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
PRE32-C,492,sqlite,src/where.c,7082,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
MEM30-C,493,sqlite,src/where.c,7087,FP,db is allocator arg to whereLoopDelete freeing loop p; db not freed,,
MEM30-C,494,sqlite,src/where.c,7096,FP,db->mallocFailed reads live connection handle; db never freed on this path,,
EXP43-C,495,sqlite,src/where.c,7099,FP,"wherePathSolver(pWInfo,int) has no overlapping buffer args",,
MEM30-C,496,sqlite,src/where.c,7100,FP,db->mallocFailed read on live connection handle,,
PRE32-C,497,sqlite,src/where.c,7108,FP,WHERETRACE expands to if(..)sqlite3DebugPrintf X; no # ## or directive in args,,
MEM30-C,498,sqlite,src/where.c,7115,FP,db->flags read on live connection handle,,
MEM30-C,499,sqlite,src/where.c,7121,FP,db->mallocFailed assert on live connection handle,,
ARR30-C,500,sqlite,src/where.c,7145,FP,pWInfo->a[ii] (WhereLevel) bounded by nLevel; misattributed to a[2]@2284,,
MEM30-C,501,sqlite,src/where.c,7164,FP,"db is connection/allocator handle, never freed",,
MEM30-C,502,sqlite,src/where.c,7175,FP,"db is connection/allocator handle, never freed",,
INT13-C,503,sqlite,src/where.c,7211,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,504,sqlite,src/where.c,7212,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,505,sqlite,src/where.c,7216,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
MEM30-C,506,sqlite,src/where.c,7217,FP,"db is connection/allocator handle, never freed",,
INT13-C,507,sqlite,src/where.c,7220,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,508,sqlite,src/where.c,7224,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
MEM30-C,509,sqlite,src/where.c,7239,FP,"db is connection/allocator handle, never freed",,
ARR37-C,510,sqlite,src/where.c,7242,FP,pTabItem[0] is *pTabItem where pTabItem=&pTabList->a[..]; valid element deref,,
INT32-C,511,sqlite,src/where.c,7244,FP,"ii-1: ii is join-level loop index, bounded by nLevel",,
INT32-C,512,sqlite,src/where.c,7245,FP,"ii-1: join-level index, bounded",,
INT32-C,513,sqlite,src/where.c,7247,FP,"ii-1: join-level index, bounded",,
MEM30-C,514,sqlite,src/where.c,7254,FP,"db is connection/allocator handle, never freed",,
ARR37-C,515,sqlite,src/where.c,7301,FP,pTabItem[0] is *pTabItem into SrcList->a array; valid element deref,,
MEM30-C,516,sqlite,src/where.c,7338,FP,"db is connection/allocator handle, never freed",,
EXP00-C,517,sqlite,src/where.c,7373,FP,((u64)1)<<(ii<63 ? ii : 63): shift amount already fully parenthesized; expression unambiguous,,
INT13-C,518,sqlite,src/where.c,7373,FP,((u64)1)<<(ii<63?ii:63) explicitly clamped to 63,,
INT34-C,519,sqlite,src/where.c,7373,FP,((u64)1)<<(ii<63?ii:63) explicitly clamped to 63,,
EXP34-C,520,sqlite,src/where.c,7403,FP,pPk in the !HasRowid(pTab) branch: WITHOUT ROWID table always has a PK index; non-null,,
MEM30-C,521,sqlite,src/where.c,7415,FP,db->mallocFailed read on live connection handle,,
ARR30-C,522,sqlite,src/where.c,7426,FP,pWInfo->a[ii] (WhereLevel) bounded by nLevel; misattributed to a[2]@2284,,
INT13-C,523,sqlite,src/where.c,7444,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,524,sqlite,src/where.c,7445,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
MEM30-C,525,sqlite,src/where.c,7452,FP,db->mallocFailed read on live connection handle,,
INT13-C,526,sqlite,src/where.c,7460,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
DCL30-C,527,sqlite,src/where.c,7468,FP,returns pWInfo from sqlite3DbMallocRawNN heap not automatic storage,,
MSC07-C,528,sqlite,src/where.c,7471,FP,code after return is goto-label whereBeginError reached via goto not dead,,
MEM30-C,529,sqlite,src/where.c,7474,FP,db is allocator arg to whereInfoFree freeing pWInfo on error path; db not freed,,
DCL13-C,530,sqlite,src/where.c,7495,TP,sqlite3WhereOpcodeRewriteTrace reads db->flags only (debug); read-only,,
API00-C,531,sqlite,src/where.c,7509,FP,sqlite3WhereEnd public-ish API; pWInfo guaranteed non-null by caller,,
MSC04-C,532,sqlite,src/where.c,7509,TP,sqlite3WhereEnd->RightJoinLoop re-enters where codegen; genuine indirect recursion,,
EXP34-C,533,sqlite,src/where.c,7510,FP,pWInfo param non-null; pParse=pWInfo->pParse,,
EXP34-C,534,sqlite,src/where.c,7511,FP,pParse from non-null pWInfo->pParse; pParse->pVdbe read,,
ARR30-C,535,sqlite,src/where.c,7528,FP,pWInfo->a[i] (WhereLevel) bounded by nLevel; misattributed to a[2]@2284,,
EXP30-C,536,sqlite,src/where.c,7548,FP,(pIdx=...)->hasStat1 && (n=...)>0: && introduces sequence points; assignments sequenced,,
EXP45-C,537,sqlite,src/where.c,7551,TP,"genuine assignment in if-condition: 'pIdx = pLoop->u.btree.pIndex' (idiomatic, real instance)",,
INT32-C,538,sqlite,src/where.c,7555,FP,"pParse->nMem+1: register counter, bounded by query size",,
INT32-C,539,sqlite,src/where.c,7558,FP,"r1+j: register base plus nDistinctCol loop index, bounded",,
INT32-C,540,sqlite,src/where.c,7560,FP,"pParse->nMem += n+1: n is nDistinctCol, bounded by index columns",,
EXP34-C,541,sqlite,src/where.c,7569,FP,pTabList = pWInfo->pTabList (non-null) established at 7515,,
INT32-C,542,sqlite,src/where.c,7580,FP,"-nOuter: nOuter counts up from 0 (>=0), so -nOuter is never -INT_MIN",,
INT32-C,543,sqlite,src/where.c,7584,FP,"-nOuter: nOuter>=0 by construction, negation safe",,
INT14-C,544,sqlite,src/where.c,7601,FP,"sqlite bitmask/LogEst/flags idiom: bitwise & arith on same var is intended, not a defect",,
INT32-C,545,sqlite,src/where.c,7601,FP,"pLevel->p2-1: VDBE address operand, bounded by program size",,
ARR37-C,546,sqlite,src/where.c,7615,FP,"pIn walks aInLoop array backward from nIn-1 (pIn=&aInLoop[j-1]; j>0; pIn--), bounded",,
EXP33-C,547,sqlite,src/where.c,7615,FP,j assigned in for-init at 7615 before use; not uninitialized,,
INT32-C,548,sqlite,src/where.c,7615,FP,"j-1: j is nIn (IN-clause element) loop index, bounded",,
INT32-C,549,sqlite,src/where.c,7634,FP,VdbeCurrentAddr()+2+bEarlyOut: current VDBE address (bounded by program size) plus small const,,
INT32-C,550,sqlite,src/where.c,7666,FP,"pLevel->addrSkip-2: VDBE address, bounded by program size",,
INT13-C,551,sqlite,src/where.c,7678,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,552,sqlite,src/where.c,7679,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT32-C,553,sqlite,src/where.c,7688,FP,"n+m-1: n is result register, m is column count; both bounded by query/schema",,
INT13-C,554,sqlite,src/where.c,7692,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,555,sqlite,src/where.c,7693,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
INT13-C,556,sqlite,src/where.c,7695,FP,"bitwise op on signed int holding flag bits (wsFlags/op/eOperator/mask); values are positive flag enums, intended",,
EXP33-C,557,sqlite,src/where.c,7717,FP,pOp assigned at 7794/7799 (sqlite3VdbeGetOp) before use at 7795/7803,,
EXP34-C,558,sqlite,src/where.c,7719,FP,pLevel assigned in for-init (pLevel=pWInfo->a) and loop-bounded valid entry,,
EXP34-C,559,sqlite,src/where.c,7757,FP,pLoop = pLevel->pWLoop at 7722 (established WhereLoop),,
EXP34-C,560,sqlite,src/where.c,7763,FP,db = pParse->db at 7516; non-null connection,,
INT32-C,561,sqlite,src/where.c,7787,FP,"pLevel->addrBody+1: VDBE address (program counter), bounded by program size",,
PRE32-C,562,sqlite,src/where.c,7790,FP,plain printf with string literal+args; no # ## or directive in args,,
INT32-C,563,sqlite,src/where.c,7791,FP,"last-1: VDBE opcode-range bound, bounded by program size; debug-only",,
INT32-C,564,sqlite,src/where.c,7794,FP,"k-1: VDBE address k=addrBody+1, bounded by program size",,
EXP34-C,565,sqlite,src/where.c,7795,FP,pOp from sqlite3VdbeGetOp (SQLITE_DEBUG); returns valid op array (dummy on OOM),,
ARR36-C,566,sqlite,src/where.c,7800,FP,pLastOp = pOp + (last-k) forms end pointer within VDBE op array; same-array arithmetic,,
INT32-C,567,sqlite,src/where.c,7800,FP,"last-k: VDBE address range span, bounded by program size",,
EXP34-C,568,sqlite,src/where.c,7819,FP,pPk in !HasRowid(pTab) branch: WITHOUT ROWID guarantees a PK index; non-null,,
INT32-C,569,sqlite,src/where.c,7847,FP,"pLevel->addrBody-1: VDBE address, bounded by program size",,
MEM30-C,570,sqlite,src/where.c,7880,FP,whereInfoFree(pWInfo) on success path is mutually exclusive with error-path free at 7474; path-insensitive double-free,,
INT34-C,571,sqlite,src/where.c,4454,FN,"whereLoopAddVirtualOne: MASKBIT32(iTerm)=((u32)1)<<iTerm (and 1<<iTerm omitMask at ~4445); iTerm=argvIndex-1 bounded only by nConstraint -> with >=32 vtab constraints, shift >= width (INT34-C UB -> wrong mask bit, not memory corruption)","STILL PRESENT on sqlite-main 124f449319 (lines 4457/4466 byte-identical); narrow/benign, vtab threat model",low