Thank you very much for the info. I do not know a whole lot regarding how sqlite uses lemon and i have also contacted the creators of lemon. I just thought i would point it out (regardless of the criticality of the vulnerability because i came across it and felt obligated. Could you please go into more detail on how sqlite uses lemon to generate C code? Thanks, Cyber Security Researcher