Index: src/where.c
==================================================================
--- src/where.c
+++ src/where.c
@@ -5469,10 +5469,11 @@
   WherePath *pTo;           /* An element of aTo[] that we are working on */
   WhereLoop *pWLoop;        /* One of the WhereLoop objects */
   WhereLoop **pX;           /* Used to divy up the pSpace memory */
   LogEst *aSortCost = 0;    /* Sorting and partial sorting costs */
   char *pSpace;             /* Temporary memory used by this routine */
+  int nSpace;               /* Bytes of space allocated at pSpace */
 
   pParse = pWInfo->pParse;
   db = pParse->db;
   nLoop = pWInfo->nLevel;
   /* TUNING: For simple queries, only the best path is tracked.
@@ -5492,13 +5493,13 @@
   }else{
     nOrderBy = pWInfo->pOrderBy->nExpr;
   }
 
   /* Allocate and initialize space for aTo, aFrom and aSortCost[] */
-  ii = (sizeof(WherePath)+sizeof(WhereLoop*)*nLoop)*mxChoice*2;
-  ii += sizeof(LogEst) * nOrderBy;
-  pSpace = sqlite3DbMallocRaw(db, ii);
+  nSpace = (sizeof(WherePath)+sizeof(WhereLoop*)*nLoop)*mxChoice*2;
+  nSpace += sizeof(LogEst) * nOrderBy;
+  pSpace = sqlite3DbMallocRaw(db, nSpace);
   if( pSpace==0 ) return SQLITE_NOMEM;
   aTo = (WherePath*)pSpace;
   aFrom = aTo+mxChoice;
   memset(aFrom, 0, sizeof(aFrom[0]));
   pX = (WhereLoop**)(aFrom+mxChoice);
@@ -5511,12 +5512,14 @@
     ** is either zero - meaning it has not yet been initialized - or the
     ** cost of sorting nRowEst rows of data where the first X terms of
     ** the ORDER BY clause are already in order, where X is the array 
     ** index.  */
     aSortCost = (LogEst*)pX;
-    memset(aSortCost, 0, sizeof(LogEst) * (nOrderBy+1));
+    memset(aSortCost, 0, sizeof(LogEst) * nOrderBy);
   }
+  assert( aSortCost==0 || &pSpace[nSpace]==(char*)&aSortCost[nOrderBy] );
+  assert( aSortCost!=0 || &pSpace[nSpace]==(char*)pX );
 
   /* Seed the search with a single WherePath containing zero WhereLoops.
   **
   ** TUNING: Do not let the number of iterations go above 25.  If the cost
   ** of computing an automatic index is not paid back within the first 25