Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -4074,11 +4074,10 @@
       releasePageNotNull(pPg);
     }else{
       rc = allocateBtreePage(pBt, &pFree, &iNew, iFirst-1, BTALLOC_LE);
       assert( rc!=SQLITE_OK || iNew<iFirst );
       if( rc==SQLITE_OK ){
-        MemPage *pPg = 0;
         releasePage(pFree);
         btreeGetPage(pBt, iPg, &pPg, 0);
         rc = relocatePage(pBt, pPg, pEntry->eType, pEntry->parent,iNew,1);
         releasePage(pPg);
       }

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -5472,10 +5472,11 @@
 
 #ifndef SQLITE_OMIT_CONCURRENT
   /* If this is an CONCURRENT transaction and the page being read was
   ** present in the database file when the transaction was opened,
   ** mark it as read in the pAllRead vector.  */
+  pPg = 0;
   if( pPager->pAllRead && pgno<=pPager->dbOrigSize ){
     rc = sqlite3BitvecSet(pPager->pAllRead, pgno);
     if( rc!=SQLITE_OK ) goto pager_acquire_err;
   }
 #endif

Index: src/wal.c
==================================================================
--- src/wal.c
+++ src/wal.c
@@ -2897,13 +2897,14 @@
         volatile u32 *aPgno;
         u32 iZero;
 
         rc = walHashGet(pWal, iHash, &aHash, &aPgno, &iZero);
         if( rc==SQLITE_OK ){
-          int i;
-          int iMin = (iFirst - iZero);
-          int iMax = (iHash==0) ? HASHTABLE_NPAGE_ONE : HASHTABLE_NPAGE;
+          u32 i, iMin, iMax;
+          assert( iFirst >= iZero );
+          iMin = (iFirst - iZero);
+          iMax = (iHash==0) ? HASHTABLE_NPAGE_ONE : HASHTABLE_NPAGE;
           if( iMin<1 ) iMin = 1;
           if( iMax>head.mxFrame ) iMax = head.mxFrame;
           for(i=iMin; rc==SQLITE_OK && i<=iMax; i++){
             PgHdr *pPg;
             if( aPgno[i]==1 ){