Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -969,13 +969,13 @@
 ** 4-byte child pointer found on interior pages, if there is one.
 **
 ** This routine works only for pages that do not contain overflow cells.
 */
 #define findCell(P,I) \
-  ((P)->aData + ((P)->maskPage & get2byte(&(P)->aCellIdx[2*(I)])))
+  ((P)->aData + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
 #define findCellPastPtr(P,I) \
-  ((P)->aDataOfst + ((P)->maskPage & get2byte(&(P)->aCellIdx[2*(I)])))
+  ((P)->aDataOfst + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
 
 
 /*
 ** This is common tail processing for btreeParseCellPtr() and
 ** btreeParseCellPtrIndex() for the case when the cell does not fit entirely
@@ -1752,11 +1752,11 @@
       int i;            /* Index into the cell pointer array */
       int sz;           /* Size of a cell */
 
       if( !pPage->leaf ) iCellLast--;
       for(i=0; i<pPage->nCell; i++){
-        pc = get2byte(&data[cellOffset+i*2]);
+        pc = get2byteAligned(&data[cellOffset+i*2]);
         testcase( pc==iCellFirst );
         testcase( pc==iCellLast );
         if( pc<iCellFirst || pc>iCellLast ){
           return SQLITE_CORRUPT_BKPT;
         }
@@ -6623,11 +6623,11 @@
   put2byte(&aData[hdr+5], pData - aData);
 
 #ifdef SQLITE_DEBUG
   for(i=0; i<nNew && !CORRUPT_DB; i++){
     u8 *pCell = pCArray->apCell[i+iNew];
-    int iOff = get2byte(&pPg->aCellIdx[i*2]);
+    int iOff = get2byteAligned(&pPg->aCellIdx[i*2]);
     if( pCell>=aData && pCell<&aData[pPg->pBt->usableSize] ){
       pCell = &pTmp[pCell - aData];
     }
     assert( 0==memcmp(pCell, &aData[iOff],
             pCArray->pRef->xCellSize(pCArray->pRef, pCArray->apCell[i+iNew])) );
@@ -7125,11 +7125,11 @@
     memset(&b.szCell[b.nCell], 0, sizeof(b.szCell[0])*limit);
     if( pOld->nOverflow>0 ){
       memset(&b.szCell[b.nCell+limit], 0, sizeof(b.szCell[0])*pOld->nOverflow);
       limit = pOld->aiOvfl[0];
       for(j=0; j<limit; j++){
-        b.apCell[b.nCell] = aData + (maskPage & get2byte(piCell));
+        b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell));
         piCell += 2;
         b.nCell++;
       }
       for(k=0; k<pOld->nOverflow; k++){
         assert( k==0 || pOld->aiOvfl[k-1]+1==pOld->aiOvfl[k] );/* NOTE 1 */
@@ -7138,11 +7138,11 @@
       }
     }
     piEnd = aData + pOld->cellOffset + 2*pOld->nCell;
     while( piCell<piEnd ){
       assert( b.nCell<nMaxCells );
-      b.apCell[b.nCell] = aData + (maskPage & get2byte(piCell));
+      b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell));
       piCell += 2;
       b.nCell++;
     }
 
     cntOld[i] = b.nCell;
@@ -9103,11 +9103,11 @@
     ** immediately follows the b-tree page header. */
     cellStart = hdr + 12 - 4*pPage->leaf;
     /* EVIDENCE-OF: R-02776-14802 The cell pointer array consists of K 2-byte
     ** integer offsets to the cell contents. */
     for(i=0; i<nCell; i++){
-      int pc = get2byte(&data[cellStart+i*2]);
+      int pc = get2byteAligned(&data[cellStart+i*2]);
       u32 size = 65536;
       if( pc<=usableSize-4 ){
         size = pPage->xCellSize(pPage, &data[pc]);
       }
       if( (int)(pc+size-1)>=usableSize ){

Index: src/btreeInt.h
==================================================================
--- src/btreeInt.h
+++ src/btreeInt.h
@@ -689,5 +689,18 @@
 */
 #define get2byte(x)   ((x)[0]<<8 | (x)[1])
 #define put2byte(p,v) ((p)[0] = (u8)((v)>>8), (p)[1] = (u8)(v))
 #define get4byte sqlite3Get4byte
 #define put4byte sqlite3Put4byte
+
+/*
+** get2byteAligned(), unlike get2byte(), requires that its argument point to a
+** two-byte aligned address.  get2bytea() is only used for accessing the
+** cell addresses in a btree header.
+*/
+#if SQLITE_BYTEORDER==4321
+# define get2byteAligned(x)  (*(u16*)(x))
+#elif SQLITE_BYTEORDER==1234 && defined(__GNUC__)
+# define get2byteAligned(x)  __builtin_bswap16(*(u16*)(x))
+#else
+# define get2byteAligned(x)  ((x)[0]<<8 | (x)[1])
+#endif

Index: src/util.c
==================================================================
--- src/util.c
+++ src/util.c
@@ -1080,14 +1080,10 @@
 u32 sqlite3Get4byte(const u8 *p){
 #if SQLITE_BYTEORDER==4321
   u32 x;
   memcpy(&x,p,4);
   return x;
-#elif defined(_MSC_VER)
-  u32 x;
-  memcpy(&x,p,4);
-  return htonl(x);
 #elif SQLITE_BYTEORDER==1234 && defined(__GNUC__)
   u32 x;
   memcpy(&x,p,4);
   return __builtin_bswap32(x);
 #else
@@ -1096,13 +1092,10 @@
 #endif
 }
 void sqlite3Put4byte(unsigned char *p, u32 v){
 #if SQLITE_BYTEORDER==4321
   memcpy(p,&v,4);
-#elif defined(_MSC_VER)
-  u32 x = htonl(v);
-  memcpy(&x,p,4);
 #elif SQLITE_BYTEORDER==1234 && defined(__GNUC__)
   u32 x = __builtin_bswap32(v);
   memcpy(p,&x,4);
 #else
   p[0] = (u8)(v>>24);