1diff --git ext/fts2/fts2_icu.c ext/fts2/fts2_icu.c 2index 6b9687e..a8b8359 100644 3--- ext/fts2/fts2_icu.c 4+++ ext/fts2/fts2_icu.c 5@@ -118,15 +118,15 @@ static int icuOpen( 6 nChar = nInput+1; 7 pCsr = (IcuCursor *)sqlite3_malloc( 8 sizeof(IcuCursor) + /* IcuCursor */ 9- nChar * sizeof(UChar) + /* IcuCursor.aChar[] */ 10- (nChar+1) * sizeof(int) /* IcuCursor.aOffset[] */ 11+ (nChar+1) * sizeof(int) + /* IcuCursor.aOffset[] */ 12+ nChar * sizeof(UChar) /* IcuCursor.aChar[] */ 13 ); 14 if( !pCsr ){ 15 return SQLITE_NOMEM; 16 } 17 memset(pCsr, 0, sizeof(IcuCursor)); 18- pCsr->aChar = (UChar *)&pCsr[1]; 19- pCsr->aOffset = (int *)&pCsr->aChar[nChar]; 20+ pCsr->aOffset = (int *)&pCsr[1]; 21+ pCsr->aChar = (UChar *)&pCsr->aOffset[nChar+1]; 22 23 pCsr->aOffset[iOut] = iInput; 24 U8_NEXT(zInput, iInput, nInput, c); 25diff --git ext/fts3/fts3_icu.c ext/fts3/fts3_icu.c 26index a75b14a..e406168 100644 27--- ext/fts3/fts3_icu.c 28+++ ext/fts3/fts3_icu.c 29@@ -118,15 +118,15 @@ static int icuOpen( 30 nChar = nInput+1; 31 pCsr = (IcuCursor *)sqlite3_malloc( 32 sizeof(IcuCursor) + /* IcuCursor */ 33- nChar * sizeof(UChar) + /* IcuCursor.aChar[] */ 34- (nChar+1) * sizeof(int) /* IcuCursor.aOffset[] */ 35+ (nChar+1) * sizeof(int) + /* IcuCursor.aOffset[] */ 36+ nChar * sizeof(UChar) /* IcuCursor.aChar[] */ 37 ); 38 if( !pCsr ){ 39 return SQLITE_NOMEM; 40 } 41 memset(pCsr, 0, sizeof(IcuCursor)); 42- pCsr->aChar = (UChar *)&pCsr[1]; 43- pCsr->aOffset = (int *)&pCsr->aChar[nChar]; 44+ pCsr->aOffset = (int *)&pCsr[1]; 45+ pCsr->aChar = (UChar *)&pCsr->aOffset[nChar+1]; 46 47 pCsr->aOffset[iOut] = iInput; 48 U8_NEXT(zInput, iInput, nInput, c); 49