Application crash via concat_ws integer overflow

Heap buffer overflow in SQLite 3.44.0 through 3.49.0 allows attackers to crash the host process via a crafted concat_ws() call. The concat_ws() result-size calculation multiplies the separator length without first widening it, so a separator larger than 2 MB and many arguments can overflow the integer and produce an undersized malloc allocation followed by an out-of-bounds write. Exploitation requires control over executable SQL and the first concat_ws() argument; applications that neither execute untrusted SQL nor call concat_ws() do not expose this path.