WITHOUT ROWID is a very useful tool to have in the bag for sqlite. didn't know this was a thing.

I've got a very large many-many map table with a composite PK of two integers, like left_id, right_id.

turns out by default sqlite adds a rowid meta-column to tables. when the PK is a single integer it's a direct alias (no additional storage) but in other cases, like my table, it ends up as a separate stored value. for small row sizes this is rather space inefficient. it can also be slower to query

the only negative effects of removing rowid are that you can't have an autoincrement PK in a table without it (which I don't need here) and you can't retrieve the ID of the last inserted row (which isn't really a useful concept when you're not autoincrementing anyway)

@gsuberland See also this neat little vuln

https://projectzero.google/2024/10/from-naptime-to-big-sleep.html

@buherator @gsuberland No PoC for exploitation.

@stiiin @gsuberland True, although I doubt many ppl spent considerable time on exploitation as the code never got to a release. A "likely exploitable" classification by P0 is also a strong indicator of impact IMO.