|  | diff --git ext/fts2/fts2_icu.c ext/fts2/fts2_icu.c | 
|  | index 6b9687e..a8b8359 100644 | 
|  | --- ext/fts2/fts2_icu.c | 
|  | +++ ext/fts2/fts2_icu.c | 
|  | @@ -118,15 +118,15 @@ static int icuOpen( | 
|  | nChar = nInput+1; | 
|  | pCsr = (IcuCursor *)sqlite3_malloc( | 
|  | sizeof(IcuCursor) +                /* IcuCursor */ | 
|  | -      nChar * sizeof(UChar) +            /* IcuCursor.aChar[] */ | 
|  | -      (nChar+1) * sizeof(int)            /* IcuCursor.aOffset[] */ | 
|  | +      (nChar+1) * sizeof(int) +          /* IcuCursor.aOffset[] */ | 
|  | +      nChar * sizeof(UChar)              /* IcuCursor.aChar[] */ | 
|  | ); | 
|  | if( !pCsr ){ | 
|  | return SQLITE_NOMEM; | 
|  | } | 
|  | memset(pCsr, 0, sizeof(IcuCursor)); | 
|  | -  pCsr->aChar = (UChar *)&pCsr[1]; | 
|  | -  pCsr->aOffset = (int *)&pCsr->aChar[nChar]; | 
|  | +  pCsr->aOffset = (int *)&pCsr[1]; | 
|  | +  pCsr->aChar = (UChar *)&pCsr->aOffset[nChar+1]; | 
|  |  | 
|  | pCsr->aOffset[iOut] = iInput; | 
|  | U8_NEXT(zInput, iInput, nInput, c); | 
|  | diff --git ext/fts3/fts3_icu.c ext/fts3/fts3_icu.c | 
|  | index a75b14a..e406168 100644 | 
|  | --- ext/fts3/fts3_icu.c | 
|  | +++ ext/fts3/fts3_icu.c | 
|  | @@ -118,15 +118,15 @@ static int icuOpen( | 
|  | nChar = nInput+1; | 
|  | pCsr = (IcuCursor *)sqlite3_malloc( | 
|  | sizeof(IcuCursor) +                /* IcuCursor */ | 
|  | -      nChar * sizeof(UChar) +            /* IcuCursor.aChar[] */ | 
|  | -      (nChar+1) * sizeof(int)            /* IcuCursor.aOffset[] */ | 
|  | +      (nChar+1) * sizeof(int) +          /* IcuCursor.aOffset[] */ | 
|  | +      nChar * sizeof(UChar)              /* IcuCursor.aChar[] */ | 
|  | ); | 
|  | if( !pCsr ){ | 
|  | return SQLITE_NOMEM; | 
|  | } | 
|  | memset(pCsr, 0, sizeof(IcuCursor)); | 
|  | -  pCsr->aChar = (UChar *)&pCsr[1]; | 
|  | -  pCsr->aOffset = (int *)&pCsr->aChar[nChar]; | 
|  | +  pCsr->aOffset = (int *)&pCsr[1]; | 
|  | +  pCsr->aChar = (UChar *)&pCsr->aOffset[nChar+1]; | 
|  |  | 
|  | pCsr->aOffset[iOut] = iInput; | 
|  | U8_NEXT(zInput, iInput, nInput, c); |