diff -Naurp vdbeInt.h.old vdbeInt.h 
--- vdbeInt.h.old	2004-10-05 16:52:42.000000000 -0400
+++ vdbeInt.h	2004-10-05 16:52:54.000000000 -0400
@@ -100,7 +100,7 @@ typedef struct Cursor Cursor;
 ** layer without having to malloc.  NBFS is short for Number of Bytes
 ** For Strings.
 */
-#define NBFS 32
+#define NBFS 15
 
 /*
 ** Internally, the vdbe manipulates nearly all SQL values as Mem
--- vdbeaux.c.old	2004-10-05 16:32:03.000000000 -0400
+++ vdbeaux.c	2004-10-05 16:17:40.000000000 -0400
@@ -574,21 +574,22 @@ void sqlite3VdbeMakeReady(
     assert( nVar>=0 );
     n = isExplain ? 10 : p->nOp;
     p->aStack = sqliteMalloc(
-      n*(sizeof(p->aStack[0])+sizeof(Mem*))          /* aStack, apArg */
-      + nVar*sizeof(Mem)                             /* aVar */
-      + nVar*sizeof(char*)                           /* azVar */
-      + nMem*sizeof(Mem)                             /* aMem */
-      + nCursor*sizeof(Cursor*)                      /* apCsr */
+      n*sizeof(p->aStack[0])         /* aStack */
+      + n*sizeof(Mem*)                 /* apArg */
+      + nVar*sizeof(Mem)               /* aVar */
+      + nVar*sizeof(char*)             /* azVar */
+      + nMem*sizeof(Mem)               /* aMem */
+      + nCursor*sizeof(Cursor*)        /* apCsr */
     );
     if( !sqlite3_malloc_failed ){
-      p->apArg = (Mem **)&p->aStack[n];
-      p->aVar = (Mem *)&p->apArg[n];
-      p->azVar = (char**)&p->aVar[nVar];
-      p->okVar = 0;
-      p->nVar = nVar;
-      p->aMem = (Mem*)&p->azVar[nVar];
+      p->aMem = &p->aStack[n];
       p->nMem = nMem;
-      p->apCsr = (Cursor**)&p->aMem[nMem];
+      p->aVar = &p->aMem[nMem];
+      p->nVar = nVar;
+      p->okVar = 0;
+      p->apArg = (Mem**)&p->aVar[nVar];
+      p->azVar = (char**)&p->apArg[n];
+      p->apCsr = (Cursor**)&p->azVar[nVar];
       p->nCursor = nCursor;
       for(n=0; n<nVar; n++){
         p->aVar[n].flags = MEM_Null;