Index: src/analyze.c
==================================================================
--- src/analyze.c
+++ src/analyze.c
@@ -1516,13 +1516,14 @@
   z = argv[2];
 
   if( pIndex ){
     int nCol = pIndex->nKeyCol+1;
 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
-    tRowcnt * const aiRowEst = pIndex->aiRowEst = (tRowcnt*)sqlite3DbMallocZero(
-        pInfo->db, sizeof(tRowcnt) * nCol
+    tRowcnt * const aiRowEst = pIndex->aiRowEst = (tRowcnt*)sqlite3MallocZero(
+        sizeof(tRowcnt) * nCol
     );
+    if( aiRowEst==0 ) pInfo->db->mallocFailed = 1;
 #else
     tRowcnt * const aiRowEst = 0;
 #endif
     pIndex->bUnordered = 0;
     decodeIntArray((char*)z, nCol, aiRowEst, pIndex->aiRowLogEst, pIndex);
@@ -1867,11 +1868,11 @@
     rc = loadStat4(db, sInfo.zDatabase);
     db->lookaside.bEnabled = lookasideEnabled;
   }
   for(i=sqliteHashFirst(&db->aDb[iDb].pSchema->idxHash);i;i=sqliteHashNext(i)){
     Index *pIdx = sqliteHashData(i);
-    sqlite3DbFree(db, pIdx->aiRowEst);
+    sqlite3_free(pIdx->aiRowEst);
     pIdx->aiRowEst = 0;
   }
 #endif
 
   if( rc==SQLITE_NOMEM ){

Index: src/build.c
==================================================================
--- src/build.c
+++ src/build.c
@@ -433,10 +433,13 @@
 #endif
   if( db==0 || db->pnBytesFreed==0 ) sqlite3KeyInfoUnref(p->pKeyInfo);
   sqlite3ExprDelete(db, p->pPartIdxWhere);
   sqlite3DbFree(db, p->zColAff);
   if( p->isResized ) sqlite3DbFree(db, p->azColl);
+#ifdef SQLITE_ENABLE_STAT3_OR_STAT4
+  sqlite3_free(p->aiRowEst);
+#endif
   sqlite3DbFree(db, p);
 }
 
 /*
 ** For the index called zIdxName which is found in the database iDb,