From 042d6a1f0f9bb5a6e183b2b9136b4634ae5b6b8c Mon Sep 17 00:00:00 2001
From: drh <drh@noemail.net>
Date: Wed, 17 Jun 2009 13:57:16 +0000
Subject: [PATCH] Fix a potential segfault following database corruption. 
 Problem made visible by check-in (6772). (CVS 6775)

FossilOrigin-Name: 69eb0ff817cff6266c53b79047bcff5e5d54b618
---
 manifest      | 12 ++++++------
 manifest.uuid |  2 +-
 src/btree.c   | 11 ++++++-----
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/manifest b/manifest
index b38c086c6a..13db7eb43b 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Suppress\ssome\s-Wextra\scompiler\swarnings\sfrom\sGCC.\s(CVS\s6774)
-D 2009-06-17T13:09:39
+C Fix\sa\spotential\ssegfault\sfollowing\sdatabase\scorruption.\s\sProblem\s\r\nmade\svisible\sby\scheck-in\s(6772).\s(CVS\s6775)
+D 2009-06-17T13:57:16
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 8b8fb7823264331210cddf103831816c286ba446
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -106,7 +106,7 @@ F src/auth.c 98db07c2088455797678eb1031f42d4d94d18a71
 F src/backup.c ff50af53184a5fd7bdee4d620b5dabef74717c79
 F src/bitvec.c 0ef0651714728055d43de7a4cdd95e703fac0119
 F src/btmutex.c 9b899c0d8df3bd68f527b0afe03088321b696d3c
-F src/btree.c 5d4e1fdae7c765b6a04b086545357bc93d7d6a63
+F src/btree.c c7fc867f52fbe5fc729aa56ce0a48c2645def82e
 F src/btree.h f70b694e8c163227369a66863b01fbff9009f323
 F src/btreeInt.h 122021a7d70633b389c447d9a05f9242f410809d
 F src/build.c 75b57e3f4de1b34d4e1e49d350dc87febff48ba0
@@ -735,7 +735,7 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl 672f81d693a03f80f5ae60bfefacd8a349e76746
-P a433ca821c134caeac0fa16416eb95c647416b95
-R 78208bbf9f02e17d66a45d7dc43ed13f
+P 59ec937ce226bbf6c48c5e0466d3bab48873c9ea
+R 91b49222de2dd4961eeb67b115d749fb
 U drh
-Z d64390aa8acff4ee038b1b110ea1e1e2
+Z 204c520d5c26a9b912018a390ab782e4
diff --git a/manifest.uuid b/manifest.uuid
index a98d4836e4..00a117fc12 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-59ec937ce226bbf6c48c5e0466d3bab48873c9ea
\ No newline at end of file
+69eb0ff817cff6266c53b79047bcff5e5d54b618
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 5fc6760383..b02cd4c89c 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.633 2009/06/17 13:09:39 drh Exp $
+** $Id: btree.c,v 1.634 2009/06/17 13:57:16 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -4389,7 +4389,7 @@ static int allocateBtreePage(
   MemPage *pPage1;
   int rc;
   u32 n;     /* Number of pages on the freelist */
-  int k;     /* Number of leaves on the trunk of the freelist */
+  u32 k;     /* Number of leaves on the trunk of the freelist */
   MemPage *pTrunk = 0;
   MemPage *pPrevTrunk = 0;
   Pgno mxPage;     /* Total size of the database file */
@@ -4467,7 +4467,7 @@ static int allocateBtreePage(
         *ppPage = pTrunk;
         pTrunk = 0;
         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
-      }else if( k>pBt->usableSize/4 - 2 ){
+      }else if( k>(u32)(pBt->usableSize/4 - 2) ){
         /* Value of k is out of range.  Database corruption */
         rc = SQLITE_CORRUPT_BKPT;
         goto end_allocate_page;
@@ -4529,7 +4529,7 @@ static int allocateBtreePage(
 #endif
       }else if( k>0 ){
         /* Extract a leaf from the trunk */
-        int closest;
+        u32 closest;
         Pgno iPage;
         unsigned char *aData = pTrunk->aData;
         rc = sqlite3PagerWrite(pTrunk->pDbPage);
@@ -4537,7 +4537,8 @@ static int allocateBtreePage(
           goto end_allocate_page;
         }
         if( nearby>0 ){
-          int i, dist;
+          u32 i;
+          int dist;
           closest = 0;
           dist = get4byte(&aData[8]) - nearby;
           if( dist<0 ) dist = -dist;