diff --git a/Makefile.in b/Makefile.in
index e8b423eb6a..9e50779a4a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -222,6 +222,7 @@ TESTSRC = \
   $(TOP)/src/test9.c \
   $(TOP)/src/test_autoext.c \
   $(TOP)/src/test_async.c \
+  $(TOP)/src/test_hexio.c \
   $(TOP)/src/test_md5.c \
   $(TOP)/src/test_schema.c \
   $(TOP)/src/test_server.c \
diff --git a/main.mk b/main.mk
index 2a2091088d..eab250a4f8 100644
--- a/main.mk
+++ b/main.mk
@@ -177,6 +177,7 @@ TESTSRC = \
   $(TOP)/src/test9.c \
   $(TOP)/src/test_autoext.c \
   $(TOP)/src/test_async.c \
+  $(TOP)/src/test_hexio.c \
   $(TOP)/src/test_md5.c \
   $(TOP)/src/test_schema.c \
   $(TOP)/src/test_server.c \
diff --git a/manifest b/manifest
index af5499c984..4f7ab1221b 100644
--- a/manifest
+++ b/manifest
@@ -1,6 +1,6 @@
-C The\sFOR\sEACH\sSTATEMENT\sclause\sin\sa\strigger\sis\snow\sa\ssyntax\serror.\s\sIt\sused\nto\sbe\ssilently\signored.\s\sSTATEMENT\sis\sno\slonger\sa\skeyword.\s(CVS\s3821)
-D 2007-04-06T11:26:00
-F Makefile.in a9bd493360a2b17e5214b69d8c32dd6cdaceaf55
+C Binary\sfile\sI/O\sinfrastructure\sadded\sand\sused\sto\sincrease\stest\scoverage\nfor\sdetection\sof\scorrupt\sdatabase\sfiles.\s(CVS\s3822)
+D 2007-04-06T15:02:13
+F Makefile.in 8cab54f7c9f5af8f22fd97ddf1ecfd1e1860de62
 F Makefile.linux-gcc 2d8574d1ba75f129aba2019f0b959db380a90935
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
 F VERSION ebbd5a08dc4d7f984b7e0f2dd3d5d78001119117
@@ -43,7 +43,7 @@ F ext/fts2/fts2_tokenizer.h 4c5ffe31d63622869eb6eec1503df7f6996fd1bd
 F ext/fts2/fts2_tokenizer1.c 6067f2f710bc7e91c0688b7b11be1027777553e0
 F install-sh 9d4de14ab9fb0facae2f48780b874848cbf2f895
 F ltmain.sh 56abb507100ed2d4261f6dd1653dec3cf4066387
-F main.mk 2c20b3501860b36115c477a95a7f9355c755cf3b
+F main.mk dd14eeac33ac5e6c062f43e79876948f1d64908b
 F mkdll.sh ed62756baf44babf562a7843588790c02fee2106
 F mkopcodec.awk bd46ad001c98dfbab07b1713cb8e692fa0e5415d
 F mkopcodeh.awk cde995d269aa06c94adbf6455bea0acedb913fa5
@@ -58,7 +58,7 @@ F src/alter.c 2c79ec40f65e33deaf90ca493422c74586e481a3
 F src/analyze.c 4bbf5ddf9680587c6d4917e02e378b6037be3651
 F src/attach.c a16ada4a4654a0d126b8223ec9494ebb81bc5c3c
 F src/auth.c 902f4722661c796b97f007d9606bd7529c02597f
-F src/btree.c 27299eba3ad5aa1fed184c707576d12d0e608e8d
+F src/btree.c 5a0f425843ff81f3308fd083e606344b48c332f8
 F src/btree.h 9b2cc0d113c0bc2d37d244b9a394d56948c9acbf
 F src/build.c 7c2efa468f0c404ef5aa648d43c383318390937f
 F src/callback.c 31d22b4919c7645cbcbb1591ce2453e8c677c558
@@ -88,7 +88,7 @@ F src/os_win.c c9a99524d6b2bdec636264cad1b67553925e3309
 F src/os_win.h 41a946bea10f61c158ce8645e7646b29d44f122b
 F src/pager.c 642f804b20a71933fb83b13a1ce93cb4dd1390f7
 F src/pager.h e79a24cf200b8771366217f5bca414f5b7823f42
-F src/parse.y 6112045e2d3b8be20049645ab494b607d271d129
+F src/parse.y b6cfbadb6d5b21b5087d30698ee5af0ebb098767
 F src/pragma.c 3b992b5b2640d6ae25cef05aa6a42cd1d6c43234
 F src/prepare.c 37207b2b2ccb41d379b01dd62231686bcc48ef1f
 F src/printf.c 0c6f40648770831341ac45ab32423a80b4c87f05
@@ -100,7 +100,7 @@ F src/sqlite.h.in e429f66f9245c7f8675db24b230c950b8672ad1c
 F src/sqlite3ext.h 7d0d363ea7327e817ef0dfe1b7eee1f171b72890
 F src/sqliteInt.h 347160d30eb61210417f1086aeb57d7d3e2a8191
 F src/table.c 6d0da66dde26ee75614ed8f584a1996467088d06
-F src/tclsqlite.c 58fd67ba2c5a6ca816ad110029b6cb2a44a3c707
+F src/tclsqlite.c ec69eb9ad56d03fbf7570ca1ca5ea947d1ec4b6f
 F src/test1.c 6021cbcede9bfab986ade678efa7226180f3edff
 F src/test2.c 24458b17ab2f3c90cbc1c8446bd7ffe69be62f88
 F src/test3.c 65f92247cf8592854e9bf5115b3fb711f8b33280
@@ -112,6 +112,7 @@ F src/test8.c 2af036d73b5ebf1b74d19f36b1b1ab22e1d99df1
 F src/test9.c cb1a7b5a4a918bb0552fd0101fd3f88d85904cd2
 F src/test_async.c 9d326ceda4306bcab252b8f7e8e480ed45d7ccb6
 F src/test_autoext.c 855157d97aa28cf84233847548bfacda21807436
+F src/test_hexio.c 9644c0360c3e1090f4a5765b9eb0492bb273bbb5
 F src/test_loadext.c 22065d601a18878e5542191001f0eaa5d77c0ed8
 F src/test_md5.c 6c42bc0a3c0b54be34623ff77a0eec32b2fa96e3
 F src/test_schema.c ced72140a3a25c148975428e170ec1850d3c3a7d
@@ -185,6 +186,7 @@ F test/colmeta.test 6505c73ab58796afcb7c89ba9f429d573fbc6e53
 F test/conflict.test 8a59399f61a14296a9bfed02e0570590a8a79cba
 F test/corrupt.test 18c7a995b1af76a8c8600b996257f2c7b7bff083
 F test/corrupt2.test 572f8df0303d0ce63ddad5c5c9101a83a345ae46
+F test/corrupt3.test 9b3a005c9692206f2800a948f0c9c79728ffee7f
 F test/crash.test 167eb4652eccbedb199b6f21850346c3f5d779fb
 F test/crash2.test ccc7d5f202aeadc3c13003829e6bb6561129f419
 F test/crashtest1.c 09c1c7d728ccf4feb9e481671e29dda5669bbcc2
@@ -205,6 +207,7 @@ F test/exclusive.test 6748eb0539c4652d596971584c50200729e57dbe
 F test/exclusive2.test 8d580e5bb8d49fde59fe1142543b7da081f28d06
 F test/exclusive3.test 0e49c35b7e7cb8e7280b4ce3f0359d30b207d2ff
 F test/expr.test ab21e2fc3613595131efd7d8bbca4b95ed5cc608
+F test/filefmt.test 16107ce2c98843070ba5ec8f0c2ac31029bdabd6
 F test/fkey1.test dcb4f28eb22d5141f15161d6bdca9a4f58c95729
 F test/format4.test bf3bed3b13c63abfb3cfec232597a319a31d0bcc
 F test/fts1a.test 46090311f85da51bb33bd5ce84f7948359c6d8d7
@@ -295,7 +298,7 @@ F test/rowid.test 040a3bef06f970c45f5fcd14b2355f7f4d62f0cf
 F test/safety.test 4a06934e45d03b8b50ebcd8d174eb0367d2fd851
 F test/schema.test 8a2ae440fb15f5798a68059e8746402f3137be46
 F test/schema2.test d815923e57e90b8c60ddf5e0d8fd65075e94f57f
-F test/select1.test fa4e941da0a38961635d903530bd292dc149a8e8
+F test/select1.test 1287b040f912b979ccc8d4b50ea585eeeacf1835
 F test/select2.test f3c2678c3a9f3cf08ec4988a3845bda64be6d9e3
 F test/select3.test 2d473f45c57c0526833e045fca0537badec0dd04
 F test/select4.test 305ba0a6e97efc5544def5e5cb49b54e1bf87fd9
@@ -451,7 +454,7 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl 97e2b5cd296f7d8057e11f44427dea8a4c2db513
-P a776d93ccae3bfa6e992cdd1387571dd21561f98
-R fa0c92e65fb1c611f3e19261755e89a8
+P 8e2559b4da6329d7c21925d0850f7f91a3731975
+R bf361c806ccd54df8932ace1ba12eaf6
 U drh
-Z db8a808c353b3a8ae294eee8fe0830c1
+Z e15d206887ea8f19e691b97bb3aee05c
diff --git a/manifest.uuid b/manifest.uuid
index c9f03c8fa9..4d740e88a3 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-8e2559b4da6329d7c21925d0850f7f91a3731975
\ No newline at end of file
+479b3d965b19c3ec4cb72542718751debf8ff75c
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index d2b9f3c104..e5b3cbec1a 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.351 2007/04/06 01:03:33 drh Exp $
+** $Id: btree.c,v 1.352 2007/04/06 15:02:14 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** For a detailed discussion of BTrees, refer to
@@ -1870,7 +1870,7 @@ static int lockBtree(BtShared *pBt){
       goto page1_init_failed;
     }
     pageSize = get2byte(&page1[16]);
-    if( ((pageSize-1)&pageSize)!=0 ){
+    if( ((pageSize-1)&pageSize)!=0 || pageSize<512 ){
       goto page1_init_failed;
     }
     assert( (pageSize & 7)==0 );
diff --git a/src/parse.y b/src/parse.y
index 372224ae15..ae71956b61 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -14,7 +14,7 @@
 ** the parser.  Lemon will also generate a header file containing
 ** numeric codes for all of the tokens.
 **
-** @(#) $Id: parse.y,v 1.217 2007/04/06 11:26:00 drh Exp $
+** @(#) $Id: parse.y,v 1.218 2007/04/06 15:02:14 drh Exp $
 */
 
 // All token codes are small integers with #defines that begin with "TK_"
@@ -542,10 +542,18 @@ having_opt(A) ::= .                {A = 0;}
 having_opt(A) ::= HAVING expr(X).  {A = X;}
 
 %type limit_opt {struct LimitVal}
-%destructor limit_opt {
-  sqlite3ExprDelete($$.pLimit);
-  sqlite3ExprDelete($$.pOffset);
-}
+
+// The destructor for limit_opt will never fire in the current grammar.
+// The limit_opt non-terminal only occurs at the end of a single production
+// rule for SELECT statements.  As soon as the rule that create the 
+// limit_opt non-terminal reduces, the SELECT statement rule will also
+// reduce.  So there is never a limit_opt non-terminal on the stack 
+// except as a transient.  So there is never anything to destroy.
+//
+//%destructor limit_opt {
+//  sqlite3ExprDelete($$.pLimit);
+//  sqlite3ExprDelete($$.pOffset);
+//}
 limit_opt(A) ::= .                     {A.pLimit = 0; A.pOffset = 0;}
 limit_opt(A) ::= LIMIT expr(X).        {A.pLimit = X; A.pOffset = 0;}
 limit_opt(A) ::= LIMIT expr(X) OFFSET expr(Y). 
diff --git a/src/tclsqlite.c b/src/tclsqlite.c
index e7b2ac4677..50b563f8df 100644
--- a/src/tclsqlite.c
+++ b/src/tclsqlite.c
@@ -12,7 +12,7 @@
 ** A TCL Interface to SQLite.  Append this file to sqlite3.c and
 ** compile the whole thing to build a TCL-enabled version of SQLite.
 **
-** $Id: tclsqlite.c,v 1.178 2007/04/05 21:58:33 drh Exp $
+** $Id: tclsqlite.c,v 1.179 2007/04/06 15:02:14 drh Exp $
 */
 #include "tcl.h"
 
@@ -2218,6 +2218,7 @@ int TCLSH_MAIN(int argc, char **argv){
     extern int Sqlitetesttclvar_Init(Tcl_Interp*);
     extern int Sqlitetestschema_Init(Tcl_Interp*);
     extern int Sqlitetest_autoext_Init(Tcl_Interp*);
+    extern int Sqlitetest_hexio_Init(Tcl_Interp*);
 
     Sqlitetest1_Init(interp);
     Sqlitetest2_Init(interp);
@@ -2232,6 +2233,7 @@ int TCLSH_MAIN(int argc, char **argv){
     Sqlitetesttclvar_Init(interp);
     Sqlitetestschema_Init(interp);
     Sqlitetest_autoext_Init(interp);
+    Sqlitetest_hexio_Init(interp);
     Md5_Init(interp);
 #ifdef SQLITE_SSE
     Sqlitetestsse_Init(interp);
diff --git a/src/test_hexio.c b/src/test_hexio.c
new file mode 100644
index 0000000000..7176dbc24f
--- /dev/null
+++ b/src/test_hexio.c
@@ -0,0 +1,311 @@
+/*
+** 2007 April 6
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+** Code for testing all sorts of SQLite interfaces.  This code
+** implements TCL commands for reading and writing the binary
+** database files and displaying the content of those files as
+** hexadecimal.  We could, in theory, use the built-in "binary"
+** command of TCL to do a lot of this, but there are some issues
+** with historical versions of the "binary" command.  So it seems
+** easier and safer to build our own mechanism.
+**
+** $Id: test_hexio.c,v 1.1 2007/04/06 15:02:14 drh Exp $
+*/
+#include "tcl.h"
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+/*
+hexio_read  filename offset amt
+hexio_write filename offset hexdata
+hexio_get_int  hexdata
+hexio_get_varint  hexdata
+hexio_render_int8  integer
+hexio_render_int16  integer
+hexio_render_int38  integer
+hexio_render_varint  integer
+*/
+
+/*
+** Convert binary to hex.  The input zBuf[] contains N bytes of
+** binary data.  zBuf[] is 2*n+1 bytes long.  Overwrite zBuf[]
+** with a hexadecimal representation of its original binary input.
+*/
+static void binToHex(unsigned char *zBuf, int N){
+  const unsigned char zHex[] = "0123456789ABCDEF";
+  int i, j;
+  unsigned char c;
+  i = N*2;
+  zBuf[i--] = 0;
+  for(j=N-1; j>=0; j--){
+    c = zBuf[j];
+    zBuf[i--] = zHex[c&0xf];
+    zBuf[i--] = zHex[c>>4];
+  }
+  assert( i==-1 );
+}
+
+/*
+** Convert hex to binary.  The input zIn[] contains N bytes of
+** hexadecimal.  Convert this into binary and write aOut[] with
+** the binary data.  Spaces in the original input are ignored.
+** Return the number of bytes of binary rendered.
+*/
+static int hexToBin(const unsigned char *zIn, int N, unsigned char *aOut){
+  const unsigned char aMap[] = {
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     1, 2, 3, 4, 5, 6, 7, 8,  9,10, 0, 0, 0, 0, 0, 0,
+     0,11,12,13,14,15,16, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0,11,12,13,14,15,16, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+  };
+  int i, j;
+  int hi=1;
+  unsigned char c;
+
+  for(i=j=0; i<N; i++){
+    c = aMap[zIn[i]];
+    if( c==0 ) continue;
+    if( hi ){
+      aOut[j] = (c-1)<<4;
+      hi = 0;
+    }else{
+      aOut[j++] |= c-1;
+      hi = 1;
+    }
+  }
+  return j;
+}
+
+
+/*
+** Usage:   hexio_read  FILENAME  OFFSET  AMT
+**
+** Read AMT bytes from file FILENAME beginning at OFFSET from the
+** beginning of the file.  Convert that information to hexadecimal
+** and return the resulting HEX string.
+*/
+static int hexio_read(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int offset;
+  int amt, got;
+  const char *zFile;
+  unsigned char *zBuf;
+  FILE *in;
+
+  if( objc!=4 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "FILENAME OFFSET AMT");
+    return TCL_ERROR;
+  }
+  if( Tcl_GetIntFromObj(interp, objv[2], &offset) ) return TCL_ERROR;
+  if( Tcl_GetIntFromObj(interp, objv[3], &amt) ) return TCL_ERROR;
+  zFile = Tcl_GetString(objv[1]);
+  zBuf = malloc( amt*2+1 );
+  if( zBuf==0 ){
+    return TCL_ERROR;
+  }
+  in = fopen(zFile, "r");
+  if( in==0 ){
+    Tcl_AppendResult(interp, "cannot open input file ", zFile, 0);
+    return TCL_ERROR;
+  }
+  fseek(in, offset, SEEK_SET);
+  got = fread(zBuf, 1, amt, in);
+  fclose(in);
+  if( got<0 ){
+    got = 0;
+  }
+  binToHex(zBuf, got);
+  Tcl_AppendResult(interp, zBuf, 0);
+  free(zBuf);
+  return TCL_OK;
+}
+
+
+/*
+** Usage:   hexio_write  FILENAME  OFFSET  DATA
+**
+** Write DATA into file FILENAME beginning at OFFSET from the
+** beginning of the file.  DATA is expressed in hexadecimal.
+*/
+static int hexio_write(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int offset;
+  int nIn, nOut, written;
+  const char *zFile;
+  const unsigned char *zIn;
+  unsigned char *aOut;
+  FILE *out;
+
+  if( objc!=4 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "FILENAME OFFSET HEXDATA");
+    return TCL_ERROR;
+  }
+  if( Tcl_GetIntFromObj(interp, objv[2], &offset) ) return TCL_ERROR;
+  zFile = Tcl_GetString(objv[1]);
+  zIn = (const unsigned char *)Tcl_GetStringFromObj(objv[3], &nIn);
+  aOut = malloc( nIn/2 );
+  if( aOut==0 ){
+    return TCL_ERROR;
+  }
+  nOut = hexToBin(zIn, nIn, aOut);
+  out = fopen(zFile, "r+");
+  if( out==0 ){
+    Tcl_AppendResult(interp, "cannot open output file ", zFile, 0);
+    return TCL_ERROR;
+  }
+  fseek(out, offset, SEEK_SET);
+  written = fwrite(aOut, 1, nOut, out);
+  free(aOut);
+  fclose(out);
+  Tcl_SetObjResult(interp, Tcl_NewIntObj(written));
+  return TCL_OK;
+}
+
+/*
+** USAGE:   hexio_get_int   HEXDATA
+**
+** Interpret the HEXDATA argument as a big-endian integer.  Return
+** the value of that integer.  HEXDATA can contain between 2 and 8
+** hexadecimal digits.
+*/
+static int hexio_get_int(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int val;
+  int nIn, nOut;
+  const unsigned char *zIn;
+  unsigned char *aOut;
+  unsigned char aNum[4];
+
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "HEXDATA");
+    return TCL_ERROR;
+  }
+  zIn = (const unsigned char *)Tcl_GetStringFromObj(objv[1], &nIn);
+  aOut = malloc( nIn/2 );
+  if( aOut==0 ){
+    return TCL_ERROR;
+  }
+  nOut = hexToBin(zIn, nIn, aOut);
+  if( nOut>=4 ){
+    memcpy(aNum, aOut, 4);
+  }else{
+    memset(aNum, 0, sizeof(aNum));
+    memcpy(&aNum[4-nOut], aOut, 4-nOut);
+  }
+  free(aOut);
+  val = (aNum[0]<<24) | (aNum[1]<<16) | (aNum[2]<<8) | aNum[3];
+  Tcl_SetObjResult(interp, Tcl_NewIntObj(val));
+  return TCL_OK;
+}
+
+
+/*
+** USAGE:   hexio_render_int16   INTEGER
+**
+** Render INTEGER has a 16-bit big-endian integer in hexadecimal.
+*/
+static int hexio_render_int16(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int val;
+  unsigned char aNum[10];
+
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "INTEGER");
+    return TCL_ERROR;
+  }
+  if( Tcl_GetIntFromObj(interp, objv[1], &val) ) return TCL_ERROR;
+  aNum[0] = val>>8;
+  aNum[1] = val;
+  binToHex(aNum, 2);
+  Tcl_SetObjResult(interp, Tcl_NewStringObj((char*)aNum, 4));
+  return TCL_OK;
+}
+
+
+/*
+** USAGE:   hexio_render_int32   INTEGER
+**
+** Render INTEGER has a 32-bit big-endian integer in hexadecimal.
+*/
+static int hexio_render_int32(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int val;
+  unsigned char aNum[10];
+
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "INTEGER");
+    return TCL_ERROR;
+  }
+  if( Tcl_GetIntFromObj(interp, objv[1], &val) ) return TCL_ERROR;
+  aNum[0] = val>>24;
+  aNum[1] = val>>16;
+  aNum[2] = val>>8;
+  aNum[3] = val;
+  binToHex(aNum, 4);
+  Tcl_SetObjResult(interp, Tcl_NewStringObj((char*)aNum, 8));
+  return TCL_OK;
+}
+
+
+
+/*
+** Register commands with the TCL interpreter.
+*/
+int Sqlitetest_hexio_Init(Tcl_Interp *interp){
+  static struct {
+     char *zName;
+     Tcl_ObjCmdProc *xProc;
+  } aObjCmd[] = {
+     { "hexio_read",                   hexio_read            },
+     { "hexio_write",                  hexio_write           },
+     { "hexio_get_int",                hexio_get_int         },
+     { "hexio_render_int16",           hexio_render_int16    },
+     { "hexio_render_int32",           hexio_render_int32    },
+  };
+  int i;
+  for(i=0; i<sizeof(aObjCmd)/sizeof(aObjCmd[0]); i++){
+    Tcl_CreateObjCommand(interp, aObjCmd[i].zName, aObjCmd[i].xProc, 0, 0);
+  }
+  return TCL_OK;
+}
diff --git a/test/corrupt3.test b/test/corrupt3.test
new file mode 100644
index 0000000000..291c1656ad
--- /dev/null
+++ b/test/corrupt3.test
@@ -0,0 +1,108 @@
+# 2007 April 6
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.
+#
+# This file implements tests to make sure SQLite does not crash or
+# segfault if it sees a corrupt database file.
+#
+# $Id: corrupt3.test,v 1.1 2007/04/06 15:02:14 drh Exp $
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+# We must have the page_size pragma for these tests to work.
+#
+ifcapable !pager_pragmas {
+  finish_test
+  return
+}
+
+# Create a database with an overflow page.
+#
+do_test corrupt3-1.1 {
+  set bigstring [string repeat 0123456789 200]
+  execsql {
+    PRAGMA page_size=1024;
+    CREATE TABLE t1(x);
+    INSERT INTO t1 VALUES($bigstring);
+  }
+  file size test.db
+} [expr {1024*3}]
+
+# Verify that the file format is as we expect.  The page size
+# should be 1024 bytes.  The only record should have a single
+# overflow page.  The overflow page is page 3.  The pointer to
+# the overflow page is on the last 4 bytes of page 2.
+#
+do_test corrupt3-1.2 {
+  hexio_get_int [hexio_read test.db 16 2]
+} 1024   ;# The page size is 1024
+do_test corrupt3-1.3 {
+  hexio_get_int [hexio_read test.db 20 1]
+} 0      ;# Unused bytes per page is 0
+do_test corrupt3-1.4 {
+  hexio_get_int [hexio_read test.db 2044 4]
+} 3      ;# Overflow page is 3
+do_test corrupt3-1.5 {
+  hexio_get_int [hexio_read test.db 2048 4]
+} 0      ;# First chained overflow is 0
+
+integrity_check corrupt3-1.6
+
+# Make the overflow chain loop back on itself.   See if the
+# corruption is detected.   (Actually, the last pointer in
+# an overflow chain is ignored, so this is not an error.)
+#
+do_test corrupt3-1.7 {
+  db close
+  hexio_write test.db 2048 [hexio_render_int32 3]
+  sqlite3 db test.db
+  catchsql {
+    SELECT x FROM t1
+  }
+} [list 0 $bigstring]
+integrity_check corrupt3-1.8
+
+# Change the pointer for the first page of the overflow
+# change to be a non-existant page.
+#
+do_test corrupt3-1.9 {
+  db close
+  hexio_write test.db 2044 [hexio_render_int32 4]
+  sqlite3 db test.db
+  catchsql {
+    SELECT substr(x,1,10) FROM t1
+  }
+} [list 0 0123456789]
+do_test corrupt3-1.10 {
+  catchsql {
+    PRAGMA integrity_check
+  }
+} {0 {{*** in database main ***
+On tree page 2 cell 0: invalid page number 4
+Page 3 is never used}}}
+do_test corrupt3-1.11 {
+  db close
+  hexio_write test.db 2044 [hexio_render_int32 0]
+  sqlite3 db test.db
+  catchsql {
+    SELECT substr(x,1,10) FROM t1
+  }
+} [list 1 {database disk image is malformed}]
+do_test corrupt3-1.12 {
+  catchsql {
+    PRAGMA integrity_check
+  }
+} {0 {{*** in database main ***
+On tree page 2 cell 0: 1 of 1 pages missing from overflow list starting at 0
+Page 3 is never used}}}
+
+finish_test
diff --git a/test/filefmt.test b/test/filefmt.test
new file mode 100644
index 0000000000..bc61ef6d1a
--- /dev/null
+++ b/test/filefmt.test
@@ -0,0 +1,112 @@
+# 2007 April 6
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.
+#
+# This file implements tests to verify database file format.
+#
+# $Id: filefmt.test,v 1.1 2007/04/06 15:02:14 drh Exp $
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+db close
+file delete -force test.db test.db-journal
+
+# Database begins with valid 16-byte header string.
+#
+do_test filefmt-1.1 {
+  sqlite3 db test.db
+  db eval {CREATE TABLE t1(x)}
+  db close
+  hexio_read test.db 0 16
+} {53514C69746520666F726D6174203300}
+
+# If the 16-byte header is changed, the file will not open
+#
+do_test filefmt-1.2 {
+  hexio_write test.db 0 54
+  set x [catch {sqlite3 db test.db} err]
+  lappend x $err
+} {0 {}}
+do_test filefmt-1.3 {
+  catchsql {
+    SELECT count(*) FROM sqlite_master
+  }
+} {1 {file is encrypted or is not a database}}
+do_test filefmt-1.4 {
+  db close
+  hexio_write test.db 0 53
+  sqlite3 db test.db
+  catchsql {
+    SELECT count(*) FROM sqlite_master
+  }
+} {0 1}
+
+# The page-size is stored at offset 16
+#
+ifcapable pager_pragmas {
+  foreach pagesize {512 1024 2048 4096 8192 16384 32768} {
+     do_test filefmt-1.5.$pagesize.1 {
+       db close
+       file delete -force test.db
+       sqlite3 db test.db
+       db eval "PRAGMA page_size=$pagesize"
+       db eval {CREATE TABLE t1(x)}
+       file size test.db
+     } [expr $pagesize*2]
+     do_test filefmt-1.5.$pagesize.2 {
+       hexio_get_int [hexio_read test.db 16 2]
+     } $pagesize
+  }
+}
+
+# The page-size must be a power of 2
+#
+do_test filefmt-1.6 {
+  db close
+  hexio_write test.db 16 [hexio_render_int16 1025]
+  sqlite3 db test.db
+  catchsql {
+     SELECT count(*) FROM sqlite_master
+  }
+} {1 {file is encrypted or is not a database}}
+
+
+# The page-size must be at least 512 bytes
+#
+do_test filefmt-1.7 {
+  db close
+  hexio_write test.db 16 [hexio_render_int16 256]
+  sqlite3 db test.db
+  catchsql {
+     SELECT count(*) FROM sqlite_master
+  }
+} {1 {file is encrypted or is not a database}}
+
+# Usable space per page (page-size minus unused space per page)
+# must be at least 500 bytes
+#
+ifcapable pager_pragmas {
+  do_test filefmt-1.8 {
+    db close
+    file delete -force test.db
+    sqlite3 db test.db
+    db eval {PRAGMA page_size=512; CREATE TABLE t1(x)}
+    db close
+    hexio_write test.db 20 10
+    sqlite3 db test.db
+    catchsql {
+       SELECT count(*) FROM sqlite_master
+    }
+  } {1 {file is encrypted or is not a database}}
+}
+
+
+finish_test
diff --git a/test/select1.test b/test/select1.test
index 18dedc1f5d..81fba4cdd6 100644
--- a/test/select1.test
+++ b/test/select1.test
@@ -11,7 +11,7 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this file is testing the SELECT statement.
 #
-# $Id: select1.test,v 1.51 2006/04/11 14:16:22 drh Exp $
+# $Id: select1.test,v 1.52 2007/04/06 15:02:14 drh Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -546,6 +546,11 @@ do_test select1-7.8 {
   }} msg]
   lappend v $msg
 } {1 {near ";": syntax error}}
+do_test select1-7.9 {
+  catchsql {
+     SELECT f1 FROM test1 LIMIT 5+3 OFFSET 11 ORDER BY f2;
+  }
+} {1 {near "ORDER": syntax error}}
 
 do_test select1-8.1 {
   execsql {SELECT f1 FROM test1 WHERE 4.3+2.4 OR 1 ORDER BY f1}