diff --git a/manifest b/manifest
index 40c0e37617..faf51dc1f2 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sbug\sin\sthe\sgrammar.\s\sWe\swere\sgiving\sthe\sones-complement\soperator\s~\nthe\ssame\sprecedence\sas\sthe\sNOT\soperator,\swhich\sis\sincorrect.\s(CVS\s4548)
-D 2007-11-17T22:23:28
+C Handle\sout-of-memory\ssituations\sinside\sthe\squery\sflattener.\nTicket\s#2784.\s(CVS\s4549)
+D 2007-11-21T15:24:01
 F Makefile.arm-wince-mingw32ce-gcc ac5f7b2cef0cd850d6f755ba6ee4ab961b1fadf7
 F Makefile.in 30c7e3ba426ddb253b8ef037d1873425da6009a8
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -129,10 +129,10 @@ F src/pragma.c cb1486e76dbcad757968afc4083d3472032e62b5
 F src/prepare.c 5dd06102c4c538fcbb9c71d35e505abb9fcbd269
 F src/printf.c 96c8d55315a13fc53cb3754cb15046f3ff891ea2
 F src/random.c 4a22746501bf36b0a088c66e38dde5daba6a35da
-F src/select.c aef87a179e287c4ab864cb927c1e95f5ee66bf45
+F src/select.c 963e2b68f7ca357cdd1a975db90c76153efca646
 F src/server.c 087b92a39d883e3fa113cae259d64e4c7438bc96
 F src/shell.c 5b950381f6fb030f123fcd41ae3fdf431c9b0689
-F src/sqlite.h.in a8ab7453e036656658e263a4542c6b27db0537cb
+F src/sqlite.h.in 75ae0863db3a0b074868a6157e34b646dbe143dd
 F src/sqlite3ext.h a93f59cdee3638dc0c9c086f80df743a4e68c3cb
 F src/sqliteInt.h 4e6fdeb5630ead97bcec60b941e7a72203c64b9e
 F src/sqliteLimit.h 15ffe2116746c27ace2b428a26a4fcd6dba6fa65
@@ -366,6 +366,7 @@ F test/mallocA.test 5ee8d42ff90e5b1aeee6fb645e73ffcb35bffd21
 F test/mallocB.test 83bdbea443cc81758a57b0287807b0941218819a
 F test/mallocC.test 6f02fa2b4baa943bc6d6db323d5d07067967e728
 F test/mallocD.test d638fb8f214b47fd31edfae8af738b92bd943dc0
+F test/mallocE.test 810c0fe01c1548cfdd24767dc72c31f77b55ccfe
 F test/malloc_common.tcl b47137fb36e95fdafb0267745afefcd6b0a5b9dc
 F test/manydb.test 8de36b8d33aab5ef295b11d9e95310aeded31af8
 F test/memdb.test a67bda4ff90a38f2b19f6c7f95aa7289e051d893
@@ -587,7 +588,7 @@ F www/tclsqlite.tcl 8be95ee6dba05eabcd27a9d91331c803f2ce2130
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P c91bc8d33306881cb2501070dccced92c82cf165
-R f495654da7f05f56c3843abadb2b39ff
+P b48a4bfd3288906dfb7659c37f76d345011c91a0
+R 94d8bd17a581bf51c0d05b97c905485d
 U drh
-Z 9ed8b035bc2cdc74a8bdbfe23b254bc4
+Z 650dc1e2f84003ff347970458f1d7c32
diff --git a/manifest.uuid b/manifest.uuid
index 4fc74a7ccf..30a3ae8324 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b48a4bfd3288906dfb7659c37f76d345011c91a0
\ No newline at end of file
+2655a3f2d18fe16a36a6cf3776261ee0507e6912
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index f165a221f5..556a9019f3 100644
--- a/src/select.c
+++ b/src/select.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle SELECT statements in SQLite.
 **
-** $Id: select.c,v 1.361 2007/11/12 15:40:42 danielk1977 Exp $
+** $Id: select.c,v 1.362 2007/11/21 15:24:01 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -2321,10 +2321,18 @@ static int flattenSubquery(
     sqlite3_free(pSubitem->zDatabase);
     sqlite3_free(pSubitem->zName);
     sqlite3_free(pSubitem->zAlias);
+    pSubitem->pTab = 0;
+    pSubitem->zDatabase = 0;
+    pSubitem->zName = 0;
+    pSubitem->zAlias = 0;
     if( nSubSrc>1 ){
       int extra = nSubSrc - 1;
       for(i=1; i<nSubSrc; i++){
         pSrc = sqlite3SrcListAppend(db, pSrc, 0, 0);
+        if( pSrc==0 ){
+          p->pSrc = 0;
+          return 1;
+        }
       }
       p->pSrc = pSrc;
       for(i=pSrc->nSrc-1; i-extra>=iFrom; i--){
@@ -3031,6 +3039,9 @@ int sqlite3Select(
 #endif
     sqlite3Select(pParse, pItem->pSelect, SRT_EphemTab, 
                  pItem->iCursor, p, i, &isAgg, 0);
+    if( db->mallocFailed ){
+      goto select_end;
+    }
 #if defined(SQLITE_TEST) || SQLITE_MAX_EXPR_DEPTH>0
     pParse->nHeight -= sqlite3SelectExprHeight(p);
 #endif
diff --git a/src/sqlite.h.in b/src/sqlite.h.in
index a169b8c861..31d92fbe71 100644
--- a/src/sqlite.h.in
+++ b/src/sqlite.h.in
@@ -30,7 +30,7 @@
 ** the version number) and changes its name to "sqlite3.h" as
 ** part of the build process.
 **
-** @(#) $Id: sqlite.h.in,v 1.270 2007/11/14 06:48:48 danielk1977 Exp $
+** @(#) $Id: sqlite.h.in,v 1.271 2007/11/21 15:24:01 drh Exp $
 */
 #ifndef _SQLITE3_H_
 #define _SQLITE3_H_
@@ -2940,7 +2940,7 @@ int sqlite3_enable_load_extension(sqlite3 *db, int onoff);
 ** This routine stores a pointer to the extension in an array
 ** that is obtained from malloc().  If you run a memory leak
 ** checker on your program and it reports a leak because of this
-** array, then invoke [sqlite3_automatic_extension_reset()] prior
+** array, then invoke [sqlite3_reset_auto_extension()] prior
 ** to shutdown to free the memory.
 **
 ** Automatic extensions apply across all threads.
diff --git a/test/mallocE.test b/test/mallocE.test
new file mode 100644
index 0000000000..e95f9e4b5c
--- /dev/null
+++ b/test/mallocE.test
@@ -0,0 +1,39 @@
+# 2007 Aug 29
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This test script checks that ticket #2784 has been fixed.
+# 
+# $Id: mallocE.test,v 1.1 2007/11/21 15:24:01 drh Exp $
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+# Only run these tests if memory debugging is turned on.
+#
+ifcapable !memdebug {
+   puts "Skipping mallocE tests: not compiled with -DSQLITE_MEMDEBUG..."
+   finish_test
+   return
+}
+source $testdir/malloc_common.tcl
+
+set PREP { 
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(a, b, c);
+  CREATE TABLE t2(x, y, z);
+}
+
+do_malloc_test mallocE-1 -sqlprep $PREP -sqlbody { 
+  SELECT p, q FROM (SELECT a+b AS p, b+c AS q FROM t1, t2 WHERE c>5)
+              LEFT JOIN t2 ON p=x;
+}
+
+finish_test