2 files changed, 55 insertions, 2 deletions
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 7036e57f5..182936cda 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -1986,9 +1986,9 @@ static void fts5SegIterSetNext(Fts5Index *p, Fts5SegIter *pIter){
 ** leave an error in the Fts5Index object.
 */
 static void fts5SegIterAllocTombstone(Fts5Index *p, Fts5SegIter *pIter){
-  const int nTomb = pIter->pSeg->nPgTombstone;
+  const i64 nTomb = (i64)pIter->pSeg->nPgTombstone;
   if( nTomb>0 ){
-    int nByte = SZ_FTS5TOMBSTONEARRAY(nTomb+1);
+    i64 nByte = SZ_FTS5TOMBSTONEARRAY(nTomb+1);
     Fts5TombstoneArray *pNew;
     pNew = (Fts5TombstoneArray*)sqlite3Fts5MallocZero(&p->rc, nByte);
     if( pNew ){
diff --git a/ext/fts5/test/fts5corrupt8.test b/ext/fts5/test/fts5corrupt8.test
index a43bbaa03..471a1b0e3 100644
--- a/ext/fts5/test/fts5corrupt8.test
+++ b/ext/fts5/test/fts5corrupt8.test
@@ -90,5 +90,58 @@ do_execsql_test 3.7 {
   SELECT * FROM sqlite_schema
 }
 
+#-------------------------------------------------------------------------
+reset_db
+
+proc hex_to_blob {hex} {
+  binary encode hex $hex
+}
+db func hex_to_blob hex_to_blob
+
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE x1 USING fts5(x, content='', contentless_delete=1);
+  BEGIN;
+    INSERT INTO x1(rowid, x) VALUES(1, 'a b c d e f g h');
+    INSERT INTO x1(rowid, x) VALUES(2, 'a b c d e f g h');
+  COMMIT;
+  DELETE FROM x1 WHERE rowid=1;
+}
+
+do_execsql_test 4.1 {
+  SELECT hex(block) FROM x1_data WHERE id=10
+} {
+  00000000FF00000101010200010101010101010102
+}
+
+do_execsql_test 4.2.1 {
+  UPDATE x1_data SET block=
+      X'00000000FF00000101010200010101010101819C9B95A8000102'
+   WHERE id=10;
+}
+
+do_catchsql_test 4.2.2 {
+  SELECT * FROM x1('c d e');
+} {1 {out of memory}}
+
+do_execsql_test 4.3.1 {
+  UPDATE x1_data SET block=
+      X'00000000FF000001010102000101010101019282AFF9A0000102'
+  WHERE id=10;
+} 
+
+do_catchsql_test 4.3.2 {
+  SELECT * FROM x1('c d e');
+} {1 {out of memory}}
+
+do_execsql_test 4.4.1 {
+  UPDATE x1_data SET block=
+      X'00000000FF000001010102000101010101018181808080130102'
+  WHERE id=10;
+}
+
+do_catchsql_test 4.3.2 {
+  SELECT * FROM x1('c d e');
+} {1 {out of memory}}
+
 finish_test