Index: src/mem3.c
==================================================================
--- src/mem3.c
+++ src/mem3.c
@@ -18,11 +18,11 @@
 ** fixed memory pool is SQLITE_MEMORY_SIZE bytes.
 **
 ** This version of the memory allocation subsystem is used if
 ** and only if SQLITE_MEMORY_SIZE is defined.
 **
-** $Id: mem3.c,v 1.9 2008/02/13 18:25:27 danielk1977 Exp $
+** $Id: mem3.c,v 1.10 2008/02/14 15:31:52 danielk1977 Exp $
 */
 
 /*
 ** This version of the memory allocator is used only when 
 ** SQLITE_MEMORY_SIZE is defined.
@@ -290,13 +290,17 @@
 ** Return the size of an outstanding allocation, in bytes.  The
 ** size returned omits the 8-byte header overhead.  This only
 ** works for chunks that are currently checked out.
 */
 int sqlite3MallocSize(void *p){
-  Mem3Block *pBlock = (Mem3Block*)p;
-  assert( (pBlock[-1].u.hdr.size4x&1)!=0 );
-  return (pBlock[-1].u.hdr.size4x&~3)*2 - 4;
+  int iSize = 0;
+  if( p ){
+    Mem3Block *pBlock = (Mem3Block*)p;
+    assert( (pBlock[-1].u.hdr.size4x&1)!=0 );
+    iSize = (pBlock[-1].u.hdr.size4x&~3)*2 - 4;
+  }
+  return iSize;
 }
 
 /*
 ** Chunk i is a free chunk that has been unlinked.  Adjust its 
 ** size parameters for check-out and return a pointer to the 

Index: src/vdbemem.c
==================================================================
--- src/vdbemem.c
+++ src/vdbemem.c
@@ -538,14 +538,16 @@
 
   /* If cell pTo currently has a reusable buffer, save a pointer to it
   ** in local variable zBuf. This function attempts to avoid freeing
   ** this buffer.
   */
-  if( pTo->xDel ){
-    sqlite3VdbeMemRelease(pTo);
-  }else if( pTo->flags&MEM_Dyn ){
-    zBuf = pTo->z;
+  if( pTo->flags&MEM_Dyn ){
+    if( pTo->xDel ){
+      sqlite3VdbeMemRelease(pTo);
+    }else{
+      zBuf = pTo->z;
+    }
   }
 
   /* Copy the contents of *pFrom to *pTo */
   memcpy(pTo, pFrom, sizeof(*pFrom));