Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -1453,11 +1453,14 @@
           if( iFree+sz>iFree2 ) return SQLITE_CORRUPT_PAGE(pPage);
           sz2 = get2byte(&data[iFree2+2]);
           if( iFree2+sz2 > usableSize ) return SQLITE_CORRUPT_PAGE(pPage);
           memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
           sz += sz2;
+        }else if( iFree+sz>usableSize ){
+          return SQLITE_CORRUPT_PAGE(pPage);
         }
+
         cbrk = top+sz;
         assert( cbrk+(iFree-top) <= usableSize );
         memmove(&data[cbrk], &data[top], iFree-top);
         for(pAddr=&data[cellOffset]; pAddr<pEnd; pAddr+=2){
           pc = get2byte(pAddr);

Index: test/corruptL.test
==================================================================
--- test/corruptL.test
+++ test/corruptL.test
@@ -724,7 +724,118 @@
 }]} {}
 
 do_catchsql_test 7.1 {
   SELECT * FROM sqlite_master;
 } {1 {malformed database schema (t1x1) - invalid rootpage}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 8.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 2048 pagesize 512 filename a.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 02 00 01 01 00 40 20 20 ff ff 00 0c 00 00 00 07   .....@  ........
+|     32: 0b 00 00 00 00 00 00 00 00 00 00 08 9c 00 00 04   ................
+|     48: 00 00 00 e0 09 00 00 01 00 00 00 01 00 00 00 00   ................
+|     64: 00 00 00 00 f2 ff 00 00 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c   ................
+|     96: 00 2e 2c 50 0d 00 00 00 06 01 06 00 01 da 01 b0   ..,P............
+|    112: 05 56 01 86 01 2a 01 06 00 00 00 00 00 06 00 00   .V...*..........
+|    128: 00 ff 00 00 ff ff ff e1 00 00 00 00 00 00 00 00   ................
+|    144: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00   ................
+|    160: 00 00 00 00 00 00 00 00 f2 00 00 00 00 00 00 00   ................
+|    176: 00 00 f9 ff ff ff ff ff ff ff 00 00 00 5f 00 fb   ............._..
+|    192: 00 00 00 00 00 00 00 00 00 e1 ff 00 00 00 00 00   ................
+|    208: 00 00 10 00 00 00 00 00 1e 00 00 00 fe 00 00 00   ................
+|    224: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ca 00   ................
+|    240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35   ...............5
+|    256: 00 00 00 00 ef ff 22 07 06 17 11 11 01 30 39 38   .............098
+|    272: 62 6c 65 74 38 38 74 04 43 52 45 41 54 45 20 54   blet88t.CREATE T
+|    288: 41 42 4c 45 20 74 34 28 87 29 2a 06 06 17 13 11   ABLE t4(.)*.....
+|    304: 01 3f 69 4f 64 65 78 74 33 78 74 40 05 43 52 45   .?iOdext3xt@.CRE
+|    320: 41 54 45 20 49 6e 44 45 58 20 74 33 78 20 4f 4e   ATE InDEX t3x ON
+|    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+|    352: 00 04 00 00 34 63 64 74 3d 05 43 52 45 41 54 45   ....4cdt=.CREATE
+|    368: 20 49 4e 44 45 58 20 63 74 64 32 20 4f 4e 20 74    INDEX ctd2 ON t
+|    384: 32 28 0a 0c 44 29 28 05 06 17 11 11 01 3d 74 6c   2(..D)(......=tl
+|    400: 62 61 d4 65 33 74 33 04 43 52 45 41 54 45 20 54   ba.e3t3.CREATE T
+|    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+|    432: 28 02 06 17 11 11 01 3d 74 61 62 6c 65 74 32 74   (......=tablet2t
+|    448: 32 03 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   2.CREATE TABLE t
+|    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+|    480: 01 35 74 60 62 6c 65 74 31 74 31 02 43 52 45 41   .5t`blet1t1.CREA
+|    496: 54 45 20 54 41 42 4c 45 20 74 30 28 61 2c 62 29   TE TABLE t0(a,b)
+| page 2 offset 512
+|      0: 0d 00 ff 11 04 01 cf 80 01 fa 01 09 00 de 01 cf   ................
+|     16: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00   ................
+|     32: 00 00 08 00 00 00 00 00 00 11 00 00 00 00 00 13   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 e0 ff ff   ................
+|     64: ff d2 ff ff ff 00 f8 ff ff ff 00 00 00 00 00 00   ................
+|     80: 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 ff de 00 00 00 00 00 00 00 00 00 00   ................
+|    112: 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00   .............@..
+|    128: 2a 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00   *...............
+|    144: 00 00 00 00 00 21 00 00 00 00 00 00 00 00 00 00   .....!..........
+|    160: 01 64 00 00 00 00 04 80 ff ff ff 00 00 00 00 00   .d..............
+|    176: 00 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00   ................
+|    192: 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00   ..@.............
+|    208: b5 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00   .......@........
+|    224: 00 00 00 f6 00 ee ff ff ff 00 00 00 00 00 00 00   ................
+|    272: f2 00 00 00 00 00 00 00 00 00 f9 ff ff ff ff ff   ................
+|    288: ff ff 00 00 00 5f 00 fb 00 00 00 00 00 00 00 00   ....._..........
+|    320: 1e 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00   ................
+|    336: 00 00 00 00 00 00 ca 00 00 00 00 00 00 00 ff ec   ................
+|    352: 00 00 00 00 00 00 00 32 00 00 00 00 ef ff 22 07   .......2........
+|    368: 06 17 11 11 01 30 74 61 62 6c 65 74 38 38 74 04   .....0tablet88t.
+|    384: 43 52 45 41 54 45 20 54 41 42 4c 45 20 8c cb d7   CREATE TABLE ...
+|    400: 78 d6 d5 f9 f9 17 13 11 01 3f 69 4f 64 65 78 74   x........?iOdext
+|    416: 33 78 74 33 05 43 52 45 41 54 45 26 49 6e 44 45   3xt3.CREATE&InDE
+|    432: 58 20 74 33 78 00 00 00 00 00 00 00 00 00 00 00   X t3x...........
+|    464: 00 00 00 00 00 13 76 65 6e 65 69 67 68 74 13 03   ......veneight..
+|    480: 03 40 07 07 15 00 54 45 20 49 4e 44 45 58 20 74   .@....TE INDEX t
+|    496: 31 63 64 20 4f 4e 20 74 ce d7 f5 f0 44 09 01 02   1cd ON t....D...
+| page 3 offset 1024
+|      0: 0d 00 00 00 48 01 54 00 01 f6 e2 ec 01 c5 01 aa   ....H.T.........
+|     16: 30 34 28 87 29 32 06 f5 16 13 11 01 8e 61 24 64   04(.)2.......a$d
+|     32: 65 78 74 37 78 1f 33 6d 6d 6d 6d 6d 00 00 04 06   ext7x.3mmmmm....
+|     48: 6d 41 6d 6d 6e 6d 6d 00 00 02 00 6d 6d 6d 6d 6d   mAmmnmm....mmmmm
+|     64: 15 11 01 45 45 45 45 45 45 45 45 45 45 45 45 45   ...EEEEEEEEEEEEE
+|     80: 45 45 45 45 45 45 45 45 45 45 45 00 45 63 74 64   EEEEEEEEEEE.Ectd
+|     96: 34 20 4f 4e 20 61 62 6c 5d 74 38 38 74 04 43 52   4 ON abl]t88t.CR
+|    112: 45 41 54 45 20 54 41 42 4c 45 20 74 34 28 87 29   EATE TABLE t4(.)
+|    128: 2a 06 06 13 13 01 00 00 00 4f 64 6e 78 74 33 44   *........Odnxt3D
+|    144: 74 13 05 43 52 45 41 54 45 20 49 6e 44 45 00 00   t..CREATE InDE..
+|    160: 00 00 00 00 00 00 00 f9 ff ff ff ff ff ff ff 00   ................
+|    176: 00 00 5f 00 fb 00 00 2d 00 00 00 00 00 00 00 00   .._....-........
+|    192: 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 00 00   ................
+|    208: 00 fe 00 00 00 00 17 15 11 01 45 69 6e 64 65 2e   ..........Einde.
+|    224: 5b 38 63 64 74 3d 05 43 52 45 41 54 45 20 49 4e   [8cdt=.CREATE IN
+|    240: 44 45 58 20 63 20 64 32 20 4f 4e 20 74 32 28 0a   DEX c d2 ON t2(.
+|    256: 0c 44 32 05 00 10 00 00 11 11 3d 74 6c 62 61 d4   .D2.......=tlba.
+|    272: 65 33 74 33 04 43 52 45 41 54 45 20 54 41 42 4c   e3t3.CREATE TABL
+|    288: 45 20 74 36 ff ff 7f ff 43 52 45 41 54 45 20 49   E t6....CREATE I
+|    304: 73 71 6c 69 74 65 5f 73 65 71 75 65 6e 63 65 28   sqlite_sequence(
+|    320: 0a 0c 44 29 28 05 06 17 11 11 01 3d 74 6c 62 61   ..D)(......=tlba
+|    336: 20 00 00 00 33 04 43 52 45 41 54 45 20 54 41 42    ...3.CREATE TAB
+|    352: 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29 28 02   LE t3(c,x,e,f)(.
+|    368: 06 00 00 7f ff 40 41 54 45 20 49 6e 44 45 58 20   .....@ATE InDEX 
+|    384: 74 33 78 20 4f 4e 20 74 31 28 78 29 2e 04 06 17   t3x ON t1(x)....
+|    400: 15 11 01 45 69 6e 64 65 2e 74 34 63 64 74 3d 05   ...Einde.t4cdt=.
+|    416: 00 00 00 00 00 00 00 00 00 00 00 4d 00 00 00 00   ...........M....
+|    432: 01 00 00 00 00 00 00 05 00 00 10 00 00 00 00 00   ................
+|    448: 00 01 00 00 00 00 01 00 00 00 00 07 40 14 00 00   ............@...
+|    464: 00 00 21 00 40 18 00 00 00 00 00 00 40 1c 00 00   ..!.@.......@...
+|    480: 00 00 ff ff ff 00 00 00 5f 00 fb 00 00 2d 00 00   ........_....-..
+|    496: 00 00 00 1e 00 00 00 fe 00 00 64 00 00 ff fb 02   ..........d.....
+| page 4 offset 1536
+|      0: 0d 00 39 00 00 02 00 00 00 00 00 00 00 00 00 00   ..9.............
+| end a.db
+}]} {}
+
+
+do_catchsql_test 8.1 {
+  INSERT INTO t3 SELECT * FROM t2;
+} {1 {database disk image is malformed}}
 
 finish_test