Index: ext/fts5/fts5Int.h
==================================================================
--- ext/fts5/fts5Int.h
+++ ext/fts5/fts5Int.h
@@ -252,11 +252,10 @@
 #define FTS5_POS2OFFSET(iPos) (int)(iPos & 0xFFFFFFFF)
 
 typedef struct Fts5PoslistReader Fts5PoslistReader;
 struct Fts5PoslistReader {
   /* Variables used only by sqlite3Fts5PoslistIterXXX() functions. */
-  int iCol;                       /* If (iCol>=0), this column only */
   const u8 *a;                    /* Position list to iterate through */
   int n;                          /* Size of buffer at a[] in bytes */
   int i;                          /* Current offset in a[] */
 
   u8 bFlag;                       /* For client use (any custom purpose) */
@@ -264,11 +263,10 @@
   /* Output variables */
   u8 bEof;                        /* Set to true at EOF */
   i64 iPos;                       /* (iCol<<32) + iPos */
 };
 int sqlite3Fts5PoslistReaderInit(
-  int iCol,                       /* If (iCol>=0), this column only */
   const u8 *a, int n,             /* Poslist buffer to iterate through */
   Fts5PoslistReader *pIter        /* Iterator object to initialize */
 );
 int sqlite3Fts5PoslistReaderNext(Fts5PoslistReader*);
 
@@ -345,11 +343,11 @@
 */
 int sqlite3Fts5IterEof(Fts5IndexIter*);
 int sqlite3Fts5IterNext(Fts5IndexIter*);
 int sqlite3Fts5IterNextFrom(Fts5IndexIter*, i64 iMatch);
 i64 sqlite3Fts5IterRowid(Fts5IndexIter*);
-int sqlite3Fts5IterPoslist(Fts5IndexIter*, const u8 **pp, int *pn, i64 *pi);
+int sqlite3Fts5IterPoslist(Fts5IndexIter*,Fts5Colset*, const u8**, int*, i64*);
 int sqlite3Fts5IterPoslistBuffer(Fts5IndexIter *pIter, Fts5Buffer *pBuf);
 
 /*
 ** Close an iterator opened by sqlite3Fts5IndexQuery().
 */

Index: ext/fts5/fts5_buffer.c
==================================================================
--- ext/fts5/fts5_buffer.c
+++ ext/fts5/fts5_buffer.c
@@ -201,30 +201,24 @@
 /*
 ** Advance the iterator object passed as the only argument. Return true
 ** if the iterator reaches EOF, or false otherwise.
 */
 int sqlite3Fts5PoslistReaderNext(Fts5PoslistReader *pIter){
-  if( sqlite3Fts5PoslistNext64(pIter->a, pIter->n, &pIter->i, &pIter->iPos) 
-   || (pIter->iCol>=0 && (pIter->iPos >> 32) > pIter->iCol)
-  ){
+  if( sqlite3Fts5PoslistNext64(pIter->a, pIter->n, &pIter->i, &pIter->iPos) ){
     pIter->bEof = 1;
   }
   return pIter->bEof;
 }
 
 int sqlite3Fts5PoslistReaderInit(
-  int iCol,                       /* If (iCol>=0), this column only */
   const u8 *a, int n,             /* Poslist buffer to iterate through */
   Fts5PoslistReader *pIter        /* Iterator object to initialize */
 ){
   memset(pIter, 0, sizeof(*pIter));
   pIter->a = a;
   pIter->n = n;
-  pIter->iCol = iCol;
-  do {
-    sqlite3Fts5PoslistReaderNext(pIter);
-  }while( pIter->bEof==0 && (pIter->iPos >> 32)<iCol );
+  sqlite3Fts5PoslistReaderNext(pIter);
   return pIter->bEof;
 }
 
 int sqlite3Fts5PoslistWriterAppend(
   Fts5Buffer *pBuf, 

Index: ext/fts5/fts5_expr.c
==================================================================
--- ext/fts5/fts5_expr.c
+++ ext/fts5/fts5_expr.c
@@ -307,10 +307,11 @@
 /*
 ** Argument pTerm must be a synonym iterator.
 */
 static int fts5ExprSynonymPoslist(
   Fts5ExprTerm *pTerm, 
+  Fts5Colset *pColset,
   i64 iRowid,
   int *pbDel,                     /* OUT: Caller should sqlite3_free(*pa) */
   u8 **pa, int *pn
 ){
   Fts5PoslistReader aStatic[4];
@@ -325,11 +326,11 @@
     Fts5IndexIter *pIter = p->pIter;
     if( sqlite3Fts5IterEof(pIter)==0 && sqlite3Fts5IterRowid(pIter)==iRowid ){
       const u8 *a;
       int n;
       i64 dummy;
-      rc = sqlite3Fts5IterPoslist(pIter, &a, &n, &dummy);
+      rc = sqlite3Fts5IterPoslist(pIter, pColset, &a, &n, &dummy);
       if( rc!=SQLITE_OK ) goto synonym_poslist_out;
       if( nIter==nAlloc ){
         int nByte = sizeof(Fts5PoslistReader) * nAlloc * 2;
         Fts5PoslistReader *aNew = (Fts5PoslistReader*)sqlite3_malloc(nByte);
         if( aNew==0 ){
@@ -339,11 +340,11 @@
         memcpy(aNew, aIter, sizeof(Fts5PoslistReader) * nIter);
         nAlloc = nAlloc*2;
         if( aIter!=aStatic ) sqlite3_free(aIter);
         aIter = aNew;
       }
-      sqlite3Fts5PoslistReaderInit(-1, a, n, &aIter[nIter]);
+      sqlite3Fts5PoslistReaderInit(a, n, &aIter[nIter]);
       assert( aIter[nIter].bEof==0 );
       nIter++;
     }
   }
 
@@ -407,17 +408,11 @@
   Fts5PoslistWriter writer = {0};
   Fts5PoslistReader aStatic[4];
   Fts5PoslistReader *aIter = aStatic;
   int i;
   int rc = SQLITE_OK;
-  int iCol = -1;
   
-  if( pColset && pColset->nCol==1 ){
-    iCol = pColset->aiCol[0];
-    pColset = 0;
-  }
-
   fts5BufferZero(&pPhrase->poslist);
 
   /* If the aStatic[] array is not large enough, allocate a large array
   ** using sqlite3_malloc(). This approach could be improved upon. */
   if( pPhrase->nTerm>(sizeof(aStatic) / sizeof(aStatic[0])) ){
@@ -433,16 +428,18 @@
     i64 dummy;
     int n = 0;
     int bFlag = 0;
     const u8 *a = 0;
     if( pTerm->pSynonym ){
-      rc = fts5ExprSynonymPoslist(pTerm, pNode->iRowid, &bFlag, (u8**)&a, &n);
+      rc = fts5ExprSynonymPoslist(
+          pTerm, pColset, pNode->iRowid, &bFlag, (u8**)&a, &n
+      );
     }else{
-      rc = sqlite3Fts5IterPoslist(pTerm->pIter, &a, &n, &dummy);
+      rc = sqlite3Fts5IterPoslist(pTerm->pIter, pColset, &a, &n, &dummy);
     }
     if( rc!=SQLITE_OK ) goto ismatch_out;
-    sqlite3Fts5PoslistReaderInit(iCol, a, n, &aIter[i]);
+    sqlite3Fts5PoslistReaderInit(a, n, &aIter[i]);
     aIter[i].bFlag = bFlag;
     if( aIter[i].bEof ) goto ismatch_out;
   }
 
   while( 1 ){
@@ -461,15 +458,13 @@
           if( pPos->iPos>iAdj ) iPos = pPos->iPos-i;
         }
       }
     }while( bMatch==0 );
 
-    if( pColset==0 || fts5ExprColsetTest(pColset, FTS5_POS2COLUMN(iPos)) ){
-      /* Append position iPos to the output */
-      rc = sqlite3Fts5PoslistWriterAppend(&pPhrase->poslist, &writer, iPos);
-      if( rc!=SQLITE_OK ) goto ismatch_out;
-    }
+    /* Append position iPos to the output */
+    rc = sqlite3Fts5PoslistWriterAppend(&pPhrase->poslist, &writer, iPos);
+    if( rc!=SQLITE_OK ) goto ismatch_out;
 
     for(i=0; i<pPhrase->nTerm; i++){
       if( sqlite3Fts5PoslistReaderNext(&aIter[i]) ) goto ismatch_out;
     }
   }
@@ -760,65 +755,10 @@
     *piLast = fts5ExprSynonymRowid(pTerm, bDesc, &bEof);
   }
   return bEof;
 }
 
-/*
-** IN/OUT parameter (*pa) points to a position list n bytes in size. If
-** the position list contains entries for column iCol, then (*pa) is set
-** to point to the sub-position-list for that column and the number of
-** bytes in it returned. Or, if the argument position list does not
-** contain any entries for column iCol, return 0.
-*/
-static int fts5ExprExtractCol(
-  const u8 **pa,                  /* IN/OUT: Pointer to poslist */
-  int n,                          /* IN: Size of poslist in bytes */
-  int iCol                        /* Column to extract from poslist */
-){
-  int iCurrent = 0;
-  const u8 *p = *pa;
-  const u8 *pEnd = &p[n];         /* One byte past end of position list */
-  u8 prev = 0;
-
-  while( iCol!=iCurrent ){
-    /* Advance pointer p until it points to pEnd or an 0x01 byte that is
-    ** not part of a varint */
-    while( (prev & 0x80) || *p!=0x01 ){
-      prev = *p++;
-      if( p==pEnd ) return 0;
-    }
-    *pa = p++;
-    p += fts5GetVarint32(p, iCurrent);
-  }
-
-  /* Advance pointer p until it points to pEnd or an 0x01 byte that is
-  ** not part of a varint */
-  assert( (prev & 0x80)==0 );
-  while( p<pEnd && ((prev & 0x80) || *p!=0x01) ){
-    prev = *p++;
-  }
-  return p - (*pa);
-}
-
-static int fts5ExprExtractColset (
-  Fts5Colset *pColset,            /* Colset to filter on */
-  const u8 *pPos, int nPos,       /* Position list */
-  Fts5Buffer *pBuf                /* Output buffer */
-){
-  int rc = SQLITE_OK;
-  int i;
-
-  fts5BufferZero(pBuf);
-  for(i=0; i<pColset->nCol; i++){
-    const u8 *pSub = pPos;
-    int nSub = fts5ExprExtractCol(&pSub, nPos, pColset->aiCol[i]);
-    if( nSub ){
-      fts5BufferAppendBlob(&rc, pBuf, nSub, pSub);
-    }
-  }
-  return rc;
-}
 
 static int fts5ExprNearTest(
   int *pRc,
   Fts5Expr *pExpr,                /* Expression that pNear is a part of */
   Fts5ExprNode *pNode             /* The "NEAR" node (FTS5_STRING) */
@@ -862,38 +802,19 @@
   ** expressions.  */
   Fts5ExprNearset *pNear = pNode->pNear;
   Fts5ExprPhrase *pPhrase = pNear->apPhrase[0];
   Fts5IndexIter *pIter = pPhrase->aTerm[0].pIter;
   Fts5Colset *pColset = pNear->pColset;
-  const u8 *pPos;
-  int nPos;
   int rc;
 
   assert( pNode->eType==FTS5_TERM );
   assert( pNear->nPhrase==1 && pPhrase->nTerm==1 );
   assert( pPhrase->aTerm[0].pSynonym==0 );
 
-  rc = sqlite3Fts5IterPoslist(pIter, &pPos, &nPos, &pNode->iRowid);
-
-  /* If the term may match any column, then this must be a match. 
-  ** Return immediately in this case. Otherwise, try to find the
-  ** part of the poslist that corresponds to the required column.
-  ** If it can be found, return. If it cannot, the next iteration
-  ** of the loop will test the next rowid in the database for this
-  ** term.  */
-  if( pColset==0 ){
-    assert( pPhrase->poslist.nSpace==0 );
-    pPhrase->poslist.p = (u8*)pPos;
-    pPhrase->poslist.n = nPos;
-  }else if( pColset->nCol==1 ){
-    assert( pPhrase->poslist.nSpace==0 );
-    pPhrase->poslist.n = fts5ExprExtractCol(&pPos, nPos, pColset->aiCol[0]);
-    pPhrase->poslist.p = (u8*)pPos;
-  }else if( rc==SQLITE_OK ){
-    rc = fts5ExprExtractColset(pColset, pPos, nPos, &pPhrase->poslist);
-  }
-
+  rc = sqlite3Fts5IterPoslist(pIter, pColset, 
+      (const u8**)&pPhrase->poslist.p, &pPhrase->poslist.n, &pNode->iRowid
+  );
   pNode->bNomatch = (pPhrase->poslist.n==0);
   return rc;
 }
 
 /*

Index: ext/fts5/fts5_index.c
==================================================================
--- ext/fts5/fts5_index.c
+++ ext/fts5/fts5_index.c
@@ -509,12 +509,13 @@
   Fts5Structure *pStruct;         /* Database structure for this iterator */
   Fts5Buffer poslist;             /* Buffer containing current poslist */
 
   int nSeg;                       /* Size of aSeg[] array */
   int bRev;                       /* True to iterate in reverse order */
-  int bSkipEmpty;                 /* True to skip deleted entries */
-  int bEof;                       /* True at EOF */
+  u8 bSkipEmpty;                  /* True to skip deleted entries */
+  u8 bEof;                        /* True at EOF */
+  u8 bFiltered;                   /* True if column-filter already applied */
 
   i64 iSwitchRowid;               /* Firstest rowid of other than aFirst[1] */
   Fts5CResult *aFirst;            /* Current merge state (see above) */
   Fts5SegIter aSeg[1];            /* Array of segment iterators */
 };
@@ -1455,11 +1456,12 @@
 ** read. Before returning, set *pnSz to the number of bytes in the position
 ** list, and *pbDel to true if the delete flag is set, or false otherwise.
 */
 static int fts5GetPoslistSize(const u8 *p, int *pnSz, int *pbDel){
   int nSz;
-  int n = fts5GetVarint32(p, nSz);
+  int n = 0;
+  fts5FastGetVarint32(p, n, nSz);
   assert_nc( nSz>=0 );
   *pnSz = nSz/2;
   *pbDel = nSz & 0x0001;
   return n;
 }
@@ -1476,17 +1478,16 @@
 ** position list content (if any).
 */
 static void fts5SegIterLoadNPos(Fts5Index *p, Fts5SegIter *pIter){
   if( p->rc==SQLITE_OK ){
     int iOff = pIter->iLeafOffset;  /* Offset to read at */
+    int nSz;
     ASSERT_SZLEAF_OK(pIter->pLeaf);
-    if( iOff>=pIter->pLeaf->szLeaf ){
-      p->rc = FTS5_CORRUPT;
-    }else{
-      const u8 *a = &pIter->pLeaf->p[iOff];
-      pIter->iLeafOffset += fts5GetPoslistSize(a, &pIter->nPos, &pIter->bDel);
-    }
+    fts5FastGetVarint32(pIter->pLeaf->p, iOff, nSz);
+    pIter->bDel = (nSz & 0x0001);
+    pIter->nPos = nSz>>1;
+    pIter->iLeafOffset = iOff;
   }
 }
 
 static void fts5SegIterLoadRowid(Fts5Index *p, Fts5SegIter *pIter){
   u8 *a = pIter->pLeaf->p;        /* Buffer to read data from */
@@ -2723,10 +2724,11 @@
   Fts5IndexIter *pNew;
   pNew = fts5MultiIterAlloc(p, 2);
   if( pNew ){
     Fts5SegIter *pIter = &pNew->aSeg[1];
 
+    pNew->bFiltered = 1;
     pIter->flags = FTS5_SEGITER_ONETERM;
     if( pData->szLeaf>0 ){
       pIter->pLeaf = pData;
       pIter->iLeafOffset = fts5GetVarint(pData->p, (u64*)&pIter->iRowid);
       pIter->iEndofDoclist = pData->nn;
@@ -3938,11 +3940,11 @@
   void *pContext, 
   const u8 *pChunk, int nChunk
 ){
   assert_nc( nChunk>=0 );
   if( nChunk>0 ){
-    fts5BufferAppendBlob(&p->rc, (Fts5Buffer*)pContext, nChunk, pChunk);
+    fts5BufferSafeAppendBlob((Fts5Buffer*)pContext, pChunk, nChunk);
   }
 }
 
 typedef struct PoslistCallbackCtx PoslistCallbackCtx;
 struct PoslistCallbackCtx {
@@ -3978,11 +3980,11 @@
     if( pCtx->eState==2 ){
       int iCol;
       fts5FastGetVarint32(pChunk, i, iCol);
       if( fts5IndexColsetTest(pCtx->pColset, iCol) ){
         pCtx->eState = 1;
-        fts5BufferAppendVarint(&p->rc, pCtx->pBuf, 1);
+        fts5BufferSafeAppendVarint(pCtx->pBuf, 1);
       }else{
         pCtx->eState = 0;
       }
     }
 
@@ -3990,11 +3992,11 @@
       while( i<nChunk && pChunk[i]!=0x01 ){
         while( pChunk[i] & 0x80 ) i++;
         i++;
       }
       if( pCtx->eState ){
-        fts5BufferAppendBlob(&p->rc, pCtx->pBuf, i-iStart, &pChunk[iStart]);
+        fts5BufferSafeAppendBlob(pCtx->pBuf, &pChunk[iStart], i-iStart);
       }
       if( i<nChunk ){
         int iCol;
         iStart = i;
         i++;
@@ -4002,11 +4004,11 @@
           pCtx->eState = 2;
         }else{
           fts5FastGetVarint32(pChunk, i, iCol);
           pCtx->eState = fts5IndexColsetTest(pCtx->pColset, iCol);
           if( pCtx->eState ){
-            fts5BufferAppendBlob(&p->rc, pCtx->pBuf, i-iStart, &pChunk[iStart]);
+            fts5BufferSafeAppendBlob(pCtx->pBuf, &pChunk[iStart], i-iStart);
             iStart = i;
           }
         }
       }
     }while( i<nChunk );
@@ -4023,60 +4025,127 @@
   Fts5Index *p,
   Fts5SegIter *pSeg,
   Fts5Colset *pColset,
   Fts5Buffer *pBuf
 ){
-  if( pColset==0 ){
-    fts5ChunkIterate(p, pSeg, (void*)pBuf, fts5PoslistCallback);
-  }else{
-    PoslistCallbackCtx sCtx;
-    sCtx.pBuf = pBuf;
-    sCtx.pColset = pColset;
-    sCtx.eState = pColset ? fts5IndexColsetTest(pColset, 0) : 1;
-    assert( sCtx.eState==0 || sCtx.eState==1 );
-    fts5ChunkIterate(p, pSeg, (void*)&sCtx, fts5PoslistFilterCallback);
-  }
-}
+  if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos) ){
+    if( pColset==0 ){
+      fts5ChunkIterate(p, pSeg, (void*)pBuf, fts5PoslistCallback);
+    }else{
+      PoslistCallbackCtx sCtx;
+      sCtx.pBuf = pBuf;
+      sCtx.pColset = pColset;
+      sCtx.eState = pColset ? fts5IndexColsetTest(pColset, 0) : 1;
+      assert( sCtx.eState==0 || sCtx.eState==1 );
+      fts5ChunkIterate(p, pSeg, (void*)&sCtx, fts5PoslistFilterCallback);
+    }
+  }
+}
+
+/*
+** IN/OUT parameter (*pa) points to a position list n bytes in size. If
+** the position list contains entries for column iCol, then (*pa) is set
+** to point to the sub-position-list for that column and the number of
+** bytes in it returned. Or, if the argument position list does not
+** contain any entries for column iCol, return 0.
+*/
+static int fts5IndexExtractCol(
+  const u8 **pa,                  /* IN/OUT: Pointer to poslist */
+  int n,                          /* IN: Size of poslist in bytes */
+  int iCol                        /* Column to extract from poslist */
+){
+  int iCurrent = 0;               /* Anything before the first 0x01 is col 0 */
+  const u8 *p = *pa;
+  const u8 *pEnd = &p[n];         /* One byte past end of position list */
+  u8 prev = 0;
+
+  while( iCol!=iCurrent ){
+    /* Advance pointer p until it points to pEnd or an 0x01 byte that is
+    ** not part of a varint */
+    while( (prev & 0x80) || *p!=0x01 ){
+      prev = *p++;
+      if( p==pEnd ) return 0;
+    }
+    *pa = p++;
+    p += fts5GetVarint32(p, iCurrent);
+  }
+
+  /* Advance pointer p until it points to pEnd or an 0x01 byte that is
+  ** not part of a varint */
+  assert( (prev & 0x80)==0 );
+  while( p<pEnd && ((prev & 0x80) || *p!=0x01) ){
+    prev = *p++;
+  }
+  return p - (*pa);
+}
+
 
 /*
 ** Iterator pMulti currently points to a valid entry (not EOF). This
-** function appends a copy of the position-list of the entry pMulti 
-** currently points to to buffer pBuf.
+** function appends the following to buffer pBuf:
 **
-** If an error occurs, an error code is left in p->rc. It is assumed
-** no error has already occurred when this function is called.
+**   * The varint iDelta, and
+**   * the position list that currently points to, including the size field.
+**
+** If argument pColset is NULL, then the position list is filtered according
+** to pColset before being appended to the buffer. If this means there are
+** no entries in the position list, nothing is appended to the buffer (not
+** even iDelta).
+**
+** If an error occurs, an error code is left in p->rc. 
 */
-static int fts5MultiIterPoslist(
+static int fts5AppendPoslist(
   Fts5Index *p,
+  i64 iDelta,
   Fts5IndexIter *pMulti,
   Fts5Colset *pColset,
   Fts5Buffer *pBuf
 ){
   if( p->rc==SQLITE_OK ){
-    int iSz;
-    int iData;
-
     Fts5SegIter *pSeg = &pMulti->aSeg[ pMulti->aFirst[1].iFirst ];
     assert( fts5MultiIterEof(p, pMulti)==0 );
+    assert( pSeg->nPos>0 );
+    if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos+9+9) ){
+      int iSv1;
+      int iSv2;
+      int iData;
 
-    /* WRITEPOSLISTSIZE */
-    iSz = pBuf->n;
-    fts5BufferSafeAppendVarint(pBuf, pSeg->nPos*2);
-    iData = pBuf->n;
+      /* Append iDelta */
+      iSv1 = pBuf->n;
+      fts5BufferSafeAppendVarint(pBuf, iDelta);
 
-    fts5SegiterPoslist(p, pSeg, pColset, pBuf);
+      /* WRITEPOSLISTSIZE */
+      iSv2 = pBuf->n;
+      fts5BufferSafeAppendVarint(pBuf, pSeg->nPos*2);
+      iData = pBuf->n;
 
-    if( pColset ){
-      int nActual = pBuf->n - iData;
-      if( nActual!=pSeg->nPos ){
-        /* WRITEPOSLISTSIZE */
-        if( nActual==0 ){
-          return 1;
+      if( pSeg->iLeafOffset+pSeg->nPos<=pSeg->pLeaf->szLeaf 
+       && (pColset==0 || pColset->nCol==1)
+      ){
+        const u8 *pPos = &pSeg->pLeaf->p[pSeg->iLeafOffset];
+        int nPos;
+        if( pColset ){
+          nPos = fts5IndexExtractCol(&pPos, pSeg->nPos, pColset->aiCol[0]);
         }else{
-          int nReq = sqlite3Fts5GetVarintLen((u32)(nActual*2));
-          while( iSz<(iData-nReq) ){ pBuf->p[iSz++] = 0x80; }
-          sqlite3Fts5PutVarint(&pBuf->p[iSz], nActual*2);
+          nPos = pSeg->nPos;
+        }
+        fts5BufferSafeAppendBlob(pBuf, pPos, nPos);
+      }else{
+        fts5SegiterPoslist(p, pSeg, pColset, pBuf);
+      }
+
+      if( pColset ){
+        int nActual = pBuf->n - iData;
+        if( nActual!=pSeg->nPos ){
+          if( nActual==0 ){
+            pBuf->n = iSv1;
+            return 1;
+          }else{
+            int nReq = sqlite3Fts5GetVarintLen((u32)(nActual*2));
+            while( iSv2<(iData-nReq) ){ pBuf->p[iSv2++] = 0x80; }
+            sqlite3Fts5PutVarint(&pBuf->p[iSv2], nActual*2);
+          }
         }
       }
     }
   }
 
@@ -4280,19 +4349,12 @@
           }
         }
         iLastRowid = 0;
       }
 
-      if( 0==sqlite3Fts5BufferGrow(&p->rc, &doclist, 9) ){
-        int iSave = doclist.n;
-        assert( doclist.n!=0 || iLastRowid==0 );
-        fts5BufferSafeAppendVarint(&doclist, iRowid - iLastRowid);
-        if( fts5MultiIterPoslist(p, p1, pColset, &doclist) ){
-          doclist.n = iSave;
-        }else{
-          iLastRowid = iRowid;
-        }
+      if( !fts5AppendPoslist(p, iRowid-iLastRowid, p1, pColset, &doclist) ){
+        iLastRowid = iRowid;
       }
     }
 
     for(i=0; i<nBuf; i++){
       if( p->rc==SQLITE_OK ){
@@ -4645,10 +4707,30 @@
   const char *z = (const char*)fts5MultiIterTerm(pIter, &n);
   *pn = n-1;
   return &z[1];
 }
 
+
+static int fts5IndexExtractColset (
+  Fts5Colset *pColset,            /* Colset to filter on */
+  const u8 *pPos, int nPos,       /* Position list */
+  Fts5Buffer *pBuf                /* Output buffer */
+){
+  int rc = SQLITE_OK;
+  int i;
+
+  fts5BufferZero(pBuf);
+  for(i=0; i<pColset->nCol; i++){
+    const u8 *pSub = pPos;
+    int nSub = fts5IndexExtractCol(&pSub, nPos, pColset->aiCol[i]);
+    if( nSub ){
+      fts5BufferAppendBlob(&rc, pBuf, nSub, pSub);
+    }
+  }
+  return rc;
+}
+
 
 /*
 ** Return a pointer to a buffer containing a copy of the position list for
 ** the current entry. Output variable *pn is set to the size of the buffer 
 ** in bytes before returning.
@@ -4656,24 +4738,37 @@
 ** The returned position list does not include the "number of bytes" varint
 ** field that starts the position list on disk.
 */
 int sqlite3Fts5IterPoslist(
   Fts5IndexIter *pIter, 
+  Fts5Colset *pColset,            /* Column filter (or NULL) */
   const u8 **pp,                  /* OUT: Pointer to position-list data */
   int *pn,                        /* OUT: Size of position-list in bytes */
   i64 *piRowid                    /* OUT: Current rowid */
 ){
   Fts5SegIter *pSeg = &pIter->aSeg[ pIter->aFirst[1].iFirst ];
   assert( pIter->pIndex->rc==SQLITE_OK );
   *piRowid = pSeg->iRowid;
-  *pn = pSeg->nPos;
-  if( pSeg->iLeafOffset+pSeg->nPos <= pSeg->pLeaf->szLeaf ){
-    *pp = &pSeg->pLeaf->p[pSeg->iLeafOffset];
+  if( pSeg->iLeafOffset+pSeg->nPos<=pSeg->pLeaf->szLeaf ){
+    u8 *pPos = &pSeg->pLeaf->p[pSeg->iLeafOffset];
+    if( pColset==0 || pIter->bFiltered ){
+      *pn = pSeg->nPos;
+      *pp = pPos;
+    }else if( pColset->nCol==1 ){
+      *pp = pPos;
+      *pn = fts5IndexExtractCol(pp, pSeg->nPos, pColset->aiCol[0]);
+    }else{
+      fts5BufferZero(&pIter->poslist);
+      fts5IndexExtractColset(pColset, pPos, pSeg->nPos, &pIter->poslist);
+      *pp = pIter->poslist.p;
+      *pn = pIter->poslist.n;
+    }
   }else{
     fts5BufferZero(&pIter->poslist);
-    fts5SegiterPoslist(pIter->pIndex, pSeg, 0, &pIter->poslist);
+    fts5SegiterPoslist(pIter->pIndex, pSeg, pColset, &pIter->poslist);
     *pp = pIter->poslist.p;
+    *pn = pIter->poslist.n;
   }
   return fts5IndexReturn(pIter->pIndex);
 }
 
 /*
@@ -4866,14 +4961,14 @@
   while( rc==SQLITE_OK && 0==sqlite3Fts5IterEof(pIdxIter) ){
     i64 dummy;
     const u8 *pPos;
     int nPos;
     i64 rowid = sqlite3Fts5IterRowid(pIdxIter);
-    rc = sqlite3Fts5IterPoslist(pIdxIter, &pPos, &nPos, &dummy);
+    rc = sqlite3Fts5IterPoslist(pIdxIter, 0, &pPos, &nPos, &dummy);
     if( rc==SQLITE_OK ){
       Fts5PoslistReader sReader;
-      for(sqlite3Fts5PoslistReaderInit(-1, pPos, nPos, &sReader);
+      for(sqlite3Fts5PoslistReaderInit(pPos, nPos, &sReader);
           sReader.bEof==0;
           sqlite3Fts5PoslistReaderNext(&sReader)
       ){
         int iCol = FTS5_POS2COLUMN(sReader.iPos);
         int iOff = FTS5_POS2OFFSET(sReader.iPos);

Index: ext/fts5/fts5_main.c
==================================================================
--- ext/fts5/fts5_main.c
+++ ext/fts5/fts5_main.c
@@ -1641,11 +1641,11 @@
 
     /* Initialize all iterators */
     for(i=0; i<nIter; i++){
       const u8 *a;
       int n = fts5CsrPoslist(pCsr, i, &a);
-      sqlite3Fts5PoslistReaderInit(-1, a, n, &aIter[i]);
+      sqlite3Fts5PoslistReaderInit(a, n, &aIter[i]);
     }
 
     while( 1 ){
       int *aInst;
       int iBest = -1;

Index: ext/fts5/fts5_vocab.c
==================================================================
--- ext/fts5/fts5_vocab.c
+++ ext/fts5/fts5_vocab.c
@@ -347,11 +347,11 @@
         i64 dummy;
         const u8 *pPos; int nPos;   /* Position list */
         i64 iPos = 0;               /* 64-bit position read from poslist */
         int iOff = 0;               /* Current offset within position list */
 
-        rc = sqlite3Fts5IterPoslist(pCsr->pIter, &pPos, &nPos, &dummy);
+        rc = sqlite3Fts5IterPoslist(pCsr->pIter, 0, &pPos, &nPos, &dummy);
         if( rc==SQLITE_OK ){
           if( pTab->eType==FTS5_VOCAB_ROW ){
             while( 0==sqlite3Fts5PoslistNext64(pPos, nPos, &iOff, &iPos) ){
               pCsr->aVal[1]++;
             }

Index: ext/fts5/test/fts5simple.test
==================================================================
--- ext/fts5/test/fts5simple.test
+++ ext/fts5/test/fts5simple.test
@@ -248,10 +248,14 @@
 }
 
 do_execsql_test 10.1 {
   SELECT rowid FROM t3('c: c*');
 } {2}
+
+do_execsql_test 10.2 {
+  SELECT rowid FROM t3('b: acb');
+} {2}
 
 #-------------------------------------------------------------------------
 # Test that character 0x1A is allowed in fts5 barewords.
 #
 do_test 11.0 {
@@ -279,8 +283,22 @@
 } {/fts5: syntax error/}
 do_test 11.5 {
   catchsql "SELECT rowid FROM t4('d\x19')"
 } {/fts5: syntax error/}
 
+#-------------------------------------------------------------------------
+#
+do_test 12.1 {
+  execsql {
+    CREATE VIRTUAL TABLE xx USING fts5(x,y);
+    BEGIN;
+      INSERT INTO xx VALUES('1 2 3', 'a b c');
+  }
+} {}
+
+do_execsql_test 12.2 {
+  SELECT rowid FROM xx('x:a');
+  COMMIT;
+} {}
 
 finish_test