Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -7,11 +7,11 @@
 **    May you do good and not evil.
 **    May you find forgiveness for yourself and forgive others.
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.453 2008/05/02 14:23:55 drh Exp $
+** $Id: btree.c,v 1.454 2008/05/05 12:09:33 danielk1977 Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
 ** Including a description of file format and an overview of operation.
 */
@@ -1052,10 +1052,14 @@
     return SQLITE_CORRUPT_BKPT; 
   }
   rc = sqlite3BtreeGetPage(pBt, pgno, ppPage, 0);
   if( rc==SQLITE_OK && (*ppPage)->isInit==0 ){
     rc = sqlite3BtreeInitPage(*ppPage, pParent);
+    if( rc!=SQLITE_OK ){
+      releasePage(*ppPage);
+      *ppPage = 0;
+    }
   }
   return rc;
 }
 
 /*
@@ -4089,11 +4093,12 @@
         iPage = get4byte(&aData[8+closest*4]);
         if( !searchList || iPage==nearby ){
           *pPgno = iPage;
           if( *pPgno>sqlite3PagerPagecount(pBt->pPager) ){
             /* Free page off the end of the file */
-            return SQLITE_CORRUPT_BKPT;
+            rc = SQLITE_CORRUPT_BKPT;
+            goto end_allocate_page;
           }
           TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d"
                  ": %d more free pages\n",
                  *pPgno, closest+1, k, pTrunk->pgno, n-1));
           if( closest<k-1 ){

Index: test/corrupt.test
==================================================================
--- test/corrupt.test
+++ test/corrupt.test
@@ -11,11 +11,11 @@
 # This file implements regression tests for SQLite library.
 #
 # This file implements tests to make sure SQLite does not crash or
 # segfault if it sees a corrupt database file.
 #
-# $Id: corrupt.test,v 1.8 2005/02/19 08:18:06 danielk1977 Exp $
+# $Id: corrupt.test,v 1.9 2008/05/05 12:09:33 danielk1977 Exp $
 
 catch {file delete -force test.db}
 catch {file delete -force test.db-journal}
 
 set testdir [file dirname $argv0]
@@ -108,10 +108,19 @@
   } {}
   do_test corrupt-2.$tn.7 {
     catchsql {PRAGMA integrity_check}
     set x {}
   } {}
+
+  # Check that no page references were leaked.
+  do_test corrupt-2.$tn.8 {
+    set bt [btree_from_db db]
+    db_enter db
+    array set stats [btree_pager_stats $bt]
+    db_leave db
+    set stats(ref)
+  } {0}
 }  
 
 #------------------------------------------------------------------------
 # For these tests, swap the rootpage entries of t1 (a table) and t1i1 (an
 # index on t1) in sqlite_master. Then perform a few different queries