Index: src/wal.c
==================================================================
--- src/wal.c
+++ src/wal.c
@@ -2390,47 +2390,53 @@
   if( rc==SQLITE_OK ){
     rc = walLockExclusive(pWal, WAL_CKPT_LOCK, 1);
     if( rc==SQLITE_OK ){
       volatile WalCkptInfo *pInfo = walCkptInfo(pWal);
       int szPage = (int)pWal->szPage;
-      void *pBuf1 = sqlite3_malloc(szPage);
-      void *pBuf2 = sqlite3_malloc(szPage);
-
-      if( pBuf1==0 || pBuf2==0 ){
-        rc = SQLITE_NOMEM;
-      }else{
-        u32 i = pInfo->nBackfillAttempted;
-        for(i=pInfo->nBackfillAttempted; i>pInfo->nBackfill; i--){
-          volatile ht_slot *dummy;
-          volatile u32 *aPgno;      /* Array of page numbers */
-          u32 iZero;                /* Frame corresponding to aPgno[0] */
-          u32 pgno;                 /* Page number in db file */
-          i64 iDbOff;               /* Offset of db file entry */
-          i64 iWalOff;              /* Offset of wal file entry */
-          rc = walHashGet(pWal, walFramePage(i), &dummy, &aPgno, &iZero);
-
-          if( rc==SQLITE_OK ){
+      i64 szDb;                   /* Size of db file in bytes */
+
+      rc = sqlite3OsFileSize(pWal->pDbFd, &szDb);
+      if( rc==SQLITE_OK ){
+        void *pBuf1 = sqlite3_malloc(szPage);
+        void *pBuf2 = sqlite3_malloc(szPage);
+        if( pBuf1==0 || pBuf2==0 ){
+          rc = SQLITE_NOMEM;
+        }else{
+          u32 i = pInfo->nBackfillAttempted;
+          for(i=pInfo->nBackfillAttempted; i>pInfo->nBackfill; i--){
+            volatile ht_slot *dummy;
+            volatile u32 *aPgno;      /* Array of page numbers */
+            u32 iZero;                /* Frame corresponding to aPgno[0] */
+            u32 pgno;                 /* Page number in db file */
+            i64 iDbOff;               /* Offset of db file entry */
+            i64 iWalOff;              /* Offset of wal file entry */
+
+            rc = walHashGet(pWal, walFramePage(i), &dummy, &aPgno, &iZero);
+            if( rc!=SQLITE_OK ) break;
             pgno = aPgno[i-iZero];
             iDbOff = (i64)(pgno-1) * szPage;
-            iWalOff = walFrameOffset(i, szPage) + WAL_FRAME_HDRSIZE;
-            rc = sqlite3OsRead(pWal->pWalFd, pBuf1, szPage, iWalOff);
-          }
-
-          if( rc==SQLITE_OK ){
-            rc = sqlite3OsRead(pWal->pDbFd, pBuf2, szPage, iDbOff);
-          }
-
-          if( rc!=SQLITE_OK || 0==memcmp(pBuf1, pBuf2, szPage) ){
-            break;
-          }
-
-          pInfo->nBackfillAttempted = i-1;
-        }
-      }
-
-      sqlite3_free(pBuf1);
-      sqlite3_free(pBuf2);
+
+            if( iDbOff+szPage<=szDb ){
+              iWalOff = walFrameOffset(i, szPage) + WAL_FRAME_HDRSIZE;
+              rc = sqlite3OsRead(pWal->pWalFd, pBuf1, szPage, iWalOff);
+
+              if( rc==SQLITE_OK ){
+                rc = sqlite3OsRead(pWal->pDbFd, pBuf2, szPage, iDbOff);
+              }
+
+              if( rc!=SQLITE_OK || 0==memcmp(pBuf1, pBuf2, szPage) ){
+                break;
+              }
+            }
+
+            pInfo->nBackfillAttempted = i-1;
+          }
+        }
+
+        sqlite3_free(pBuf1);
+        sqlite3_free(pBuf2);
+      }
       walUnlockExclusive(pWal, WAL_CKPT_LOCK, 1);
     }
 
     /* End the read transaction opened above. Also zero the cache of the
     ** wal-index header to force the pager-cache to be flushed when the next

Index: test/snapshot_fault.test
==================================================================
--- test/snapshot_fault.test
+++ test/snapshot_fault.test
@@ -14,10 +14,12 @@
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 ifcapable !snapshot {finish_test; return}
 set testprefix snapshot_fault
+
+if 1 {
 
 #-------------------------------------------------------------------------
 # Check that an sqlite3_snapshot_open() client cannot be tricked into
 # reading a corrupt snapshot even if a second client fails while 
 # checkpointing the db.
@@ -157,8 +159,37 @@
   }
 
   sqlite3_snapshot_free $::snapshot
 }
 
+}
+
+#-------------------------------------------------------------------------
+# Test the handling of faults that occur within sqlite3_snapshot_recover().
+#
+reset_db
+do_execsql_test 4.0 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(zzz);
+  INSERT INTO t1 VALUES('abc');
+  INSERT INTO t1 VALUES('def');
+} {wal}
+faultsim_save_and_close
+
+do_test 4.1 {
+  faultsim_restore_and_reopen
+  db eval { SELECT * FROM sqlite_master } 
+  sqlite3_snapshot_recover db main
+} {}
+db close
+
+do_faultsim_test 4 -faults oom* -prep {
+  faultsim_restore_and_reopen
+  db eval { SELECT * FROM sqlite_master } 
+} -body {
+  sqlite3_snapshot_recover db main
+} -test {
+  faultsim_test_result {0 {}} {1 SQLITE_NOMEM} {1 SQLITE_IOERR_NOMEM}
+}
 
 
 finish_test