Index: src/vdbe.c
==================================================================
--- src/vdbe.c
+++ src/vdbe.c
@@ -41,11 +41,11 @@
 ** documentation, headers files, or other derived files.  The formatting
 ** of the code in this file is, therefore, important.  See other comments
 ** in this file for details.  If in doubt, do not deviate from existing
 ** commenting and indentation practices when changing or adding code.
 **
-** $Id: vdbe.c,v 1.615 2007/05/10 21:14:03 drh Exp $
+** $Id: vdbe.c,v 1.616 2007/05/11 07:08:28 danielk1977 Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
 #include <ctype.h>
 #include <math.h>
@@ -917,11 +917,11 @@
 
   ts = *pFrom;
   Deephemeralize(pTos);
   for(i=0; i<pOp->p1; i++, pFrom++){
     Deephemeralize(&pFrom[1]);
-    assert( (pFrom->flags & MEM_Ephem)==0 );
+    assert( (pFrom[1].flags & MEM_Ephem)==0 );
     *pFrom = pFrom[1];
     if( pFrom->flags & MEM_Short ){
       assert( pFrom->flags & (MEM_Str|MEM_Blob) );
       assert( pFrom->z==pFrom[1].zShort );
       pFrom->z = pFrom->zShort;
@@ -2273,19 +2273,21 @@
     if( zAffinity ){
       applyAffinity(pRec, zAffinity[pRec-pData0], encoding);
     }
     if( pRec->flags&MEM_Null ){
       containsNull = 1;
+    }
+    if( pRec->flags&MEM_Zero && pRec->n>0 ){
+      sqlite3VdbeMemExpandBlob(pRec);
     }
     serial_type = sqlite3VdbeSerialType(pRec, file_format);
     len = sqlite3VdbeSerialTypeLen(serial_type);
     nData += len;
     nHdr += sqlite3VarintLen(serial_type);
     if( pRec->flags & MEM_Zero ){
       /* Only pure zero-filled BLOBs can be input to this Opcode.
       ** We do not allow blobs with a prefix and a zero-filled tail. */
-      assert( pRec->n==0 );
       nZero += pRec->u.i;
     }else if( len ){
       nZero = 0;
     }
   }
@@ -3828,16 +3830,19 @@
   assert( pTos>=p->aStack );
   assert( i>=0 && i<p->nCursor );
   assert( p->apCsr[i]!=0 );
   assert( pTos->flags & MEM_Blob );
   if( (pCrsr = (pC = p->apCsr[i])->pCursor)!=0 ){
-    int nKey = pTos->n;
-    const char *zKey = pTos->z;
     assert( pC->isTable==0 );
-    rc = sqlite3BtreeInsert(pCrsr, zKey, nKey, "", 0, 0, pOp->p2);
-    assert( pC->deferredMoveto==0 );
-    pC->cacheStatus = CACHE_STALE;
+    rc = sqlite3VdbeMemExpandBlob(pTos);
+    if( rc==SQLITE_OK ){
+      int nKey = pTos->n;
+      const char *zKey = pTos->z;
+      rc = sqlite3BtreeInsert(pCrsr, zKey, nKey, "", 0, 0, pOp->p2);
+      assert( pC->deferredMoveto==0 );
+      pC->cacheStatus = CACHE_STALE;
+    }
   }
   Release(pTos);
   pTos--;
   break;
 }

Index: test/fuzz.test
==================================================================
--- test/fuzz.test
+++ test/fuzz.test
@@ -11,11 +11,11 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this file is generating semi-random strings of SQL
 # (a.k.a. "fuzz") and sending it into the parser to try to generate
 # errors.
 #
-# $Id: fuzz.test,v 1.4 2007/05/11 00:20:08 drh Exp $
+# $Id: fuzz.test,v 1.5 2007/05/11 07:08:29 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 
 proc fuzz {TemplateList} {
@@ -133,17 +133,15 @@
   }
 } [execsql {SELECT 'abc', zeroblob(1)}]
 
 do_test fuzz-1.7 {
   execsql {
-    SELECT (
-      SELECT zeroblob(1000) FROM (
-        SELECT * FROM (SELECT 'first') ORDER BY NOT 'in'
-      )
+    SELECT ( SELECT zeroblob(1000) FROM ( 
+      SELECT * FROM (SELECT 'first') ORDER BY NOT 'in') 
     )
   }
-} {}
+} [execsql {SELECT zeroblob(1000)}]
 
 #----------------------------------------------------------------
 # Test some fuzzily generated expressions.
 #
 for {set ii 0} {$ii < 2000} {incr ii} {