Applying fts2.patch to fts3.

third_party/sqlite/ext/fts3/fts3.c

 /*
 ** 2006 Oct 10
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
 **
 **    May you do good and not evil.
 **    May you find forgiveness for yourself and forgive others.
 **    May you share freely, never taking more than you give.
 **
@@ skipping 253 matching lines @@
 ** we simply write the new doclist.  Segment merges overwrite older
 ** data for a particular docid with newer data, so deletes or updates
 ** will eventually overtake the earlier data and knock it out.  The
 ** query logic likewise merges doclists so that newer data knocks out
 ** older data.
 **
 ** TODO(shess) Provide a VACUUM type operation to clear out all
 ** deletions and duplications.  This would basically be a forced merge
 ** into a single segment.
 */
+#define CHROMIUM_FTS3_CHANGES 1
 
 #if !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3)
 
 #if defined(SQLITE_ENABLE_FTS3) && !defined(SQLITE_CORE)
 # define SQLITE_CORE 1
 #endif
 
 #include <assert.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ skipping 22 matching lines @@
 ** Put the query functions last because they're likely to reference
 ** typedefs or functions from the table update section.
 */
 
 #if 0
 # define FTSTRACE(A)  printf A; fflush(stdout)
 #else
 # define FTSTRACE(A)
 #endif
 
+#if 0
+/* Useful to set breakpoints. See main.c sqlite3Corrupt(). */
+static int fts3Corrupt(void){
+  return SQLITE_CORRUPT;
+}
+# define SQLITE_CORRUPT_BKPT fts3Corrupt()
+#else
+# define SQLITE_CORRUPT_BKPT SQLITE_CORRUPT
+#endif
+
 /* It is not safe to call isspace(), tolower(), or isalnum() on
 ** hi-bit-set characters.  This is the same solution used in the
 ** tokenizer.
 */
 /* TODO(shess) The snippet-generation code should be using the
 ** tokenizer-generated tokens rather than doing its own local
 ** tokenization.
 */
 /* TODO(shess) Is __isascii() a portable version of (c&0x80)==0? */
 static int safe_isspace(char c){
@@ skipping 68 matching lines @@
     vu >>= 7;
   }while( vu!=0 );
   q[-1] &= 0x7f;  /* turn off high bit in final byte */
   assert( q - (unsigned char *)p <= VARINT_MAX );
   return (int) (q - (unsigned char *)p);
 }
 
 /* Read a 64-bit variable-length integer from memory starting at p[0].
  * Return the number of bytes read, or 0 on error.
  * The value is stored in *v. */
-static int fts3GetVarint(const char *p, sqlite_int64 *v){
+static int fts3GetVarintSafe(const char *p, sqlite_int64 *v, int max){
   const unsigned char *q = (const unsigned char *) p;
   sqlite_uint64 x = 0, y = 1;
-  while( (*q & 0x80) == 0x80 ){
+  if( max>VARINT_MAX ) max = VARINT_MAX;
+  while( max && (*q & 0x80) == 0x80 ){
+    max--;
     x += y * (*q++ & 0x7f);
     y <<= 7;
-    if( q - (unsigned char *)p >= VARINT_MAX ){  /* bad data */
-      assert( 0 );
-      return 0;
-    }
+  }
+  if( !max ){
+    assert( 0 );
+    return 0;  /* tried to read too much; bad data */
   }
   x += y * (*q++);
   *v = (sqlite_int64) x;
   return (int) (q - (unsigned char *)p);
 }
 
-static int fts3GetVarint32(const char *p, int *pi){
+static int fts3GetVarint(const char *p, sqlite_int64 *v){
+  return fts3GetVarintSafe(p, v, VARINT_MAX);
+}
+
+static int fts3GetVarint32Safe(const char *p, int *pi, int max){
  sqlite_int64 i;
- int ret = fts3GetVarint(p, &i);
+ int ret = fts3GetVarintSafe(p, &i, max);
+ if( !ret ) return ret;
  *pi = (int) i;
  assert( *pi==i );
  return ret;
 }
 
+static int fts3GetVarint32(const char* p, int *pi){
+  return fts3GetVarint32Safe(p, pi, VARINT_MAX);
+}
+
 /*******************************************************************/
 /* DataBuffer is used to collect data into a buffer in piecemeal
 ** fashion.  It implements the usual distinction between amount of
 ** data currently stored (nData) and buffer capacity (nCapacity).
 **
 ** dataBufferInit - create a buffer with given initial capacity.
 ** dataBufferReset - forget buffer's data, retaining capacity.
 ** dataBufferDestroy - free buffer's data.
 ** dataBufferSwap - swap contents of two buffers.
 ** dataBufferExpand - expand capacity without adding data.
@@ skipping 148 matching lines @@
   DocListType iType;
   const char *pData;
   int nData;
 
   sqlite_int64 iDocid;
   int nElement;
 } DLReader;
 
 static int dlrAtEnd(DLReader *pReader){
   assert( pReader->nData>=0 );
-  return pReader->nData==0;
+  return pReader->nData<=0;
 }
 static sqlite_int64 dlrDocid(DLReader *pReader){
   assert( !dlrAtEnd(pReader) );
   return pReader->iDocid;
 }
 static const char *dlrDocData(DLReader *pReader){
   assert( !dlrAtEnd(pReader) );
   return pReader->pData;
 }
 static int dlrDocDataBytes(DLReader *pReader){
   assert( !dlrAtEnd(pReader) );
   return pReader->nElement;
 }
 static int dlrAllDataBytes(DLReader *pReader){
   assert( !dlrAtEnd(pReader) );
   return pReader->nData;
 }
 /* TODO(shess) Consider adding a field to track iDocid varint length
 ** to make these two functions faster.  This might matter (a tiny bit)
 ** for queries.
 */
 static const char *dlrPosData(DLReader *pReader){
   sqlite_int64 iDummy;
-  int n = fts3GetVarint(pReader->pData, &iDummy);
+  int n = fts3GetVarintSafe(pReader->pData, &iDummy, pReader->nElement);
+  if( !n ) return NULL;
   assert( !dlrAtEnd(pReader) );
   return pReader->pData+n;
 }
 static int dlrPosDataLen(DLReader *pReader){
   sqlite_int64 iDummy;
   int n = fts3GetVarint(pReader->pData, &iDummy);
   assert( !dlrAtEnd(pReader) );
   return pReader->nElement-n;
 }
-static void dlrStep(DLReader *pReader){
+static int dlrStep(DLReader *pReader){
   assert( !dlrAtEnd(pReader) );
 
   /* Skip past current doclist element. */
   assert( pReader->nElement<=pReader->nData );
   pReader->pData += pReader->nElement;
   pReader->nData -= pReader->nElement;
 
   /* If there is more data, read the next doclist element. */
-  if( pReader->nData!=0 ){
+  if( pReader->nData>0 ){
     sqlite_int64 iDocidDelta;
-    int iDummy, n = fts3GetVarint(pReader->pData, &iDocidDelta);
+    int nTotal = 0;
+    int iDummy, n = fts3GetVarintSafe(pReader->pData, &iDocidDelta, pReader->nData);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    nTotal += n;
     pReader->iDocid += iDocidDelta;
     if( pReader->iType>=DL_POSITIONS ){
-      assert( n<pReader->nData );
       while( 1 ){
-        n += fts3GetVarint32(pReader->pData+n, &iDummy);
-        assert( n<=pReader->nData );
+        n = fts3GetVarint32Safe(pReader->pData+nTotal, &iDummy, pReader->nData-nTotal);
+        if( !n ) return SQLITE_CORRUPT_BKPT;
+        nTotal += n;
         if( iDummy==POS_END ) break;
         if( iDummy==POS_COLUMN ){
-          n += fts3GetVarint32(pReader->pData+n, &iDummy);
-          assert( n<pReader->nData );
+          n = fts3GetVarint32Safe(pReader->pData+nTotal, &iDummy, pReader->nData-nTotal);
+          if( !n ) return SQLITE_CORRUPT_BKPT;
+          nTotal += n;
         }else if( pReader->iType==DL_POSITIONS_OFFSETS ){
-          n += fts3GetVarint32(pReader->pData+n, &iDummy);
-          n += fts3GetVarint32(pReader->pData+n, &iDummy);
-          assert( n<pReader->nData );
+          n = fts3GetVarint32Safe(pReader->pData+nTotal, &iDummy, pReader->nData-nTotal);
+          if( !n ) return SQLITE_CORRUPT_BKPT;
+          nTotal += n;
+          n = fts3GetVarint32Safe(pReader->pData+nTotal, &iDummy, pReader->nData-nTotal);
+          if( !n ) return SQLITE_CORRUPT_BKPT;
+          nTotal += n;
         }
       }
     }
-    pReader->nElement = n;
+    pReader->nElement = nTotal;
     assert( pReader->nElement<=pReader->nData );
   }
+  return SQLITE_OK;
 }
-static void dlrInit(DLReader *pReader, DocListType iType,
-                    const char *pData, int nData){
+static void dlrDestroy(DLReader *pReader){
+  SCRAMBLE(pReader);
+}
+static int dlrInit(DLReader *pReader, DocListType iType,
+                   const char *pData, int nData){
+  int rc;
   assert( pData!=NULL && nData!=0 );
   pReader->iType = iType;
   pReader->pData = pData;
   pReader->nData = nData;
   pReader->nElement = 0;
   pReader->iDocid = 0;
 
   /* Load the first element's data.  There must be a first element. */
-  dlrStep(pReader);
-}
-static void dlrDestroy(DLReader *pReader){
-  SCRAMBLE(pReader);
+  rc = dlrStep(pReader);
+  if( rc!=SQLITE_OK ) dlrDestroy(pReader);
+  return rc;
 }
 
 #ifndef NDEBUG
 /* Verify that the doclist can be validly decoded.  Also returns the
 ** last docid found because it is convenient in other assertions for
 ** DLWriter.
 */
 static void docListValidate(DocListType iType, const char *pData, int nData,
                             sqlite_int64 *pLastDocid){
   sqlite_int64 iPrevDocid = 0;
@@ skipping 66 matching lines @@
 **
 ** iLastDocid is the final docid in the doclist in pData.  It is
 ** needed to create the new iPrevDocid for future delta-encoding.  The
 ** code could decode the passed doclist to recreate iLastDocid, but
 ** the only current user (docListMerge) already has decoded this
 ** information.
 */
 /* TODO(shess) This has become just a helper for docListMerge.
 ** Consider a refactor to make this cleaner.
 */
-static void dlwAppend(DLWriter *pWriter,
-                      const char *pData, int nData,
-                      sqlite_int64 iFirstDocid, sqlite_int64 iLastDocid){
+static int dlwAppend(DLWriter *pWriter,
+                     const char *pData, int nData,
+                     sqlite_int64 iFirstDocid, sqlite_int64 iLastDocid){
   sqlite_int64 iDocid = 0;
   char c[VARINT_MAX];
   int nFirstOld, nFirstNew;     /* Old and new varint len of first docid. */
 #ifndef NDEBUG
   sqlite_int64 iLastDocidDelta;
 #endif
 
   /* Recode the initial docid as delta from iPrevDocid. */
-  nFirstOld = fts3GetVarint(pData, &iDocid);
+  nFirstOld = fts3GetVarintSafe(pData, &iDocid, nData);
+  if( !nFirstOld ) return SQLITE_CORRUPT_BKPT;
   assert( nFirstOld<nData || (nFirstOld==nData && pWriter->iType==DL_DOCIDS) );
   nFirstNew = fts3PutVarint(c, iFirstDocid-pWriter->iPrevDocid);
 
   /* Verify that the incoming doclist is valid AND that it ends with
   ** the expected docid.  This is essential because we'll trust this
   ** docid in future delta-encoding.
   */
   ASSERT_VALID_DOCLIST(pWriter->iType, pData, nData, &iLastDocidDelta);
   assert( iLastDocid==iFirstDocid-iDocid+iLastDocidDelta );
 
   /* Append recoded initial docid and everything else.  Rest of docids
   ** should have been delta-encoded from previous initial docid.
   */
   if( nFirstOld<nData ){
     dataBufferAppend2(pWriter->b, c, nFirstNew,
                       pData+nFirstOld, nData-nFirstOld);
   }else{
     dataBufferAppend(pWriter->b, c, nFirstNew);
   }
   pWriter->iPrevDocid = iLastDocid;
+  return SQLITE_OK;
 }
-static void dlwCopy(DLWriter *pWriter, DLReader *pReader){
-  dlwAppend(pWriter, dlrDocData(pReader), dlrDocDataBytes(pReader),
-            dlrDocid(pReader), dlrDocid(pReader));
+static int dlwCopy(DLWriter *pWriter, DLReader *pReader){
+  return dlwAppend(pWriter, dlrDocData(pReader), dlrDocDataBytes(pReader),
+                   dlrDocid(pReader), dlrDocid(pReader));
 }
 static void dlwAdd(DLWriter *pWriter, sqlite_int64 iDocid){
   char c[VARINT_MAX];
   int n = fts3PutVarint(c, iDocid-pWriter->iPrevDocid);
 
   /* Docids must ascend. */
   assert( !pWriter->has_iPrevDocid || iDocid>pWriter->iPrevDocid );
   assert( pWriter->iType==DL_DOCIDS );
 
   dataBufferAppend(pWriter->b, c, n);
@@ skipping 40 matching lines @@
   return pReader->iPosition;
 }
 static int plrStartOffset(PLReader *pReader){
   assert( !plrAtEnd(pReader) );
   return pReader->iStartOffset;
 }
 static int plrEndOffset(PLReader *pReader){
   assert( !plrAtEnd(pReader) );
   return pReader->iEndOffset;
 }
-static void plrStep(PLReader *pReader){
-  int i, n;
+static int plrStep(PLReader *pReader){
+  int i, n, nTotal = 0;
 
   assert( !plrAtEnd(pReader) );
 
-  if( pReader->nData==0 ){
+  if( pReader->nData<=0 ){
     pReader->pData = NULL;
-    return;
+    return SQLITE_OK;
   }
 
-  n = fts3GetVarint32(pReader->pData, &i);
+  n = fts3GetVarint32Safe(pReader->pData, &i, pReader->nData);
+  if( !n ) return SQLITE_CORRUPT_BKPT;
+  nTotal += n;
   if( i==POS_COLUMN ){
-    n += fts3GetVarint32(pReader->pData+n, &pReader->iColumn);
+    n = fts3GetVarint32Safe(pReader->pData+nTotal, &pReader->iColumn, pReader->nData-nTotal);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    nTotal += n;
     pReader->iPosition = 0;
     pReader->iStartOffset = 0;
-    n += fts3GetVarint32(pReader->pData+n, &i);
+    n = fts3GetVarint32Safe(pReader->pData+nTotal, &i, pReader->nData-nTotal);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    nTotal += n;
   }
   /* Should never see adjacent column changes. */
   assert( i!=POS_COLUMN );
 
   if( i==POS_END ){
+    assert( nTotal<=pReader->nData );
     pReader->nData = 0;
     pReader->pData = NULL;
-    return;
+    return SQLITE_OK;
   }
 
   pReader->iPosition += i-POS_BASE;
   if( pReader->iType==DL_POSITIONS_OFFSETS ){
-    n += fts3GetVarint32(pReader->pData+n, &i);
+    n = fts3GetVarint32Safe(pReader->pData+nTotal, &i, pReader->nData-nTotal);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    nTotal += n;
     pReader->iStartOffset += i;
-    n += fts3GetVarint32(pReader->pData+n, &i);
+    n = fts3GetVarint32Safe(pReader->pData+nTotal, &i, pReader->nData-nTotal);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    nTotal += n;
     pReader->iEndOffset = pReader->iStartOffset+i;
   }
-  assert( n<=pReader->nData );
-  pReader->pData += n;
-  pReader->nData -= n;
+  assert( nTotal<=pReader->nData );
+  pReader->pData += nTotal;
+  pReader->nData -= nTotal;
+  return SQLITE_OK;
 }
 
-static void plrInit(PLReader *pReader, DLReader *pDLReader){
+static void plrDestroy(PLReader *pReader){
+  SCRAMBLE(pReader);
+}
+static int plrInit(PLReader *pReader, DLReader *pDLReader){
+  int rc;
   pReader->pData = dlrPosData(pDLReader);
   pReader->nData = dlrPosDataLen(pDLReader);
   pReader->iType = pDLReader->iType;
   pReader->iColumn = 0;
   pReader->iPosition = 0;
   pReader->iStartOffset = 0;
   pReader->iEndOffset = 0;
-  plrStep(pReader);
-}
-static void plrDestroy(PLReader *pReader){
-  SCRAMBLE(pReader);
+  rc = plrStep(pReader);
+  if( rc!=SQLITE_OK ) plrDestroy(pReader);
+  return rc;
 }
 
 /*******************************************************************/
 /* PLWriter is used in constructing a document's position list.  As a
 ** convenience, if iType is DL_DOCIDS, PLWriter becomes a no-op.
 ** PLWriter writes to the associated DLWriter's buffer.
 **
 ** plwInit - init for writing a document's poslist.
 ** plwDestroy - clear a writer.
 ** plwAdd - append position and offset information.
@@ skipping 165 matching lines @@
 /* Copy the doclist data of iType in pData/nData into *out, trimming
 ** unnecessary data as we go.  Only columns matching iColumn are
 ** copied, all columns copied if iColumn is -1.  Elements with no
 ** matching columns are dropped.  The output is an iOutType doclist.
 */
 /* NOTE(shess) This code is only valid after all doclists are merged.
 ** If this is run before merges, then doclist items which represent
 ** deletion will be trimmed, and will thus not effect a deletion
 ** during the merge.
 */
-static void docListTrim(DocListType iType, const char *pData, int nData,
-                        int iColumn, DocListType iOutType, DataBuffer *out){
+static int docListTrim(DocListType iType, const char *pData, int nData,
+                       int iColumn, DocListType iOutType, DataBuffer *out){
   DLReader dlReader;
   DLWriter dlWriter;
+  int rc;
 
   assert( iOutType<=iType );
 
-  dlrInit(&dlReader, iType, pData, nData);
+  rc = dlrInit(&dlReader, iType, pData, nData);
+  if( rc!=SQLITE_OK ) return rc;
   dlwInit(&dlWriter, iOutType, out);
 
   while( !dlrAtEnd(&dlReader) ){
     PLReader plReader;
     PLWriter plWriter;
     int match = 0;
 
-    plrInit(&plReader, &dlReader);
+    rc = plrInit(&plReader, &dlReader);
+    if( rc!=SQLITE_OK ) break;
 
     while( !plrAtEnd(&plReader) ){
       if( iColumn==-1 || plrColumn(&plReader)==iColumn ){
         if( !match ){
           plwInit(&plWriter, &dlWriter, dlrDocid(&dlReader));
           match = 1;
         }
         plwAdd(&plWriter, plrColumn(&plReader), plrPosition(&plReader),
                plrStartOffset(&plReader), plrEndOffset(&plReader));
       }
-      plrStep(&plReader);
+      rc = plrStep(&plReader);
+      if( rc!=SQLITE_OK ){
+        plrDestroy(&plReader);
+        goto err;
+      }
     }
     if( match ){
       plwTerminate(&plWriter);
       plwDestroy(&plWriter);
     }
 
     plrDestroy(&plReader);
-    dlrStep(&dlReader);
+    rc = dlrStep(&dlReader);
+    if( rc!=SQLITE_OK ) break;
   }
+err:
   dlwDestroy(&dlWriter);
   dlrDestroy(&dlReader);
+  return rc;
 }
 
 /* Used by docListMerge() to keep doclists in the ascending order by
 ** docid, then ascending order by age (so the newest comes first).
 */
 typedef struct OrderedDLReader {
   DLReader *pReader;
 
   /* TODO(shess) If we assume that docListMerge pReaders is ordered by
   ** age (which we do), then we could use pReader comparisons to break
@@ skipping 36 matching lines @@
 }
 
 /* Given an array of doclist readers, merge their doclist elements
 ** into out in sorted order (by docid), dropping elements from older
 ** readers when there is a duplicate docid.  pReaders is assumed to be
 ** ordered by age, oldest first.
 */
 /* TODO(shess) nReaders must be <= MERGE_COUNT.  This should probably
 ** be fixed.
 */
-static void docListMerge(DataBuffer *out,
-                         DLReader *pReaders, int nReaders){
+static int docListMerge(DataBuffer *out,
+                        DLReader *pReaders, int nReaders){
   OrderedDLReader readers[MERGE_COUNT];
   DLWriter writer;
   int i, n;
   const char *pStart = 0;
   int nStart = 0;
   sqlite_int64 iFirstDocid = 0, iLastDocid = 0;
+  int rc = SQLITE_OK;
 
   assert( nReaders>0 );
   if( nReaders==1 ){
     dataBufferAppend(out, dlrDocData(pReaders), dlrAllDataBytes(pReaders));
-    return;
+    return SQLITE_OK;
   }
 
   assert( nReaders<=MERGE_COUNT );
   n = 0;
   for(i=0; i<nReaders; i++){
     assert( pReaders[i].iType==pReaders[0].iType );
     readers[i].pReader = pReaders+i;
     readers[i].idx = i;
     n += dlrAllDataBytes(&pReaders[i]);
   }
@@ skipping 12 matching lines @@
     sqlite_int64 iDocid = dlrDocid(readers[0].pReader);
 
     /* If this is a continuation of the current buffer to copy, extend
     ** that buffer.  memcpy() seems to be more efficient if it has a
     ** lots of data to copy.
     */
     if( dlrDocData(readers[0].pReader)==pStart+nStart ){
       nStart += dlrDocDataBytes(readers[0].pReader);
     }else{
       if( pStart!=0 ){
-        dlwAppend(&writer, pStart, nStart, iFirstDocid, iLastDocid);
+        rc = dlwAppend(&writer, pStart, nStart, iFirstDocid, iLastDocid);
+        if( rc!=SQLITE_OK ) goto err;
       }
       pStart = dlrDocData(readers[0].pReader);
       nStart = dlrDocDataBytes(readers[0].pReader);
       iFirstDocid = iDocid;
     }
     iLastDocid = iDocid;
-    dlrStep(readers[0].pReader);
+    rc = dlrStep(readers[0].pReader);
+    if( rc!= SQLITE_OK ) goto err;
 
     /* Drop all of the older elements with the same docid. */
     for(i=1; i<nReaders &&
              !dlrAtEnd(readers[i].pReader) &&
              dlrDocid(readers[i].pReader)==iDocid; i++){
-      dlrStep(readers[i].pReader);
+      rc = dlrStep(readers[i].pReader);
+      if( rc!=SQLITE_OK ) goto err;
     }
 
     /* Get the readers back into order. */
     while( i-->0 ){
       orderedDLReaderReorder(readers+i, nReaders-i);
     }
   }
 
   /* Copy over any remaining elements. */
-  if( nStart>0 ) dlwAppend(&writer, pStart, nStart, iFirstDocid, iLastDocid);
+  if( nStart>0 ) rc = dlwAppend(&writer, pStart, nStart, iFirstDocid, iLastDocid);
+err:
   dlwDestroy(&writer);
+  return rc;
 }
 
 /* Helper function for posListUnion().  Compares the current position
 ** between left and right, returning as standard C idiom of <0 if
 ** left<right, >0 if left>right, and 0 if left==right.  "End" always
 ** compares greater.
 */
 static int posListCmp(PLReader *pLeft, PLReader *pRight){
   assert( pLeft->iType==pRight->iType );
   if( pLeft->iType==DL_DOCIDS ) return 0;
@@ skipping 15 matching lines @@
   if( plrEndOffset(pLeft)>plrEndOffset(pRight) ) return 1;
 
   return 0;
 }
 
 /* Write the union of position lists in pLeft and pRight to pOut.
 ** "Union" in this case meaning "All unique position tuples".  Should
 ** work with any doclist type, though both inputs and the output
 ** should be the same type.
 */
-static void posListUnion(DLReader *pLeft, DLReader *pRight, DLWriter *pOut){
+static int posListUnion(DLReader *pLeft, DLReader *pRight, DLWriter *pOut){
   PLReader left, right;
   PLWriter writer;
+  int rc;
 
   assert( dlrDocid(pLeft)==dlrDocid(pRight) );
   assert( pLeft->iType==pRight->iType );
   assert( pLeft->iType==pOut->iType );
 
-  plrInit(&left, pLeft);
-  plrInit(&right, pRight);
+  rc = plrInit(&left, pLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = plrInit(&right, pRight);
+  if( rc!=SQLITE_OK ){
+    plrDestroy(&left);
+    return rc;
+  }
   plwInit(&writer, pOut, dlrDocid(pLeft));
 
   while( !plrAtEnd(&left) || !plrAtEnd(&right) ){
     int c = posListCmp(&left, &right);
     if( c<0 ){
       plwCopy(&writer, &left);
-      plrStep(&left);
+      rc = plrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( c>0 ){
       plwCopy(&writer, &right);
-      plrStep(&right);
+      rc = plrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else{
       plwCopy(&writer, &left);
-      plrStep(&left);
-      plrStep(&right);
+      rc = plrStep(&left);
+      if( rc!=SQLITE_OK ) break;
+      rc = plrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }
   }
 
   plwTerminate(&writer);
   plwDestroy(&writer);
   plrDestroy(&left);
   plrDestroy(&right);
+  return rc;
 }
 
 /* Write the union of doclists in pLeft and pRight to pOut.  For
 ** docids in common between the inputs, the union of the position
 ** lists is written.  Inputs and outputs are always type DL_DEFAULT.
 */
-static void docListUnion(
+static int docListUnion(
   const char *pLeft, int nLeft,
   const char *pRight, int nRight,
   DataBuffer *pOut      /* Write the combined doclist here */
 ){
   DLReader left, right;
   DLWriter writer;
+  int rc;
 
   if( nLeft==0 ){
     if( nRight!=0) dataBufferAppend(pOut, pRight, nRight);
-    return;
+    return SQLITE_OK;
   }
   if( nRight==0 ){
     dataBufferAppend(pOut, pLeft, nLeft);
-    return;
+    return SQLITE_OK;
   }
 
-  dlrInit(&left, DL_DEFAULT, pLeft, nLeft);
-  dlrInit(&right, DL_DEFAULT, pRight, nRight);
+  rc = dlrInit(&left, DL_DEFAULT, pLeft, nLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = dlrInit(&right, DL_DEFAULT, pRight, nRight);
+  if( rc!=SQLITE_OK){
+    dlrDestroy(&left);
+    return rc;
+  }
   dlwInit(&writer, DL_DEFAULT, pOut);
 
   while( !dlrAtEnd(&left) || !dlrAtEnd(&right) ){
     if( dlrAtEnd(&right) ){
-      dlwCopy(&writer, &left);
-      dlrStep(&left);
+      rc = dlwCopy(&writer, &left);
+      if( rc!=SQLITE_OK) break;
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK) break;
     }else if( dlrAtEnd(&left) ){
-      dlwCopy(&writer, &right);
-      dlrStep(&right);
+      rc = dlwCopy(&writer, &right);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrDocid(&left)<dlrDocid(&right) ){
-      dlwCopy(&writer, &left);
-      dlrStep(&left);
+      rc = dlwCopy(&writer, &left);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrDocid(&left)>dlrDocid(&right) ){
-      dlwCopy(&writer, &right);
-      dlrStep(&right);
+      rc = dlwCopy(&writer, &right);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else{
-      posListUnion(&left, &right, &writer);
-      dlrStep(&left);
-      dlrStep(&right);
+      rc = posListUnion(&left, &right, &writer);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }
   }
 
   dlrDestroy(&left);
   dlrDestroy(&right);
   dlwDestroy(&writer);
+  return rc;
 }
 
 /* 
 ** This function is used as part of the implementation of phrase and
 ** NEAR matching.
 **
 ** pLeft and pRight are DLReaders positioned to the same docid in
 ** lists of type DL_POSITION. This function writes an entry to the
 ** DLWriter pOut for each position in pRight that is less than
 ** (nNear+1) greater (but not equal to or smaller) than a position 
 ** in pLeft. For example, if nNear is 0, and the positions contained
 ** by pLeft and pRight are:
 **
 **    pLeft:  5 10 15 20
 **    pRight: 6  9 17 21
 **
 ** then the docid is added to pOut. If pOut is of type DL_POSITIONS,
 ** then a positionids "6" and "21" are also added to pOut.
 **
 ** If boolean argument isSaveLeft is true, then positionids are copied
 ** from pLeft instead of pRight. In the example above, the positions "5"
 ** and "20" would be added instead of "6" and "21".
 */
-static void posListPhraseMerge(
+static int posListPhraseMerge(
   DLReader *pLeft, 
   DLReader *pRight,
   int nNear,
   int isSaveLeft,
   DLWriter *pOut
 ){
   PLReader left, right;
   PLWriter writer;
   int match = 0;
+  int rc;
 
   assert( dlrDocid(pLeft)==dlrDocid(pRight) );
   assert( pOut->iType!=DL_POSITIONS_OFFSETS );
 
-  plrInit(&left, pLeft);
-  plrInit(&right, pRight);
+  rc = plrInit(&left, pLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = plrInit(&right, pRight);
+  if( rc!=SQLITE_OK ){
+    plrDestroy(&left);
+    return rc;
+  }
 
   while( !plrAtEnd(&left) && !plrAtEnd(&right) ){
     if( plrColumn(&left)<plrColumn(&right) ){
-      plrStep(&left);
+      rc = plrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( plrColumn(&left)>plrColumn(&right) ){
-      plrStep(&right);
+      rc = plrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else if( plrPosition(&left)>=plrPosition(&right) ){
-      plrStep(&right);
+      rc = plrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else{
       if( (plrPosition(&right)-plrPosition(&left))<=(nNear+1) ){
         if( !match ){
           plwInit(&writer, pOut, dlrDocid(pLeft));
           match = 1;
         }
         if( !isSaveLeft ){
           plwAdd(&writer, plrColumn(&right), plrPosition(&right), 0, 0);
         }else{
           plwAdd(&writer, plrColumn(&left), plrPosition(&left), 0, 0);
         }
-        plrStep(&right);
+        rc = plrStep(&right);
+        if( rc!=SQLITE_OK ) break;
       }else{
-        plrStep(&left);
+        rc = plrStep(&left);
+        if( rc!=SQLITE_OK ) break;
       }
     }
   }
 
   if( match ){
     plwTerminate(&writer);
     plwDestroy(&writer);
   }
 
   plrDestroy(&left);
   plrDestroy(&right);
+  return rc;
 }
 
 /*
 ** Compare the values pointed to by the PLReaders passed as arguments. 
 ** Return -1 if the value pointed to by pLeft is considered less than
 ** the value pointed to by pRight, +1 if it is considered greater
 ** than it, or 0 if it is equal. i.e.
 **
 **     (*pLeft - *pRight)
 **
@@ skipping 33 matching lines @@
 ** combined. For example:
 **
 **       Query syntax               nPhrase
 **      ------------------------------------
 **       "A B C" NEAR "D E"         5
 **       A NEAR B                   2
 **
 ** iType controls the type of data written to pOut.  If iType is
 ** DL_POSITIONS, the positions are those from pRight.
 */
-static void docListPhraseMerge(
+static int docListPhraseMerge(
   const char *pLeft, int nLeft,
   const char *pRight, int nRight,
   int nNear,            /* 0 for a phrase merge, non-zero for a NEAR merge */
   int nPhrase,          /* Number of tokens in left+right operands to NEAR */
   DocListType iType,    /* Type of doclist to write to pOut */
   DataBuffer *pOut      /* Write the combined doclist here */
 ){
   DLReader left, right;
   DLWriter writer;
+  int rc;
 
-  if( nLeft==0 || nRight==0 ) return;
+  /* These two buffers are used in the 'while', but are declared here
+  ** to simplify error-handling.
+  */
+  DataBuffer one = {0, 0, 0};
+  DataBuffer two = {0, 0, 0};
+
+  if( nLeft==0 || nRight==0 ) return SQLITE_OK;
 
   assert( iType!=DL_POSITIONS_OFFSETS );
 
-  dlrInit(&left, DL_POSITIONS, pLeft, nLeft);
-  dlrInit(&right, DL_POSITIONS, pRight, nRight);
+  rc = dlrInit(&left, DL_POSITIONS, pLeft, nLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = dlrInit(&right, DL_POSITIONS, pRight, nRight);
+  if( rc!=SQLITE_OK ){
+    dlrDestroy(&left);
+    return rc;
+  }
   dlwInit(&writer, iType, pOut);
 
   while( !dlrAtEnd(&left) && !dlrAtEnd(&right) ){
     if( dlrDocid(&left)<dlrDocid(&right) ){
-      dlrStep(&left);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) goto err;
     }else if( dlrDocid(&right)<dlrDocid(&left) ){
-      dlrStep(&right);
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) goto err;
     }else{
       if( nNear==0 ){
-        posListPhraseMerge(&left, &right, 0, 0, &writer);
+        rc = posListPhraseMerge(&left, &right, 0, 0, &writer);
+        if( rc!=SQLITE_OK ) goto err;
       }else{
         /* This case occurs when two terms (simple terms or phrases) are
          * connected by a NEAR operator, span (nNear+1). i.e.
          *
          *     '"terrible company" NEAR widget'
          */
-        DataBuffer one = {0, 0, 0};
-        DataBuffer two = {0, 0, 0};
-
         DLWriter dlwriter2;
-        DLReader dr1 = {0, 0, 0, 0, 0}; 
+        DLReader dr1 = {0, 0, 0, 0, 0};
         DLReader dr2 = {0, 0, 0, 0, 0};
 
         dlwInit(&dlwriter2, iType, &one);
-        posListPhraseMerge(&right, &left, nNear-3+nPhrase, 1, &dlwriter2);
+        rc = posListPhraseMerge(&right, &left, nNear-3+nPhrase, 1, &dlwriter2);
+        if( rc!=SQLITE_OK ) goto err;
         dlwInit(&dlwriter2, iType, &two);
-        posListPhraseMerge(&left, &right, nNear-1, 0, &dlwriter2);
+        rc = posListPhraseMerge(&left, &right, nNear-1, 0, &dlwriter2);
+        if( rc!=SQLITE_OK ) goto err;
 
-        if( one.nData) dlrInit(&dr1, iType, one.pData, one.nData);
-        if( two.nData) dlrInit(&dr2, iType, two.pData, two.nData);
+        if( one.nData){
+          rc = dlrInit(&dr1, iType, one.pData, one.nData);
+          if( rc!=SQLITE_OK ) goto err;
+        }
+        if( two.nData){
+          rc = dlrInit(&dr2, iType, two.pData, two.nData);
+          if( rc!=SQLITE_OK ) goto err;
+        }
 
         if( !dlrAtEnd(&dr1) || !dlrAtEnd(&dr2) ){
           PLReader pr1 = {0};
           PLReader pr2 = {0};
 
           PLWriter plwriter;
           plwInit(&plwriter, &writer, dlrDocid(dlrAtEnd(&dr1)?&dr2:&dr1));
 
-          if( one.nData ) plrInit(&pr1, &dr1);
-          if( two.nData ) plrInit(&pr2, &dr2);
+          if( one.nData ){
+            rc = plrInit(&pr1, &dr1);
+            if( rc!=SQLITE_OK ) goto err;
+          }
+          if( two.nData ){
+            rc = plrInit(&pr2, &dr2);
+            if( rc!=SQLITE_OK ) goto err;
+          }
           while( !plrAtEnd(&pr1) || !plrAtEnd(&pr2) ){
             int iCompare = plrCompare(&pr1, &pr2);
             switch( iCompare ){
               case -1:
                 plwCopy(&plwriter, &pr1);
-                plrStep(&pr1);
+                rc = plrStep(&pr1);
+                if( rc!=SQLITE_OK ) goto err;
                 break;
               case 1:
                 plwCopy(&plwriter, &pr2);
-                plrStep(&pr2);
+                rc = plrStep(&pr2);
+                if( rc!=SQLITE_OK ) goto err;
                 break;
               case 0:
                 plwCopy(&plwriter, &pr1);
-                plrStep(&pr1);
-                plrStep(&pr2);
+                rc = plrStep(&pr1);
+                if( rc!=SQLITE_OK ) goto err;
+                rc = plrStep(&pr2);
+                if( rc!=SQLITE_OK ) goto err;
                 break;
             }
           }
           plwTerminate(&plwriter);
         }
-        dataBufferDestroy(&one);
-        dataBufferDestroy(&two);
+        dataBufferReset(&one);
+        dataBufferReset(&two);
       }
-      dlrStep(&left);
-      dlrStep(&right);
-    }
-  }
-
-  dlrDestroy(&left);
-  dlrDestroy(&right);
-  dlwDestroy(&writer);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) goto err;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) goto err;
+    }
+  }
+
+err:
+  dataBufferDestroy(&one);
+  dataBufferDestroy(&two);
+  dlrDestroy(&left);
+  dlrDestroy(&right);
+  dlwDestroy(&writer);
+  return rc;
 }
 
 /* We have two DL_DOCIDS doclists:  pLeft and pRight.
 ** Write the intersection of these two doclists into pOut as a
 ** DL_DOCIDS doclist.
 */
-static void docListAndMerge(
+static int docListAndMerge(
   const char *pLeft, int nLeft,
   const char *pRight, int nRight,
   DataBuffer *pOut      /* Write the combined doclist here */
 ){
   DLReader left, right;
   DLWriter writer;
-
-  if( nLeft==0 || nRight==0 ) return;
-
-  dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
-  dlrInit(&right, DL_DOCIDS, pRight, nRight);
+  int rc;
+
+  if( nLeft==0 || nRight==0 ) return SQLITE_OK;
+
+  rc = dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = dlrInit(&right, DL_DOCIDS, pRight, nRight);
+  if( rc!=SQLITE_OK ){
+    dlrDestroy(&left);
+    return rc;
+  }
   dlwInit(&writer, DL_DOCIDS, pOut);
 
   while( !dlrAtEnd(&left) && !dlrAtEnd(&right) ){
     if( dlrDocid(&left)<dlrDocid(&right) ){
-      dlrStep(&left);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrDocid(&right)<dlrDocid(&left) ){
-      dlrStep(&right);
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else{
       dlwAdd(&writer, dlrDocid(&left));
-      dlrStep(&left);
-      dlrStep(&right);
-    }
-  }
-
-  dlrDestroy(&left);
-  dlrDestroy(&right);
-  dlwDestroy(&writer);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
+    }
+  }
+
+  dlrDestroy(&left);
+  dlrDestroy(&right);
+  dlwDestroy(&writer);
+  return rc;
 }
 
 /* We have two DL_DOCIDS doclists:  pLeft and pRight.
 ** Write the union of these two doclists into pOut as a
 ** DL_DOCIDS doclist.
 */
-static void docListOrMerge(
+static int docListOrMerge(
   const char *pLeft, int nLeft,
   const char *pRight, int nRight,
   DataBuffer *pOut      /* Write the combined doclist here */
 ){
   DLReader left, right;
   DLWriter writer;
+  int rc;
 
   if( nLeft==0 ){
     if( nRight!=0 ) dataBufferAppend(pOut, pRight, nRight);
-    return;
+    return SQLITE_OK;
   }
   if( nRight==0 ){
     dataBufferAppend(pOut, pLeft, nLeft);
-    return;
-  }
-
-  dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
-  dlrInit(&right, DL_DOCIDS, pRight, nRight);
+    return SQLITE_OK;
+  }
+
+  rc = dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = dlrInit(&right, DL_DOCIDS, pRight, nRight);
+  if( rc!=SQLITE_OK ){
+    dlrDestroy(&left);
+    return rc;
+  }
   dlwInit(&writer, DL_DOCIDS, pOut);
 
   while( !dlrAtEnd(&left) || !dlrAtEnd(&right) ){
     if( dlrAtEnd(&right) ){
       dlwAdd(&writer, dlrDocid(&left));
-      dlrStep(&left);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrAtEnd(&left) ){
       dlwAdd(&writer, dlrDocid(&right));
-      dlrStep(&right);
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrDocid(&left)<dlrDocid(&right) ){
       dlwAdd(&writer, dlrDocid(&left));
-      dlrStep(&left);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
     }else if( dlrDocid(&right)<dlrDocid(&left) ){
       dlwAdd(&writer, dlrDocid(&right));
-      dlrStep(&right);
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
     }else{
       dlwAdd(&writer, dlrDocid(&left));
-      dlrStep(&left);
-      dlrStep(&right);
-    }
-  }
-
-  dlrDestroy(&left);
-  dlrDestroy(&right);
-  dlwDestroy(&writer);
+      rc = dlrStep(&left);
+      if( rc!=SQLITE_OK ) break;
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) break;
+    }
+  }
+
+  dlrDestroy(&left);
+  dlrDestroy(&right);
+  dlwDestroy(&writer);
+  return rc;
 }
 
 /* We have two DL_DOCIDS doclists:  pLeft and pRight.
 ** Write into pOut as DL_DOCIDS doclist containing all documents that
 ** occur in pLeft but not in pRight.
 */
-static void docListExceptMerge(
+static int docListExceptMerge(
   const char *pLeft, int nLeft,
   const char *pRight, int nRight,
   DataBuffer *pOut      /* Write the combined doclist here */
 ){
   DLReader left, right;
   DLWriter writer;
-
-  if( nLeft==0 ) return;
+  int rc;
+
+  if( nLeft==0 ) return SQLITE_OK;
   if( nRight==0 ){
     dataBufferAppend(pOut, pLeft, nLeft);
-    return;
-  }
-
-  dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
-  dlrInit(&right, DL_DOCIDS, pRight, nRight);
+    return SQLITE_OK;
+  }
+
+  rc = dlrInit(&left, DL_DOCIDS, pLeft, nLeft);
+  if( rc!=SQLITE_OK ) return rc;
+  rc = dlrInit(&right, DL_DOCIDS, pRight, nRight);
+  if( rc!=SQLITE_OK ){
+    dlrDestroy(&left);
+    return rc;
+  }
   dlwInit(&writer, DL_DOCIDS, pOut);
 
   while( !dlrAtEnd(&left) ){
     while( !dlrAtEnd(&right) && dlrDocid(&right)<dlrDocid(&left) ){
-      dlrStep(&right);
+      rc = dlrStep(&right);
+      if( rc!=SQLITE_OK ) goto err;
     }
     if( dlrAtEnd(&right) || dlrDocid(&left)<dlrDocid(&right) ){
       dlwAdd(&writer, dlrDocid(&left));
     }
-    dlrStep(&left);
-  }
-
-  dlrDestroy(&left);
-  dlrDestroy(&right);
-  dlwDestroy(&writer);
+    rc = dlrStep(&left);
+    if( rc!=SQLITE_OK ) break;
+  }
+
+err:
+  dlrDestroy(&left);
+  dlrDestroy(&right);
+  dlwDestroy(&writer);
+  return rc;
 }
 
 static char *string_dup_n(const char *s, int n){
   char *str = sqlite3_malloc(n + 1);
   memcpy(str, s, n);
   str[n] = '\0';
   return str;
 }
 
 /* Duplicate a string; the caller must free() the returned string.
@@ skipping 132 matching lines @@
 
   /* BLOCK_INSERT */
   "insert into %_segments (blockid, block) values (null, ?)",
   /* BLOCK_SELECT */ "select block from %_segments where blockid = ?",
   /* BLOCK_DELETE */ "delete from %_segments where blockid between ? and ?",
   /* BLOCK_DELETE_ALL */ "delete from %_segments",
 
   /* SEGDIR_MAX_INDEX */ "select max(idx) from %_segdir where level = ?",
   /* SEGDIR_SET */ "insert into %_segdir values (?, ?, ?, ?, ?, ?)",
   /* SEGDIR_SELECT_LEVEL */
-  "select start_block, leaves_end_block, root from %_segdir "
+  "select start_block, leaves_end_block, root, idx from %_segdir "
   " where level = ? order by idx",
   /* SEGDIR_SPAN */
   "select min(start_block), max(end_block) from %_segdir "
   " where level = ? and start_block <> 0",
   /* SEGDIR_DELETE */ "delete from %_segdir where level = ?",
 
   /* NOTE(shess): The first three results of the following two
   ** statements must match.
   */
   /* SEGDIR_SELECT_SEGMENT */
@@ skipping 1801 matching lines @@
     }
   } else {  /* full-text query */
     rc = sqlite3_reset(c->pStmt);
     if( rc!=SQLITE_OK ) return rc;
 
     if( c->result.nData==0 || dlrAtEnd(&c->reader) ){
       c->eof = 1;
       return SQLITE_OK;
     }
     rc = sqlite3_bind_int64(c->pStmt, 1, dlrDocid(&c->reader));
-    dlrStep(&c->reader);
+    if( rc!=SQLITE_OK ) return rc;
+    rc = dlrStep(&c->reader);
     if( rc!=SQLITE_OK ) return rc;
     /* TODO(shess) Handle SQLITE_SCHEMA AND SQLITE_BUSY. */
     rc = sqlite3_step(c->pStmt);
     if( rc==SQLITE_ROW ){   /* the case we expect */
       c->eof = 0;
       return SQLITE_OK;
     }
-    /* an error occurred; abort */
-    return rc==SQLITE_DONE ? SQLITE_ERROR : rc;
+    /* Corrupt if the index refers to missing document. */
+    if( rc==SQLITE_DONE ) return SQLITE_CORRUPT_BKPT;
+
+    return rc;
   }
 }
 
 
 /* TODO(shess) If we pushed LeafReader to the top of the file, or to
 ** another file, term_select() could be pushed above
 ** docListOfTerm().
 */
 static int termSelect(fulltext_vtab *v, int iColumn,
                       const char *pTerm, int nTerm, int isPrefix,
@@ skipping 29 matching lines @@
     rc = termSelect(pTab, iCol, p->z, p->n, p->isPrefix, eType, &tmp);
     if( rc==SQLITE_OK ){
       if( ii==0 ){
         *pResult = tmp;
       }else{
         DataBuffer res = *pResult;
         dataBufferInit(pResult, 0);
         if( ii==(pPhrase->nToken-1) ){
           eType = eListType;
         }
-        docListPhraseMerge(
+        rc = docListPhraseMerge(
           res.pData, res.nData, tmp.pData, tmp.nData, 0, 0, eType, pResult
         );
         dataBufferDestroy(&res);
         dataBufferDestroy(&tmp);
+        if( rc!= SQLITE_OK ) return rc;
       }
     }
   }
 
   return rc;
 }
 
 /*
 ** Evaluate the full-text expression pExpr against fts3 table pTab. Write
 ** the results into pRes.
@@ skipping 34 matching lines @@
             if( pExpr->pParent && pExpr->pParent->eType==FTSQUERY_NEAR ){
               eType = DL_POSITIONS;
             }
             pLeft = pExpr->pLeft;
             while( pLeft->eType==FTSQUERY_NEAR ){ 
               pLeft=pLeft->pRight;
             }
             assert( pExpr->pRight->eType==FTSQUERY_PHRASE );
             assert( pLeft->eType==FTSQUERY_PHRASE );
             nToken = pLeft->pPhrase->nToken + pExpr->pRight->pPhrase->nToken;
-            docListPhraseMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, 
+            rc = docListPhraseMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, 
                 pExpr->nNear+1, nToken, eType, pRes
             );
             break;
           }
           case FTSQUERY_NOT: {
-            docListExceptMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData,pRes);
+            rc = docListExceptMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData,pRes);
             break;
           }
           case FTSQUERY_AND: {
-            docListAndMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, pRes);
+            rc = docListAndMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, pRes);
             break;
           }
           case FTSQUERY_OR: {
-            docListOrMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, pRes);
+            rc = docListOrMerge(lhs.pData, lhs.nData, rhs.pData, rhs.nData, pRes);
             break;
           }
         }
       }
       dataBufferDestroy(&lhs);
       dataBufferDestroy(&rhs);
     }
   }
 
   return rc;
@@ skipping 636 matching lines @@
   DataBuffer term;          /* previous term, for decoding term delta. */
 
   sqlite_int64 iBlockid;
 } InteriorReader;
 
 static void interiorReaderDestroy(InteriorReader *pReader){
   dataBufferDestroy(&pReader->term);
   SCRAMBLE(pReader);
 }
 
-/* TODO(shess) The assertions are great, but what if we're in NDEBUG
-** and the blob is empty or otherwise contains suspect data?
-*/
-static void interiorReaderInit(const char *pData, int nData,
-                               InteriorReader *pReader){
+static int interiorReaderInit(const char *pData, int nData,
+                              InteriorReader *pReader){
   int n, nTerm;
 
-  /* Require at least the leading flag byte */
+  /* These conditions are checked and met by the callers. */
   assert( nData>0 );
   assert( pData[0]!='\0' );
 
   CLEAR(pReader);
 
   /* Decode the base blockid, and set the cursor to the first term. */
-  n = fts3GetVarint(pData+1, &pReader->iBlockid);
-  assert( 1+n<=nData );
+  n = fts3GetVarintSafe(pData+1, &pReader->iBlockid, nData-1);
+  if( !n ) return SQLITE_CORRUPT_BKPT;
   pReader->pData = pData+1+n;
   pReader->nData = nData-(1+n);
 
   /* A single-child interior node (such as when a leaf node was too
   ** large for the segment directory) won't have any terms.
   ** Otherwise, decode the first term.
   */
   if( pReader->nData==0 ){
     dataBufferInit(&pReader->term, 0);
   }else{
-    n = fts3GetVarint32(pReader->pData, &nTerm);
+    n = fts3GetVarint32Safe(pReader->pData, &nTerm, pReader->nData);
+    if( !n || nTerm<0 || nTerm>pReader->nData-n) return SQLITE_CORRUPT_BKPT;
     dataBufferInit(&pReader->term, nTerm);
     dataBufferReplace(&pReader->term, pReader->pData+n, nTerm);
-    assert( n+nTerm<=pReader->nData );
     pReader->pData += n+nTerm;
     pReader->nData -= n+nTerm;
   }
+  return SQLITE_OK;
 }
 
 static int interiorReaderAtEnd(InteriorReader *pReader){
-  return pReader->term.nData==0;
+  return pReader->term.nData<=0;
 }
 
 static sqlite_int64 interiorReaderCurrentBlockid(InteriorReader *pReader){
   return pReader->iBlockid;
 }
 
 static int interiorReaderTermBytes(InteriorReader *pReader){
   assert( !interiorReaderAtEnd(pReader) );
   return pReader->term.nData;
 }
 static const char *interiorReaderTerm(InteriorReader *pReader){
   assert( !interiorReaderAtEnd(pReader) );
   return pReader->term.pData;
 }
 
 /* Step forward to the next term in the node. */
-static void interiorReaderStep(InteriorReader *pReader){
+static int interiorReaderStep(InteriorReader *pReader){
   assert( !interiorReaderAtEnd(pReader) );
 
   /* If the last term has been read, signal eof, else construct the
   ** next term.
   */
   if( pReader->nData==0 ){
     dataBufferReset(&pReader->term);
   }else{
     int n, nPrefix, nSuffix;
 
-    n = fts3GetVarint32(pReader->pData, &nPrefix);
-    n += fts3GetVarint32(pReader->pData+n, &nSuffix);
+    n = fts3GetVarint32Safe(pReader->pData, &nPrefix, pReader->nData);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    pReader->nData -= n;
+    pReader->pData += n;
+    n += fts3GetVarint32Safe(pReader->pData, &nSuffix, pReader->nData);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    pReader->nData -= n;
+    pReader->pData += n;
+    if( nSuffix<0 || nSuffix>pReader->nData ) return SQLITE_CORRUPT_BKPT;
+    if( nPrefix<0 || nPrefix>pReader->term.nData ) return SQLITE_CORRUPT_BKPT;
 
     /* Truncate the current term and append suffix data. */
     pReader->term.nData = nPrefix;
-    dataBufferAppend(&pReader->term, pReader->pData+n, nSuffix);
+    dataBufferAppend(&pReader->term, pReader->pData, nSuffix);
 
-    assert( n+nSuffix<=pReader->nData );
-    pReader->pData += n+nSuffix;
-    pReader->nData -= n+nSuffix;
+    pReader->pData += nSuffix;
+    pReader->nData -= nSuffix;
   }
   pReader->iBlockid++;
+  return SQLITE_OK;
 }
 
 /* Compare the current term to pTerm[nTerm], returning strcmp-style
 ** results.  If isPrefix, equality means equal through nTerm bytes.
 */
 static int interiorReaderTermCmp(InteriorReader *pReader,
                                  const char *pTerm, int nTerm, int isPrefix){
   const char *pReaderTerm = interiorReaderTerm(pReader);
   int nReaderTerm = interiorReaderTermBytes(pReader);
   int c, n = nReaderTerm<nTerm ? nReaderTerm : nTerm;
@@ skipping 351 matching lines @@
 
   /* Estimate the length of the merged doclist so we can leave space
   ** to encode it.
   */
   for(i=0, nData=0; i<nReaders; i++){
     nData += dlrAllDataBytes(&pReaders[i]);
   }
   n = fts3PutVarint(c, nData);
   dataBufferAppend(&pWriter->data, c, n);
 
-  docListMerge(&pWriter->data, pReaders, nReaders);
+  rc = docListMerge(&pWriter->data, pReaders, nReaders);
+  if( rc!=SQLITE_OK ) return rc;
   ASSERT_VALID_DOCLIST(DL_DEFAULT,
                        pWriter->data.pData+iDoclistData+n,
                        pWriter->data.nData-iDoclistData-n, NULL);
 
   /* The actual amount of doclist data at this point could be smaller
   ** than the length we encoded.  Additionally, the space required to
   ** encode this length could be smaller.  For small doclists, this is
   ** not a big deal, we can just use memmove() to adjust things.
   */
   nActualData = pWriter->data.nData-(iDoclistData+n);
@@ skipping 89 matching lines @@
 */
 /* TODO(shess) Revise writeZeroSegment() so that doclists are
 ** constructed directly in pWriter->data.
 */
 static int leafWriterStep(fulltext_vtab *v, LeafWriter *pWriter,
                           const char *pTerm, int nTerm,
                           const char *pData, int nData){
   int rc;
   DLReader reader;
 
-  dlrInit(&reader, DL_DEFAULT, pData, nData);
+  rc = dlrInit(&reader, DL_DEFAULT, pData, nData);
+  if( rc!=SQLITE_OK ) return rc;
   rc = leafWriterStepMerge(v, pWriter, pTerm, nTerm, &reader, 1);
   dlrDestroy(&reader);
 
   return rc;
 }
 
 
 /****************************************************************/
 /* LeafReader is used to iterate over an individual leaf node. */
 typedef struct LeafReader {
@@ skipping 24 matching lines @@
 /* Access the doclist data for the current term. */
 static int leafReaderDataBytes(LeafReader *pReader){
   int nData;
   assert( pReader->term.nData>0 );
   fts3GetVarint32(pReader->pData, &nData);
   return nData;
 }
 static const char *leafReaderData(LeafReader *pReader){
   int n, nData;
   assert( pReader->term.nData>0 );
-  n = fts3GetVarint32(pReader->pData, &nData);
+  n = fts3GetVarint32Safe(pReader->pData, &nData, pReader->nData);
+  if( !n || nData>pReader->nData-n ) return NULL;
   return pReader->pData+n;
 }
 
-static void leafReaderInit(const char *pData, int nData,
-                           LeafReader *pReader){
+static int leafReaderInit(const char *pData, int nData,
+                          LeafReader *pReader){
   int nTerm, n;
 
+  /* All callers check this precondition. */
   assert( nData>0 );
   assert( pData[0]=='\0' );
 
   CLEAR(pReader);
 
   /* Read the first term, skipping the header byte. */
-  n = fts3GetVarint32(pData+1, &nTerm);
+  n = fts3GetVarint32Safe(pData+1, &nTerm, nData-1);
+  if( !n || nTerm<0 || nTerm>nData-1-n ) return SQLITE_CORRUPT_BKPT;
   dataBufferInit(&pReader->term, nTerm);
   dataBufferReplace(&pReader->term, pData+1+n, nTerm);
 
   /* Position after the first term. */
-  assert( 1+n+nTerm<nData );
   pReader->pData = pData+1+n+nTerm;
   pReader->nData = nData-1-n-nTerm;
+  return SQLITE_OK;
 }
 
 /* Step the reader forward to the next term. */
-static void leafReaderStep(LeafReader *pReader){
+static int leafReaderStep(LeafReader *pReader){
   int n, nData, nPrefix, nSuffix;
   assert( !leafReaderAtEnd(pReader) );
 
   /* Skip previous entry's data block. */
-  n = fts3GetVarint32(pReader->pData, &nData);
-  assert( n+nData<=pReader->nData );
+  n = fts3GetVarint32Safe(pReader->pData, &nData, pReader->nData);
+  if( !n || nData<0 || nData>pReader->nData-n ) return SQLITE_CORRUPT_BKPT;
   pReader->pData += n+nData;
   pReader->nData -= n+nData;
 
   if( !leafReaderAtEnd(pReader) ){
     /* Construct the new term using a prefix from the old term plus a
     ** suffix from the leaf data.
     */
-    n = fts3GetVarint32(pReader->pData, &nPrefix);
-    n += fts3GetVarint32(pReader->pData+n, &nSuffix);
-    assert( n+nSuffix<pReader->nData );
+    n = fts3GetVarint32Safe(pReader->pData, &nPrefix, pReader->nData);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    pReader->nData -= n;
+    pReader->pData += n;
+    n = fts3GetVarint32Safe(pReader->pData, &nSuffix, pReader->nData);
+    if( !n ) return SQLITE_CORRUPT_BKPT;
+    pReader->nData -= n;
+    pReader->pData += n;
+    if( nSuffix<0 || nSuffix>pReader->nData ) return SQLITE_CORRUPT_BKPT;
+    if( nPrefix<0 || nPrefix>pReader->term.nData ) return SQLITE_CORRUPT_BKPT;
     pReader->term.nData = nPrefix;
-    dataBufferAppend(&pReader->term, pReader->pData+n, nSuffix);
+    dataBufferAppend(&pReader->term, pReader->pData, nSuffix);
 
-    pReader->pData += n+nSuffix;
-    pReader->nData -= n+nSuffix;
+    pReader->pData += nSuffix;
+    pReader->nData -= nSuffix;
   }
+  return SQLITE_OK;
 }
 
 /* strcmp-style comparison of pReader's current term against pTerm.
 ** If isPrefix, equality means equal through nTerm bytes.
 */
 static int leafReaderTermCmp(LeafReader *pReader,
                              const char *pTerm, int nTerm, int isPrefix){
   int c, n = pReader->term.nData<nTerm ? pReader->term.nData : nTerm;
   if( n==0 ){
     if( pReader->term.nData>0 ) return -1;
@@ skipping 83 matching lines @@
                             int idx,
                             sqlite_int64 iStartBlockid,
                             sqlite_int64 iEndBlockid,
                             const char *pRootData, int nRootData,
                             LeavesReader *pReader){
   CLEAR(pReader);
   pReader->idx = idx;
 
   dataBufferInit(&pReader->rootData, 0);
   if( iStartBlockid==0 ){
+    int rc;
+    /* Corrupt if this can't be a leaf node. */
+    if( pRootData==NULL || nRootData<1 || pRootData[0]!='\0' ){
+      return SQLITE_CORRUPT_BKPT;
+    }
     /* Entire leaf level fit in root data. */
     dataBufferReplace(&pReader->rootData, pRootData, nRootData);
-    leafReaderInit(pReader->rootData.pData, pReader->rootData.nData,
-                   &pReader->leafReader);
+    rc = leafReaderInit(pReader->rootData.pData, pReader->rootData.nData,
+                        &pReader->leafReader);
+    if( rc!=SQLITE_OK ){
+      dataBufferDestroy(&pReader->rootData);
+      return rc;
+    }
   }else{
     sqlite3_stmt *s;
     int rc = sql_get_leaf_statement(v, idx, &s);
     if( rc!=SQLITE_OK ) return rc;
 
     rc = sqlite3_bind_int64(s, 1, iStartBlockid);
-    if( rc!=SQLITE_OK ) return rc;
+    if( rc!=SQLITE_OK ) goto err;
 
     rc = sqlite3_bind_int64(s, 2, iEndBlockid);
-    if( rc!=SQLITE_OK ) return rc;
+    if( rc!=SQLITE_OK ) goto err;
 
     rc = sqlite3_step(s);
+
+    /* Corrupt if interior node referenced missing leaf node. */
     if( rc==SQLITE_DONE ){
-      pReader->eof = 1;
-      return SQLITE_OK;
+      rc = SQLITE_CORRUPT_BKPT;
+      goto err;
     }
-    if( rc!=SQLITE_ROW ) return rc;
 
-    pReader->pStmt = s;
-    leafReaderInit(sqlite3_column_blob(pReader->pStmt, 0),
-                   sqlite3_column_bytes(pReader->pStmt, 0),
-                   &pReader->leafReader);
+    if( rc!=SQLITE_ROW ) goto err;
+    rc = SQLITE_OK;
+
+    /* Corrupt if leaf data isn't a blob. */
+    if( sqlite3_column_type(s, 0)!=SQLITE_BLOB ){
+      rc = SQLITE_CORRUPT_BKPT;
+    }else{
+      const char *pLeafData = sqlite3_column_blob(s, 0);
+      int nLeafData = sqlite3_column_bytes(s, 0);
+
+      /* Corrupt if this can't be a leaf node. */
+      if( pLeafData==NULL || nLeafData<1 || pLeafData[0]!='\0' ){
+        rc = SQLITE_CORRUPT_BKPT;
+      }else{
+        rc = leafReaderInit(pLeafData, nLeafData, &pReader->leafReader);
+      }
+    }
+
+ err:
+    if( rc!=SQLITE_OK ){
+      if( idx==-1 ){
+        sqlite3_finalize(s);
+      }else{
+        sqlite3_reset(s);
+      }
+      return rc;
+    }
   }
   return SQLITE_OK;
 }
 
 /* Step the current leaf forward to the next term.  If we reach the
 ** end of the current leaf, step forward to the next leaf block.
 */
 static int leavesReaderStep(fulltext_vtab *v, LeavesReader *pReader){
+  int rc;
   assert( !leavesReaderAtEnd(pReader) );
-  leafReaderStep(&pReader->leafReader);
+  rc = leafReaderStep(&pReader->leafReader);
+  if( rc!=SQLITE_OK ) return rc;
 
   if( leafReaderAtEnd(&pReader->leafReader) ){
-    int rc;
     if( pReader->rootData.pData ){
       pReader->eof = 1;
       return SQLITE_OK;
     }
     rc = sqlite3_step(pReader->pStmt);
     if( rc!=SQLITE_ROW ){
       pReader->eof = 1;
       return rc==SQLITE_DONE ? SQLITE_OK : rc;
     }
-    leafReaderDestroy(&pReader->leafReader);
-    leafReaderInit(sqlite3_column_blob(pReader->pStmt, 0),
-                   sqlite3_column_bytes(pReader->pStmt, 0),
-                   &pReader->leafReader);
+
+    /* Corrupt if leaf data isn't a blob. */
+    if( sqlite3_column_type(pReader->pStmt, 0)!=SQLITE_BLOB ){
+      return SQLITE_CORRUPT_BKPT;
+    }else{
+      LeafReader tmp;
+      const char *pLeafData = sqlite3_column_blob(pReader->pStmt, 0);
+      int nLeafData = sqlite3_column_bytes(pReader->pStmt, 0);
+
+      /* Corrupt if this can't be a leaf node. */
+      if( pLeafData==NULL || nLeafData<1 || pLeafData[0]!='\0' ){
+        return SQLITE_CORRUPT_BKPT;
+      }
+
+      rc = leafReaderInit(pLeafData, nLeafData, &tmp);
+      if( rc!=SQLITE_OK ) return rc;
+      leafReaderDestroy(&pReader->leafReader);
+      pReader->leafReader = tmp;
+    }
   }
   return SQLITE_OK;
 }
 
 /* Order LeavesReaders by their term, ignoring idx.  Readers at eof
 ** always sort to the end.
 */
 static int leavesReaderTermCmp(LeavesReader *lr1, LeavesReader *lr2){
   if( leavesReaderAtEnd(lr1) ){
     if( leavesReaderAtEnd(lr2) ) return 0;
@@ skipping 40 matching lines @@
 
   rc = sqlite3_bind_int(s, 1, iLevel);
   if( rc!=SQLITE_OK ) return rc;
 
   i = 0;
   while( (rc = sqlite3_step(s))==SQLITE_ROW ){
     sqlite_int64 iStart = sqlite3_column_int64(s, 0);
     sqlite_int64 iEnd = sqlite3_column_int64(s, 1);
     const char *pRootData = sqlite3_column_blob(s, 2);
     int nRootData = sqlite3_column_bytes(s, 2);
+    sqlite_int64 iIndex = sqlite3_column_int64(s, 3);
 
-    assert( i<MERGE_COUNT );
+    /* Corrupt if we get back different types than we stored. */
+    /* Also corrupt if the index is not sequential starting at 0. */
+    if( sqlite3_column_type(s, 0)!=SQLITE_INTEGER ||
+        sqlite3_column_type(s, 1)!=SQLITE_INTEGER ||
+        sqlite3_column_type(s, 2)!=SQLITE_BLOB ||
+        i!=iIndex ||
+        i>=MERGE_COUNT ){
+      rc = SQLITE_CORRUPT_BKPT;
+      break;
+    }
+
     rc = leavesReaderInit(v, i, iStart, iEnd, pRootData, nRootData,
                           &pReaders[i]);
     if( rc!=SQLITE_OK ) break;
 
     i++;
   }
   if( rc!=SQLITE_DONE ){
     while( i-->0 ){
       leavesReaderDestroy(&pReaders[i]);
     }
+    sqlite3_reset(s);  /* So we don't leave a lock. */
     return rc;
   }
 
   *piReaders = i;
 
   /* Leave our results sorted by term, then age. */
   while( i-- ){
     leavesReaderReorder(pReaders+i, *piReaders-i);
   }
   return SQLITE_OK;
 }
 
 /* Merge doclists from pReaders[nReaders] into a single doclist, which
 ** is written to pWriter.  Assumes pReaders is ordered oldest to
 ** newest.
 */
 /* TODO(shess) Consider putting this inline in segmentMerge(). */
 static int leavesReadersMerge(fulltext_vtab *v,
                               LeavesReader *pReaders, int nReaders,
                               LeafWriter *pWriter){
   DLReader dlReaders[MERGE_COUNT];
   const char *pTerm = leavesReaderTerm(pReaders);
   int i, nTerm = leavesReaderTermBytes(pReaders);
+  int rc;
 
   assert( nReaders<=MERGE_COUNT );
 
   for(i=0; i<nReaders; i++){
-    dlrInit(&dlReaders[i], DL_DEFAULT,
-            leavesReaderData(pReaders+i),
-            leavesReaderDataBytes(pReaders+i));
+    const char *pData = leavesReaderData(pReaders+i);
+    if( pData==NULL ){
+      rc = SQLITE_CORRUPT_BKPT;
+      break;
+    }
+    rc = dlrInit(&dlReaders[i], DL_DEFAULT,
+                 pData,
+                 leavesReaderDataBytes(pReaders+i));
+    if( rc!=SQLITE_OK ) break;
+  }
+  if( rc!=SQLITE_OK ){
+    while( i-->0 ){
+      dlrDestroy(&dlReaders[i]);
+    }
+    return rc;
   }
 
   return leafWriterStepMerge(v, pWriter, pTerm, nTerm, dlReaders, nReaders);
 }
 
 /* Forward ref due to mutual recursion with segdirNextIndex(). */
 static int segmentMerge(fulltext_vtab *v, int iLevel);
 
 /* Put the next available index at iLevel into *pidx.  If iLevel
 ** already has MERGE_COUNT segments, they are merged to a higher
@@ skipping 33 matching lines @@
   if( rc!=SQLITE_OK ) return rc;
 
   /* TODO(shess) This assumes that we'll always see exactly
   ** MERGE_COUNT segments to merge at a given level.  That will be
   ** broken if we allow the developer to request preemptive or
   ** deferred merging.
   */
   memset(&lrs, '\0', sizeof(lrs));
   rc = leavesReadersInit(v, iLevel, lrs, &i);
   if( rc!=SQLITE_OK ) return rc;
-  assert( i==MERGE_COUNT );
 
   leafWriterInit(iLevel+1, idx, &writer);
 
+  if( i!=MERGE_COUNT ){
+    rc = SQLITE_CORRUPT_BKPT;
+    goto err;
+  }
+
   /* Since leavesReaderReorder() pushes readers at eof to the end,
   ** when the first reader is empty, all will be empty.
   */
   while( !leavesReaderAtEnd(lrs) ){
     /* Figure out how many readers share their next term. */
     for(i=1; i<MERGE_COUNT && !leavesReaderAtEnd(lrs+i); i++){
       if( 0!=leavesReaderTermCmp(lrs, lrs+i) ) break;
     }
 
     rc = leavesReadersMerge(v, lrs, i, &writer);
@@ skipping 22 matching lines @@
 
  err:
   for(i=0; i<MERGE_COUNT; i++){
     leavesReaderDestroy(&lrs[i]);
   }
   leafWriterDestroy(&writer);
   return rc;
 }
 
 /* Accumulate the union of *acc and *pData into *acc. */
-static void docListAccumulateUnion(DataBuffer *acc,
-                                   const char *pData, int nData) {
+static int docListAccumulateUnion(DataBuffer *acc,
+                                  const char *pData, int nData) {
   DataBuffer tmp = *acc;
+  int rc;
   dataBufferInit(acc, tmp.nData+nData);
-  docListUnion(tmp.pData, tmp.nData, pData, nData, acc);
+  rc = docListUnion(tmp.pData, tmp.nData, pData, nData, acc);
   dataBufferDestroy(&tmp);
+  return rc;
 }
 
 /* TODO(shess) It might be interesting to explore different merge
 ** strategies, here.  For instance, since this is a sorted merge, we
 ** could easily merge many doclists in parallel.  With some
 ** comprehension of the storage format, we could merge all of the
 ** doclists within a leaf node directly from the leaf node's storage.
 ** It may be worthwhile to merge smaller doclists before larger
 ** doclists, since they can be traversed more quickly - but the
 ** results may have less overlap, making them more expensive in a
@@ skipping 21 matching lines @@
   for(rc=SQLITE_OK; rc==SQLITE_OK && !leavesReaderAtEnd(pReader);
       rc=leavesReaderStep(v, pReader)){
     /* TODO(shess) Really want leavesReaderTermCmp(), but that name is
     ** already taken to compare the terms of two LeavesReaders.  Think
     ** on a better name.  [Meanwhile, break encapsulation rather than
     ** use a confusing name.]
     */
     int c = leafReaderTermCmp(&pReader->leafReader, pTerm, nTerm, isPrefix);
     if( c>0 ) break;      /* Past any possible matches. */
     if( c==0 ){
+      int iBuffer, nData;
       const char *pData = leavesReaderData(pReader);
-      int iBuffer, nData = leavesReaderDataBytes(pReader);
+      if( pData==NULL ){
+        rc = SQLITE_CORRUPT_BKPT;
+        break;
+      }
+      nData = leavesReaderDataBytes(pReader);
 
       /* Find the first empty buffer. */
       for(iBuffer=0; iBuffer<nBuffers; ++iBuffer){
         if( 0==pBuffers[iBuffer].nData ) break;
       }
 
       /* Out of buffers, add an empty one. */
       if( iBuffer==nBuffers ){
         if( nBuffers==nMaxBuffers ){
           DataBuffer *p;
@@ skipping 25 matching lines @@
         dataBufferReplace(&(pBuffers[0]), pData, nData);
       }else{
         /* pAcc is the empty buffer the merged data will end up in. */
         DataBuffer *pAcc = &(pBuffers[iBuffer]);
         DataBuffer *p = &(pBuffers[0]);
 
         /* Handle position 0 specially to avoid need to prime pAcc
         ** with pData/nData.
         */
         dataBufferSwap(p, pAcc);
-        docListAccumulateUnion(pAcc, pData, nData);
+        rc = docListAccumulateUnion(pAcc, pData, nData);
+        if( rc!=SQLITE_OK ) goto err;
 
         /* Accumulate remaining doclists into pAcc. */
         for(++p; p<pAcc; ++p){
-          docListAccumulateUnion(pAcc, p->pData, p->nData);
+          rc = docListAccumulateUnion(pAcc, p->pData, p->nData);
+          if( rc!=SQLITE_OK ) goto err;
 
           /* dataBufferReset() could allow a large doclist to blow up
           ** our memory requirements.
           */
           if( p->nCapacity<1024 ){
             dataBufferReset(p);
           }else{
             dataBufferDestroy(p);
             dataBufferInit(p, 0);
           }
         }
       }
     }
   }
 
   /* Union all the doclists together into *out. */
   /* TODO(shess) What if *out is big?  Sigh. */
   if( rc==SQLITE_OK && nBuffers>0 ){
     int iBuffer;
     for(iBuffer=0; iBuffer<nBuffers; ++iBuffer){
       if( pBuffers[iBuffer].nData>0 ){
         if( out->nData==0 ){
           dataBufferSwap(out, &(pBuffers[iBuffer]));
         }else{
-          docListAccumulateUnion(out, pBuffers[iBuffer].pData,
-                                 pBuffers[iBuffer].nData);
+          rc = docListAccumulateUnion(out, pBuffers[iBuffer].pData,
+                                      pBuffers[iBuffer].nData);
+          if( rc!=SQLITE_OK ) break;
         }
       }
     }
   }
 
+err:
   while( nBuffers-- ){
     dataBufferDestroy(&(pBuffers[nBuffers]));
   }
   if( pBuffers!=NULL ) sqlite3_free(pBuffers);
 
   return rc;
 }
 
 /* Call loadSegmentLeavesInt() with pData/nData as input. */
 static int loadSegmentLeaf(fulltext_vtab *v, const char *pData, int nData,
@@ skipping 38 matching lines @@
 ** nodes which could include pTerm/nTerm/isPrefix.  Note that the
 ** interior node terms logically come between the blocks, so there is
 ** one more blockid than there are terms (that block contains terms >=
 ** the last interior-node term).
 */
 /* TODO(shess) The calling code may already know that the end child is
 ** not worth calculating, because the end may be in a later sibling
 ** node.  Consider whether breaking symmetry is worthwhile.  I suspect
 ** it is not worthwhile.
 */
-static void getChildrenContaining(const char *pData, int nData,
-                                  const char *pTerm, int nTerm, int isPrefix,
-                                  sqlite_int64 *piStartChild,
-                                  sqlite_int64 *piEndChild){
+static int getChildrenContaining(const char *pData, int nData,
+                                 const char *pTerm, int nTerm, int isPrefix,
+                                 sqlite_int64 *piStartChild,
+                                 sqlite_int64 *piEndChild){
   InteriorReader reader;
+  int rc;
 
   assert( nData>1 );
   assert( *pData!='\0' );
-  interiorReaderInit(pData, nData, &reader);
+  rc = interiorReaderInit(pData, nData, &reader);
+  if( rc!=SQLITE_OK ) return rc;
 
   /* Scan for the first child which could contain pTerm/nTerm. */
   while( !interiorReaderAtEnd(&reader) ){
     if( interiorReaderTermCmp(&reader, pTerm, nTerm, 0)>0 ) break;
-    interiorReaderStep(&reader);
+    rc = interiorReaderStep(&reader);
+    if( rc!=SQLITE_OK ){
+      interiorReaderDestroy(&reader);
+      return rc;
+    }
   }
   *piStartChild = interiorReaderCurrentBlockid(&reader);
 
   /* Keep scanning to find a term greater than our term, using prefix
   ** comparison if indicated.  If isPrefix is false, this will be the
   ** same blockid as the starting block.
   */
   while( !interiorReaderAtEnd(&reader) ){
     if( interiorReaderTermCmp(&reader, pTerm, nTerm, isPrefix)>0 ) break;
-    interiorReaderStep(&reader);
+    rc = interiorReaderStep(&reader);
+    if( rc!=SQLITE_OK ){
+      interiorReaderDestroy(&reader);
+      return rc;
+    }
   }
   *piEndChild = interiorReaderCurrentBlockid(&reader);
 
   interiorReaderDestroy(&reader);
 
   /* Children must ascend, and if !prefix, both must be the same. */
   assert( *piEndChild>=*piStartChild );
   assert( isPrefix || *piStartChild==*piEndChild );
+  return rc;
 }
 
 /* Read block at iBlockid and pass it with other params to
 ** getChildrenContaining().
 */
 static int loadAndGetChildrenContaining(
   fulltext_vtab *v,
   sqlite_int64 iBlockid,
   const char *pTerm, int nTerm, int isPrefix,
   sqlite_int64 *piStartChild, sqlite_int64 *piEndChild
 ){
   sqlite3_stmt *s = NULL;
   int rc;
 
   assert( iBlockid!=0 );
   assert( pTerm!=NULL );
   assert( nTerm!=0 );        /* TODO(shess) Why not allow this? */
   assert( piStartChild!=NULL );
   assert( piEndChild!=NULL );
 
   rc = sql_get_statement(v, BLOCK_SELECT_STMT, &s);
   if( rc!=SQLITE_OK ) return rc;
 
   rc = sqlite3_bind_int64(s, 1, iBlockid);
   if( rc!=SQLITE_OK ) return rc;
 
   rc = sqlite3_step(s);
-  if( rc==SQLITE_DONE ) return SQLITE_ERROR;
+  /* Corrupt if interior node references missing child node. */
+  if( rc==SQLITE_DONE ) return SQLITE_CORRUPT_BKPT;
   if( rc!=SQLITE_ROW ) return rc;
 
-  getChildrenContaining(sqlite3_column_blob(s, 0), sqlite3_column_bytes(s, 0),
-                        pTerm, nTerm, isPrefix, piStartChild, piEndChild);
+  /* Corrupt if child node isn't a blob. */
+  if( sqlite3_column_type(s, 0)!=SQLITE_BLOB ){
+    sqlite3_reset(s);  /* So we don't leave a lock. */
+    return SQLITE_CORRUPT_BKPT;
+  }else{
+    const char *pData = sqlite3_column_blob(s, 0);
+    int nData = sqlite3_column_bytes(s, 0);
+
+    /* Corrupt if child is not a valid interior node. */
+    if( pData==NULL || nData<1 || pData[0]=='\0' ){
+      sqlite3_reset(s);  /* So we don't leave a lock. */
+      return SQLITE_CORRUPT_BKPT;
+    }
+
+    rc = getChildrenContaining(pData, nData, pTerm, nTerm,
+                               isPrefix, piStartChild, piEndChild);
+    if( rc!=SQLITE_OK ){
+      sqlite3_reset(s);
+      return rc;
+    }
+  }
 
   /* We expect only one row.  We must execute another sqlite3_step()
    * to complete the iteration; otherwise the table will remain
    * locked. */
   rc = sqlite3_step(s);
   if( rc==SQLITE_ROW ) return SQLITE_ERROR;
   if( rc!=SQLITE_DONE ) return rc;
 
   return SQLITE_OK;
 }
 
 /* Traverse the tree represented by pData[nData] looking for
 ** pTerm[nTerm], placing its doclist into *out.  This is internal to
 ** loadSegment() to make error-handling cleaner.
 */
 static int loadSegmentInt(fulltext_vtab *v, const char *pData, int nData,
                           sqlite_int64 iLeavesEnd,
                           const char *pTerm, int nTerm, int isPrefix,
                           DataBuffer *out){
   /* Special case where root is a leaf. */
   if( *pData=='\0' ){
     return loadSegmentLeaf(v, pData, nData, pTerm, nTerm, isPrefix, out);
   }else{
     int rc;
     sqlite_int64 iStartChild, iEndChild;
 
     /* Process pData as an interior node, then loop down the tree
     ** until we find the set of leaf nodes to scan for the term.
     */
-    getChildrenContaining(pData, nData, pTerm, nTerm, isPrefix,
-                          &iStartChild, &iEndChild);
+    rc = getChildrenContaining(pData, nData, pTerm, nTerm, isPrefix,
+                               &iStartChild, &iEndChild);
+    if( rc!=SQLITE_OK ) return rc;
     while( iStartChild>iLeavesEnd ){
       sqlite_int64 iNextStart, iNextEnd;
       rc = loadAndGetChildrenContaining(v, iStartChild, pTerm, nTerm, isPrefix,
                                         &iNextStart, &iNextEnd);
       if( rc!=SQLITE_OK ) return rc;
 
       /* If we've branched, follow the end branch, too. */
       if( iStartChild!=iEndChild ){
         sqlite_int64 iDummy;
         rc = loadAndGetChildrenContaining(v, iEndChild, pTerm, nTerm, isPrefix,
@@ skipping 31 matching lines @@
 ** within a segment, with pairwise merges across segments, or across
 ** all segments at once.
 */
 static int loadSegment(fulltext_vtab *v, const char *pData, int nData,
                        sqlite_int64 iLeavesEnd,
                        const char *pTerm, int nTerm, int isPrefix,
                        DataBuffer *out){
   DataBuffer result;
   int rc;
 
-  assert( nData>1 );
+  /* Corrupt if segment root can't be valid. */
+  if( pData==NULL || nData<1 ) return SQLITE_CORRUPT_BKPT;
 
   /* This code should never be called with buffered updates. */
   assert( v->nPendingData<0 );
 
   dataBufferInit(&result, 0);
   rc = loadSegmentInt(v, pData, nData, iLeavesEnd,
                       pTerm, nTerm, isPrefix, &result);
   if( rc==SQLITE_OK && result.nData>0 ){
     if( out->nData==0 ){
       DataBuffer tmp = *out;
       *out = result;
       result = tmp;
     }else{
       DataBuffer merged;
       DLReader readers[2];
 
-      dlrInit(&readers[0], DL_DEFAULT, out->pData, out->nData);
-      dlrInit(&readers[1], DL_DEFAULT, result.pData, result.nData);
-      dataBufferInit(&merged, out->nData+result.nData);
-      docListMerge(&merged, readers, 2);
-      dataBufferDestroy(out);
-      *out = merged;
-      dlrDestroy(&readers[0]);
-      dlrDestroy(&readers[1]);
+      rc = dlrInit(&readers[0], DL_DEFAULT, out->pData, out->nData);
+      if( rc==SQLITE_OK ){
+        rc = dlrInit(&readers[1], DL_DEFAULT, result.pData, result.nData);
+        if( rc==SQLITE_OK ){
+          dataBufferInit(&merged, out->nData+result.nData);
+          rc = docListMerge(&merged, readers, 2);
+          dataBufferDestroy(out);
+          *out = merged;
+          dlrDestroy(&readers[1]);
+        }
+        dlrDestroy(&readers[0]);
+      }
     }
   }
+
   dataBufferDestroy(&result);
   return rc;
 }
 
 /* Scan the database and merge together the posting lists for the term
 ** into *out.
 */
 static int termSelect(
   fulltext_vtab *v, 
   int iColumn,
@@ skipping 13 matching lines @@
   dataBufferInit(&doclist, 0);
   dataBufferInit(out, 0);
 
   /* Traverse the segments from oldest to newest so that newer doclist
   ** elements for given docids overwrite older elements.
   */
   while( (rc = sqlite3_step(s))==SQLITE_ROW ){
     const char *pData = sqlite3_column_blob(s, 2);
     const int nData = sqlite3_column_bytes(s, 2);
     const sqlite_int64 iLeavesEnd = sqlite3_column_int64(s, 1);
+
+    /* Corrupt if we get back different types than we stored. */
+    if( sqlite3_column_type(s, 1)!=SQLITE_INTEGER ||
+        sqlite3_column_type(s, 2)!=SQLITE_BLOB ){
+      rc = SQLITE_CORRUPT_BKPT;
+      goto err;
+    }
+
     rc = loadSegment(v, pData, nData, iLeavesEnd, pTerm, nTerm, isPrefix,
                      &doclist);
     if( rc!=SQLITE_OK ) goto err;
   }
   if( rc==SQLITE_DONE ){
+    rc = SQLITE_OK;
     if( doclist.nData!=0 ){
       /* TODO(shess) The old term_select_all() code applied the column
       ** restrict as we merged segments, leading to smaller buffers.
       ** This is probably worthwhile to bring back, once the new storage
       ** system is checked in.
       */
       if( iColumn==v->nColumn) iColumn = -1;
-      docListTrim(DL_DEFAULT, doclist.pData, doclist.nData,
-                  iColumn, iType, out);
+      rc = docListTrim(DL_DEFAULT, doclist.pData, doclist.nData,
+                       iColumn, iType, out);
     }
-    rc = SQLITE_OK;
   }
 
  err:
+  sqlite3_reset(s);  /* So we don't leave a lock. */
   dataBufferDestroy(&doclist);
   return rc;
 }
 
 /****************************************************************/
 /* Used to hold hashtable data for sorting. */
 typedef struct TermData {
   const char *pTerm;
   int nTerm;
   DLCollector *pCollector;
@@ skipping 342 matching lines @@
 /* optimize() helper function.  Put the readers in order and iterate
 ** through them, merging doclists for matching terms into pWriter.
 ** Returns SQLITE_OK on success, or the SQLite error code which
 ** prevented success.
 */
 static int optimizeInternal(fulltext_vtab *v,
                             OptLeavesReader *readers, int nReaders,
                             LeafWriter *pWriter){
   int i, rc = SQLITE_OK;
   DataBuffer doclist, merged, tmp;
+  const char *pData;
 
   /* Order the readers. */
   i = nReaders;
   while( i-- > 0 ){
     optLeavesReaderReorder(&readers[i], nReaders-i);
   }
 
   dataBufferInit(&doclist, LEAF_MAX);
   dataBufferInit(&merged, LEAF_MAX);
 
   /* Exhausted readers bubble to the end, so when the first reader is
   ** at eof, all are at eof.
   */
   while( !optLeavesReaderAtEnd(&readers[0]) ){
 
     /* Figure out how many readers share the next term. */
     for(i=1; i<nReaders && !optLeavesReaderAtEnd(&readers[i]); i++){
       if( 0!=optLeavesReaderTermCmp(&readers[0], &readers[i]) ) break;
     }
 
+    pData = optLeavesReaderData(&readers[0]);
+    if( pData==NULL ){
+      rc = SQLITE_CORRUPT_BKPT;
+      break;
+    }
+
     /* Special-case for no merge. */
     if( i==1 ){
       /* Trim deletions from the doclist. */
       dataBufferReset(&merged);
-      docListTrim(DL_DEFAULT,
-                  optLeavesReaderData(&readers[0]),
-                  optLeavesReaderDataBytes(&readers[0]),
-                  -1, DL_DEFAULT, &merged);
+      rc = docListTrim(DL_DEFAULT, pData,
+                       optLeavesReaderDataBytes(&readers[0]),
+                       -1, DL_DEFAULT, &merged);
+      if( rc!=SQLITE_OK ) break;
     }else{
       DLReader dlReaders[MERGE_COUNT];
       int iReader, nReaders;
 
       /* Prime the pipeline with the first reader's doclist.  After
       ** one pass index 0 will reference the accumulated doclist.
       */
-      dlrInit(&dlReaders[0], DL_DEFAULT,
-              optLeavesReaderData(&readers[0]),
-              optLeavesReaderDataBytes(&readers[0]));
+      rc = dlrInit(&dlReaders[0], DL_DEFAULT,
+                   pData,
+                   optLeavesReaderDataBytes(&readers[0]));
+      if( rc!=SQLITE_OK ) break;
       iReader = 1;
 
       assert( iReader<i );  /* Must execute the loop at least once. */
       while( iReader<i ){
         /* Merge 16 inputs per pass. */
         for( nReaders=1; iReader<i && nReaders<MERGE_COUNT;
              iReader++, nReaders++ ){
-          dlrInit(&dlReaders[nReaders], DL_DEFAULT,
-                  optLeavesReaderData(&readers[iReader]),
-                  optLeavesReaderDataBytes(&readers[iReader]));
+          pData = optLeavesReaderData(&readers[iReader]);
+          if( pData==NULL ){
+            rc = SQLITE_CORRUPT_BKPT;
+            break;
+          }
+          rc = dlrInit(&dlReaders[nReaders], DL_DEFAULT, pData,
+                       optLeavesReaderDataBytes(&readers[iReader]));
+          if( rc!=SQLITE_OK ) break;
         }
 
         /* Merge doclists and swap result into accumulator. */
-        dataBufferReset(&merged);
-        docListMerge(&merged, dlReaders, nReaders);
-        tmp = merged;
-        merged = doclist;
-        doclist = tmp;
+        if( rc==SQLITE_OK ){
+          dataBufferReset(&merged);
+          rc = docListMerge(&merged, dlReaders, nReaders);
+          tmp = merged;
+          merged = doclist;
+          doclist = tmp;
+        }
 
         while( nReaders-- > 0 ){
           dlrDestroy(&dlReaders[nReaders]);
         }
 
+        if( rc!=SQLITE_OK ) goto err;
+
         /* Accumulated doclist to reader 0 for next pass. */
-        dlrInit(&dlReaders[0], DL_DEFAULT, doclist.pData, doclist.nData);
+        rc = dlrInit(&dlReaders[0], DL_DEFAULT, doclist.pData, doclist.nData);
+        if( rc!=SQLITE_OK ) goto err;
       }
 
       /* Destroy reader that was left in the pipeline. */
       dlrDestroy(&dlReaders[0]);
 
       /* Trim deletions from the doclist. */
       dataBufferReset(&merged);
-      docListTrim(DL_DEFAULT, doclist.pData, doclist.nData,
-                  -1, DL_DEFAULT, &merged);
+      rc = docListTrim(DL_DEFAULT, doclist.pData, doclist.nData,
+                       -1, DL_DEFAULT, &merged);
+      if( rc!=SQLITE_OK ) goto err;
     }
 
     /* Only pass doclists with hits (skip if all hits deleted). */
     if( merged.nData>0 ){
       rc = leafWriterStep(v, pWriter,
                           optLeavesReaderTerm(&readers[0]),
                           optLeavesReaderTermBytes(&readers[0]),
                           merged.pData, merged.nData);
       if( rc!=SQLITE_OK ) goto err;
     }
@@ skipping 59 matching lines @@
     */
     leafWriterInit(iMaxLevel, 0, &writer);
 
     i = 0;
     while( (rc = sqlite3_step(s))==SQLITE_ROW ){
       sqlite_int64 iStart = sqlite3_column_int64(s, 0);
       sqlite_int64 iEnd = sqlite3_column_int64(s, 1);
       const char *pRootData = sqlite3_column_blob(s, 2);
       int nRootData = sqlite3_column_bytes(s, 2);
 
+      /* Corrupt if we get back different types than we stored. */
+      if( sqlite3_column_type(s, 0)!=SQLITE_INTEGER ||
+          sqlite3_column_type(s, 1)!=SQLITE_INTEGER ||
+          sqlite3_column_type(s, 2)!=SQLITE_BLOB ){
+        rc = SQLITE_CORRUPT_BKPT;
+        break;
+      }
+
       assert( i<nReaders );
       rc = leavesReaderInit(v, -1, iStart, iEnd, pRootData, nRootData,
                             &readers[i].reader);
       if( rc!=SQLITE_OK ) break;
 
       readers[i].segment = i;
       i++;
     }
 
     /* If we managed to successfully read them all, optimize them. */
     if( rc==SQLITE_DONE ){
       assert( i==nReaders );
       rc = optimizeInternal(v, readers, nReaders, &writer);
+    }else{
+      sqlite3_reset(s);  /* So we don't leave a lock. */
     }
 
     while( i-- > 0 ){
       leavesReaderDestroy(&readers[i].reader);
     }
     sqlite3_free(readers);
 
     /* If we've successfully gotten to here, delete the old segments
     ** and flush the interior structure of the new segment.
     */
@@ skipping 43 matching lines @@
 ** iStartBlockid and iEndBlockid, inclusive, or by the contents of
 ** pRootData if iStartBlockid is 0 (in which case the entire segment
 ** fit in a leaf).
 */
 static int collectSegmentTerms(fulltext_vtab *v, sqlite3_stmt *s,
                                fts3Hash *pTerms){
   const sqlite_int64 iStartBlockid = sqlite3_column_int64(s, 0);
   const sqlite_int64 iEndBlockid = sqlite3_column_int64(s, 1);
   const char *pRootData = sqlite3_column_blob(s, 2);
   const int nRootData = sqlite3_column_bytes(s, 2);
+  int rc;
   LeavesReader reader;
-  int rc = leavesReaderInit(v, 0, iStartBlockid, iEndBlockid,
-                            pRootData, nRootData, &reader);
+
+  /* Corrupt if we get back different types than we stored. */
+  if( sqlite3_column_type(s, 0)!=SQLITE_INTEGER ||
+      sqlite3_column_type(s, 1)!=SQLITE_INTEGER ||
+      sqlite3_column_type(s, 2)!=SQLITE_BLOB ){
+    return SQLITE_CORRUPT_BKPT;
+  }
+
+  rc = leavesReaderInit(v, 0, iStartBlockid, iEndBlockid,
+                        pRootData, nRootData, &reader);
   if( rc!=SQLITE_OK ) return rc;
 
   while( rc==SQLITE_OK && !leavesReaderAtEnd(&reader) ){
     const char *pTerm = leavesReaderTerm(&reader);
     const int nTerm = leavesReaderTermBytes(&reader);
     void *oldValue = sqlite3Fts3HashFind(pTerms, pTerm, nTerm);
     void *newValue = (void *)((char *)oldValue+1);
 
     /* From the comment before sqlite3Fts3HashInsert in fts3_hash.c,
     ** the data value passed is returned in case of malloc failure.
@@ skipping 141 matching lines @@
   }
 }
 
 /* Expand the DL_DEFAULT doclist in pData into a text result in
 ** pContext.
 */
 static void createDoclistResult(sqlite3_context *pContext,
                                 const char *pData, int nData){
   DataBuffer dump;
   DLReader dlReader;
+  int rc;
 
   assert( pData!=NULL && nData>0 );
 
+  rc = dlrInit(&dlReader, DL_DEFAULT, pData, nData);
+  if( rc!=SQLITE_OK ) return rc;
   dataBufferInit(&dump, 0);
-  dlrInit(&dlReader, DL_DEFAULT, pData, nData);
-  for( ; !dlrAtEnd(&dlReader); dlrStep(&dlReader) ){
+  for( ; rc==SQLITE_OK && !dlrAtEnd(&dlReader); rc = dlrStep(&dlReader) ){
     char buf[256];
     PLReader plReader;
 
-    plrInit(&plReader, &dlReader);
+    rc = plrInit(&plReader, &dlReader);
+    if( rc!=SQLITE_OK ) break;
     if( DL_DEFAULT==DL_DOCIDS || plrAtEnd(&plReader) ){
       sqlite3_snprintf(sizeof(buf), buf, "[%lld] ", dlrDocid(&dlReader));
       dataBufferAppend(&dump, buf, strlen(buf));
     }else{
       int iColumn = plrColumn(&plReader);
 
       sqlite3_snprintf(sizeof(buf), buf, "[%lld %d[",
                        dlrDocid(&dlReader), iColumn);
       dataBufferAppend(&dump, buf, strlen(buf));
 
-      for( ; !plrAtEnd(&plReader); plrStep(&plReader) ){
+      for( ; !plrAtEnd(&plReader); rc = plrStep(&plReader) ){
+        if( rc!=SQLITE_OK ) break;
         if( plrColumn(&plReader)!=iColumn ){
           iColumn = plrColumn(&plReader);
           sqlite3_snprintf(sizeof(buf), buf, "] %d[", iColumn);
           assert( dump.nData>0 );
           dump.nData--;                     /* Overwrite trailing space. */
           assert( dump.pData[dump.nData]==' ');
           dataBufferAppend(&dump, buf, strlen(buf));
         }
         if( DL_DEFAULT==DL_POSITIONS_OFFSETS ){
           sqlite3_snprintf(sizeof(buf), buf, "%d,%d,%d ",
                            plrPosition(&plReader),
                            plrStartOffset(&plReader), plrEndOffset(&plReader));
         }else if( DL_DEFAULT==DL_POSITIONS ){
           sqlite3_snprintf(sizeof(buf), buf, "%d ", plrPosition(&plReader));
         }else{
           assert( NULL=="Unhandled DL_DEFAULT value");
         }
         dataBufferAppend(&dump, buf, strlen(buf));
       }
       plrDestroy(&plReader);
+      if( rc!= SQLITE_OK ) break;
 
       assert( dump.nData>0 );
       dump.nData--;                     /* Overwrite trailing space. */
       assert( dump.pData[dump.nData]==' ');
       dataBufferAppend(&dump, "]] ", 3);
     }
   }
   dlrDestroy(&dlReader);
+  if( rc!=SQLITE_OK ){
+    dataBufferDestroy(&dump);
+    return rc;
+  }
 
   assert( dump.nData>0 );
   dump.nData--;                     /* Overwrite trailing space. */
   assert( dump.pData[dump.nData]==' ');
   dump.pData[dump.nData] = '\0';
   assert( dump.nData>0 );
 
   /* Passes ownership of dump's buffer to pContext. */
   sqlite3_result_text(pContext, dump.pData, dump.nData, sqlite3_free);
   dump.pData = NULL;
   dump.nData = dump.nCapacity = 0;
+  return SQLITE_OK;
 }
 
 /* Implements dump_doclist() for use in inspecting the fts3 index from
 ** tests.  TEXT result containing a string representation of the
 ** doclist for the indicated term.  dump_doclist(t, term, level, idx)
 ** dumps the doclist for term from the segment specified by level, idx
 ** (in %_segdir), while dump_doclist(t, term) dumps the logical
 ** doclist for the term across all segments.  The per-segment doclist
 ** can contain deletions, while the full-index doclist will not
 ** (deletions are omitted).
@@ skipping 266 matching lines @@
 
 #ifdef SQLITE_TEST
   sqlite3Fts3ExprInitTestInterface(db);
 #endif
 
   /* Create the virtual table wrapper around the hash-table and overload 
   ** the two scalar functions. If this is successful, register the
   ** module with sqlite.
   */
   if( SQLITE_OK==rc 
+#if CHROMIUM_FTS3_CHANGES && !SQLITE_TEST
+      /* fts3_tokenizer() disabled for security reasons. */
+#else
    && SQLITE_OK==(rc = sqlite3Fts3InitHashTable(db, pHash, "fts3_tokenizer"))
+#endif
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "snippet", -1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "offsets", -1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "optimize", -1))
 #ifdef SQLITE_TEST
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "dump_terms", -1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "dump_doclist", -1))
 #endif
   ){
     return sqlite3_create_module_v2(
         db, "fts3", &fts3Module, (void *)pHash, hashDestroy
@@ skipping 14 matching lines @@
   sqlite3 *db, 
   char **pzErrMsg,
   const sqlite3_api_routines *pApi
 ){
   SQLITE_EXTENSION_INIT2(pApi)
   return sqlite3Fts3Init(db);
 }
 #endif
 
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3) */