Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -10,11 +10,11 @@
 **
 *************************************************************************
 ** This file contains C code routines that are called by the parser
 ** to handle SELECT statements in SQLite.
 **
-** $Id: select.c,v 1.348 2007/05/14 16:50:49 danielk1977 Exp $
+** $Id: select.c,v 1.349 2007/05/31 08:20:44 danielk1977 Exp $
 */
 #include "sqliteInt.h"
 
 
 /*
@@ -2647,10 +2647,14 @@
     if( processOrderGroupBy(&sNC, p->pOrderBy, "ORDER") ||
         processOrderGroupBy(&sNC, pGroupBy, "GROUP") ){
       return SQLITE_ERROR;
     }
   }
+
+  if( sqlite3MallocFailed() ){
+    return SQLITE_NOMEM;
+  }
 
   /* Make sure the GROUP BY clause does not contain aggregate functions.
   */
   if( pGroupBy ){
     struct ExprList_item *pItem;

Index: test/fuzz_malloc.test
==================================================================
--- test/fuzz_malloc.test
+++ test/fuzz_malloc.test
@@ -10,11 +10,11 @@
 #
 #***********************************************************************
 #
 # This file tests malloc failures in concert with fuzzy SQL generation.
 #
-# $Id: fuzz_malloc.test,v 1.1 2007/05/30 10:36:47 danielk1977 Exp $
+# $Id: fuzz_malloc.test,v 1.2 2007/05/31 08:20:44 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 source $testdir/fuzz_common.tcl
 source $testdir/malloc_common.tcl
@@ -23,22 +23,30 @@
 
 #
 # Usage: do_fuzzy_malloc_test <testname> ?<options>?
 # 
 #     -template
+#     -sqlprep
 #     -repeats
 #     
 proc do_fuzzy_malloc_test {testname args} {
   set ::fuzzyopts(-repeats) $::REPEATS
+  set ::fuzzyopts(-sqlprep) {}
   array set ::fuzzyopts $args
+
+  sqlite_malloc_fail 0
+  db close
+  file delete test.db test.db-journal
+  sqlite3 db test.db
+  set ::prep $::fuzzyopts(-sqlprep)
+  execsql $::prep
 
   for {set ii 0} {$ii < $::fuzzyopts(-repeats)} {incr ii} {
     set ::sql [subst $::fuzzyopts(-template)]
-    # puts $::sql
-    foreach {rc res} [catchsql $::sql] {}
+    foreach {rc res} [catchsql "$::sql"] {}
     if {$rc==0} {
-      do_malloc_test $testname-$ii -sqlbody $::sql
+      do_malloc_test $testname-$ii -sqlbody $::sql -sqlprep $::prep
     } else {
       incr ii -1
     }
   }
 }
@@ -46,8 +54,28 @@
 #----------------------------------------------------------------
 # Test malloc failure during parsing (and execution) of a fuzzily 
 # generated expressions.
 #
 do_fuzzy_malloc_test fuzzy_malloc-1 -template {Select [Expr]}
+do_fuzzy_malloc_test fuzzy_malloc-2 -template {[Select]}
+
+set ::SQLPREP {
+  BEGIN;
+    CREATE TABLE abc(a, b, c);
+    CREATE TABLE def(a, b, c);
+    CREATE TABLE ghi(a, b, c);
+    INSERT INTO abc VALUES(1.5, 3, 'a short string');
+    INSERT INTO def VALUES(NULL, X'ABCDEF', 
+        'a longer string. Long enough that it doesn''t fit in Mem.zShort');
+    INSERT INTO ghi VALUES(zeroblob(1000), 'hello world', -1257900987654321);
+  COMMIT;
+}
+set ::TableList  [list abc def ghi]
+set ::ColumnList [list a b c]
+
+do_fuzzy_malloc_test fuzzy_malloc-3 \
+  -template {[Select]}              \
+  -sqlprep $::SQLPREP
 
 sqlite_malloc_fail 0
 finish_test
+

Index: test/mallocB.test
==================================================================
--- test/mallocB.test
+++ test/mallocB.test
@@ -10,11 +10,11 @@
 #***********************************************************************
 # This file contains additional out-of-memory checks (see malloc.tcl).
 # These were all discovered by fuzzy generation of SQL. Apart from
 # that they have little in common.
 #
-# $Id: mallocB.test,v 1.1 2007/05/30 10:36:47 danielk1977 Exp $
+# $Id: mallocB.test,v 1.2 2007/05/31 08:20:44 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 source $testdir/malloc_common.tcl
 
@@ -28,8 +28,9 @@
 
 do_malloc_test mallocB-1 -sqlbody {SELECT - 456}
 do_malloc_test mallocB-2 -sqlbody {SELECT - 456.1}
 do_malloc_test mallocB-3 -sqlbody {SELECT random()}
 do_malloc_test mallocB-4 -sqlbody {SELECT zeroblob(1000)}
+do_malloc_test mallocB-5 -sqlbody {SELECT * FROM (SELECT 1) GROUP BY 1;}
 
 sqlite_malloc_fail 0
 finish_test