Index: src/analyze.c
==================================================================
--- src/analyze.c
+++ src/analyze.c
@@ -184,11 +184,11 @@
   };
   int i;
   sqlite3 *db = pParse->db;
   Db *pDb;
   Vdbe *v = sqlite3GetVdbe(pParse);
-  int aRoot[ArraySize(aTable)];
+  u32 aRoot[ArraySize(aTable)];
   u8 aCreateTbl[ArraySize(aTable)];
 #ifdef SQLITE_ENABLE_STAT4
   const int nToOpen = OptimizationEnabled(db,SQLITE_Stat4) ? 2 : 1;
 #else
   const int nToOpen = 1;
@@ -213,11 +213,11 @@
         ** of the new table in register pParse->regRoot. This is important 
         ** because the OpenWrite opcode below will be needing it. */
         sqlite3NestedParse(pParse,
             "CREATE TABLE %Q.%s(%s)", pDb->zDbSName, zTab, aTable[i].zCols
         );
-        aRoot[i] = pParse->regRoot;
+        aRoot[i] = (u32)pParse->regRoot;
         aCreateTbl[i] = OPFLAG_P2ISREG;
       }
     }else{
       /* The table already exists. If zWhere is not NULL, delete all entries 
       ** associated with the table zWhere. If zWhere is NULL, delete the
@@ -233,19 +233,19 @@
       }else if( db->xPreUpdateCallback ){
         sqlite3NestedParse(pParse, "DELETE FROM %Q.%s", pDb->zDbSName, zTab);
 #endif
       }else{
         /* The sqlite_stat[134] table already exists.  Delete all rows. */
-        sqlite3VdbeAddOp2(v, OP_Clear, aRoot[i], iDb);
+        sqlite3VdbeAddOp2(v, OP_Clear, (int)aRoot[i], iDb);
       }
     }
   }
 
   /* Open the sqlite_stat[134] tables for writing. */
   for(i=0; i<nToOpen; i++){
     assert( i<ArraySize(aTable) );
-    sqlite3VdbeAddOp4Int(v, OP_OpenWrite, iStatCur+i, aRoot[i], iDb, 3);
+    sqlite3VdbeAddOp4Int(v, OP_OpenWrite, iStatCur+i, (int)aRoot[i], iDb, 3);
     sqlite3VdbeChangeP5(v, aCreateTbl[i]);
     VdbeComment((v, aTable[i].zName));
   }
 }
 

Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -2137,16 +2137,15 @@
 /*
 ** Return the size of the database file in pages. If there is any kind of
 ** error, return ((unsigned int)-1).
 */
 static Pgno btreePagecount(BtShared *pBt){
-  assert( (pBt->nPage & 0x80000000)==0 || CORRUPT_DB );
   return pBt->nPage;
 }
-u32 sqlite3BtreeLastPage(Btree *p){
+Pgno sqlite3BtreeLastPage(Btree *p){
   assert( sqlite3BtreeHoldsMutex(p) );
-  return btreePagecount(p->pBt) & 0x7fffffff;
+  return btreePagecount(p->pBt);
 }
 
 /*
 ** Get a page from the pager and initialize it.
 **
@@ -2930,12 +2929,12 @@
 /*
 ** Set the maximum page count for a database if mxPage is positive.
 ** No changes are made if mxPage is 0 or negative.
 ** Regardless of the value of mxPage, return the maximum page count.
 */
-int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){
-  int n;
+Pgno sqlite3BtreeMaxPageCount(Btree *p, Pgno mxPage){
+  Pgno n;
   sqlite3BtreeEnter(p);
   n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage);
   sqlite3BtreeLeave(p);
   return n;
 }
@@ -4370,11 +4369,11 @@
 ** It is assumed that the sqlite3BtreeCursorZero() has been called
 ** on pCur to initialize the memory space prior to invoking this routine.
 */
 static int btreeCursor(
   Btree *p,                              /* The btree */
-  int iTable,                            /* Root page of table to open */
+  Pgno iTable,                           /* Root page of table to open */
   int wrFlag,                            /* 1 to write. 0 read-only */
   struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
   BtCursor *pCur                         /* Space for new cursor */
 ){
   BtShared *pBt = p->pBt;                /* Shared b-tree handle */
@@ -4413,21 +4412,21 @@
     }
   }
 
   /* Now that no other errors can occur, finish filling in the BtCursor
   ** variables and link the cursor into the BtShared list.  */
-  pCur->pgnoRoot = (Pgno)iTable;
+  pCur->pgnoRoot = iTable;
   pCur->iPage = -1;
   pCur->pKeyInfo = pKeyInfo;
   pCur->pBtree = p;
   pCur->pBt = pBt;
   pCur->curFlags = wrFlag ? BTCF_WriteFlag : 0;
   pCur->curPagerFlags = wrFlag ? 0 : PAGER_GET_READONLY;
   /* If there are two or more cursors on the same btree, then all such
   ** cursors *must* have the BTCF_Multiple flag set. */
   for(pX=pBt->pCursor; pX; pX=pX->pNext){
-    if( pX->pgnoRoot==(Pgno)iTable ){
+    if( pX->pgnoRoot==iTable ){
       pX->curFlags |= BTCF_Multiple;
       pCur->curFlags |= BTCF_Multiple;
     }
   }
   pCur->pNext = pBt->pCursor;
@@ -4435,11 +4434,11 @@
   pCur->eState = CURSOR_INVALID;
   return SQLITE_OK;
 }
 static int btreeCursorWithLock(
   Btree *p,                              /* The btree */
-  int iTable,                            /* Root page of table to open */
+  Pgno iTable,                           /* Root page of table to open */
   int wrFlag,                            /* 1 to write. 0 read-only */
   struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
   BtCursor *pCur                         /* Space for new cursor */
 ){
   int rc;
@@ -4448,11 +4447,11 @@
   sqlite3BtreeLeave(p);
   return rc;
 }
 int sqlite3BtreeCursor(
   Btree *p,                                   /* The btree */
-  int iTable,                                 /* Root page of table to open */
+  Pgno iTable,                                /* Root page of table to open */
   int wrFlag,                                 /* 1 to write. 0 read-only */
   struct KeyInfo *pKeyInfo,                   /* First arg to xCompare() */
   BtCursor *pCur                              /* Write new cursor here */
 ){
   if( p->sharable ){
@@ -4834,11 +4833,11 @@
   if( rc==SQLITE_OK && amt>0 ){
     const u32 ovflSize = pBt->usableSize - 4;  /* Bytes content per ovfl page */
     Pgno nextPage;
 
     nextPage = get4byte(&aPayload[pCur->info.nLocal]);
-
+ 
     /* If the BtCursor.aOverflow[] has not been allocated, allocate it now.
     **
     ** The aOverflow[] array is sized at one entry for each overflow page
     ** in the overflow chain. The page number of the first overflow page is
     ** stored in aOverflow[0], etc. A value of 0 in the aOverflow[] array
@@ -4873,10 +4872,11 @@
     }
 
     assert( rc==SQLITE_OK && amt>0 );
     while( nextPage ){
       /* If required, populate the overflow page-list cache. */
+      if( nextPage > pBt->nPage ) return SQLITE_CORRUPT_BKPT;
       assert( pCur->aOverflow[iIdx]==0
               || pCur->aOverflow[iIdx]==nextPage
               || CORRUPT_DB );
       pCur->aOverflow[iIdx] = nextPage;
 
@@ -5945,11 +5945,11 @@
     ** shows that the page 'nearby' is somewhere on the free-list, then
     ** the entire-list will be searched for that page.
     */
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( eMode==BTALLOC_EXACT ){
-      if( nearby<=mxPage ){
+      if( ALWAYS(nearby<=mxPage) ){
         u8 eType;
         assert( nearby>0 );
         assert( pBt->autoVacuum );
         rc = ptrmapGet(pBt, nearby, &eType, 0);
         if( rc ) return rc;
@@ -6241,11 +6241,11 @@
 
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( CORRUPT_DB || iPage>1 );
   assert( !pMemPage || pMemPage->pgno==iPage );
 
-  if( iPage<2 || iPage>pBt->nPage ){
+  if( iPage<2 || NEVER(iPage>pBt->nPage) ){
     return SQLITE_CORRUPT_BKPT;
   }
   if( pMemPage ){
     pPage = pMemPage;
     sqlite3PagerRef(pPage->pDbPage);
@@ -6288,10 +6288,14 @@
   */
   if( nFree!=0 ){
     u32 nLeaf;                /* Initial number of leaf cells on trunk page */
 
     iTrunk = get4byte(&pPage1->aData[32]);
+    if( iTrunk>btreePagecount(pBt) ){
+      rc = SQLITE_CORRUPT_BKPT;
+      goto freepage_out;
+    }
     rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
     if( rc!=SQLITE_OK ){
       goto freepage_out;
     }
 
@@ -9092,11 +9096,11 @@
 ** flags might not work:
 **
 **     BTREE_INTKEY|BTREE_LEAFDATA     Used for SQL tables with rowid keys
 **     BTREE_ZERODATA                  Used for SQL indices
 */
-static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){
+static int btreeCreateTable(Btree *p, Pgno *piTable, int createTabFlags){
   BtShared *pBt = p->pBt;
   MemPage *pRoot;
   Pgno pgnoRoot;
   int rc;
   int ptfFlags;          /* Page-type flage for the root page of new table */
@@ -9125,21 +9129,23 @@
     /* Read the value of meta[3] from the database to determine where the
     ** root page of the new table should go. meta[3] is the largest root-page
     ** created so far, so the new root-page is (meta[3]+1).
     */
     sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot);
+    if( pgnoRoot>btreePagecount(pBt) ){
+      return SQLITE_CORRUPT_BKPT;
+    }
     pgnoRoot++;
 
     /* The new root-page may not be allocated on a pointer-map page, or the
     ** PENDING_BYTE page.
     */
     while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) ||
         pgnoRoot==PENDING_BYTE_PAGE(pBt) ){
       pgnoRoot++;
     }
-    assert( pgnoRoot>=3 || CORRUPT_DB );
-    testcase( pgnoRoot<3 );
+    assert( pgnoRoot>=3 );
 
     /* Allocate a page. The page that currently resides at pgnoRoot will
     ** be moved to the allocated page (unless the allocated page happens
     ** to reside at pgnoRoot).
     */
@@ -9232,14 +9238,14 @@
     ptfFlags = PTF_ZERODATA | PTF_LEAF;
   }
   zeroPage(pRoot, ptfFlags);
   sqlite3PagerUnref(pRoot->pDbPage);
   assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 );
-  *piTable = (int)pgnoRoot;
+  *piTable = pgnoRoot;
   return SQLITE_OK;
 }
-int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){
+int sqlite3BtreeCreateTable(Btree *p, Pgno *piTable, int flags){
   int rc;
   sqlite3BtreeEnter(p);
   rc = btreeCreateTable(p, piTable, flags);
   sqlite3BtreeLeave(p);
   return rc;
@@ -9719,11 +9725,11 @@
 ** Verify that the number of pages on the list is N.
 */
 static void checkList(
   IntegrityCk *pCheck,  /* Integrity checking context */
   int isFreeList,       /* True for a freelist.  False for overflow page list */
-  int iPage,            /* Page number for first page in the list */
+  Pgno iPage,           /* Page number for first page in the list */
   u32 N                 /* Expected number of pages in the list */
 ){
   int i;
   u32 expected = N;
   int nErrAtStart = pCheck->nErr;
@@ -9851,11 +9857,11 @@
 **      4.  Recursively call checkTreePage on all children.
 **      5.  Verify that the depth of all children is the same.
 */
 static int checkTreePage(
   IntegrityCk *pCheck,  /* Context for the sanity check */
-  int iPage,            /* Page number of the page to check */
+  Pgno iPage,           /* Page number of the page to check */
   i64 *piMinKey,        /* Write minimum integer primary key here */
   i64 maxKey            /* Error if integer primary key greater than this */
 ){
   MemPage *pPage = 0;      /* The page being analyzed */
   int i;                   /* Loop counter */
@@ -9887,13 +9893,13 @@
   */
   pBt = pCheck->pBt;
   usableSize = pBt->usableSize;
   if( iPage==0 ) return 0;
   if( checkRef(pCheck, iPage) ) return 0;
-  pCheck->zPfx = "Page %d: ";
+  pCheck->zPfx = "Page %u: ";
   pCheck->v1 = iPage;
-  if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){
+  if( (rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0 ){
     checkAppendMsg(pCheck,
        "unable to get the page. error code=%d", rc);
     goto end_of_check;
   }
 
@@ -9914,11 +9920,11 @@
   }
   data = pPage->aData;
   hdr = pPage->hdrOffset;
 
   /* Set up for cell analysis */
-  pCheck->zPfx = "On tree page %d cell %d: ";
+  pCheck->zPfx = "On tree page %u cell %d: ";
   contentOffset = get2byteNotZero(&data[hdr+5]);
   assert( contentOffset<=usableSize );  /* Enforced by btreeInitPage() */
 
   /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
   ** number of cells on the page. */
@@ -9934,11 +9940,11 @@
   if( !pPage->leaf ){
     /* Analyze the right-child page of internal pages */
     pgno = get4byte(&data[hdr+8]);
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( pBt->autoVacuum ){
-      pCheck->zPfx = "On page %d at right child: ";
+      pCheck->zPfx = "On page %u at right child: ";
       checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage);
     }
 #endif
     depth = checkTreePage(pCheck, pgno, &maxKey, maxKey);
     keyCanBeEqual = 0;
@@ -10075,11 +10081,11 @@
     nFrag = 0;
     prev = contentOffset - 1;   /* Implied first min-heap entry */
     while( btreeHeapPull(heap,&x) ){
       if( (prev&0xffff)>=(x>>16) ){
         checkAppendMsg(pCheck,
-          "Multiple uses for byte %u of page %d", x>>16, iPage);
+          "Multiple uses for byte %u of page %u", x>>16, iPage);
         break;
       }else{
         nFrag += (x>>16) - (prev&0xffff) - 1;
         prev = x;
       }
@@ -10090,11 +10096,11 @@
     ** EVIDENCE-OF: R-07161-27322 The one-byte integer at offset 7 gives the
     ** number of fragmented free bytes within the cell content area.
     */
     if( heap[0]==0 && nFrag!=data[hdr+7] ){
       checkAppendMsg(pCheck,
-          "Fragmentation of %d bytes reported as %d on page %d",
+          "Fragmentation of %d bytes reported as %d on page %u",
           nFrag, data[hdr+7], iPage);
     }
   }
 
 end_of_check:
@@ -10131,23 +10137,23 @@
 ** checks are still performed.
 */
 char *sqlite3BtreeIntegrityCheck(
   sqlite3 *db,  /* Database connection that is running the check */
   Btree *p,     /* The btree to be checked */
-  int *aRoot,   /* An array of root pages numbers for individual trees */
+  Pgno *aRoot,  /* An array of root pages numbers for individual trees */
   int nRoot,    /* Number of entries in aRoot[] */
   int mxErr,    /* Stop reporting errors after this many */
   int *pnErr    /* Write number of errors seen to this variable */
 ){
   Pgno i;
   IntegrityCk sCheck;
   BtShared *pBt = p->pBt;
   u64 savedDbFlags = pBt->db->flags;
   char zErr[100];
-  VVA_ONLY( int nRef );
   int bPartial = 0;            /* True if not checking all btrees */
   int bCkFreelist = 1;         /* True to scan the freelist */
+  VVA_ONLY( int nRef );
   assert( nRoot>0 );
 
   /* aRoot[0]==0 means this is a partial check */
   if( aRoot[0]==0 ){
     assert( nRoot>1 );
@@ -10203,12 +10209,12 @@
   /* Check all the tables.
   */
 #ifndef SQLITE_OMIT_AUTOVACUUM
   if( !bPartial ){
     if( pBt->autoVacuum ){
-      int mx = 0;
-      int mxInHdr;
+      Pgno mx = 0;
+      Pgno mxInHdr;
       for(i=0; (int)i<nRoot; i++) if( mx<aRoot[i] ) mx = aRoot[i];
       mxInHdr = get4byte(&pBt->pPage1->aData[52]);
       if( mx!=mxInHdr ){
         checkAppendMsg(&sCheck,
           "max rootpage (%d) disagrees with header (%d)",

Index: src/btree.h
==================================================================
--- src/btree.h
+++ src/btree.h
@@ -69,12 +69,12 @@
   int sqlite3BtreeSetMmapLimit(Btree*,sqlite3_int64);
 #endif
 int sqlite3BtreeSetPagerFlags(Btree*,unsigned);
 int sqlite3BtreeSetPageSize(Btree *p, int nPagesize, int nReserve, int eFix);
 int sqlite3BtreeGetPageSize(Btree*);
-int sqlite3BtreeMaxPageCount(Btree*,int);
-u32 sqlite3BtreeLastPage(Btree*);
+Pgno sqlite3BtreeMaxPageCount(Btree*,Pgno);
+Pgno sqlite3BtreeLastPage(Btree*);
 int sqlite3BtreeSecureDelete(Btree*,int);
 int sqlite3BtreeGetRequestedReserve(Btree*);
 int sqlite3BtreeGetReserveNoMutex(Btree *p);
 int sqlite3BtreeSetAutoVacuum(Btree *, int);
 int sqlite3BtreeGetAutoVacuum(Btree *);
@@ -82,11 +82,11 @@
 int sqlite3BtreeCommitPhaseOne(Btree*, const char*);
 int sqlite3BtreeCommitPhaseTwo(Btree*, int);
 int sqlite3BtreeCommit(Btree*);
 int sqlite3BtreeRollback(Btree*,int,int);
 int sqlite3BtreeBeginStmt(Btree*,int);
-int sqlite3BtreeCreateTable(Btree*, int*, int flags);
+int sqlite3BtreeCreateTable(Btree*, Pgno*, int flags);
 int sqlite3BtreeIsInTrans(Btree*);
 int sqlite3BtreeIsInReadTrans(Btree*);
 int sqlite3BtreeIsInBackup(Btree*);
 void *sqlite3BtreeSchema(Btree *, int, void(*)(void *));
 int sqlite3BtreeSchemaLocked(Btree *pBtree);
@@ -223,11 +223,11 @@
 #define BTREE_WRCSR     0x00000004     /* read-write cursor */
 #define BTREE_FORDELETE 0x00000008     /* Cursor is for seek/delete only */
 
 int sqlite3BtreeCursor(
   Btree*,                              /* BTree containing table to open */
-  int iTable,                          /* Index of root page */
+  Pgno iTable,                         /* Index of root page */
   int wrFlag,                          /* 1 for writing.  0 for read-only */
   struct KeyInfo*,                     /* First argument to compare function */
   BtCursor *pCursor                    /* Space to write cursor structure */
 );
 BtCursor *sqlite3BtreeFakeValidCursor(void);
@@ -314,11 +314,11 @@
 int sqlite3BtreePayload(BtCursor*, u32 offset, u32 amt, void*);
 const void *sqlite3BtreePayloadFetch(BtCursor*, u32 *pAmt);
 u32 sqlite3BtreePayloadSize(BtCursor*);
 sqlite3_int64 sqlite3BtreeMaxRecordSize(BtCursor*);
 
-char *sqlite3BtreeIntegrityCheck(sqlite3*,Btree*,int*aRoot,int nRoot,int,int*);
+char *sqlite3BtreeIntegrityCheck(sqlite3*,Btree*,Pgno*aRoot,int nRoot,int,int*);
 struct Pager *sqlite3BtreePager(Btree*);
 i64 sqlite3BtreeRowCountEst(BtCursor*);
 
 #ifndef SQLITE_OMIT_INCRBLOB
 int sqlite3BtreePayloadChecked(BtCursor*, u32 offset, u32 amt, void*);

Index: src/btreeInt.h
==================================================================
--- src/btreeInt.h
+++ src/btreeInt.h
@@ -679,11 +679,12 @@
   Pgno nPage;       /* Number of pages in the database */
   int mxErr;        /* Stop accumulating errors when this reaches zero */
   int nErr;         /* Number of messages written to zErrMsg so far */
   int bOomFault;    /* A memory allocation error has occurred */
   const char *zPfx; /* Error message prefix */
-  int v1, v2;       /* Values for up to two %d fields in zPfx */
+  Pgno v1;          /* Value for first %u substitution in zPfx */
+  int v2;           /* Value for second %d substitution in zPfx */
   StrAccum errMsg;  /* Accumulate the error message text here */
   u32 *heap;        /* Min-heap used for analyzing cell coverage */
   sqlite3 *db;      /* Database connection running the check */
 };
 

Index: src/build.c
==================================================================
--- src/build.c
+++ src/build.c
@@ -29,11 +29,11 @@
 ** The TableLock structure is only used by the sqlite3TableLock() and
 ** codeTableLocks() functions.
 */
 struct TableLock {
   int iDb;               /* The database containing the table to be locked */
-  int iTab;              /* The root page of the table to be locked */
+  Pgno iTab;             /* The root page of the table to be locked */
   u8 isWriteLock;        /* True for write lock.  False for a read lock */
   const char *zLockName; /* Name of the table */
 };
 
 /*
@@ -47,11 +47,11 @@
 ** codeTableLocks() which occurs during sqlite3FinishCoding().
 */
 void sqlite3TableLock(
   Parse *pParse,     /* Parsing context */
   int iDb,           /* Index of the database containing the table to lock */
-  int iTab,          /* Root page number of the table to be locked */
+  Pgno iTab,         /* Root page number of the table to be locked */
   u8 isWriteLock,    /* True for a write lock */
   const char *zName  /* Name of the table to be locked */
 ){
   Parse *pToplevel = sqlite3ParseToplevel(pParse);
   int i;
@@ -886,23 +886,24 @@
   const char *zName,        /* Name of the object to check */
   const char *zType,        /* Type of this object */
   const char *zTblName      /* Parent table name for triggers and indexes */
 ){
   sqlite3 *db = pParse->db;
-  if( sqlite3WritableSchema(db) || db->init.imposterTable ){
+  if( sqlite3WritableSchema(db)
+   || db->init.imposterTable
+   || !sqlite3Config.bExtraSchemaChecks
+  ){
     /* Skip these error checks for writable_schema=ON */
     return SQLITE_OK;
   }
   if( db->init.busy ){
     if( sqlite3_stricmp(zType, db->init.azInit[0])
      || sqlite3_stricmp(zName, db->init.azInit[1])
      || sqlite3_stricmp(zTblName, db->init.azInit[2])
     ){
-      if( sqlite3Config.bExtraSchemaChecks ){
-        sqlite3ErrorMsg(pParse, ""); /* corruptSchema() will supply the error */
-        return SQLITE_ERROR;
-      }
+      sqlite3ErrorMsg(pParse, ""); /* corruptSchema() will supply the error */
+      return SQLITE_ERROR;
     }
   }else{
     if( (pParse->nested==0 && 0==sqlite3StrNICmp(zName, "sqlite_", 7))
      || (sqlite3ReadOnlyShadowTables(db) && sqlite3ShadowTableName(db, zName))
     ){
@@ -2112,11 +2113,11 @@
   ** table entry. This is only required if currently generating VDBE
   ** code for a CREATE TABLE (not when parsing one as part of reading
   ** a database schema).  */
   if( v && pPk->tnum>0 ){
     assert( db->init.busy==0 );
-    sqlite3VdbeChangeOpcode(v, pPk->tnum, OP_Goto);
+    sqlite3VdbeChangeOpcode(v, (int)pPk->tnum, OP_Goto);
   }
 
   /* The root page of the PRIMARY KEY is the table root page */
   pPk->tnum = pTab->tnum;
 
@@ -2808,11 +2809,11 @@
 ** We must continue looping until all tables and indices with
 ** rootpage==iFrom have been converted to have a rootpage of iTo
 ** in order to be certain that we got the right one.
 */
 #ifndef SQLITE_OMIT_AUTOVACUUM
-void sqlite3RootPageMoved(sqlite3 *db, int iDb, int iFrom, int iTo){
+void sqlite3RootPageMoved(sqlite3 *db, int iDb, Pgno iFrom, Pgno iTo){
   HashElem *pElem;
   Hash *pHash;
   Db *pDb;
 
   assert( sqlite3SchemaMutexHeld(db, iDb, 0) );
@@ -2841,11 +2842,11 @@
 ** erasing iTable (this can happen with an auto-vacuum database).
 */ 
 static void destroyRootPage(Parse *pParse, int iTable, int iDb){
   Vdbe *v = sqlite3GetVdbe(pParse);
   int r1 = sqlite3GetTempReg(pParse);
-  if( iTable<2 ) sqlite3ErrorMsg(pParse, "corrupt schema");
+  if( NEVER(iTable<2) ) return;
   sqlite3VdbeAddOp3(v, OP_Destroy, iTable, r1, iDb);
   sqlite3MayAbort(pParse);
 #ifndef SQLITE_OMIT_AUTOVACUUM
   /* OP_Destroy stores an in integer r1. If this integer
   ** is non-zero, then it is the root page number of a table moved to
@@ -2885,22 +2886,22 @@
   ** and root page 5 happened to be the largest root-page number in the
   ** database, then root page 5 would be moved to page 4 by the 
   ** "OP_Destroy 4 0" opcode. The subsequent "OP_Destroy 5 0" would hit
   ** a free-list page.
   */
-  int iTab = pTab->tnum;
-  int iDestroyed = 0;
+  Pgno iTab = pTab->tnum;
+  Pgno iDestroyed = 0;
 
   while( 1 ){
     Index *pIdx;
-    int iLargest = 0;
+    Pgno iLargest = 0;
 
     if( iDestroyed==0 || iTab<iDestroyed ){
       iLargest = iTab;
     }
     for(pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext){
-      int iIdx = pIdx->tnum;
+      Pgno iIdx = pIdx->tnum;
       assert( pIdx->pSchema==pTab->pSchema );
       if( (iDestroyed==0 || (iIdx<iDestroyed)) && iIdx>iLargest ){
         iLargest = iIdx;
       }
     }
@@ -3319,11 +3320,11 @@
   int iTab = pParse->nTab++;     /* Btree cursor used for pTab */
   int iIdx = pParse->nTab++;     /* Btree cursor used for pIndex */
   int iSorter;                   /* Cursor opened by OpenSorter (if in use) */
   int addr1;                     /* Address of top of loop */
   int addr2;                     /* Address to jump to for next iteration */
-  int tnum;                      /* Root page of index */
+  Pgno tnum;                     /* Root page of index */
   int iPartIdxLabel;             /* Jump to this label to skip a row */
   Vdbe *v;                       /* Generate code into this virtual machine */
   KeyInfo *pKey;                 /* KeyInfo for index */
   int regRecord;                 /* Register holding assembled index record */
   sqlite3 *db = pParse->db;      /* The database connection */
@@ -3340,11 +3341,11 @@
   sqlite3TableLock(pParse, iDb, pTab->tnum, 1, pTab->zName);
 
   v = sqlite3GetVdbe(pParse);
   if( v==0 ) return;
   if( memRootPage>=0 ){
-    tnum = memRootPage;
+    tnum = (Pgno)memRootPage;
   }else{
     tnum = pIndex->tnum;
   }
   pKey = sqlite3KeyInfoOfIndex(pParse, pIndex);
   assert( pKey!=0 || db->mallocFailed || pParse->nErr );
@@ -3365,11 +3366,11 @@
   sqlite3VdbeAddOp2(v, OP_SorterInsert, iSorter, regRecord);
   sqlite3ResolvePartIdxLabel(pParse, iPartIdxLabel);
   sqlite3VdbeAddOp2(v, OP_Next, iTab, addr1+1); VdbeCoverage(v);
   sqlite3VdbeJumpHere(v, addr1);
   if( memRootPage<0 ) sqlite3VdbeAddOp2(v, OP_Clear, tnum, iDb);
-  sqlite3VdbeAddOp4(v, OP_OpenWrite, iIdx, tnum, iDb, 
+  sqlite3VdbeAddOp4(v, OP_OpenWrite, iIdx, (int)tnum, iDb, 
                     (char *)pKey, P4_KEYINFO);
   sqlite3VdbeChangeP5(v, OPFLAG_BULKCSR|((memRootPage>=0)?OPFLAG_P2ISREG:0));
 
   addr1 = sqlite3VdbeAddOp2(v, OP_SorterSort, iSorter, 0); VdbeCoverage(v);
   if( IsUniqueIndex(pIndex) ){
@@ -3974,11 +3975,11 @@
       ** doing so, code a Noop instruction and store its address in 
       ** Index.tnum. This is required in case this index is actually a 
       ** PRIMARY KEY and the table is actually a WITHOUT ROWID table. In 
       ** that case the convertToWithoutRowidTable() routine will replace
       ** the Noop with a Goto to jump over the VDBE code generated below. */
-      pIndex->tnum = sqlite3VdbeAddOp0(v, OP_Noop);
+      pIndex->tnum = (Pgno)sqlite3VdbeAddOp0(v, OP_Noop);
       sqlite3VdbeAddOp3(v, OP_CreateBtree, iDb, iMem, BTREE_BLOBKEY);
 
       /* Gather the complete text of the CREATE INDEX statement into
       ** the zStmt variable
       */
@@ -4016,11 +4017,11 @@
         sqlite3VdbeAddParseSchemaOp(v, iDb,
             sqlite3MPrintf(db, "name='%q' AND type='index'", pIndex->zName));
         sqlite3VdbeAddOp2(v, OP_Expire, 0, 1);
       }
 
-      sqlite3VdbeJumpHere(v, pIndex->tnum);
+      sqlite3VdbeJumpHere(v, (int)pIndex->tnum);
     }
   }
   if( db->init.busy || pTblName==0 ){
     pIndex->pNext = pTab->pIndex;
     pTab->pIndex = pIndex;

Index: src/insert.c
==================================================================
--- src/insert.c
+++ src/insert.c
@@ -178,11 +178,11 @@
   for(i=1; i<iEnd; i++){
     VdbeOp *pOp = sqlite3VdbeGetOp(v, i);
     assert( pOp!=0 );
     if( pOp->opcode==OP_OpenRead && pOp->p3==iDb ){
       Index *pIndex;
-      int tnum = pOp->p2;
+      Pgno tnum = pOp->p2;
       if( tnum==pTab->tnum ){
         return 1;
       }
       for(pIndex=pTab->pIndex; pIndex; pIndex=pIndex->pNext){
         if( tnum==pIndex->tnum ){

Index: src/main.c
==================================================================
--- src/main.c
+++ src/main.c
@@ -4089,10 +4089,16 @@
     /*   sqlite3_test_control(SQLITE_TESTCTRL_EXTRA_SCHEMA_CHECKS, int);
     **
     ** Set or clear a flag that causes SQLite to verify that type, name,
     ** and tbl_name fields of the sqlite_schema table.  This is normally
     ** on, but it is sometimes useful to turn it off for testing.
+    **
+    ** 2020-07-22:  Disabling EXTRA_SCHEMA_CHECKS also disables the
+    ** verification of rootpage numbers when parsing the schema.  This
+    ** is useful to make it easier to reach strange internal error states
+    ** during testing.  The EXTRA_SCHEMA_CHECKS settting is always enabled
+    ** in production.
     */
     case SQLITE_TESTCTRL_EXTRA_SCHEMA_CHECKS: {
       sqlite3GlobalConfig.bExtraSchemaChecks = va_arg(ap, int);
       break;
     }

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -784,15 +784,10 @@
 # define USEFETCH(x) ((x)->bUseFetch)
 #else
 # define USEFETCH(x) 0
 #endif
 
-/*
-** The maximum legal page number is (2^31 - 1).
-*/
-#define PAGER_MAX_PGNO 2147483647
-
 /*
 ** The argument to this macro is a file descriptor (type sqlite3_file*).
 ** Return 0 if it is not open, or non-zero (but not 1) if it is.
 **
 ** This is so that expressions can be written as:
@@ -3761,11 +3756,11 @@
 ** Make no changes if mxPage is zero or negative.  And never reduce the
 ** maximum page count below the current size of the database.
 **
 ** Regardless of mxPage, return the current maximum page count.
 */
-int sqlite3PagerMaxPageCount(Pager *pPager, int mxPage){
+Pgno sqlite3PagerMaxPageCount(Pager *pPager, Pgno mxPage){
   if( mxPage>0 ){
     pPager->mxPgno = mxPage;
   }
   assert( pPager->eState!=PAGER_OPEN );      /* Called only by OP_MaxPgcnt */
   /* assert( pPager->mxPgno>=pPager->dbSize ); */
@@ -5488,22 +5483,22 @@
 
   noContent = (flags & PAGER_GET_NOCONTENT)!=0;
   if( pPg->pPager && !noContent ){
     /* In this case the pcache already contains an initialized copy of
     ** the page. Return without further ado.  */
-    assert( pgno<=PAGER_MAX_PGNO && pgno!=PAGER_MJ_PGNO(pPager) );
+    assert( pgno!=PAGER_MJ_PGNO(pPager) );
     pPager->aStat[PAGER_STAT_HIT]++;
     return SQLITE_OK;
 
   }else{
     /* The pager cache has created a new page. Its content needs to 
     ** be initialized. But first some error checks:
     **
-    ** (1) The maximum page number is 2^31
+    ** (*) obsolete.  Was: maximum page number is 2^31
     ** (2) Never try to fetch the locking page
     */
-    if( pgno>PAGER_MAX_PGNO || pgno==PAGER_MJ_PGNO(pPager) ){
+    if( pgno==PAGER_MJ_PGNO(pPager) ){
       rc = SQLITE_CORRUPT_BKPT;
       goto pager_acquire_err;
     }
 
     pPg->pPager = pPager;

Index: src/pager.h
==================================================================
--- src/pager.h
+++ src/pager.h
@@ -126,11 +126,11 @@
 int sqlite3PagerReadFileheader(Pager*, int, unsigned char*);
 
 /* Functions used to configure a Pager object. */
 void sqlite3PagerSetBusyHandler(Pager*, int(*)(void *), void *);
 int sqlite3PagerSetPagesize(Pager*, u32*, int);
-int sqlite3PagerMaxPageCount(Pager*, int);
+Pgno sqlite3PagerMaxPageCount(Pager*, Pgno);
 void sqlite3PagerSetCachesize(Pager*, int);
 int sqlite3PagerSetSpillsize(Pager*, int);
 void sqlite3PagerSetMmapLimit(Pager *, sqlite3_int64);
 void sqlite3PagerShrink(Pager*);
 void sqlite3PagerSetFlags(Pager*,unsigned);

Index: src/pragma.c
==================================================================
--- src/pragma.c
+++ src/pragma.c
@@ -609,17 +609,23 @@
   **
   ** Return the number of pages in the specified database.
   */
   case PragTyp_PAGE_COUNT: {
     int iReg;
+    i64 x = 0;
     sqlite3CodeVerifySchema(pParse, iDb);
     iReg = ++pParse->nMem;
     if( sqlite3Tolower(zLeft[0])=='p' ){
       sqlite3VdbeAddOp2(v, OP_Pagecount, iDb, iReg);
     }else{
-      sqlite3VdbeAddOp3(v, OP_MaxPgcnt, iDb, iReg, 
-                        sqlite3AbsInt32(sqlite3Atoi(zRight)));
+      if( zRight && sqlite3DecOrHexToI64(zRight,&x)==0 ){
+        if( x<0 ) x = 0;
+        else if( x>0xfffffffe ) x = 0xfffffffe;
+      }else{
+        x = 0;
+      }
+      sqlite3VdbeAddOp3(v, OP_MaxPgcnt, iDb, iReg, (int)x);
     }
     sqlite3VdbeAddOp2(v, OP_ResultRow, iReg, 1);
     break;
   }
 

Index: src/prepare.c
==================================================================
--- src/prepare.c
+++ src/prepare.c
@@ -113,11 +113,17 @@
     sqlite3_stmt *pStmt;
     TESTONLY(int rcp);            /* Return code from sqlite3_prepare() */
 
     assert( db->init.busy );
     db->init.iDb = iDb;
-    db->init.newTnum = sqlite3Atoi(argv[3]);
+    if( sqlite3GetUInt32(argv[3], &db->init.newTnum)==0
+     || (db->init.newTnum>pData->mxPage && pData->mxPage>0)
+    ){
+      if( sqlite3Config.bExtraSchemaChecks ){
+        corruptSchema(pData, argv[1], "invalid rootpage");
+      }
+    }
     db->init.orphanTrigger = 0;
     db->init.azInit = argv;
     pStmt = 0;
     TESTONLY(rcp = ) sqlite3Prepare(db, argv[4], -1, 0, 0, &pStmt, 0);
     rc = db->errCode;
@@ -146,16 +152,21 @@
     ** been created when we processed the CREATE TABLE.  All we have
     ** to do here is record the root page number for that index.
     */
     Index *pIndex;
     pIndex = sqlite3FindIndex(db, argv[1], db->aDb[iDb].zDbSName);
-    if( pIndex==0
-     || sqlite3GetInt32(argv[3],&pIndex->tnum)==0
+    if( pIndex==0 ){
+      corruptSchema(pData, argv[1], "orphan index");
+    }else
+    if( sqlite3GetUInt32(argv[3],&pIndex->tnum)==0
      || pIndex->tnum<2
+     || pIndex->tnum>pData->mxPage
      || sqlite3IndexHasDuplicateRootPage(pIndex)
     ){
-      corruptSchema(pData, argv[1], pIndex?"invalid rootpage":"orphan index");
+      if( sqlite3Config.bExtraSchemaChecks ){
+        corruptSchema(pData, argv[1], "invalid rootpage");
+      }
     }
   }
   return 0;
 }
 
@@ -205,10 +216,11 @@
   initData.iDb = iDb;
   initData.rc = SQLITE_OK;
   initData.pzErrMsg = pzErrMsg;
   initData.mInitFlags = mFlags;
   initData.nInitRow = 0;
+  initData.mxPage = 0;
   sqlite3InitCallback(&initData, 5, (char **)azArg, 0);
   db->mDbFlags &= mask;
   if( initData.rc ){
     rc = initData.rc;
     goto error_out;
@@ -327,10 +339,11 @@
   }
 
   /* Read the schema information out of the schema tables
   */
   assert( db->init.busy );
+  initData.mxPage = sqlite3BtreeLastPage(pDb->pBt);
   {
     char *zSql;
     zSql = sqlite3MPrintf(db, 
         "SELECT*FROM\"%w\".%s ORDER BY rowid",
         db->aDb[iDb].zDbSName, zSchemaTabName);

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -3179,11 +3179,11 @@
   KeyInfo *pKeyDup = 0; /* Comparison information for duplicate removal */
   KeyInfo *pKeyMerge;   /* Comparison information for merging rows */
   sqlite3 *db;          /* Database connection */
   ExprList *pOrderBy;   /* The ORDER BY clause */
   int nOrderBy;         /* Number of terms in the ORDER BY clause */
-  int *aPermute;        /* Mapping from ORDER BY terms to result set columns */
+  u32 *aPermute;        /* Mapping from ORDER BY terms to result set columns */
 
   assert( p->pOrderBy!=0 );
   assert( pKeyDup==0 ); /* "Managed" code needs this.  Ticket #3382. */
   db = pParse->db;
   v = pParse->pVdbe;
@@ -3228,11 +3228,11 @@
   ** row of results comes from selectA or selectB.  Also add explicit
   ** collations to the ORDER BY clause terms so that when the subqueries
   ** to the right and the left are evaluated, they use the correct
   ** collation.
   */
-  aPermute = sqlite3DbMallocRawNN(db, sizeof(int)*(nOrderBy + 1));
+  aPermute = sqlite3DbMallocRawNN(db, sizeof(u32)*(nOrderBy + 1));
   if( aPermute ){
     struct ExprList_item *pItem;
     aPermute[0] = nOrderBy;
     for(i=1, pItem=pOrderBy->a; i<=nOrderBy; i++, pItem++){
       assert( pItem->u.x.iOrderByCol>0 );
@@ -6721,11 +6721,11 @@
         const int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
         const int iCsr = pParse->nTab++;     /* Cursor to scan b-tree */
         Index *pIdx;                         /* Iterator variable */
         KeyInfo *pKeyInfo = 0;               /* Keyinfo for scanned index */
         Index *pBest = 0;                    /* Best index found so far */
-        int iRoot = pTab->tnum;              /* Root page of scanned b-tree */
+        Pgno iRoot = pTab->tnum;             /* Root page of scanned b-tree */
 
         sqlite3CodeVerifySchema(pParse, iDb);
         sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
 
         /* Search for the index that has the lowest scan cost.
@@ -6753,11 +6753,11 @@
           iRoot = pBest->tnum;
           pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pBest);
         }
 
         /* Open a read-only cursor, execute the OP_Count, close the cursor. */
-        sqlite3VdbeAddOp4Int(v, OP_OpenRead, iCsr, iRoot, iDb, 1);
+        sqlite3VdbeAddOp4Int(v, OP_OpenRead, iCsr, (int)iRoot, iDb, 1);
         if( pKeyInfo ){
           sqlite3VdbeChangeP4(v, -1, (char *)pKeyInfo, P4_KEYINFO);
         }
         sqlite3VdbeAddOp2(v, OP_Count, iCsr, pAggInfo->aFunc[0].iMem);
         sqlite3VdbeAddOp1(v, OP_Close, iCsr);

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -1184,13 +1184,13 @@
 /*
 ** Defer sourcing vdbe.h and btree.h until after the "u8" and
 ** "BusyHandler" typedefs. vdbe.h also requires a few of the opaque
 ** pointer types (i.e. FuncDef) defined above.
 */
+#include "pager.h"
 #include "btree.h"
 #include "vdbe.h"
-#include "pager.h"
 #include "pcache.h"
 #include "os.h"
 #include "mutex.h"
 
 /* The SQLITE_EXTRA_DURABLE compile-time option used to set the default
@@ -1480,11 +1480,11 @@
   int nChange;                  /* Value returned by sqlite3_changes() */
   int nTotalChange;             /* Value returned by sqlite3_total_changes() */
   int aLimit[SQLITE_N_LIMIT];   /* Limits */
   int nMaxSorterMmap;           /* Maximum size of regions mapped by sorter */
   struct sqlite3InitInfo {      /* Information used during initialization */
-    int newTnum;                /* Rootpage of table being initialized */
+    Pgno newTnum;               /* Rootpage of table being initialized */
     u8 iDb;                     /* Which db file is being initialized */
     u8 busy;                    /* TRUE if currently initializing */
     unsigned orphanTrigger : 1; /* Last statement is orphaned TEMP trigger */
     unsigned imposterTable : 1; /* Building an imposter table */
     unsigned reopenMemdb : 1;   /* ATTACH is really a reopen using MemDB */
@@ -2119,11 +2119,11 @@
   Select *pSelect;     /* NULL for tables.  Points to definition if a view. */
   FKey *pFKey;         /* Linked list of all foreign keys in this table */
   char *zColAff;       /* String defining the affinity of each column */
   ExprList *pCheck;    /* All CHECK constraints */
                        /*   ... also used as column name list in a VIEW */
-  int tnum;            /* Root BTree page for this table */
+  Pgno tnum;           /* Root BTree page for this table */
   u32 nTabRef;         /* Number of pointers to this Table */
   u32 tabFlags;        /* Mask of TF_* values */
   i16 iPKey;           /* If not negative, use aCol[iPKey] as the rowid */
   i16 nCol;            /* Number of columns in this table */
   i16 nNVCol;          /* Number of columns that are not VIRTUAL */
@@ -2412,11 +2412,11 @@
   Schema *pSchema;         /* Schema containing this index */
   u8 *aSortOrder;          /* for each column: True==DESC, False==ASC */
   const char **azColl;     /* Array of collation sequence names for index */
   Expr *pPartIdxWhere;     /* WHERE clause for partial indices */
   ExprList *aColExpr;      /* Column expressions */
-  int tnum;                /* DB Page containing root of this index */
+  Pgno tnum;               /* DB Page containing root of this index */
   LogEst szIdxRow;         /* Estimated average row size in bytes */
   u16 nKeyCol;             /* Number of columns forming the key */
   u16 nColumn;             /* Number of columns stored in the index */
   u8 onError;              /* OE_Abort, OE_Ignore, OE_Replace, or OE_None */
   unsigned idxType:2;      /* 0:Normal 1:UNIQUE, 2:PRIMARY KEY, 3:IPK */
@@ -3627,10 +3627,11 @@
   char **pzErrMsg;    /* Error message stored here */
   int iDb;            /* 0 for main database.  1 for TEMP, 2.. for ATTACHed */
   int rc;             /* Result code stored here */
   u32 mInitFlags;     /* Flags controlling error messages */
   u32 nInitRow;       /* Number of rows processed */
+  Pgno mxPage;        /* Maximum page number.  0 for no limit. */
 } InitData;
 
 /*
 ** Allowed values for mInitFlags
 */
@@ -4463,10 +4464,11 @@
 int sqlite3FixTriggerStep(DbFixer*, TriggerStep*);
 int sqlite3RealSameAsInt(double,sqlite3_int64);
 void sqlite3Int64ToText(i64,char*);
 int sqlite3AtoF(const char *z, double*, int, u8);
 int sqlite3GetInt32(const char *, int*);
+int sqlite3GetUInt32(const char*, u32*);
 int sqlite3Atoi(const char*);
 #ifndef SQLITE_OMIT_UTF16
 int sqlite3Utf16ByteLen(const void *pData, int nChar);
 #endif
 int sqlite3Utf8CharLen(const char *pData, int nByte);
@@ -4590,11 +4592,11 @@
 #endif
 #endif /* SQLITE_AMALGAMATION */
 #ifdef VDBE_PROFILE
 extern sqlite3_uint64 sqlite3NProfileCnt;
 #endif
-void sqlite3RootPageMoved(sqlite3*, int, int, int);
+void sqlite3RootPageMoved(sqlite3*, int, Pgno, Pgno);
 void sqlite3Reindex(Parse*, Token*, Token*);
 void sqlite3AlterFunctions(void);
 void sqlite3AlterRenameTable(Parse*, SrcList*, Token*);
 void sqlite3AlterRenameColumn(Parse*, SrcList*, Token*, Token*);
 int sqlite3GetToken(const unsigned char *, int *);
@@ -4704,11 +4706,11 @@
 #else
 # define sqlite3CloseExtensions(X)
 #endif
 
 #ifndef SQLITE_OMIT_SHARED_CACHE
-  void sqlite3TableLock(Parse *, int, int, u8, const char *);
+  void sqlite3TableLock(Parse *, int, Pgno, u8, const char *);
 #else
   #define sqlite3TableLock(v,w,x,y,z)
 #endif
 
 #ifdef SQLITE_TEST

Index: src/test1.c
==================================================================
--- src/test1.c
+++ src/test1.c
@@ -6434,10 +6434,34 @@
     return TCL_ERROR;
   }
   sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, i, db);
   return TCL_OK;
 }
+
+/*
+** tclcmd:  extra_schema_checks BOOLEAN
+**
+** Enable or disable schema checks when parsing the sqlite_schema file.
+** This is always enabled in production, but it is sometimes useful to
+** disable the checks in order to make some internal error states reachable
+** for testing.
+*/
+static int SQLITE_TCLAPI extra_schema_checks(
+  ClientData clientData, /* Pointer to sqlite3_enable_XXX function */
+  Tcl_Interp *interp,    /* The TCL interpreter that invoked this command */
+  int objc,              /* Number of arguments */
+  Tcl_Obj *CONST objv[]  /* Command arguments */
+){
+  int i = 0;
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "BOOLEAN");
+    return TCL_ERROR;
+  }
+  if( Tcl_GetBooleanFromObj(interp,objv[1],&i) ) return TCL_ERROR;
+  sqlite3_test_control(SQLITE_TESTCTRL_EXTRA_SCHEMA_CHECKS, i);
+  return TCL_OK;
+}
 
 /*
 ** tclcmd:  database_may_be_corrupt
 **
 ** Indicate that database files might be corrupt. In other words, set the normal
@@ -8001,10 +8025,11 @@
 
      { "save_prng_state",               save_prng_state,    0 },
      { "restore_prng_state",            restore_prng_state, 0 },
      { "reset_prng_state",              reset_prng_state,   0 },
      { "prng_seed",                     prng_seed,          0 },
+     { "extra_schema_checks",           extra_schema_checks,    0},
      { "database_never_corrupt",        database_never_corrupt, 0},
      { "database_may_be_corrupt",       database_may_be_corrupt, 0},
      { "optimization_control",          optimization_control,0},
 #if SQLITE_OS_WIN
      { "lock_win32_file",               win32_file_lock,    0 },

Index: src/util.c
==================================================================
--- src/util.c
+++ src/util.c
@@ -603,11 +603,11 @@
 void sqlite3Int64ToText(i64 v, char *zOut){
   int i;
   u64 x;
   char zTemp[22];
   if( v<0 ){
-    x = (v==SMALLEST_INT64) ? ((u64)1)<<63 : -v;
+    x = (v==SMALLEST_INT64) ? ((u64)1)<<63 : (u64)-v;
   }else{
     x = v;
   }
   i = sizeof(zTemp)-2;
   zTemp[sizeof(zTemp)-1] = 0;
@@ -857,13 +857,31 @@
 ** Return a 32-bit integer value extracted from a string.  If the
 ** string is not an integer, just return 0.
 */
 int sqlite3Atoi(const char *z){
   int x = 0;
-  if( z ) sqlite3GetInt32(z, &x);
+  sqlite3GetInt32(z, &x);
   return x;
 }
+
+/*
+** Try to convert z into an unsigned 32-bit integer.  Return true on
+** success and false if there is an error.
+**
+** Only decimal notation is accepted.
+*/
+int sqlite3GetUInt32(const char *z, u32 *pI){
+  u64 v = 0;
+  int i;
+  for(i=0; sqlite3Isdigit(z[i]); i++){
+    v = v*10 + z[i] - '0';
+    if( v>4294967296LL ){ *pI = 0; return 0; }
+  }
+  if( i==0 || z[i]!=0 ){ *pI = 0; return 0; }
+  *pI = (u32)v;
+  return 1;
+}
 
 /*
 ** The variable-length integer encoding is as follows:
 **
 ** KEY:

Index: src/vdbe.c
==================================================================
--- src/vdbe.c
+++ src/vdbe.c
@@ -2248,14 +2248,14 @@
   int n;
   int i;
   int p1;
   int p2;
   const KeyInfo *pKeyInfo;
-  int idx;
+  u32 idx;
   CollSeq *pColl;    /* Collating sequence to use on this term */
   int bRev;          /* True for DESCENDING sort order */
-  int *aPermute;     /* The permutation */
+  u32 *aPermute;     /* The permutation */
 
   if( (pOp->p5 & OPFLAG_PERMUTE)==0 ){
     aPermute = 0;
   }else{
     assert( pOp>aOp );
@@ -2280,11 +2280,11 @@
     assert( p1>0 && p1+n<=(p->nMem+1 - p->nCursor)+1 );
     assert( p2>0 && p2+n<=(p->nMem+1 - p->nCursor)+1 );
   }
 #endif /* SQLITE_DEBUG */
   for(i=0; i<n; i++){
-    idx = aPermute ? aPermute[i] : i;
+    idx = aPermute ? aPermute[i] : (u32)i;
     assert( memIsValid(&aMem[p1+idx]) );
     assert( memIsValid(&aMem[p2+idx]) );
     REGISTER_TRACE(p1+idx, &aMem[p1+idx]);
     REGISTER_TRACE(p2+idx, &aMem[p2+idx]);
     assert( i<pKeyInfo->nKeyField );
@@ -2591,11 +2591,11 @@
 ** the result is guaranteed to only be used as the argument of a length()
 ** or typeof() function, respectively.  The loading of large blobs can be
 ** skipped for length() and all content loading can be skipped for typeof().
 */
 case OP_Column: {
-  int p2;            /* column number to retrieve */
+  u32 p2;            /* column number to retrieve */
   VdbeCursor *pC;    /* The VDBE cursor */
   BtCursor *pCrsr;   /* The BTree cursor */
   u32 *aOffset;      /* aOffset[i] is offset to start of data for i-th column */
   int len;           /* The length of the serialized data for the column */
   int i;             /* Loop counter */
@@ -2609,11 +2609,11 @@
   Mem *pReg;         /* PseudoTable input register */
 
   assert( pOp->p1>=0 && pOp->p1<p->nCursor );
   pC = p->apCsr[pOp->p1];
   assert( pC!=0 );
-  p2 = pOp->p2;
+  p2 = (u32)pOp->p2;
 
   /* If the cursor cache is stale (meaning it is not currently point at
   ** the correct row) then bring it up-to-date by doing the necessary 
   ** B-Tree seek. */
   rc = sqlite3VdbeCursorMoveto(&pC, &p2);
@@ -2736,11 +2736,11 @@
           zHdr += sqlite3GetVarint32(zHdr, &t);
           pC->aType[i] = t;
           offset64 += sqlite3VdbeSerialTypeLen(t);
         }
         aOffset[++i] = (u32)(offset64 & 0xffffffff);
-      }while( i<=p2 && zHdr<zEndHdr );
+      }while( (u32)i<=p2 && zHdr<zEndHdr );
 
       /* The record is corrupt if any of the following are true:
       ** (1) the bytes of the header extend past the declared header size
       ** (2) the entire header was used but not all data was used
       ** (3) the end of the data extends beyond the end of the record.
@@ -3760,11 +3760,11 @@
 ** See also: OP_OpenRead, OP_ReopenIdx
 */
 case OP_ReopenIdx: {
   int nField;
   KeyInfo *pKeyInfo;
-  int p2;
+  u32 p2;
   int iDb;
   int wrFlag;
   Btree *pX;
   VdbeCursor *pCur;
   Db *pDb;
@@ -3791,11 +3791,11 @@
     goto abort_due_to_error;
   }
 
   nField = 0;
   pKeyInfo = 0;
-  p2 = pOp->p2;
+  p2 = (u32)pOp->p2;
   iDb = pOp->p3;
   assert( iDb>=0 && iDb<db->nDb );
   assert( DbMaskTest(p->btreeMask, iDb) );
   pDb = &db->aDb[iDb];
   pX = pDb->pBt;
@@ -3963,11 +3963,11 @@
       ** opening it. If a transient table is required, just use the
       ** automatically created table with root-page 1 (an BLOB_INTKEY table).
       */
       if( (pCx->pKeyInfo = pKeyInfo = pOp->p4.pKeyInfo)!=0 ){
         assert( pOp->p4type==P4_KEYINFO );
-        rc = sqlite3BtreeCreateTable(pCx->pBtx, (int*)&pCx->pgnoRoot,
+        rc = sqlite3BtreeCreateTable(pCx->pBtx, &pCx->pgnoRoot,
                                      BTREE_BLOBKEY | pOp->p5); 
         if( rc==SQLITE_OK ){
           assert( pCx->pgnoRoot==SCHEMA_ROOT+1 );
           assert( pKeyInfo->db==db );
           assert( pKeyInfo->enc==ENC(db) );
@@ -5227,14 +5227,10 @@
   ** generator) then the fix would be to insert a call to
   ** sqlite3VdbeCursorMoveto().
   */
   assert( pC->deferredMoveto==0 );
   assert( sqlite3BtreeCursorIsValid(pCrsr) );
-#if 0  /* Not required due to the previous to assert() statements */
-  rc = sqlite3VdbeCursorMoveto(pC);
-  if( rc!=SQLITE_OK ) goto abort_due_to_error;
-#endif
 
   n = sqlite3BtreePayloadSize(pCrsr);
   if( n>(u32)db->aLimit[SQLITE_LIMIT_LENGTH] ){
     goto too_big;
   }
@@ -6000,11 +5996,11 @@
   sqlite3VdbeIncrWriteCounter(p, 0);
   nChange = 0;
   assert( p->readOnly==0 );
   assert( DbMaskTest(p->btreeMask, pOp->p2) );
   rc = sqlite3BtreeClearTable(
-      db->aDb[pOp->p2].pBt, pOp->p1, (pOp->p3 ? &nChange : 0)
+      db->aDb[pOp->p2].pBt, (u32)pOp->p1, (pOp->p3 ? &nChange : 0)
   );
   if( pOp->p3 ){
     p->nChange += nChange;
     if( pOp->p3>0 ){
       assert( memIsValid(&aMem[pOp->p3]) );
@@ -6049,11 +6045,11 @@
 ** P1>1.  The P3 argument must be 1 (BTREE_INTKEY) for a rowid table
 ** it must be 2 (BTREE_BLOBKEY) for an index or WITHOUT ROWID table.
 ** The root page number of the new b-tree is stored in register P2.
 */
 case OP_CreateBtree: {          /* out2 */
-  int pgno;
+  Pgno pgno;
   Db *pDb;
 
   sqlite3VdbeIncrWriteCounter(p, 0);
   pOut = out2Prerelease(p, pOp);
   pgno = 0;
@@ -6124,10 +6120,11 @@
     zSchema = DFLT_SCHEMA_TABLE;
     initData.db = db;
     initData.iDb = iDb;
     initData.pzErrMsg = &p->zErrMsg;
     initData.mInitFlags = 0;
+    initData.mxPage = sqlite3BtreeLastPage(db->aDb[iDb].pBt);
     zSql = sqlite3MPrintf(db,
        "SELECT*FROM\"%w\".%s WHERE %s ORDER BY rowid",
        db->aDb[iDb].zDbSName, zSchema, pOp->p4.z);
     if( zSql==0 ){
       rc = SQLITE_NOMEM_BKPT;
@@ -6237,11 +6234,11 @@
 **
 ** This opcode is used to implement the integrity_check pragma.
 */
 case OP_IntegrityCk: {
   int nRoot;      /* Number of tables to check.  (Number of root pages.) */
-  int *aRoot;     /* Array of rootpage numbers for tables to be checked */
+  Pgno *aRoot;    /* Array of rootpage numbers for tables to be checked */
   int nErr;       /* Number of errors reported */
   char *z;        /* Text of the error report */
   Mem *pnErr;     /* Register keeping track of errors remaining */
 
   assert( p->bIsReader );

Index: src/vdbe.h
==================================================================
--- src/vdbe.h
+++ src/vdbe.h
@@ -55,11 +55,11 @@
     sqlite3_context *pCtx; /* Used when p4type is P4_FUNCCTX */
     CollSeq *pColl;        /* Used when p4type is P4_COLLSEQ */
     Mem *pMem;             /* Used when p4type is P4_MEM */
     VTable *pVtab;         /* Used when p4type is P4_VTAB */
     KeyInfo *pKeyInfo;     /* Used when p4type is P4_KEYINFO */
-    int *ai;               /* Used when p4type is P4_INTARRAY */
+    u32 *ai;               /* Used when p4type is P4_INTARRAY */
     SubProgram *pProgram;  /* Used when p4type is P4_SUBPROGRAM */
     Table *pTab;           /* Used when p4type is P4_TABLE */
 #ifdef SQLITE_ENABLE_CURSOR_HINTS
     Expr *pExpr;           /* Used when p4type is P4_EXPR */
 #endif

Index: src/vdbeInt.h
==================================================================
--- src/vdbeInt.h
+++ src/vdbeInt.h
@@ -87,11 +87,11 @@
   Bool useRandomRowid:1;  /* Generate new record numbers semi-randomly */
   Bool isOrdered:1;       /* True if the table is not BTREE_UNORDERED */
   Bool seekHit:1;         /* See the OP_SeekHit and OP_IfNoHope opcodes */
   Btree *pBtx;            /* Separate file holding temporary table */
   i64 seqCount;           /* Sequence counter */
-  int *aAltMap;           /* Mapping from table to index column numbers */
+  u32 *aAltMap;           /* Mapping from table to index column numbers */
 
   /* Cached OP_Column parse information is only valid if cacheStatus matches
   ** Vdbe.cacheCtr.  Vdbe.cacheCtr will never take on the value of
   ** CACHE_STALE (0) and so setting cacheStatus=CACHE_STALE guarantees that
   ** the cache is out of date. */
@@ -483,11 +483,11 @@
 */
 void sqlite3VdbeError(Vdbe*, const char *, ...);
 void sqlite3VdbeFreeCursor(Vdbe *, VdbeCursor*);
 void sqliteVdbePopStack(Vdbe*,int);
 int SQLITE_NOINLINE sqlite3VdbeFinishMoveto(VdbeCursor*);
-int sqlite3VdbeCursorMoveto(VdbeCursor**, int*);
+int sqlite3VdbeCursorMoveto(VdbeCursor**, u32*);
 int sqlite3VdbeCursorRestore(VdbeCursor*);
 u32 sqlite3VdbeSerialTypeLen(u32);
 u8 sqlite3VdbeOneByteSerialTypeLen(u8);
 u32 sqlite3VdbeSerialPut(unsigned char*, Mem*, u32);
 u32 sqlite3VdbeSerialGet(const unsigned char*, u32, Mem*);

Index: src/vdbeaux.c
==================================================================
--- src/vdbeaux.c
+++ src/vdbeaux.c
@@ -1710,16 +1710,16 @@
       sqlite3_str_appendf(&x, "vtab:%p", pVtab);
       break;
     }
 #endif
     case P4_INTARRAY: {
-      int i;
-      int *ai = pOp->p4.ai;
-      int n = ai[0];   /* The first element of an INTARRAY is always the
+      u32 i;
+      u32 *ai = pOp->p4.ai;
+      u32 n = ai[0];   /* The first element of an INTARRAY is always the
                        ** count of the number of elements to follow */
       for(i=1; i<=n; i++){
-        sqlite3_str_appendf(&x, "%c%d", (i==1 ? '[' : ','), ai[i]);
+        sqlite3_str_appendf(&x, "%c%u", (i==1 ? '[' : ','), ai[i]);
       }
       sqlite3_str_append(&x, "]", 1);
       break;
     }
     case P4_SUBPROGRAM: {
@@ -3559,15 +3559,15 @@
 ** a NULL row.
 **
 ** If the cursor is already pointing to the correct row and that row has
 ** not been deleted out from under the cursor, then this routine is a no-op.
 */
-int sqlite3VdbeCursorMoveto(VdbeCursor **pp, int *piCol){
+int sqlite3VdbeCursorMoveto(VdbeCursor **pp, u32 *piCol){
   VdbeCursor *p = *pp;
   assert( p->eCurType==CURTYPE_BTREE || p->eCurType==CURTYPE_PSEUDO );
   if( p->deferredMoveto ){
-    int iMap;
+    u32 iMap;
     if( p->aAltMap && (iMap = p->aAltMap[1+*piCol])>0 && !p->nullRow ){
       *pp = p->pAltCursor;
       *piCol = iMap - 1;
       return SQLITE_OK;
     }

Index: src/vdbevtab.c
==================================================================
--- src/vdbevtab.c
+++ src/vdbevtab.c
@@ -204,11 +204,11 @@
     }else{
       if( i<=2 && pCur->zType==0 ){
         Schema *pSchema;
         HashElem *k;
         int iDb = pOp->p3;
-        int iRoot = pOp->p2;
+        Pgno iRoot = (Pgno)pOp->p2;
         sqlite3 *db = pVTab->db;
         pSchema = db->aDb[iDb].pSchema;
         pCur->zSchema = db->aDb[iDb].zDbSName;
         for(k=sqliteHashFirst(&pSchema->tblHash); k; k=sqliteHashNext(k)){
           Table *pTab = (Table*)sqliteHashData(k);

Index: src/wal.c
==================================================================
--- src/wal.c
+++ src/wal.c
@@ -506,11 +506,11 @@
 **   walIteratorFree() - Free an iterator.
 **
 ** This functionality is used by the checkpoint code (see walCheckpoint()).
 */
 struct WalIterator {
-  int iPrior;                     /* Last result returned from the iterator */
+  u32 iPrior;                     /* Last result returned from the iterator */
   int nSegment;                   /* Number of entries in aSegment[] */
   struct WalSegment {
     int iNext;                    /* Next slot in aIndex[] not yet returned */
     ht_slot *aIndex;              /* i0, i1, i2... such that aPgno[iN] ascend */
     u32 *aPgno;                   /* Array of page numbers. */
@@ -965,10 +965,11 @@
        && (iHash>=1 || iFrame<=HASHTABLE_NPAGE_ONE)
        && (iHash<=1 || iFrame>(HASHTABLE_NPAGE_ONE+HASHTABLE_NPAGE))
        && (iHash>=2 || iFrame<=HASHTABLE_NPAGE_ONE+HASHTABLE_NPAGE)
        && (iHash<=2 || iFrame>(HASHTABLE_NPAGE_ONE+2*HASHTABLE_NPAGE))
   );
+  assert( iHash>=0 );
   return iHash;
 }
 
 /*
 ** Return the page number associated with frame iFrame in this WAL.
@@ -1184,12 +1185,12 @@
     u8 *aData;                    /* Pointer to data part of aFrame buffer */
     int szPage;                   /* Page size according to the log */
     u32 magic;                    /* Magic value read from WAL header */
     u32 version;                  /* Magic value read from WAL header */
     int isValid;                  /* True if this frame is valid */
-    int iPg;                      /* Current 32KB wal-index page */
-    int iLastFrame;               /* Last frame in wal, based on nSize alone */
+    u32 iPg;                      /* Current 32KB wal-index page */
+    u32 iLastFrame;               /* Last frame in wal, based on nSize alone */
 
     /* Read in the WAL header. */
     rc = sqlite3OsRead(pWal->pWalFd, aBuf, WAL_HDRSIZE, 0);
     if( rc!=SQLITE_OK ){
       goto recovery_error;
@@ -1242,16 +1243,16 @@
     aData = &aFrame[WAL_FRAME_HDRSIZE];
     aPrivate = (u32*)&aData[szPage];
 
     /* Read all frames from the log file. */
     iLastFrame = (nSize - WAL_HDRSIZE) / szFrame;
-    for(iPg=0; iPg<=walFramePage(iLastFrame); iPg++){
+    for(iPg=0; iPg<=(u32)walFramePage(iLastFrame); iPg++){
       u32 *aShare;
-      int iFrame;                 /* Index of last frame read */
-      int iLast = MIN(iLastFrame, HASHTABLE_NPAGE_ONE+iPg*HASHTABLE_NPAGE);
-      int iFirst = 1 + (iPg==0?0:HASHTABLE_NPAGE_ONE+(iPg-1)*HASHTABLE_NPAGE);
-      int nHdr, nHdr32;
+      u32 iFrame;                 /* Index of last frame read */
+      u32 iLast = MIN(iLastFrame, HASHTABLE_NPAGE_ONE+iPg*HASHTABLE_NPAGE);
+      u32 iFirst = 1 + (iPg==0?0:HASHTABLE_NPAGE_ONE+(iPg-1)*HASHTABLE_NPAGE);
+      u32 nHdr, nHdr32;
       rc = walIndexPage(pWal, iPg, (volatile u32**)&aShare);
       if( rc ) break;
       pWal->apWiData[iPg] = aPrivate;
       
       for(iFrame=iFirst; iFrame<=iLast; iFrame++){

Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -1050,11 +1050,11 @@
   if( (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)
    && DbMaskAllZero(sqlite3ParseToplevel(pParse)->writeMask)
   ){
     int i;
     Table *pTab = pIdx->pTable;
-    int *ai = (int*)sqlite3DbMallocZero(pParse->db, sizeof(int)*(pTab->nCol+1));
+    u32 *ai = (u32*)sqlite3DbMallocZero(pParse->db, sizeof(u32)*(pTab->nCol+1));
     if( ai ){
       ai[0] = pTab->nCol;
       for(i=0; i<pIdx->nColumn-1; i++){
         int x1, x2;
         assert( pIdx->aiColumn[i]<pTab->nCol );

Index: test/corrupt3.test
==================================================================
--- test/corrupt3.test
+++ test/corrupt3.test
@@ -92,11 +92,11 @@
   hexio_write test.db 2044 [hexio_render_int32 4]
   sqlite3 db test.db
   catchsql {
     SELECT substr(x,1,10) FROM t1
   }
-} [list 0 0123456789]
+} [list 1 {database disk image is malformed}]
 do_test corrupt3-1.10 {
   catchsql {
     PRAGMA integrity_check
   }
 } {0 {{*** in database main ***

Index: test/corruptL.test
==================================================================
--- test/corruptL.test
+++ test/corruptL.test
@@ -1172,17 +1172,19 @@
 |    480: 01 35 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .5tablet1t1.CREA
 |    496: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 63 29   TE TABLE t1(a,c)
 | end clusterfuzz-testcase-minimized-sqlite3_dbfuzz2_fuzzer-4806406219825152
 }]} {}
 
+extra_schema_checks 0
 do_catchsql_test 14.1 {
   PRAGMA integrity_check;
 } {1 {database disk image is malformed}}
 
 do_catchsql_test 14.2 {
   ALTER TABLE t1 RENAME TO alkjalkjdfiiiwuer987lkjwer82mx97sf98788s9789s; 
 } {1 {database disk image is malformed}}
+extra_schema_checks 1
 
 #-------------------------------------------------------------------------
 reset_db
 do_test 15.0 {
   sqlite3 db {}
@@ -1261,13 +1263,15 @@
 |   4064: 0e 02 04 11 13 07 63 31 63 31 64 37 20 31 20 31   ......c1c1d7 1 1
 |   4080: 0e 01 04 11 13 17 63 31 63 31 63 37 20 31 00 00   ......c1c1c7 1..
 | end crash-3afa1ca9e9c1bd.db
 }]} {}
 
+extra_schema_checks 0
 do_execsql_test 15.1 {
   UPDATE c1 SET c= NOT EXISTS(SELECT 1 FROM c1 ORDER BY (SELECT 1 FROM c1 ORDER BY a)) +10 WHERE d BETWEEN 4 AND 7;
 } {}
+extra_schema_checks 1
 
 #-------------------------------------------------------------------------
 reset_db
 do_execsql_test 16.0 {
   CREATE TABLE t1(w, x, y, z, UNIQUE(w, x), UNIQUE(y, z));
@@ -1289,7 +1293,5 @@
   PRAGMA writable_schema = ON;
   INSERT INTO t1(rowid, w, x, y, z) VALUES(5, 10, 11, 10, NULL);
 } {1 {database disk image is malformed}}
 
 finish_test
-
-

Index: test/dbfuzz001.test
==================================================================
--- test/dbfuzz001.test
+++ test/dbfuzz001.test
@@ -359,14 +359,16 @@
 |    496: 04 03 03 02 01 04 03 02 02 01 02 03 01 02 01 02   ................
 | end x/c02.db
   }]
 } {}
 
+extra_schema_checks 0
 do_catchsql_test dbfuzz001-320 {
   PRAGMA integrity_check;
 } {1 {database disk image is malformed}}
 
 do_catchsql_test dbfuzz001-330 {
   DELETE FROM t3 WHERE x IN (SELECT x FROM t4);
 } {1 {database disk image is malformed}}
+extra_schema_checks 1
 
 finish_test

Index: test/fts3corrupt4.test
==================================================================
--- test/fts3corrupt4.test
+++ test/fts3corrupt4.test
@@ -25,10 +25,11 @@
   return
 }
 
 sqlite3_fts3_may_be_corrupt 1
 database_may_be_corrupt
+extra_schema_checks 0
 
 do_execsql_test 1.0 {
   BEGIN;
     CREATE VIRTUAL TABLE ft USING fts3;
     INSERT INTO ft VALUES('aback');
@@ -6279,10 +6280,11 @@
   SELECT * FROM t0
     WHERE t0 MATCH x'2b0a312b0a312a312a2a0b5d0a0b0b0a312a0a0b0b0a312a0b310a392a0b0a27312a2a0b5d0a312a0b310a31315d0b310a312a316d2a0b313b15bceaa50a312a0b0a27312a2a0b5d0a312a0b310a312b0b2a310a312a0b2a0b2a0b2e5d0a0bff313336e34a2a312a0b0a3c310b0a0b4b4b0b4b2a4bec40322b2a0b310a0a312a0a0a0a0a0a0a0a0a0b310a312a2a2a0b5d0a0b0b0a312a0b310a312a0b0a4e4541530b310a5df5ced70a0a0a0a0a4f520a0a0a0a0a0a0a312a0b0a4e4541520b310a5d616161610a0a0a0a4f520a0a0a0a0a0a312b0a312a312a0a0a0a0a0a0a004a0b0a310b220a0b0a310a4a22310a0b0a7e6fe0e0e030e0e0e0e0e01176e02000e0e0e0e0e01131320226310a0b0a310a4a22310a0b0a310a766f8b8b4ee0e0300ae0090909090909090909090909090909090909090909090909090909090909090947aaaa540b09090909090909090909090909090909090909090909090909090909090909fae0e0f2f22164e0e0f273e07fefefef7d6dfafafafa6d6d6d6d';
 } {1 {database disk image is malformed}}
 
 set sqlite_fts3_enable_parentheses $saved
+extra_schema_checks 1
 
 #-------------------------------------------------------------------------
 reset_db
 do_execsql_test 47.1 {
   CREATE VIRTUAL TABLE t1 USING fts3(a,b,c);
@@ -6293,8 +6295,7 @@
 }
 
 do_catchsql_test 47.3 {
   SELECT matchinfo(t1) FROM t1 WHERE t1 MATCH '"json1 enable"';
 } {1 {database disk image is malformed}}
-
 
 finish_test

Index: test/pager1.test
==================================================================
--- test/pager1.test
+++ test/pager1.test
@@ -1928,10 +1928,11 @@
   hexio_write test.db [expr ($pgno-1)*1024] 90000000
   sqlite3 db2 test.db
   catchsql { SELECT length(x||'') FROM t2 } db2
 } {1 {database disk image is malformed}}
 db2 close
+extra_schema_checks 0
 do_test pager1-18.5 {
   sqlite3 db ""
   sqlite3_db_config db DEFENSIVE 0
   execsql {
     CREATE TABLE t1(a, b);
@@ -1942,10 +1943,11 @@
     ALTER TABLE t1 RENAME TO x1;
   }
   catchsql { SELECT * FROM x1 }
 } {1 {database disk image is malformed}}
 db close
+extra_schema_checks 1
 
 do_test pager1-18.6 {
   faultsim_delete_and_reopen
   db func a_string a_string
   execsql {

Index: test/tester.tcl
==================================================================
--- test/tester.tcl
+++ test/tester.tcl
@@ -2477,8 +2477,9 @@
 # During testing, assume that all database files are well-formed.  The
 # few test cases that deliberately corrupt database files should rescind 
 # this setting by invoking "database_can_be_corrupt"
 #
 database_never_corrupt
+extra_schema_checks 1
 
 source $testdir/thread_common.tcl
 source $testdir/malloc_common.tcl

ADDED   tool/enlargedb.c
Index: tool/enlargedb.c
==================================================================
--- /dev/null
+++ tool/enlargedb.c
@@ -0,0 +1,68 @@
+/*
+** Try to enlarge an SQLite database by appending many unused pages.
+** The resulting database will fail PRAGMA integrity_check due to the
+** appended unused pages, but it should work otherwise.
+**
+** Usage:
+**
+**        enlargedb  DATABASE   N
+**
+** Adds N blank pages onto the end of DATABASE.  N can be decimal
+** or hex.  The total number of pages after adding must be no greater
+** than 4294967297
+*/
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv){
+  char *zEnd;
+  long long int toAppend;
+  long long int currentSz;
+  long long int newSz;
+  FILE *f;
+  size_t got;
+  int pgsz;
+  char zero = 0;
+  unsigned char buf[100];
+
+  if( argc!=3 ) goto usage_error;
+  toAppend = strtoll(argv[2], &zEnd, 0);
+  if( zEnd==argv[2] || zEnd[0] ) goto usage_error;
+  if( toAppend<1 ){
+    fprintf(stderr, "N must be at least 1\n");
+    exit(1);
+  }
+  f = fopen(argv[1], "r+b");
+  if( f==0 ){
+    fprintf(stderr, "cannot open \"%s\" for reading and writing\n", argv[1]);
+    exit(1);
+  }
+  got = fread(buf, 1, sizeof(buf), f);
+  if( got!=sizeof(buf) ) goto not_valid_db;
+  if( strcmp((char*)buf,"SQLite format 3")!=0 ) goto not_valid_db;
+  pgsz = (buf[16]<<8) + buf[17];
+  if( pgsz==1 ) pgsz = 65536;
+  if( pgsz<512 || pgsz>65536 || (pgsz&(pgsz-1))!=0 ) goto not_valid_db;
+  currentSz = (buf[28]<<24) + (buf[29]<<16) + (buf[30]<<8) + buf[31];
+  newSz = currentSz + toAppend;
+  if( newSz > 0xffffffff ) newSz = 0xffffffff;
+  buf[28] = (newSz>>24) & 0xff;
+  buf[29] = (newSz>>16) & 0xff;
+  buf[30] = (newSz>>8) & 0xff;
+  buf[31] = newSz & 0xff;
+  fseek(f, 28, SEEK_SET);
+  fwrite(&buf[28],4,1,f);
+  fseek(f, (long)(newSz*pgsz - 1), SEEK_SET);
+  fwrite(&zero,1,1,f);
+  fclose(f);
+  return 0;  
+
+not_valid_db:
+  fprintf(stderr,"not a valid database: %s\n", argv[1]);
+  exit(1);  
+
+usage_error:
+  fprintf(stderr,"Usage: %s DATABASE N\n", argv[0]);
+  exit(1);
+}

Index: tool/showdb.c
==================================================================
--- tool/showdb.c
+++ tool/showdb.c
@@ -18,24 +18,25 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
 #include "sqlite3.h"
 
+typedef unsigned char u8;         /* unsigned 8-bit */
+typedef unsigned int u32;         /* unsigned 32-bit */
+typedef sqlite3_int64 i64;        /* signed 64-bit */
+typedef sqlite3_uint64 u64;       /* unsigned 64-bit */
+
 
 static struct GlobalData {
-  int pagesize;                   /* Size of a database page */
+  u32 pagesize;                   /* Size of a database page */
   int dbfd;                       /* File descriptor for reading the DB */
-  int mxPage;                     /* Last page number */
+  u32 mxPage;                     /* Last page number */
   int perLine;                    /* HEX elements to print per line */
   int bRaw;                       /* True to access db file via OS APIs */
   sqlite3_file *pFd;              /* File descriptor for non-raw mode */
   sqlite3 *pDb;                   /* Database handle that owns pFd */
 } g = {1024, -1, 0, 16,   0, 0, 0};
-
-
-typedef long long int i64;      /* Datatype for 64-bit integers */
-
 
 /*
 ** Convert the var-int format into i64.  Return the number of bytes
 ** in the var-int.  Write the var-int value into *pVal.
 */
@@ -52,11 +53,11 @@
 }
 
 /*
 ** Extract a big-endian 32-bit integer
 */
-static unsigned int decodeInt32(const unsigned char *z){
+static u32 decodeInt32(const u8 *z){
   return (z[0]<<24) + (z[1]<<16) + (z[2]<<8) + z[3];
 }
 
 /* Report an out-of-memory error and die.
 */
@@ -139,11 +140,11 @@
 ** to be freed by the caller.
 */
 static unsigned char *fileRead(sqlite3_int64 ofst, int nByte){
   unsigned char *aData;
   int got;
-  aData = sqlite3_malloc(nByte+32);
+  aData = sqlite3_malloc64(32+(i64)nByte);
   if( aData==0 ) out_of_memory();
   memset(aData, 0, nByte+32);
   if( g.bRaw==0 ){
     int rc = g.pFd->pMethods->xRead(g.pFd, (void*)aData, nByte, ofst);
     if( rc!=SQLITE_OK && rc!=SQLITE_IOERR_SHORT_READ ){
@@ -159,12 +160,12 @@
 }
 
 /*
 ** Return the size of the file in byte.
 */
-static sqlite3_int64 fileGetsize(void){
-  sqlite3_int64 res = 0;
+static i64 fileGetsize(void){
+  i64 res = 0;
   if( g.bRaw==0 ){
     int rc = g.pFd->pMethods->xFileSize(g.pFd, &res);
     if( rc!=SQLITE_OK ){
       fprintf(stderr, "error in xFileSize() - %d\n", rc);
       exit(1);
@@ -183,13 +184,13 @@
 
 /*
 ** Print a range of bytes as hex and as ascii.
 */
 static unsigned char *print_byte_range(
-  int ofst,          /* First byte in the range of bytes to print */
-  int nByte,         /* Number of bytes to print */
-  int printOfst      /* Add this amount to the index on the left column */
+  sqlite3_int64 ofst,  /* First byte in the range of bytes to print */
+  int nByte,           /* Number of bytes to print */
+  int printOfst        /* Add this amount to the index on the left column */
 ){
   unsigned char *aData;
   int i, j;
   const char *zOfstFmt;
 
@@ -205,10 +206,16 @@
     zOfstFmt = " %08x: ";
   }
 
   aData = fileRead(ofst, nByte);
   for(i=0; i<nByte; i += g.perLine){
+    int go = 0;
+    for(j=0; j<g.perLine; j++){
+      if( i+j>nByte ){ break; }
+      if( aData[i+j] ){ go = 1; break; }
+    }
+    if( !go && i>0 && i+g.perLine<nByte ) continue;
     fprintf(stdout, zOfstFmt, i+printOfst);
     for(j=0; j<g.perLine; j++){
       if( i+j>nByte ){
         fprintf(stdout, "   ");
       }else{
@@ -228,30 +235,30 @@
 }
 
 /*
 ** Print an entire page of content as hex
 */
-static void print_page(int iPg){
-  int iStart;
+static void print_page(u32 iPg){
+  i64 iStart;
   unsigned char *aData;
-  iStart = (iPg-1)*g.pagesize;
-  fprintf(stdout, "Page %d:   (offsets 0x%x..0x%x)\n",
+  iStart = ((i64)(iPg-1))*g.pagesize;
+  fprintf(stdout, "Page %u:   (offsets 0x%llx..0x%llx)\n",
           iPg, iStart, iStart+g.pagesize-1);
   aData = print_byte_range(iStart, g.pagesize, 0);
   sqlite3_free(aData);
 }
 
 
-/* Print a line of decode output showing a 4-byte integer.
+/* Print a line of decoded output showing a 4-byte unsigned integer.
 */
 static void print_decode_line(
   unsigned char *aData,      /* Content being decoded */
   int ofst, int nByte,       /* Start and size of decode */
   const char *zMsg           /* Message to append */
 ){
   int i, j;
-  int val = aData[ofst];
+  u32 val = aData[ofst];
   char zBuf[100];
   sprintf(zBuf, " %03x: %02x", ofst, aData[ofst]);
   i = (int)strlen(zBuf);
   for(j=1; j<4; j++){
     if( j>=nByte ){
@@ -260,11 +267,11 @@
       sprintf(&zBuf[i], " %02x", aData[ofst+j]);
       val = val*256 + aData[ofst+j];
     }
     i += (int)strlen(&zBuf[i]);
   }
-  sprintf(&zBuf[i], "   %9d", val);
+  sprintf(&zBuf[i], "   %10u", val);
   printf("%s  %s\n", zBuf, zMsg);
 }
 
 /*
 ** Decode the database header.
@@ -294,10 +301,11 @@
   print_decode_line(aData, 80, 4, "meta[10]");
   print_decode_line(aData, 84, 4, "meta[11]");
   print_decode_line(aData, 88, 4, "meta[12]");
   print_decode_line(aData, 92, 4, "Change counter for version number");
   print_decode_line(aData, 96, 4, "SQLite version number");
+  sqlite3_free(aData);
 }
 
 /*
 ** Describe cell content.
 */
@@ -406,21 +414,21 @@
   char **pzDesc           /* Store description here */
 ){
   int i;
   i64 nDesc = 0;
   int n = 0;
-  int leftChild;
+  u32 leftChild;
   i64 nPayload;
   i64 rowid;
   i64 nLocal;
   static char zDesc[1000];
   i = 0;
   if( cType<=5 ){
     leftChild = ((a[0]*256 + a[1])*256 + a[2])*256 + a[3];
     a += 4;
     n += 4;
-    sprintf(zDesc, "lx: %d ", leftChild);
+    sprintf(zDesc, "lx: %u ", leftChild);
     nDesc = strlen(zDesc);
   }
   if( cType!=5 ){
     i = decodeVarint(a, &nPayload);
     a += i;
@@ -437,14 +445,14 @@
     n += i;
     sprintf(&zDesc[nDesc], "r: %lld ", rowid);
     nDesc += strlen(&zDesc[nDesc]);
   }
   if( nLocal<nPayload ){
-    int ovfl;
+    u32 ovfl;
     unsigned char *b = &a[nLocal];
     ovfl = ((b[0]*256 + b[1])*256 + b[2])*256 + b[3];
-    sprintf(&zDesc[nDesc], "ov: %d ", ovfl);
+    sprintf(&zDesc[nDesc], "ov: %u ", ovfl);
     nDesc += strlen(&zDesc[nDesc]);
     n += 4;
   }
   if( showCellContent && cType!=5 ){
     nDesc += describeContent(a, nLocal, &zDesc[nDesc-1]);
@@ -483,11 +491,11 @@
   int iCell,              /* Cell index */
   int szPgHdr,            /* Size of the page header.  0 or 100 */
   int ofst                /* Cell begins at a[ofst] */
 ){
   int i, j = 0;
-  int leftChild;
+  u32 leftChild;
   i64 k;
   i64 nPayload;
   i64 rowid;
   i64 nHdr;
   i64 iType;
@@ -502,11 +510,11 @@
 
   printf("Cell[%d]:\n", iCell);
   if( cType<=5 ){
     leftChild = ((x[0]*256 + x[1])*256 + x[2])*256 + x[3];
     printBytes(a, x, 4);
-    printf("left child page:: %d\n", leftChild);
+    printf("left child page:: %u\n", leftChild);
     x += 4;
   }
   if( cType!=5 ){
     i = decodeVarint(x, &nPayload);
     printBytes(a, x, i);
@@ -620,11 +628,11 @@
     printBytes(a, x+j, 0);
     printf("... %lld bytes of content ...\n", nLocal-j);
   }
   if( nLocal<nPayload ){
     printBytes(a, x+nLocal, 4);
-    printf("overflow-page: %d\n", decodeInt32(x+nLocal));
+    printf("overflow-page: %u\n", decodeInt32(x+nLocal));
   }
 }
 
 
 /*
@@ -727,25 +735,26 @@
 
 /*
 ** Decode a freelist trunk page.
 */
 static void decode_trunk_page(
-  int pgno,             /* The page number */
+  u32 pgno,             /* The page number */
   int detail,           /* Show leaf pages if true */
   int recursive         /* Follow the trunk change if true */
 ){
-  int n, i;
+  u32 i;
+  u32 n;
   unsigned char *a;
   while( pgno>0 ){
     a = fileRead((pgno-1)*g.pagesize, g.pagesize);
     printf("Decode of freelist trunk page %d:\n", pgno);
     print_decode_line(a, 0, 4, "Next freelist trunk page");
     print_decode_line(a, 4, 4, "Number of entries on this page");
     if( detail ){
-      n = (int)decodeInt32(&a[4]);
-      for(i=0; i<n; i++){
-        unsigned int x = decodeInt32(&a[8+4*i]);
+      n = decodeInt32(&a[4]);
+      for(i=0; i<n && i<g.pagesize/4; i++){
+        u32 x = decodeInt32(&a[8+4*i]);
         char zIdx[10];
         sprintf(zIdx, "[%d]", i);
         printf("  %5s %7u", zIdx, x);
         if( i%5==4 ) printf("\n");
       }
@@ -752,11 +761,11 @@
       if( i%5!=0 ) printf("\n");
     }
     if( !recursive ){
       pgno = 0;
     }else{
-      pgno = (int)decodeInt32(&a[0]);
+      pgno = decodeInt32(&a[0]);
     }
     sqlite3_free(a);
   }
 }
 
@@ -766,19 +775,19 @@
 static char **zPageUse;
 
 /*
 ** Add a comment on the use of a page.
 */
-static void page_usage_msg(int pgno, const char *zFormat, ...){
+static void page_usage_msg(u32 pgno, const char *zFormat, ...){
   va_list ap;
   char *zMsg;
 
   va_start(ap, zFormat);
   zMsg = sqlite3_vmprintf(zFormat, ap);
   va_end(ap);
   if( pgno<=0 || pgno>g.mxPage ){
-    printf("ERROR: page %d out of range 1..%d: %s\n",
+    printf("ERROR: page %d out of range 1..%u: %s\n",
             pgno, g.mxPage, zMsg);
     sqlite3_free(zMsg);
     return;
   }
   if( zPageUse[pgno]!=0 ){
@@ -794,11 +803,11 @@
 ** Find overflow pages of a cell and describe their usage.
 */
 static void page_usage_cell(
   unsigned char cType,    /* Page type */
   unsigned char *a,       /* Cell content */
-  int pgno,               /* page containing the cell */
+  u32 pgno,               /* page containing the cell */
   int cellno              /* Index of the cell on the page */
 ){
   int i;
   int n = 0;
   i64 nPayload;
@@ -821,14 +830,14 @@
     i = decodeVarint(a, &rowid);
     a += i;
     n += i;
   }
   if( nLocal<nPayload ){
-    int ovfl = decodeInt32(a+nLocal);
-    int cnt = 0;
+    u32 ovfl = decodeInt32(a+nLocal);
+    u32 cnt = 0;
     while( ovfl && (cnt++)<g.mxPage ){
-      page_usage_msg(ovfl, "overflow %d from cell %d of page %d",
+      page_usage_msg(ovfl, "overflow %d from cell %d of page %u",
                      cnt, cellno, pgno);
       a = fileRead((ovfl-1)*(sqlite3_int64)g.pagesize, 4);
       ovfl = decodeInt32(a);
       sqlite3_free(a);
     }
@@ -849,12 +858,12 @@
 **
 ** If parent==0, then this is the root of a btree.  If parent<0 then
 ** this is an orphan page.
 */
 static void page_usage_btree(
-  int pgno,             /* Page to describe */
-  int parent,           /* Parent of this page.  0 for root pages */
+  u32 pgno,             /* Page to describe */
+  u32 parent,           /* Parent of this page.  0 for root pages */
   int idx,              /* Which child of the parent */
   const char *zName     /* Name of the table */
 ){
   unsigned char *a;
   const char *zType = "corrupt node";
@@ -899,13 +908,13 @@
   }else{
     page_usage_msg(pgno, "orphaned %s, %s", zType, zEntry);
   }
   if( a[hdr]==2 || a[hdr]==5 ){
     int cellstart = hdr+12;
-    unsigned int child;
+    u32 child;
     for(i=0; i<nCell; i++){
-      int ofst;
+      u32 ofst;
 
       ofst = cellstart + i*2;
       ofst = a[ofst]*256 + a[ofst+1];
       child = decodeInt32(a+ofst);
       page_usage_btree(child, pgno, i, zName);
@@ -926,11 +935,11 @@
 }
 
 /*
 ** Determine page usage by the freelist
 */
-static void page_usage_freelist(int pgno){
+static void page_usage_freelist(u32 pgno){
   unsigned char *a;
   int cnt = 0;
   int i;
   int n;
   int iNext;
@@ -953,17 +962,17 @@
 }
 
 /*
 ** Determine pages used as PTRMAP pages
 */
-static void page_usage_ptrmap(unsigned char *a){
+static void page_usage_ptrmap(u8 *a){
   if( decodeInt32(a+52) ){
     int usable = g.pagesize - a[20];
-    int pgno = 2;
+    u64 pgno = 2;
     int perPage = usable/5;
     while( pgno<=g.mxPage ){
-      page_usage_msg(pgno, "PTRMAP page covering %d..%d",
+      page_usage_msg((u32)pgno, "PTRMAP page covering %llu..%llu",
                            pgno+1, pgno+perPage);
       pgno += perPage + 1;
     }
   }
 }
@@ -970,11 +979,11 @@
 
 /*
 ** Try to figure out how every page in the database file is being used.
 */
 static void page_usage_report(const char *zPrg, const char *zDbName){
-  int i, j;
+  u32 i, j;
   int rc;
   sqlite3 *db;
   sqlite3_stmt *pStmt;
   unsigned char *a;
   char zQuery[200];
@@ -988,11 +997,11 @@
   /* Open the database file */
   db = openDatabase(zPrg, zDbName);
 
   /* Set up global variables zPageUse[] and g.mxPage to record page
   ** usages */
-  zPageUse = sqlite3_malloc( sizeof(zPageUse[0])*(g.mxPage+1) );
+  zPageUse = sqlite3_malloc64( sizeof(zPageUse[0])*(g.mxPage+1) );
   if( zPageUse==0 ) out_of_memory();
   memset(zPageUse, 0, sizeof(zPageUse[0])*(g.mxPage+1));
 
   /* Discover the usage of each page */
   a = fileRead(0, 100);
@@ -1006,11 +1015,11 @@
              "SELECT type, name, rootpage FROM SQLITE_MASTER WHERE rootpage"
              " ORDER BY rowid %s", j?"DESC":"");
     rc = sqlite3_prepare_v2(db, zQuery, -1, &pStmt, 0);
     if( rc==SQLITE_OK ){
       while( sqlite3_step(pStmt)==SQLITE_ROW ){
-        int pgno = sqlite3_column_int(pStmt, 2);
+        u32 pgno = (u32)sqlite3_column_int64(pStmt, 2);
         page_usage_btree(pgno, 0, 0, (const char*)sqlite3_column_text(pStmt,1));
       }
     }else{
       printf("ERROR: cannot query database: %s\n", sqlite3_errmsg(db));
     }
@@ -1020,11 +1029,11 @@
   sqlite3_close(db);
 
   /* Print the report and free memory used */
   for(i=1; i<=g.mxPage; i++){
     if( zPageUse[i]==0 ) page_usage_btree(i, -1, 0, 0);
-    printf("%5d: %s\n", i, zPageUse[i] ? zPageUse[i] : "???");
+    printf("%5u: %s\n", i, zPageUse[i] ? zPageUse[i] : "???");
     sqlite3_free(zPageUse[i]);
   }
   sqlite3_free(zPageUse);
   zPageUse = 0;
 }
@@ -1031,11 +1040,11 @@
 
 /*
 ** Try to figure out how every page in the database file is being used.
 */
 static void ptrmap_coverage_report(const char *zDbName){
-  int pgno;
+  u64 pgno;
   unsigned char *aHdr;
   unsigned char *a;
   int usable;
   int perPage;
   int i;
@@ -1055,24 +1064,24 @@
   usable = g.pagesize - aHdr[20];
   perPage = usable/5;
   sqlite3_free(aHdr);
   printf("%5d: root of sqlite_schema\n", 1);
   for(pgno=2; pgno<=g.mxPage; pgno += perPage+1){
-    printf("%5d: PTRMAP page covering %d..%d\n", pgno,
+    printf("%5llu: PTRMAP page covering %llu..%llu\n", pgno,
            pgno+1, pgno+perPage);
     a = fileRead((pgno-1)*g.pagesize, usable);
     for(i=0; i+5<=usable && pgno+1+i/5<=g.mxPage; i+=5){
       const char *zType = "???";
-      unsigned int iFrom = decodeInt32(&a[i+1]);
+      u32 iFrom = decodeInt32(&a[i+1]);
       switch( a[i] ){
         case 1:  zType = "b-tree root page";        break;
         case 2:  zType = "freelist page";           break;
         case 3:  zType = "first page of overflow";  break;
         case 4:  zType = "later page of overflow";  break;
         case 5:  zType = "b-tree non-root page";    break;
       }
-      printf("%5d: %s, parent=%u\n", pgno+1+i/5, zType, iFrom);
+      printf("%5llu: %s, parent=%u\n", pgno+1+i/5, zType, iFrom);
     }
     sqlite3_free(a);
   }
 }
 
@@ -1130,20 +1139,20 @@
   g.pagesize = zPgSz[0]*256 + zPgSz[1]*65536;
   if( g.pagesize==0 ) g.pagesize = 1024;
   sqlite3_free(zPgSz);
 
   printf("Pagesize: %d\n", g.pagesize);
-  g.mxPage = (int)((szFile+g.pagesize-1)/g.pagesize);
+  g.mxPage = (u32)((szFile+g.pagesize-1)/g.pagesize);
 
-  printf("Available pages: 1..%d\n", g.mxPage);
+  printf("Available pages: 1..%u\n", g.mxPage);
   if( nArg==2 ){
-    int i;
+    u32 i;
     for(i=1; i<=g.mxPage; i++) print_page(i);
   }else{
     int i;
     for(i=2; i<nArg; i++){
-      int iStart, iEnd;
+      u32 iStart, iEnd;
       char *zLeft;
       if( strcmp(azArg[i], "dbheader")==0 ){
         print_db_header();
         continue;
       }
@@ -1161,11 +1170,11 @@
       }
       if( !ISDIGIT(azArg[i][0]) ){
         fprintf(stderr, "%s: unknown option: [%s]\n", zPrg, azArg[i]);
         continue;
       }
-      iStart = strtol(azArg[i], &zLeft, 0);
+      iStart = strtoul(azArg[i], &zLeft, 0);
       if( zLeft && strcmp(zLeft,"..end")==0 ){
         iEnd = g.mxPage;
       }else if( zLeft && zLeft[0]=='.' && zLeft[1]=='.' ){
         iEnd = strtol(&zLeft[2], 0, 0);
       }else if( zLeft && zLeft[0]=='b' ){