Prevent an infinite loop while searching a corrupt freelist.

FossilOrigin-Name: 4e5424fe89eed346f6cf26a05c72694d1eb9f58f

manifest

@@ -1,5 +1,5 @@
-C Strengthen\sthe\snew\sbalance_nonroot()\scode\sagainst\svarious\scorrupt\sdatabase\nproblems.
-D 2015-06-24T12:07:40.692
+C Prevent\san\sinfinite\sloop\swhile\ssearching\sa\scorrupt\sfreelist.
+D 2015-06-24T12:24:03.684
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in 1063c58075b7400d93326b0eb332b48a54f53025
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -192,7 +192,7 @@ F src/auth.c b56c78ebe40a2110fd361379f7e8162d23f92240
 F src/backup.c ff743689c4d6c5cb55ad42ed9d174b2b3e71f1e3
 F src/bitvec.c 5eb7958c3bf65210211cbcfc44eff86d0ded7c9d
 F src/btmutex.c 45a968cc85afed9b5e6cf55bf1f42f8d18107f79
-F src/btree.c 2167a4fdf8ab24b0bc066969db47f4c17a7773ec
+F src/btree.c 1fbed35020af5a1f6d531748223b774c57934c58
 F src/btree.h 969adc948e89e449220ff0ff724c94bb2a52e9f1
 F src/btreeInt.h 6ece2dd9c8e2eac05f0a8ded8772a44e96486c65
 F src/build.c b3f15255d5b16e42dafeaa638fd4f8a47c94ed70
@@ -1286,7 +1286,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 48bd54594752d5be3337f12c72f28d2080cb630b
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P e0195070f84f418c46698627a2dcbfcfb94d999c
-R 7d5a275fb657ecb8665ac07bebe4c955
+P 5ba983432069714afebbb2f0ef22d41be52f7a4c
+R fe400a5b514399d4ba64d3ad8d7504b9
 U drh
-Z 5227e07a1b8f384d21181ee18b88f9b4
+Z 86686a0d10808f274a0105773f11c508

manifest.uuid

@@ -1 +1 @@
-5ba983432069714afebbb2f0ef22d41be52f7a4c
+4e5424fe89eed346f6cf26a05c72694d1eb9f58f

src/btree.c

@@ -5423,6 +5423,7 @@ static int allocateBtreePage(
     /* There are pages on the freelist.  Reuse one of those pages. */
     Pgno iTrunk;
     u8 searchList = 0; /* If the free-list must be searched for 'nearby' */
+    int nSearch = 0;   /* Count of the number of search attempts */
     
     /* If eMode==BTALLOC_EXACT and a query of the pointer-map
     ** shows that the page 'nearby' is somewhere on the free-list, then
@@ -5471,7 +5472,7 @@ static int allocateBtreePage(
         iTrunk = get4byte(&pPage1->aData[32]);
       }
       testcase( iTrunk==mxPage );
-      if( iTrunk>mxPage ){
+      if( iTrunk>mxPage || nSearch++ > n ){
         rc = SQLITE_CORRUPT_BKPT;
       }else{
         rc = btreeGetUnusedPage(pBt, iTrunk, &pTrunk, 0);