sessionBufferGrow.patch

Index: ext/session/sqlite3session.c
==================================================================
--- ext/session/sqlite3session.c
+++ ext/session/sqlite3session.c
@@ -1977,11 +1977,20 @@
 static int sessionBufferGrow(SessionBuffer *p, size_t nByte, int *pRc){
   if( *pRc==SQLITE_OK && (size_t)(p->nAlloc-p->nBuf)<nByte ){
     u8 *aNew;
     i64 nNew = p->nAlloc ? p->nAlloc : 128;
     do {
-      nNew = nNew*2;
+      /* limit growth to 2 bytes below our max threshold as defined
+       in sqlite3Malloc(), otherwise we would hit OOM condition when
+       requesting to grow the buffer >= 1/2 max threshold */
+      nNew = MIN(nNew*2, 0x7FFFFEFE);
+      /* if we've hit 2 bytes below our max threshold and still haven't
+       reached the requested size, break out with OOM */
+      if ( nNew == 0x7FFFFEFE && (size_t)(nNew-p->nBuf)<nByte ){
+        *pRc = SQLITE_NOMEM;
+        break;
+      }
     }while( (size_t)(nNew-p->nBuf)<nByte );
 
     aNew = (u8 *)sqlite3_realloc64(p->aBuf, nNew);
     if( 0==aNew ){
       *pRc = SQLITE_NOMEM;