Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -3355,10 +3355,12 @@
       u8 *pCell = findCell(pPage, i);
       if( eType==PTRMAP_OVERFLOW1 ){
         CellInfo info;
         pPage->xParseCell(pPage, pCell, &info);
         if( info.nLocal<info.nPayload ){
+          testcase( pCell+info.nSize == pPage->aData+pPage->pBt->usableSize );
+          testcase( pCell+info.nSize == pPage->aData+pPage->pBt->usableSize+1 );
           if( pCell+info.nSize > pPage->aData+pPage->pBt->usableSize ){
             return SQLITE_CORRUPT_BKPT;
           }
           if( iFrom==get4byte(pCell+info.nSize-4) ){
             put4byte(pCell+info.nSize-4, iTo);