Boundary Value tests are standard practice when doing extensive testing.

Bugs rarely occur for typical input values but more often occur at the "boundaries" or limits of the input domain.

That being said I don't really fault SQlites testing here.

The key takeaway for me is that even with exhaustive testing you can still have security issues like this, so perhaps what is needed is a language or methodology change.

If SQLite, a quality codebase with exhaustive tests, can have memory vulnerabilities, maybe we need to leave C behind.