gitlab.com/CoiaPrant/sqlite3@v1.19.1/testdata/tcl/dbfuzz2.c (about) 1 /* 2 ** 2018-10-26 3 ** 4 ** The author disclaims copyright to this source code. In place of 5 ** a legal notice, here is a blessing: 6 ** 7 ** May you do good and not evil. 8 ** May you find forgiveness for yourself and forgive others. 9 ** May you share freely, never taking more than you give. 10 ** 11 ************************************************************************* 12 ** 13 ** This program is designed for fuzz-testing SQLite database files using 14 ** the -fsanitize=fuzzer option of clang. 15 ** 16 ** The -fsanitize=fuzzer option causes a main() to be inserted automatically. 17 ** That main() invokes LLVMFuzzerTestOneInput(D,S) to be invoked repeatedly. 18 ** Each D is a fuzzed database file. The code in this file runs various 19 ** SQL statements against that database, trying to provoke a failure. 20 ** 21 ** For best results the seed database files should have these tables: 22 ** 23 ** Table "t1" with columns "a" and "b" 24 ** Tables "t2" and "t3 with the same number of compatible columns 25 ** "t3" should have a column names "x" 26 ** Table "t4" with a column "x" that is compatible with t3.x. 27 ** 28 ** Any of these tables can be virtual tables, for example FTS or RTree tables. 29 ** 30 ** To run this test: 31 ** 32 ** mkdir dir 33 ** cp dbfuzz2-seed*.db dir 34 ** clang-6.0 -I. -g -O1 -fsanitize=fuzzer -DTHREADSAFE=0 \ 35 ** -DSQLITE_ENABLE_DBSTAT_VTAB dbfuzz2.c sqlite3.c -ldl 36 ** ./a.out dir 37 */ 38 #include <assert.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <string.h> 42 #include <stdarg.h> 43 #include <ctype.h> 44 #include <stdint.h> 45 #ifndef _WIN32 46 #include <sys/time.h> 47 #include <sys/resource.h> 48 #endif 49 #include "sqlite3.h" 50 51 /* 52 ** This is the is the SQL that is run against the database. 53 */ 54 static const char *azSql[] = { 55 "PRAGMA integrity_check;", 56 "SELECT * FROM sqlite_schema;", 57 "SELECT sum(length(name)) FROM dbstat;", 58 "UPDATE t1 SET b=a, a=b WHERE a<b;", 59 "ALTER TABLE t1 RENAME TO alkjalkjdfiiiwuer987lkjwer82mx97sf98788s9789s;", 60 "INSERT INTO t3 SELECT * FROM t2;", 61 "DELETE FROM t3 WHERE x IN (SELECT x FROM t4);", 62 "REINDEX;", 63 "DROP TABLE t3;", 64 "VACUUM;", 65 }; 66 67 /* Output verbosity level. 0 means complete silence */ 68 int eVerbosity = 0; 69 70 /* True to activate PRAGMA vdbe_debug=on */ 71 static int bVdbeDebug = 0; 72 73 /* Maximum size of the in-memory database file */ 74 static sqlite3_int64 szMax = 104857600; 75 76 /* Progress handler callback data */ 77 static int nCb = 0; /* Number of callbacks seen so far */ 78 static int mxCb = 250000; /* Maximum allowed callbacks */ 79 80 /***** Copy/paste from ext/misc/memtrace.c ***************************/ 81 /* The original memory allocation routines */ 82 static sqlite3_mem_methods memtraceBase; 83 static FILE *memtraceOut; 84 85 /* Methods that trace memory allocations */ 86 static void *memtraceMalloc(int n){ 87 if( memtraceOut ){ 88 fprintf(memtraceOut, "MEMTRACE: allocate %d bytes\n", 89 memtraceBase.xRoundup(n)); 90 } 91 return memtraceBase.xMalloc(n); 92 } 93 static void memtraceFree(void *p){ 94 if( p==0 ) return; 95 if( memtraceOut ){ 96 fprintf(memtraceOut, "MEMTRACE: free %d bytes\n", memtraceBase.xSize(p)); 97 } 98 memtraceBase.xFree(p); 99 } 100 static void *memtraceRealloc(void *p, int n){ 101 if( p==0 ) return memtraceMalloc(n); 102 if( n==0 ){ 103 memtraceFree(p); 104 return 0; 105 } 106 if( memtraceOut ){ 107 fprintf(memtraceOut, "MEMTRACE: resize %d -> %d bytes\n", 108 memtraceBase.xSize(p), memtraceBase.xRoundup(n)); 109 } 110 return memtraceBase.xRealloc(p, n); 111 } 112 static int memtraceSize(void *p){ 113 return memtraceBase.xSize(p); 114 } 115 static int memtraceRoundup(int n){ 116 return memtraceBase.xRoundup(n); 117 } 118 static int memtraceInit(void *p){ 119 return memtraceBase.xInit(p); 120 } 121 static void memtraceShutdown(void *p){ 122 memtraceBase.xShutdown(p); 123 } 124 125 /* The substitute memory allocator */ 126 static sqlite3_mem_methods ersaztMethods = { 127 memtraceMalloc, 128 memtraceFree, 129 memtraceRealloc, 130 memtraceSize, 131 memtraceRoundup, 132 memtraceInit, 133 memtraceShutdown 134 }; 135 136 /* Begin tracing memory allocations to out. */ 137 int sqlite3MemTraceActivate(FILE *out){ 138 int rc = SQLITE_OK; 139 if( memtraceBase.xMalloc==0 ){ 140 rc = sqlite3_config(SQLITE_CONFIG_GETMALLOC, &memtraceBase); 141 if( rc==SQLITE_OK ){ 142 rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &ersaztMethods); 143 } 144 } 145 memtraceOut = out; 146 return rc; 147 } 148 149 /* Deactivate memory tracing */ 150 int sqlite3MemTraceDeactivate(void){ 151 int rc = SQLITE_OK; 152 if( memtraceBase.xMalloc!=0 ){ 153 rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &memtraceBase); 154 if( rc==SQLITE_OK ){ 155 memset(&memtraceBase, 0, sizeof(memtraceBase)); 156 } 157 } 158 memtraceOut = 0; 159 return rc; 160 } 161 /***** End copy/paste from ext/misc/memtrace.c ***************************/ 162 163 /* 164 ** Progress handler callback 165 ** 166 ** Count the number of callbacks and cause an abort once the limit is 167 ** reached. 168 */ 169 static int progress_handler(void *pNotUsed){ 170 nCb++; 171 if( nCb<mxCb ) return 0; 172 if( eVerbosity>=1 ){ 173 printf("-- Progress limit of %d reached\n", mxCb); 174 } 175 return 1; 176 } 177 178 /* libFuzzer invokes this routine with fuzzed database files (in aData). 179 ** This routine run SQLite against the malformed database to see if it 180 ** can provoke a failure or malfunction. 181 */ 182 int LLVMFuzzerTestOneInput(const uint8_t *aData, size_t nByte){ 183 unsigned char *a; 184 sqlite3 *db; 185 int rc; 186 int i; 187 sqlite3_int64 x; 188 char *zErr = 0; 189 190 if( eVerbosity>=1 ){ 191 printf("************** nByte=%d ***************\n", (int)nByte); 192 fflush(stdout); 193 } 194 if( sqlite3_initialize() ) return 0; 195 rc = sqlite3_open(0, &db); 196 if( rc ) return 1; 197 a = sqlite3_malloc64(nByte+1); 198 if( a==0 ) return 1; 199 memcpy(a, aData, nByte); 200 sqlite3_deserialize(db, "main", a, nByte, nByte, 201 SQLITE_DESERIALIZE_RESIZEABLE | 202 SQLITE_DESERIALIZE_FREEONCLOSE); 203 x = szMax; 204 #ifdef SQLITE_FCNTL_SIZE_LIMIT 205 sqlite3_file_control(db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x); 206 #endif 207 if( bVdbeDebug ){ 208 sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 209 } 210 if( mxCb>0 ){ 211 sqlite3_progress_handler(db, 10, progress_handler, 0); 212 } 213 #ifdef SQLITE_TESTCTRL_PRNG_SEED 214 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db); 215 #endif 216 for(i=0; i<sizeof(azSql)/sizeof(azSql[0]); i++){ 217 if( eVerbosity>=1 ){ 218 printf("%s\n", azSql[i]); 219 fflush(stdout); 220 } 221 zErr = 0; 222 nCb = 0; 223 rc = sqlite3_exec(db, azSql[i], 0, 0, &zErr); 224 if( rc && eVerbosity>=1 ){ 225 printf("-- rc=%d zErr=%s\n", rc, zErr); 226 } 227 sqlite3_free(zErr); 228 } 229 rc = sqlite3_close(db); 230 if( rc!=SQLITE_OK ){ 231 fprintf(stdout, "sqlite3_close() returns %d\n", rc); 232 } 233 if( sqlite3_memory_used()!=0 ){ 234 int nAlloc = 0; 235 int nNotUsed = 0; 236 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 237 fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n", 238 sqlite3_memory_used(), nAlloc); 239 exit(1); 240 } 241 return 0; 242 } 243 244 /* 245 ** Return the number of "v" characters in a string. Return 0 if there 246 ** are any characters in the string other than "v". 247 */ 248 static int numberOfVChar(const char *z){ 249 int N = 0; 250 while( z[0] && z[0]=='v' ){ 251 z++; 252 N++; 253 } 254 return z[0]==0 ? N : 0; 255 } 256 257 /* libFuzzer invokes this routine once when the executable starts, to 258 ** process the command-line arguments. 259 */ 260 int LLVMFuzzerInitialize(int *pArgc, char ***pArgv){ 261 int i, j, n; 262 int argc = *pArgc; 263 char **argv = *pArgv; 264 for(i=j=1; i<argc; i++){ 265 char *z = argv[i]; 266 if( z[0]=='-' ){ 267 z++; 268 if( z[0]=='-' ) z++; 269 if( z[0]=='v' && (n = numberOfVChar(z))>0 ){ 270 eVerbosity += n; 271 continue; 272 } 273 if( strcmp(z,"vdbe-debug")==0 ){ 274 bVdbeDebug = 1; 275 continue; 276 } 277 if( strcmp(z,"limit")==0 ){ 278 if( i+1==argc ){ 279 fprintf(stderr, "missing argument to %s\n", argv[i]); 280 exit(1); 281 } 282 mxCb = strtol(argv[++i], 0, 0); 283 continue; 284 } 285 if( strcmp(z,"memtrace")==0 ){ 286 sqlite3MemTraceActivate(stdout); 287 continue; 288 } 289 if( strcmp(z,"max-db-size")==0 ){ 290 if( i+1==argc ){ 291 fprintf(stderr, "missing argument to %s\n", argv[i]); 292 exit(1); 293 } 294 szMax = strtol(argv[++i], 0, 0); 295 continue; 296 } 297 if( strcmp(z, "lookaside")==0 ){ 298 int sz, nSlot; 299 if( i+2>=argc ){ 300 fprintf(stderr, 301 "--lookaside requires two arguments: slot-size num-slots\n"); 302 exit(1); 303 } 304 sz = atoi(argv[++i]); 305 nSlot = atoi(argv[++i]); 306 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, sz, nSlot); 307 continue; 308 } 309 #ifndef _WIN32 310 if( strcmp(z,"max-stack")==0 311 || strcmp(z,"max-data")==0 312 || strcmp(z,"max-as")==0 313 ){ 314 struct rlimit x,y; 315 int resource = RLIMIT_STACK; 316 char *zType = "RLIMIT_STACK"; 317 if( i+1==argc ){ 318 fprintf(stderr, "missing argument to %s\n", argv[i]); 319 exit(1); 320 } 321 if( z[4]=='d' ){ 322 resource = RLIMIT_DATA; 323 zType = "RLIMIT_DATA"; 324 } 325 if( z[4]=='a' ){ 326 resource = RLIMIT_AS; 327 zType = "RLIMIT_AS"; 328 } 329 memset(&x,0,sizeof(x)); 330 getrlimit(resource, &x); 331 y.rlim_cur = atoi(argv[++i]); 332 y.rlim_max = x.rlim_cur; 333 setrlimit(resource, &y); 334 memset(&y,0,sizeof(y)); 335 getrlimit(resource, &y); 336 printf("%s changed from %d to %d\n", 337 zType, (int)x.rlim_cur, (int)y.rlim_cur); 338 continue; 339 } 340 #endif /* _WIN32 */ 341 } 342 argv[j++] = argv[i]; 343 } 344 argv[j] = 0; 345 *pArgc = j; 346 return 0; 347 } 348 349 #ifdef STANDALONE 350 /* 351 ** Read an entire file into memory. Space to hold the file comes 352 ** from malloc(). 353 */ 354 static unsigned char *readFile(const char *zName, int *pnByte){ 355 FILE *in = fopen(zName, "rb"); 356 long nIn; 357 size_t nRead; 358 unsigned char *pBuf; 359 if( in==0 ) return 0; 360 fseek(in, 0, SEEK_END); 361 nIn = ftell(in); 362 rewind(in); 363 pBuf = malloc( nIn+1 ); 364 if( pBuf==0 ){ fclose(in); return 0; } 365 nRead = fread(pBuf, nIn, 1, in); 366 fclose(in); 367 if( nRead!=1 ){ 368 free(pBuf); 369 return 0; 370 } 371 pBuf[nIn] = 0; 372 if( pnByte ) *pnByte = nIn; 373 return pBuf; 374 } 375 #endif /* STANDALONE */ 376 377 #ifdef STANDALONE 378 int main(int argc, char **argv){ 379 int i; 380 LLVMFuzzerInitialize(&argc, &argv); 381 for(i=1; i<argc; i++){ 382 unsigned char *pIn; 383 int nIn; 384 pIn = readFile(argv[i], &nIn); 385 if( pIn ){ 386 LLVMFuzzerTestOneInput((const uint8_t*)pIn, (size_t)nIn); 387 free(pIn); 388 } 389 } 390 #ifdef RUSAGE_SELF 391 if( eVerbosity>0 ){ 392 struct rusage x; 393 printf("SQLite %s\n", sqlite3_sourceid()); 394 memset(&x, 0, sizeof(x)); 395 if( getrusage(RUSAGE_SELF, &x)==0 ){ 396 printf("Maximum RSS = %ld KB\n", x.ru_maxrss); 397 } 398 } 399 #endif 400 return 0; 401 } 402 #endif /*STANDALONE*/