1 /*
2 ** 2018-10-26
3 **
4 ** The author disclaims copyright to this source code. In place of
5 ** a legal notice, here is a blessing:
6 **
7 ** May you do good and not evil.
8 ** May you find forgiveness for yourself and forgive others.
9 ** May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This program is designed for fuzz-testing SQLite database files using
14 ** the -fsanitize=fuzzer option of clang.
15 **
16 ** The -fsanitize=fuzzer option causes a main() to be inserted automatically.
17 ** That main() invokes LLVMFuzzerTestOneInput(D,S) to be invoked repeatedly.
18 ** Each D is a fuzzed database file. The code in this file runs various
19 ** SQL statements against that database, trying to provoke a failure.
20 **
21 ** For best results the seed database files should have these tables:
22 **
23 ** Table "t1" with columns "a" and "b"
24 ** Tables "t2" and "t3 with the same number of compatible columns
25 ** "t3" should have a column names "x"
26 ** Table "t4" with a column "x" that is compatible with t3.x.
27 **
28 ** Any of these tables can be virtual tables, for example FTS or RTree tables.
29 **
30 ** To run this test:
31 **
32 ** mkdir dir
33 ** cp dbfuzz2-seed*.db dir
34 ** clang-6.0 -I. -g -O1 -fsanitize=fuzzer -DTHREADSAFE=0 \
35 ** -DSQLITE_ENABLE_DBSTAT_VTAB dbfuzz2.c sqlite3.c -ldl
36 ** ./a.out dir
37 */
38 #include <assert.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <stdarg.h>
43 #include <ctype.h>
44 #include <stdint.h>
45 #ifndef _WIN32
46 #include <sys/time.h>
47 #include <sys/resource.h>
48 #endif
49 #include "sqlite3.h"
50
51 /*
52 ** This is the is the SQL that is run against the database.
53 */
54 static const char *azSql[] = {
55 "PRAGMA integrity_check;",
56 "SELECT * FROM sqlite_schema;",
57 "SELECT sum(length(name)) FROM dbstat;",
58 "UPDATE t1 SET b=a, a=b WHERE a<b;",
59 "ALTER TABLE t1 RENAME TO alkjalkjdfiiiwuer987lkjwer82mx97sf98788s9789s;",
60 "INSERT INTO t3 SELECT * FROM t2;",
61 "DELETE FROM t3 WHERE x IN (SELECT x FROM t4);",
62 "REINDEX;",
63 "DROP TABLE t3;",
64 "VACUUM;",
65 };
66
67 /* Output verbosity level. 0 means complete silence */
68 int eVerbosity = 0;
69
70 /* True to activate PRAGMA vdbe_debug=on */
71 static int bVdbeDebug = 0;
72
73 /* Maximum size of the in-memory database file */
74 static sqlite3_int64 szMax = 104857600;
75
76 /* Progress handler callback data */
77 static int nCb = 0; /* Number of callbacks seen so far */
78 static int mxCb = 250000; /* Maximum allowed callbacks */
79
80 /***** Copy/paste from ext/misc/memtrace.c ***************************/
81 /* The original memory allocation routines */
82 static sqlite3_mem_methods memtraceBase;
83 static FILE *memtraceOut;
84
85 /* Methods that trace memory allocations */
memtraceMalloc(int n)86 static void *memtraceMalloc(int n){
87 if( memtraceOut ){
88 fprintf(memtraceOut, "MEMTRACE: allocate %d bytes\n",
89 memtraceBase.xRoundup(n));
90 }
91 return memtraceBase.xMalloc(n);
92 }
memtraceFree(void * p)93 static void memtraceFree(void *p){
94 if( p==0 ) return;
95 if( memtraceOut ){
96 fprintf(memtraceOut, "MEMTRACE: free %d bytes\n", memtraceBase.xSize(p));
97 }
98 memtraceBase.xFree(p);
99 }
memtraceRealloc(void * p,int n)100 static void *memtraceRealloc(void *p, int n){
101 if( p==0 ) return memtraceMalloc(n);
102 if( n==0 ){
103 memtraceFree(p);
104 return 0;
105 }
106 if( memtraceOut ){
107 fprintf(memtraceOut, "MEMTRACE: resize %d -> %d bytes\n",
108 memtraceBase.xSize(p), memtraceBase.xRoundup(n));
109 }
110 return memtraceBase.xRealloc(p, n);
111 }
memtraceSize(void * p)112 static int memtraceSize(void *p){
113 return memtraceBase.xSize(p);
114 }
memtraceRoundup(int n)115 static int memtraceRoundup(int n){
116 return memtraceBase.xRoundup(n);
117 }
memtraceInit(void * p)118 static int memtraceInit(void *p){
119 return memtraceBase.xInit(p);
120 }
memtraceShutdown(void * p)121 static void memtraceShutdown(void *p){
122 memtraceBase.xShutdown(p);
123 }
124
125 /* The substitute memory allocator */
126 static sqlite3_mem_methods ersaztMethods = {
127 memtraceMalloc,
128 memtraceFree,
129 memtraceRealloc,
130 memtraceSize,
131 memtraceRoundup,
132 memtraceInit,
133 memtraceShutdown
134 };
135
136 /* Begin tracing memory allocations to out. */
sqlite3MemTraceActivate(FILE * out)137 int sqlite3MemTraceActivate(FILE *out){
138 int rc = SQLITE_OK;
139 if( memtraceBase.xMalloc==0 ){
140 rc = sqlite3_config(SQLITE_CONFIG_GETMALLOC, &memtraceBase);
141 if( rc==SQLITE_OK ){
142 rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &ersaztMethods);
143 }
144 }
145 memtraceOut = out;
146 return rc;
147 }
148
149 /* Deactivate memory tracing */
sqlite3MemTraceDeactivate(void)150 int sqlite3MemTraceDeactivate(void){
151 int rc = SQLITE_OK;
152 if( memtraceBase.xMalloc!=0 ){
153 rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &memtraceBase);
154 if( rc==SQLITE_OK ){
155 memset(&memtraceBase, 0, sizeof(memtraceBase));
156 }
157 }
158 memtraceOut = 0;
159 return rc;
160 }
161 /***** End copy/paste from ext/misc/memtrace.c ***************************/
162
163 /*
164 ** Progress handler callback
165 **
166 ** Count the number of callbacks and cause an abort once the limit is
167 ** reached.
168 */
progress_handler(void * pNotUsed)169 static int progress_handler(void *pNotUsed){
170 nCb++;
171 if( nCb<mxCb ) return 0;
172 if( eVerbosity>=1 ){
173 printf("-- Progress limit of %d reached\n", mxCb);
174 }
175 return 1;
176 }
177
178 /* libFuzzer invokes this routine with fuzzed database files (in aData).
179 ** This routine run SQLite against the malformed database to see if it
180 ** can provoke a failure or malfunction.
181 */
LLVMFuzzerTestOneInput(const uint8_t * aData,size_t nByte)182 int LLVMFuzzerTestOneInput(const uint8_t *aData, size_t nByte){
183 unsigned char *a;
184 sqlite3 *db;
185 int rc;
186 int i;
187 sqlite3_int64 x;
188 char *zErr = 0;
189
190 if( eVerbosity>=1 ){
191 printf("************** nByte=%d ***************\n", (int)nByte);
192 fflush(stdout);
193 }
194 if( sqlite3_initialize() ) return 0;
195 rc = sqlite3_open(0, &db);
196 if( rc ) return 1;
197 a = sqlite3_malloc64(nByte+1);
198 if( a==0 ) return 1;
199 memcpy(a, aData, nByte);
200 sqlite3_deserialize(db, "main", a, nByte, nByte,
201 SQLITE_DESERIALIZE_RESIZEABLE |
202 SQLITE_DESERIALIZE_FREEONCLOSE);
203 x = szMax;
204 #ifdef SQLITE_FCNTL_SIZE_LIMIT
205 sqlite3_file_control(db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x);
206 #endif
207 if( bVdbeDebug ){
208 sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0);
209 }
210 if( mxCb>0 ){
211 sqlite3_progress_handler(db, 10, progress_handler, 0);
212 }
213 #ifdef SQLITE_TESTCTRL_PRNG_SEED
214 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db);
215 #endif
216 for(i=0; i<sizeof(azSql)/sizeof(azSql[0]); i++){
217 if( eVerbosity>=1 ){
218 printf("%s\n", azSql[i]);
219 fflush(stdout);
220 }
221 zErr = 0;
222 nCb = 0;
223 rc = sqlite3_exec(db, azSql[i], 0, 0, &zErr);
224 if( rc && eVerbosity>=1 ){
225 printf("-- rc=%d zErr=%s\n", rc, zErr);
226 }
227 sqlite3_free(zErr);
228 }
229 rc = sqlite3_close(db);
230 if( rc!=SQLITE_OK ){
231 fprintf(stdout, "sqlite3_close() returns %d\n", rc);
232 }
233 if( sqlite3_memory_used()!=0 ){
234 int nAlloc = 0;
235 int nNotUsed = 0;
236 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0);
237 fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n",
238 sqlite3_memory_used(), nAlloc);
239 exit(1);
240 }
241 return 0;
242 }
243
244 /*
245 ** Return the number of "v" characters in a string. Return 0 if there
246 ** are any characters in the string other than "v".
247 */
numberOfVChar(const char * z)248 static int numberOfVChar(const char *z){
249 int N = 0;
250 while( z[0] && z[0]=='v' ){
251 z++;
252 N++;
253 }
254 return z[0]==0 ? N : 0;
255 }
256
257 /* libFuzzer invokes this routine once when the executable starts, to
258 ** process the command-line arguments.
259 */
LLVMFuzzerInitialize(int * pArgc,char *** pArgv)260 int LLVMFuzzerInitialize(int *pArgc, char ***pArgv){
261 int i, j, n;
262 int argc = *pArgc;
263 char **argv = *pArgv;
264 for(i=j=1; i<argc; i++){
265 char *z = argv[i];
266 if( z[0]=='-' ){
267 z++;
268 if( z[0]=='-' ) z++;
269 if( z[0]=='v' && (n = numberOfVChar(z))>0 ){
270 eVerbosity += n;
271 continue;
272 }
273 if( strcmp(z,"vdbe-debug")==0 ){
274 bVdbeDebug = 1;
275 continue;
276 }
277 if( strcmp(z,"limit")==0 ){
278 if( i+1==argc ){
279 fprintf(stderr, "missing argument to %s\n", argv[i]);
280 exit(1);
281 }
282 mxCb = strtol(argv[++i], 0, 0);
283 continue;
284 }
285 if( strcmp(z,"memtrace")==0 ){
286 sqlite3MemTraceActivate(stdout);
287 continue;
288 }
289 if( strcmp(z,"max-db-size")==0 ){
290 if( i+1==argc ){
291 fprintf(stderr, "missing argument to %s\n", argv[i]);
292 exit(1);
293 }
294 szMax = strtol(argv[++i], 0, 0);
295 continue;
296 }
297 if( strcmp(z, "lookaside")==0 ){
298 int sz, nSlot;
299 if( i+2>=argc ){
300 fprintf(stderr,
301 "--lookaside requires two arguments: slot-size num-slots\n");
302 exit(1);
303 }
304 sz = atoi(argv[++i]);
305 nSlot = atoi(argv[++i]);
306 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, sz, nSlot);
307 continue;
308 }
309 #ifndef _WIN32
310 if( strcmp(z,"max-stack")==0
311 || strcmp(z,"max-data")==0
312 || strcmp(z,"max-as")==0
313 ){
314 struct rlimit x,y;
315 int resource = RLIMIT_STACK;
316 char *zType = "RLIMIT_STACK";
317 if( i+1==argc ){
318 fprintf(stderr, "missing argument to %s\n", argv[i]);
319 exit(1);
320 }
321 if( z[4]=='d' ){
322 resource = RLIMIT_DATA;
323 zType = "RLIMIT_DATA";
324 }
325 if( z[4]=='a' ){
326 resource = RLIMIT_AS;
327 zType = "RLIMIT_AS";
328 }
329 memset(&x,0,sizeof(x));
330 getrlimit(resource, &x);
331 y.rlim_cur = atoi(argv[++i]);
332 y.rlim_max = x.rlim_cur;
333 setrlimit(resource, &y);
334 memset(&y,0,sizeof(y));
335 getrlimit(resource, &y);
336 printf("%s changed from %d to %d\n",
337 zType, (int)x.rlim_cur, (int)y.rlim_cur);
338 continue;
339 }
340 #endif /* _WIN32 */
341 }
342 argv[j++] = argv[i];
343 }
344 argv[j] = 0;
345 *pArgc = j;
346 return 0;
347 }
348
349 #ifdef STANDALONE
350 /*
351 ** Read an entire file into memory. Space to hold the file comes
352 ** from malloc().
353 */
readFile(const char * zName,int * pnByte)354 static unsigned char *readFile(const char *zName, int *pnByte){
355 FILE *in = fopen(zName, "rb");
356 long nIn;
357 size_t nRead;
358 unsigned char *pBuf;
359 if( in==0 ) return 0;
360 fseek(in, 0, SEEK_END);
361 nIn = ftell(in);
362 rewind(in);
363 pBuf = malloc( nIn+1 );
364 if( pBuf==0 ){ fclose(in); return 0; }
365 nRead = fread(pBuf, nIn, 1, in);
366 fclose(in);
367 if( nRead!=1 ){
368 free(pBuf);
369 return 0;
370 }
371 pBuf[nIn] = 0;
372 if( pnByte ) *pnByte = nIn;
373 return pBuf;
374 }
375 #endif /* STANDALONE */
376
377 #ifdef STANDALONE
main(int argc,char ** argv)378 int main(int argc, char **argv){
379 int i;
380 LLVMFuzzerInitialize(&argc, &argv);
381 for(i=1; i<argc; i++){
382 unsigned char *pIn;
383 int nIn;
384 pIn = readFile(argv[i], &nIn);
385 if( pIn ){
386 LLVMFuzzerTestOneInput((const uint8_t*)pIn, (size_t)nIn);
387 free(pIn);
388 }
389 }
390 #ifdef RUSAGE_SELF
391 if( eVerbosity>0 ){
392 struct rusage x;
393 printf("SQLite %s\n", sqlite3_sourceid());
394 memset(&x, 0, sizeof(x));
395 if( getrusage(RUSAGE_SELF, &x)==0 ){
396 printf("Maximum RSS = %ld KB\n", x.ru_maxrss);
397 }
398 }
399 #endif
400 return 0;
401 }
402 #endif /*STANDALONE*/
403