1 /* 2 ** 2015-05-25 3 ** 4 ** The author disclaims copyright to this source code. In place of 5 ** a legal notice, here is a blessing: 6 ** 7 ** May you do good and not evil. 8 ** May you find forgiveness for yourself and forgive others. 9 ** May you share freely, never taking more than you give. 10 ** 11 ************************************************************************* 12 ** 13 ** This is a utility program designed to aid running regressions tests on 14 ** the SQLite library using data from external fuzzers. 15 ** 16 ** This program reads content from an SQLite database file with the following 17 ** schema: 18 ** 19 ** CREATE TABLE db( 20 ** dbid INTEGER PRIMARY KEY, -- database id 21 ** dbcontent BLOB -- database disk file image 22 ** ); 23 ** CREATE TABLE xsql( 24 ** sqlid INTEGER PRIMARY KEY, -- SQL script id 25 ** sqltext TEXT -- Text of SQL statements to run 26 ** ); 27 ** CREATE TABLE IF NOT EXISTS readme( 28 ** msg TEXT -- Human-readable description of this test collection 29 ** ); 30 ** 31 ** For each database file in the DB table, the SQL text in the XSQL table 32 ** is run against that database. All README.MSG values are printed prior 33 ** to the start of the test (unless the --quiet option is used). If the 34 ** DB table is empty, then all entries in XSQL are run against an empty 35 ** in-memory database. 36 ** 37 ** This program is looking for crashes, assertion faults, and/or memory leaks. 38 ** No attempt is made to verify the output. The assumption is that either all 39 ** of the database files or all of the SQL statements are malformed inputs, 40 ** generated by a fuzzer, that need to be checked to make sure they do not 41 ** present a security risk. 42 ** 43 ** This program also includes some command-line options to help with 44 ** creation and maintenance of the source content database. The command 45 ** 46 ** ./fuzzcheck database.db --load-sql FILE... 47 ** 48 ** Loads all FILE... arguments into the XSQL table. The --load-db option 49 ** works the same but loads the files into the DB table. The -m option can 50 ** be used to initialize the README table. The "database.db" file is created 51 ** if it does not previously exist. Example: 52 ** 53 ** ./fuzzcheck new.db --load-sql *.sql 54 ** ./fuzzcheck new.db --load-db *.db 55 ** ./fuzzcheck new.db -m 'New test cases' 56 ** 57 ** The three commands above will create the "new.db" file and initialize all 58 ** tables. Then do "./fuzzcheck new.db" to run the tests. 59 ** 60 ** DEBUGGING HINTS: 61 ** 62 ** If fuzzcheck does crash, it can be run in the debugger and the content 63 ** of the global variable g.zTextName[] will identify the specific XSQL and 64 ** DB values that were running when the crash occurred. 65 ** 66 ** DBSQLFUZZ: (Added 2020-02-25) 67 ** 68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against 69 ** that database in its input. This utility can now process dbsqlfuzz 70 ** input files. Load such files using the "--load-dbsql FILE ..." command-line 71 ** option. 72 ** 73 ** Dbsqlfuzz inputs are ordinary text. The first part of the file is text 74 ** that describes the content of the database (using a lot of hexadecimal), 75 ** then there is a divider line followed by the SQL to run against the 76 ** database. Because they are ordinary text, dbsqlfuzz inputs are stored 77 ** in the XSQL table, as if they were ordinary SQL inputs. The isDbSql() 78 ** function can look at a text string and determine whether or not it is 79 ** a valid dbsqlfuzz input. 80 */ 81 #include <stdio.h> 82 #include <stdlib.h> 83 #include <string.h> 84 #include <stdarg.h> 85 #include <ctype.h> 86 #include <assert.h> 87 #include "sqlite3.h" 88 #define ISSPACE(X) isspace((unsigned char)(X)) 89 #define ISDIGIT(X) isdigit((unsigned char)(X)) 90 91 92 #ifdef __unix__ 93 # include <signal.h> 94 # include <unistd.h> 95 #endif 96 97 #include <stddef.h> 98 #if !defined(_MSC_VER) 99 # include <stdint.h> 100 #endif 101 102 #if defined(_MSC_VER) 103 typedef unsigned char uint8_t; 104 #endif 105 106 /* 107 ** Files in the virtual file system. 108 */ 109 typedef struct VFile VFile; 110 struct VFile { 111 char *zFilename; /* Filename. NULL for delete-on-close. From malloc() */ 112 int sz; /* Size of the file in bytes */ 113 int nRef; /* Number of references to this file */ 114 unsigned char *a; /* Content of the file. From malloc() */ 115 }; 116 typedef struct VHandle VHandle; 117 struct VHandle { 118 sqlite3_file base; /* Base class. Must be first */ 119 VFile *pVFile; /* The underlying file */ 120 }; 121 122 /* 123 ** The value of a database file template, or of an SQL script 124 */ 125 typedef struct Blob Blob; 126 struct Blob { 127 Blob *pNext; /* Next in a list */ 128 int id; /* Id of this Blob */ 129 int seq; /* Sequence number */ 130 int sz; /* Size of this Blob in bytes */ 131 unsigned char a[1]; /* Blob content. Extra space allocated as needed. */ 132 }; 133 134 /* 135 ** Maximum number of files in the in-memory virtual filesystem. 136 */ 137 #define MX_FILE 10 138 139 /* 140 ** Maximum allowed file size 141 */ 142 #define MX_FILE_SZ 10000000 143 144 /* 145 ** All global variables are gathered into the "g" singleton. 146 */ 147 static struct GlobalVars { 148 const char *zArgv0; /* Name of program */ 149 const char *zDbFile; /* Name of database file */ 150 VFile aFile[MX_FILE]; /* The virtual filesystem */ 151 int nDb; /* Number of template databases */ 152 Blob *pFirstDb; /* Content of first template database */ 153 int nSql; /* Number of SQL scripts */ 154 Blob *pFirstSql; /* First SQL script */ 155 unsigned int uRandom; /* Seed for the SQLite PRNG */ 156 char zTestName[100]; /* Name of current test */ 157 } g; 158 159 /* 160 ** Print an error message and quit. 161 */ 162 static void fatalError(const char *zFormat, ...){ 163 va_list ap; 164 fprintf(stderr, "%s", g.zArgv0); 165 if( g.zDbFile ) fprintf(stderr, " %s", g.zDbFile); 166 if( g.zTestName[0] ) fprintf(stderr, " (%s)", g.zTestName); 167 fprintf(stderr, ": "); 168 va_start(ap, zFormat); 169 vfprintf(stderr, zFormat, ap); 170 va_end(ap); 171 fprintf(stderr, "\n"); 172 exit(1); 173 } 174 175 /* 176 ** signal handler 177 */ 178 #ifdef __unix__ 179 static void signalHandler(int signum){ 180 const char *zSig; 181 if( signum==SIGABRT ){ 182 zSig = "abort"; 183 }else if( signum==SIGALRM ){ 184 zSig = "timeout"; 185 }else if( signum==SIGSEGV ){ 186 zSig = "segfault"; 187 }else{ 188 zSig = "signal"; 189 } 190 fatalError(zSig); 191 } 192 #endif 193 194 /* 195 ** Set the an alarm to go off after N seconds. Disable the alarm 196 ** if N==0 197 */ 198 static void setAlarm(int N){ 199 #ifdef __unix__ 200 alarm(N); 201 #else 202 (void)N; 203 #endif 204 } 205 206 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 207 /* 208 ** This an SQL progress handler. After an SQL statement has run for 209 ** many steps, we want to interrupt it. This guards against infinite 210 ** loops from recursive common table expressions. 211 ** 212 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used. 213 ** In that case, hitting the progress handler is a fatal error. 214 */ 215 static int progressHandler(void *pVdbeLimitFlag){ 216 if( *(int*)pVdbeLimitFlag ) fatalError("too many VDBE cycles"); 217 return 1; 218 } 219 #endif 220 221 /* 222 ** Reallocate memory. Show an error and quit if unable. 223 */ 224 static void *safe_realloc(void *pOld, int szNew){ 225 void *pNew = realloc(pOld, szNew<=0 ? 1 : szNew); 226 if( pNew==0 ) fatalError("unable to realloc for %d bytes", szNew); 227 return pNew; 228 } 229 230 /* 231 ** Initialize the virtual file system. 232 */ 233 static void formatVfs(void){ 234 int i; 235 for(i=0; i<MX_FILE; i++){ 236 g.aFile[i].sz = -1; 237 g.aFile[i].zFilename = 0; 238 g.aFile[i].a = 0; 239 g.aFile[i].nRef = 0; 240 } 241 } 242 243 244 /* 245 ** Erase all information in the virtual file system. 246 */ 247 static void reformatVfs(void){ 248 int i; 249 for(i=0; i<MX_FILE; i++){ 250 if( g.aFile[i].sz<0 ) continue; 251 if( g.aFile[i].zFilename ){ 252 free(g.aFile[i].zFilename); 253 g.aFile[i].zFilename = 0; 254 } 255 if( g.aFile[i].nRef>0 ){ 256 fatalError("file %d still open. nRef=%d", i, g.aFile[i].nRef); 257 } 258 g.aFile[i].sz = -1; 259 free(g.aFile[i].a); 260 g.aFile[i].a = 0; 261 g.aFile[i].nRef = 0; 262 } 263 } 264 265 /* 266 ** Find a VFile by name 267 */ 268 static VFile *findVFile(const char *zName){ 269 int i; 270 if( zName==0 ) return 0; 271 for(i=0; i<MX_FILE; i++){ 272 if( g.aFile[i].zFilename==0 ) continue; 273 if( strcmp(g.aFile[i].zFilename, zName)==0 ) return &g.aFile[i]; 274 } 275 return 0; 276 } 277 278 /* 279 ** Find a VFile by name. Create it if it does not already exist and 280 ** initialize it to the size and content given. 281 ** 282 ** Return NULL only if the filesystem is full. 283 */ 284 static VFile *createVFile(const char *zName, int sz, unsigned char *pData){ 285 VFile *pNew = findVFile(zName); 286 int i; 287 if( pNew ) return pNew; 288 for(i=0; i<MX_FILE && g.aFile[i].sz>=0; i++){} 289 if( i>=MX_FILE ) return 0; 290 pNew = &g.aFile[i]; 291 if( zName ){ 292 int nName = (int)strlen(zName)+1; 293 pNew->zFilename = safe_realloc(0, nName); 294 memcpy(pNew->zFilename, zName, nName); 295 }else{ 296 pNew->zFilename = 0; 297 } 298 pNew->nRef = 0; 299 pNew->sz = sz; 300 pNew->a = safe_realloc(0, sz); 301 if( sz>0 ) memcpy(pNew->a, pData, sz); 302 return pNew; 303 } 304 305 /* 306 ** Read the complete content of a file into memory. Add a 0x00 terminator 307 ** and return a pointer to the result. 308 ** 309 ** The file content is held in memory obtained from sqlite_malloc64() which 310 ** should be freed by the caller. 311 */ 312 static char *readFile(const char *zFilename, long *sz){ 313 FILE *in; 314 long nIn; 315 unsigned char *pBuf; 316 317 *sz = 0; 318 if( zFilename==0 ) return 0; 319 in = fopen(zFilename, "rb"); 320 if( in==0 ) return 0; 321 fseek(in, 0, SEEK_END); 322 *sz = nIn = ftell(in); 323 rewind(in); 324 pBuf = sqlite3_malloc64( nIn+1 ); 325 if( pBuf && 1==fread(pBuf, nIn, 1, in) ){ 326 pBuf[nIn] = 0; 327 fclose(in); 328 return pBuf; 329 } 330 sqlite3_free(pBuf); 331 *sz = 0; 332 fclose(in); 333 return 0; 334 } 335 336 337 /* 338 ** Implementation of the "readfile(X)" SQL function. The entire content 339 ** of the file named X is read and returned as a BLOB. NULL is returned 340 ** if the file does not exist or is unreadable. 341 */ 342 static void readfileFunc( 343 sqlite3_context *context, 344 int argc, 345 sqlite3_value **argv 346 ){ 347 long nIn; 348 void *pBuf; 349 const char *zName = (const char*)sqlite3_value_text(argv[0]); 350 351 if( zName==0 ) return; 352 pBuf = readFile(zName, &nIn); 353 if( pBuf ){ 354 sqlite3_result_blob(context, pBuf, nIn, sqlite3_free); 355 } 356 } 357 358 /* 359 ** Implementation of the "readtextfile(X)" SQL function. The text content 360 ** of the file named X through the end of the file or to the first \000 361 ** character, whichever comes first, is read and returned as TEXT. NULL 362 ** is returned if the file does not exist or is unreadable. 363 */ 364 static void readtextfileFunc( 365 sqlite3_context *context, 366 int argc, 367 sqlite3_value **argv 368 ){ 369 const char *zName; 370 FILE *in; 371 long nIn; 372 char *pBuf; 373 374 zName = (const char*)sqlite3_value_text(argv[0]); 375 if( zName==0 ) return; 376 in = fopen(zName, "rb"); 377 if( in==0 ) return; 378 fseek(in, 0, SEEK_END); 379 nIn = ftell(in); 380 rewind(in); 381 pBuf = sqlite3_malloc64( nIn+1 ); 382 if( pBuf && 1==fread(pBuf, nIn, 1, in) ){ 383 pBuf[nIn] = 0; 384 sqlite3_result_text(context, pBuf, -1, sqlite3_free); 385 }else{ 386 sqlite3_free(pBuf); 387 } 388 fclose(in); 389 } 390 391 /* 392 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y 393 ** is written into file X. The number of bytes written is returned. Or 394 ** NULL is returned if something goes wrong, such as being unable to open 395 ** file X for writing. 396 */ 397 static void writefileFunc( 398 sqlite3_context *context, 399 int argc, 400 sqlite3_value **argv 401 ){ 402 FILE *out; 403 const char *z; 404 sqlite3_int64 rc; 405 const char *zFile; 406 407 (void)argc; 408 zFile = (const char*)sqlite3_value_text(argv[0]); 409 if( zFile==0 ) return; 410 out = fopen(zFile, "wb"); 411 if( out==0 ) return; 412 z = (const char*)sqlite3_value_blob(argv[1]); 413 if( z==0 ){ 414 rc = 0; 415 }else{ 416 rc = fwrite(z, 1, sqlite3_value_bytes(argv[1]), out); 417 } 418 fclose(out); 419 sqlite3_result_int64(context, rc); 420 } 421 422 423 /* 424 ** Load a list of Blob objects from the database 425 */ 426 static void blobListLoadFromDb( 427 sqlite3 *db, /* Read from this database */ 428 const char *zSql, /* Query used to extract the blobs */ 429 int onlyId, /* Only load where id is this value */ 430 int *pN, /* OUT: Write number of blobs loaded here */ 431 Blob **ppList /* OUT: Write the head of the blob list here */ 432 ){ 433 Blob head; 434 Blob *p; 435 sqlite3_stmt *pStmt; 436 int n = 0; 437 int rc; 438 char *z2; 439 440 if( onlyId>0 ){ 441 z2 = sqlite3_mprintf("%s WHERE rowid=%d", zSql, onlyId); 442 }else{ 443 z2 = sqlite3_mprintf("%s", zSql); 444 } 445 rc = sqlite3_prepare_v2(db, z2, -1, &pStmt, 0); 446 sqlite3_free(z2); 447 if( rc ) fatalError("%s", sqlite3_errmsg(db)); 448 head.pNext = 0; 449 p = &head; 450 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 451 int sz = sqlite3_column_bytes(pStmt, 1); 452 Blob *pNew = safe_realloc(0, sizeof(*pNew)+sz ); 453 pNew->id = sqlite3_column_int(pStmt, 0); 454 pNew->sz = sz; 455 pNew->seq = n++; 456 pNew->pNext = 0; 457 memcpy(pNew->a, sqlite3_column_blob(pStmt,1), sz); 458 pNew->a[sz] = 0; 459 p->pNext = pNew; 460 p = pNew; 461 } 462 sqlite3_finalize(pStmt); 463 *pN = n; 464 *ppList = head.pNext; 465 } 466 467 /* 468 ** Free a list of Blob objects 469 */ 470 static void blobListFree(Blob *p){ 471 Blob *pNext; 472 while( p ){ 473 pNext = p->pNext; 474 free(p); 475 p = pNext; 476 } 477 } 478 479 /* Return the current wall-clock time 480 ** 481 ** The number of milliseconds since the julian epoch. 482 ** 1907-01-01 00:00:00 -> 210866716800000 483 ** 2021-01-01 00:00:00 -> 212476176000000 484 */ 485 static sqlite3_int64 timeOfDay(void){ 486 static sqlite3_vfs *clockVfs = 0; 487 sqlite3_int64 t; 488 if( clockVfs==0 ){ 489 clockVfs = sqlite3_vfs_find(0); 490 if( clockVfs==0 ) return 0; 491 } 492 if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){ 493 clockVfs->xCurrentTimeInt64(clockVfs, &t); 494 }else{ 495 double r; 496 clockVfs->xCurrentTime(clockVfs, &r); 497 t = (sqlite3_int64)(r*86400000.0); 498 } 499 return t; 500 } 501 502 /*************************************************************************** 503 ** Code to process combined database+SQL scripts generated by the 504 ** dbsqlfuzz fuzzer. 505 */ 506 507 /* An instance of the following object is passed by pointer as the 508 ** client data to various callbacks. 509 */ 510 typedef struct FuzzCtx { 511 sqlite3 *db; /* The database connection */ 512 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */ 513 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */ 514 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */ 515 unsigned nCb; /* Number of progress callbacks */ 516 unsigned mxCb; /* Maximum number of progress callbacks allowed */ 517 unsigned execCnt; /* Number of calls to the sqlite3_exec callback */ 518 int timeoutHit; /* True when reaching a timeout */ 519 } FuzzCtx; 520 521 /* Verbosity level for the dbsqlfuzz test runner */ 522 static int eVerbosity = 0; 523 524 /* True to activate PRAGMA vdbe_debug=on */ 525 static int bVdbeDebug = 0; 526 527 /* Timeout for each fuzzing attempt, in milliseconds */ 528 static int giTimeout = 10000; /* Defaults to 10 seconds */ 529 530 /* Maximum number of progress handler callbacks */ 531 static unsigned int mxProgressCb = 2000; 532 533 /* Maximum string length in SQLite */ 534 static int lengthLimit = 1000000; 535 536 /* Maximum expression depth */ 537 static int depthLimit = 500; 538 539 /* Limit on the amount of heap memory that can be used */ 540 static sqlite3_int64 heapLimit = 100000000; 541 542 /* Maximum byte-code program length in SQLite */ 543 static int vdbeOpLimit = 25000; 544 545 /* Maximum size of the in-memory database */ 546 static sqlite3_int64 maxDbSize = 104857600; 547 /* OOM simulation parameters */ 548 static unsigned int oomCounter = 0; /* Simulate OOM when equals 1 */ 549 static unsigned int oomRepeat = 0; /* Number of OOMs in a row */ 550 static void*(*defaultMalloc)(int) = 0; /* The low-level malloc routine */ 551 552 /* This routine is called when a simulated OOM occurs. It is broken 553 ** out as a separate routine to make it easy to set a breakpoint on 554 ** the OOM 555 */ 556 void oomFault(void){ 557 if( eVerbosity ){ 558 printf("Simulated OOM fault\n"); 559 } 560 if( oomRepeat>0 ){ 561 oomRepeat--; 562 }else{ 563 oomCounter--; 564 } 565 } 566 567 /* This routine is a replacement malloc() that is used to simulate 568 ** Out-Of-Memory (OOM) errors for testing purposes. 569 */ 570 static void *oomMalloc(int nByte){ 571 if( oomCounter ){ 572 if( oomCounter==1 ){ 573 oomFault(); 574 return 0; 575 }else{ 576 oomCounter--; 577 } 578 } 579 return defaultMalloc(nByte); 580 } 581 582 /* Register the OOM simulator. This must occur before any memory 583 ** allocations */ 584 static void registerOomSimulator(void){ 585 sqlite3_mem_methods mem; 586 sqlite3_shutdown(); 587 sqlite3_config(SQLITE_CONFIG_GETMALLOC, &mem); 588 defaultMalloc = mem.xMalloc; 589 mem.xMalloc = oomMalloc; 590 sqlite3_config(SQLITE_CONFIG_MALLOC, &mem); 591 } 592 593 /* Turn off any pending OOM simulation */ 594 static void disableOom(void){ 595 oomCounter = 0; 596 oomRepeat = 0; 597 } 598 599 /* 600 ** Translate a single byte of Hex into an integer. 601 ** This routine only works if h really is a valid hexadecimal 602 ** character: 0..9a..fA..F 603 */ 604 static unsigned char hexToInt(unsigned int h){ 605 #ifdef SQLITE_EBCDIC 606 h += 9*(1&~(h>>4)); /* EBCDIC */ 607 #else 608 h += 9*(1&(h>>6)); /* ASCII */ 609 #endif 610 return h & 0xf; 611 } 612 613 /* 614 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine 615 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it 616 ** does it makes corresponding changes to the *pK value and *pI value 617 ** and returns true. If the input buffer does not match the patterns, 618 ** no changes are made to either *pK or *pI and this routine returns false. 619 */ 620 static int isOffset( 621 const unsigned char *zIn, /* Text input */ 622 int nIn, /* Bytes of input */ 623 unsigned int *pK, /* half-byte cursor to adjust */ 624 unsigned int *pI /* Input index to adjust */ 625 ){ 626 int i; 627 unsigned int k = 0; 628 unsigned char c; 629 for(i=1; i<nIn && (c = zIn[i])!=']'; i++){ 630 if( !isxdigit(c) ) return 0; 631 k = k*16 + hexToInt(c); 632 } 633 if( i==nIn ) return 0; 634 *pK = 2*k; 635 *pI += i; 636 return 1; 637 } 638 639 /* 640 ** Decode the text starting at zIn into a binary database file. 641 ** The maximum length of zIn is nIn bytes. Store the binary database 642 ** file in space obtained from sqlite3_malloc(). 643 ** 644 ** Return the number of bytes of zIn consumed. Or return -1 if there 645 ** is an error. One potential error is that the recipe specifies a 646 ** database file larger than MX_FILE_SZ bytes. 647 ** 648 ** Abort on an OOM. 649 */ 650 static int decodeDatabase( 651 const unsigned char *zIn, /* Input text to be decoded */ 652 int nIn, /* Bytes of input text */ 653 unsigned char **paDecode, /* OUT: decoded database file */ 654 int *pnDecode /* OUT: Size of decoded database */ 655 ){ 656 unsigned char *a, *aNew; /* Database under construction */ 657 int mx = 0; /* Current size of the database */ 658 sqlite3_uint64 nAlloc = 4096; /* Space allocated in a[] */ 659 unsigned int i; /* Next byte of zIn[] to read */ 660 unsigned int j; /* Temporary integer */ 661 unsigned int k; /* half-byte cursor index for output */ 662 unsigned int n; /* Number of bytes of input */ 663 unsigned char b = 0; 664 if( nIn<4 ) return -1; 665 n = (unsigned int)nIn; 666 a = sqlite3_malloc64( nAlloc ); 667 if( a==0 ){ 668 fprintf(stderr, "Out of memory!\n"); 669 exit(1); 670 } 671 memset(a, 0, (size_t)nAlloc); 672 for(i=k=0; i<n; i++){ 673 unsigned char c = (unsigned char)zIn[i]; 674 if( isxdigit(c) ){ 675 k++; 676 if( k & 1 ){ 677 b = hexToInt(c)*16; 678 }else{ 679 b += hexToInt(c); 680 j = k/2 - 1; 681 if( j>=nAlloc ){ 682 sqlite3_uint64 newSize; 683 if( nAlloc==MX_FILE_SZ || j>=MX_FILE_SZ ){ 684 if( eVerbosity ){ 685 fprintf(stderr, "Input database too big: max %d bytes\n", 686 MX_FILE_SZ); 687 } 688 sqlite3_free(a); 689 return -1; 690 } 691 newSize = nAlloc*2; 692 if( newSize<=j ){ 693 newSize = (j+4096)&~4095; 694 } 695 if( newSize>MX_FILE_SZ ){ 696 if( j>=MX_FILE_SZ ){ 697 sqlite3_free(a); 698 return -1; 699 } 700 newSize = MX_FILE_SZ; 701 } 702 aNew = sqlite3_realloc64( a, newSize ); 703 if( aNew==0 ){ 704 sqlite3_free(a); 705 return -1; 706 } 707 a = aNew; 708 assert( newSize > nAlloc ); 709 memset(a+nAlloc, 0, (size_t)(newSize - nAlloc)); 710 nAlloc = newSize; 711 } 712 if( j>=(unsigned)mx ){ 713 mx = (j + 4095)&~4095; 714 if( mx>MX_FILE_SZ ) mx = MX_FILE_SZ; 715 } 716 assert( j<nAlloc ); 717 a[j] = b; 718 } 719 }else if( zIn[i]=='[' && i<n-3 && isOffset(zIn+i, nIn-i, &k, &i) ){ 720 continue; 721 }else if( zIn[i]=='\n' && i<n-4 && memcmp(zIn+i,"\n--\n",4)==0 ){ 722 i += 4; 723 break; 724 } 725 } 726 *pnDecode = mx; 727 *paDecode = a; 728 return i; 729 } 730 731 /* 732 ** Progress handler callback. 733 ** 734 ** The argument is the cutoff-time after which all processing should 735 ** stop. So return non-zero if the cut-off time is exceeded. 736 */ 737 static int progress_handler(void *pClientData) { 738 FuzzCtx *p = (FuzzCtx*)pClientData; 739 sqlite3_int64 iNow = timeOfDay(); 740 int rc = iNow>=p->iCutoffTime; 741 sqlite3_int64 iDiff = iNow - p->iLastCb; 742 /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */ 743 if( iDiff > p->mxInterval ) p->mxInterval = iDiff; 744 p->nCb++; 745 if( rc==0 && p->mxCb>0 && p->mxCb<=p->nCb ) rc = 1; 746 if( rc && !p->timeoutHit && eVerbosity>=2 ){ 747 printf("Timeout on progress callback %d\n", p->nCb); 748 fflush(stdout); 749 p->timeoutHit = 1; 750 } 751 return rc; 752 } 753 754 /* 755 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and 756 ** "PRAGMA parser_trace" since they can dramatically increase the 757 ** amount of output without actually testing anything useful. 758 ** 759 ** Also block ATTACH if attaching a file from the filesystem. 760 */ 761 static int block_troublesome_sql( 762 void *Notused, 763 int eCode, 764 const char *zArg1, 765 const char *zArg2, 766 const char *zArg3, 767 const char *zArg4 768 ){ 769 (void)Notused; 770 (void)zArg2; 771 (void)zArg3; 772 (void)zArg4; 773 if( eCode==SQLITE_PRAGMA ){ 774 if( sqlite3_stricmp("busy_timeout",zArg1)==0 775 && (zArg2==0 || strtoll(zArg2,0,0)>100) 776 ){ 777 return SQLITE_DENY; 778 }else if( eVerbosity==0 ){ 779 if( sqlite3_strnicmp("vdbe_", zArg1, 5)==0 780 || sqlite3_stricmp("parser_trace", zArg1)==0 781 || sqlite3_stricmp("temp_store_directory", zArg1)==0 782 ){ 783 return SQLITE_DENY; 784 } 785 }else if( sqlite3_stricmp("oom",zArg1)==0 786 && zArg2!=0 && zArg2[0]!=0 ){ 787 oomCounter = atoi(zArg2); 788 } 789 }else if( eCode==SQLITE_ATTACH ){ 790 /* Deny the ATTACH if it is attaching anything other than an in-memory 791 ** database. */ 792 if( zArg1==0 ) return SQLITE_DENY; 793 if( strcmp(zArg1,":memory:")==0 ) return SQLITE_OK; 794 if( sqlite3_strglob("file:*[?]vfs=memdb", zArg1)==0 795 && sqlite3_strglob("file:*[^/a-zA-Z0-9_.]*[?]vfs=memdb", zArg1)!=0 796 ){ 797 return SQLITE_OK; 798 } 799 return SQLITE_DENY; 800 } 801 return SQLITE_OK; 802 } 803 804 /* 805 ** Run the SQL text 806 */ 807 static int runDbSql(sqlite3 *db, const char *zSql){ 808 int rc; 809 sqlite3_stmt *pStmt; 810 while( isspace(zSql[0]&0x7f) ) zSql++; 811 if( zSql[0]==0 ) return SQLITE_OK; 812 if( eVerbosity>=4 ){ 813 printf("RUNNING-SQL: [%s]\n", zSql); 814 fflush(stdout); 815 } 816 rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0); 817 if( rc==SQLITE_OK ){ 818 while( (rc = sqlite3_step(pStmt))==SQLITE_ROW ){ 819 if( eVerbosity>=5 ){ 820 int j; 821 for(j=0; j<sqlite3_column_count(pStmt); j++){ 822 if( j ) printf(","); 823 switch( sqlite3_column_type(pStmt, j) ){ 824 case SQLITE_NULL: { 825 printf("NULL"); 826 break; 827 } 828 case SQLITE_INTEGER: 829 case SQLITE_FLOAT: { 830 printf("%s", sqlite3_column_text(pStmt, j)); 831 break; 832 } 833 case SQLITE_BLOB: { 834 int n = sqlite3_column_bytes(pStmt, j); 835 int i; 836 const unsigned char *a; 837 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 838 printf("x'"); 839 for(i=0; i<n; i++){ 840 printf("%02x", a[i]); 841 } 842 printf("'"); 843 break; 844 } 845 case SQLITE_TEXT: { 846 int n = sqlite3_column_bytes(pStmt, j); 847 int i; 848 const unsigned char *a; 849 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 850 printf("'"); 851 for(i=0; i<n; i++){ 852 if( a[i]=='\'' ){ 853 printf("''"); 854 }else{ 855 putchar(a[i]); 856 } 857 } 858 printf("'"); 859 break; 860 } 861 } /* End switch() */ 862 } /* End for() */ 863 printf("\n"); 864 fflush(stdout); 865 } /* End if( eVerbosity>=5 ) */ 866 } /* End while( SQLITE_ROW */ 867 if( rc!=SQLITE_DONE && eVerbosity>=4 ){ 868 printf("SQL-ERROR: (%d) %s\n", rc, sqlite3_errmsg(db)); 869 fflush(stdout); 870 } 871 }else if( eVerbosity>=4 ){ 872 printf("SQL-ERROR (%d): %s\n", rc, sqlite3_errmsg(db)); 873 fflush(stdout); 874 } /* End if( SQLITE_OK ) */ 875 return sqlite3_finalize(pStmt); 876 } 877 878 /* Invoke this routine to run a single test case */ 879 int runCombinedDbSqlInput(const uint8_t *aData, size_t nByte, int iTimeout){ 880 int rc; /* SQLite API return value */ 881 int iSql; /* Index in aData[] of start of SQL */ 882 unsigned char *aDb = 0; /* Decoded database content */ 883 int nDb = 0; /* Size of the decoded database */ 884 int i; /* Loop counter */ 885 int j; /* Start of current SQL statement */ 886 char *zSql = 0; /* SQL text to run */ 887 int nSql; /* Bytes of SQL text */ 888 FuzzCtx cx; /* Fuzzing context */ 889 890 if( nByte<10 ) return 0; 891 if( sqlite3_initialize() ) return 0; 892 if( sqlite3_memory_used()!=0 ){ 893 int nAlloc = 0; 894 int nNotUsed = 0; 895 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 896 fprintf(stderr,"memory leak prior to test start:" 897 " %lld bytes in %d allocations\n", 898 sqlite3_memory_used(), nAlloc); 899 exit(1); 900 } 901 memset(&cx, 0, sizeof(cx)); 902 iSql = decodeDatabase((unsigned char*)aData, (int)nByte, &aDb, &nDb); 903 if( iSql<0 ) return 0; 904 nSql = (int)(nByte - iSql); 905 if( eVerbosity>=3 ){ 906 printf( 907 "****** %d-byte input, %d-byte database, %d-byte script " 908 "******\n", (int)nByte, nDb, nSql); 909 fflush(stdout); 910 } 911 rc = sqlite3_open(0, &cx.db); 912 if( rc ){ 913 sqlite3_free(aDb); 914 return 1; 915 } 916 if( bVdbeDebug ){ 917 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 918 } 919 920 /* Invoke the progress handler frequently to check to see if we 921 ** are taking too long. The progress handler will return true 922 ** (which will block further processing) if more than giTimeout seconds have 923 ** elapsed since the start of the test. 924 */ 925 cx.iLastCb = timeOfDay(); 926 cx.iCutoffTime = cx.iLastCb + (iTimeout<giTimeout ? iTimeout : giTimeout); 927 cx.mxCb = mxProgressCb; 928 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 929 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx); 930 #endif 931 932 /* Set a limit on the maximum size of a prepared statement, and the 933 ** maximum length of a string or blob */ 934 if( vdbeOpLimit>0 ){ 935 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, vdbeOpLimit); 936 } 937 if( lengthLimit>0 ){ 938 sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, lengthLimit); 939 } 940 if( depthLimit>0 ){ 941 sqlite3_limit(cx.db, SQLITE_LIMIT_EXPR_DEPTH, depthLimit); 942 } 943 sqlite3_limit(cx.db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 100); 944 sqlite3_hard_heap_limit64(heapLimit); 945 946 if( nDb>=20 && aDb[18]==2 && aDb[19]==2 ){ 947 aDb[18] = aDb[19] = 1; 948 } 949 rc = sqlite3_deserialize(cx.db, "main", aDb, nDb, nDb, 950 SQLITE_DESERIALIZE_RESIZEABLE | 951 SQLITE_DESERIALIZE_FREEONCLOSE); 952 if( rc ){ 953 fprintf(stderr, "sqlite3_deserialize() failed with %d\n", rc); 954 goto testrun_finished; 955 } 956 if( maxDbSize>0 ){ 957 sqlite3_int64 x = maxDbSize; 958 sqlite3_file_control(cx.db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x); 959 } 960 961 /* For high debugging levels, turn on debug mode */ 962 if( eVerbosity>=5 ){ 963 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON;", 0, 0, 0); 964 } 965 966 /* Block debug pragmas and ATTACH/DETACH. But wait until after 967 ** deserialize to do this because deserialize depends on ATTACH */ 968 sqlite3_set_authorizer(cx.db, block_troublesome_sql, 0); 969 970 /* Consistent PRNG seed */ 971 #ifdef SQLITE_TESTCTRL_PRNG_SEED 972 sqlite3_table_column_metadata(cx.db, 0, "x", 0, 0, 0, 0, 0, 0); 973 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, cx.db); 974 #else 975 sqlite3_randomness(0,0); 976 #endif 977 978 zSql = sqlite3_malloc( nSql + 1 ); 979 if( zSql==0 ){ 980 fprintf(stderr, "Out of memory!\n"); 981 }else{ 982 memcpy(zSql, aData+iSql, nSql); 983 zSql[nSql] = 0; 984 for(i=j=0; zSql[i]; i++){ 985 if( zSql[i]==';' ){ 986 char cSaved = zSql[i+1]; 987 zSql[i+1] = 0; 988 if( sqlite3_complete(zSql+j) ){ 989 rc = runDbSql(cx.db, zSql+j); 990 j = i+1; 991 } 992 zSql[i+1] = cSaved; 993 if( rc==SQLITE_INTERRUPT || progress_handler(&cx) ){ 994 goto testrun_finished; 995 } 996 } 997 } 998 if( j<i ){ 999 runDbSql(cx.db, zSql+j); 1000 } 1001 } 1002 testrun_finished: 1003 sqlite3_free(zSql); 1004 rc = sqlite3_close(cx.db); 1005 if( rc!=SQLITE_OK ){ 1006 fprintf(stdout, "sqlite3_close() returns %d\n", rc); 1007 } 1008 if( eVerbosity>=2 ){ 1009 fprintf(stdout, "Peak memory usages: %f MB\n", 1010 sqlite3_memory_highwater(1) / 1000000.0); 1011 } 1012 if( sqlite3_memory_used()!=0 ){ 1013 int nAlloc = 0; 1014 int nNotUsed = 0; 1015 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 1016 fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n", 1017 sqlite3_memory_used(), nAlloc); 1018 exit(1); 1019 } 1020 sqlite3_hard_heap_limit64(0); 1021 sqlite3_soft_heap_limit64(0); 1022 return 0; 1023 } 1024 1025 /* 1026 ** END of the dbsqlfuzz code 1027 ***************************************************************************/ 1028 1029 /* Look at a SQL text and try to determine if it begins with a database 1030 ** description, such as would be found in a dbsqlfuzz test case. Return 1031 ** true if this does appear to be a dbsqlfuzz test case and false otherwise. 1032 */ 1033 static int isDbSql(unsigned char *a, int n){ 1034 unsigned char buf[12]; 1035 int i; 1036 if( n>4 && memcmp(a,"\n--\n",4)==0 ) return 1; 1037 while( n>0 && isspace(a[0]) ){ a++; n--; } 1038 for(i=0; n>0 && i<8; n--, a++){ 1039 if( isxdigit(a[0]) ) buf[i++] = a[0]; 1040 } 1041 if( i==8 && memcmp(buf,"53514c69",8)==0 ) return 1; 1042 return 0; 1043 } 1044 1045 /* Implementation of the isdbsql(TEXT) SQL function. 1046 */ 1047 static void isDbSqlFunc( 1048 sqlite3_context *context, 1049 int argc, 1050 sqlite3_value **argv 1051 ){ 1052 int n = sqlite3_value_bytes(argv[0]); 1053 unsigned char *a = (unsigned char*)sqlite3_value_blob(argv[0]); 1054 sqlite3_result_int(context, a!=0 && n>0 && isDbSql(a,n)); 1055 } 1056 1057 /* Methods for the VHandle object 1058 */ 1059 static int inmemClose(sqlite3_file *pFile){ 1060 VHandle *p = (VHandle*)pFile; 1061 VFile *pVFile = p->pVFile; 1062 pVFile->nRef--; 1063 if( pVFile->nRef==0 && pVFile->zFilename==0 ){ 1064 pVFile->sz = -1; 1065 free(pVFile->a); 1066 pVFile->a = 0; 1067 } 1068 return SQLITE_OK; 1069 } 1070 static int inmemRead( 1071 sqlite3_file *pFile, /* Read from this open file */ 1072 void *pData, /* Store content in this buffer */ 1073 int iAmt, /* Bytes of content */ 1074 sqlite3_int64 iOfst /* Start reading here */ 1075 ){ 1076 VHandle *pHandle = (VHandle*)pFile; 1077 VFile *pVFile = pHandle->pVFile; 1078 if( iOfst<0 || iOfst>=pVFile->sz ){ 1079 memset(pData, 0, iAmt); 1080 return SQLITE_IOERR_SHORT_READ; 1081 } 1082 if( iOfst+iAmt>pVFile->sz ){ 1083 memset(pData, 0, iAmt); 1084 iAmt = (int)(pVFile->sz - iOfst); 1085 memcpy(pData, pVFile->a + iOfst, iAmt); 1086 return SQLITE_IOERR_SHORT_READ; 1087 } 1088 memcpy(pData, pVFile->a + iOfst, iAmt); 1089 return SQLITE_OK; 1090 } 1091 static int inmemWrite( 1092 sqlite3_file *pFile, /* Write to this file */ 1093 const void *pData, /* Content to write */ 1094 int iAmt, /* bytes to write */ 1095 sqlite3_int64 iOfst /* Start writing here */ 1096 ){ 1097 VHandle *pHandle = (VHandle*)pFile; 1098 VFile *pVFile = pHandle->pVFile; 1099 if( iOfst+iAmt > pVFile->sz ){ 1100 if( iOfst+iAmt >= MX_FILE_SZ ){ 1101 return SQLITE_FULL; 1102 } 1103 pVFile->a = safe_realloc(pVFile->a, (int)(iOfst+iAmt)); 1104 if( iOfst > pVFile->sz ){ 1105 memset(pVFile->a + pVFile->sz, 0, (int)(iOfst - pVFile->sz)); 1106 } 1107 pVFile->sz = (int)(iOfst + iAmt); 1108 } 1109 memcpy(pVFile->a + iOfst, pData, iAmt); 1110 return SQLITE_OK; 1111 } 1112 static int inmemTruncate(sqlite3_file *pFile, sqlite3_int64 iSize){ 1113 VHandle *pHandle = (VHandle*)pFile; 1114 VFile *pVFile = pHandle->pVFile; 1115 if( pVFile->sz>iSize && iSize>=0 ) pVFile->sz = (int)iSize; 1116 return SQLITE_OK; 1117 } 1118 static int inmemSync(sqlite3_file *pFile, int flags){ 1119 return SQLITE_OK; 1120 } 1121 static int inmemFileSize(sqlite3_file *pFile, sqlite3_int64 *pSize){ 1122 *pSize = ((VHandle*)pFile)->pVFile->sz; 1123 return SQLITE_OK; 1124 } 1125 static int inmemLock(sqlite3_file *pFile, int type){ 1126 return SQLITE_OK; 1127 } 1128 static int inmemUnlock(sqlite3_file *pFile, int type){ 1129 return SQLITE_OK; 1130 } 1131 static int inmemCheckReservedLock(sqlite3_file *pFile, int *pOut){ 1132 *pOut = 0; 1133 return SQLITE_OK; 1134 } 1135 static int inmemFileControl(sqlite3_file *pFile, int op, void *pArg){ 1136 return SQLITE_NOTFOUND; 1137 } 1138 static int inmemSectorSize(sqlite3_file *pFile){ 1139 return 512; 1140 } 1141 static int inmemDeviceCharacteristics(sqlite3_file *pFile){ 1142 return 1143 SQLITE_IOCAP_SAFE_APPEND | 1144 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN | 1145 SQLITE_IOCAP_POWERSAFE_OVERWRITE; 1146 } 1147 1148 1149 /* Method table for VHandle 1150 */ 1151 static sqlite3_io_methods VHandleMethods = { 1152 /* iVersion */ 1, 1153 /* xClose */ inmemClose, 1154 /* xRead */ inmemRead, 1155 /* xWrite */ inmemWrite, 1156 /* xTruncate */ inmemTruncate, 1157 /* xSync */ inmemSync, 1158 /* xFileSize */ inmemFileSize, 1159 /* xLock */ inmemLock, 1160 /* xUnlock */ inmemUnlock, 1161 /* xCheck... */ inmemCheckReservedLock, 1162 /* xFileCtrl */ inmemFileControl, 1163 /* xSectorSz */ inmemSectorSize, 1164 /* xDevchar */ inmemDeviceCharacteristics, 1165 /* xShmMap */ 0, 1166 /* xShmLock */ 0, 1167 /* xShmBarrier */ 0, 1168 /* xShmUnmap */ 0, 1169 /* xFetch */ 0, 1170 /* xUnfetch */ 0 1171 }; 1172 1173 /* 1174 ** Open a new file in the inmem VFS. All files are anonymous and are 1175 ** delete-on-close. 1176 */ 1177 static int inmemOpen( 1178 sqlite3_vfs *pVfs, 1179 const char *zFilename, 1180 sqlite3_file *pFile, 1181 int openFlags, 1182 int *pOutFlags 1183 ){ 1184 VFile *pVFile = createVFile(zFilename, 0, (unsigned char*)""); 1185 VHandle *pHandle = (VHandle*)pFile; 1186 if( pVFile==0 ){ 1187 return SQLITE_FULL; 1188 } 1189 pHandle->pVFile = pVFile; 1190 pVFile->nRef++; 1191 pFile->pMethods = &VHandleMethods; 1192 if( pOutFlags ) *pOutFlags = openFlags; 1193 return SQLITE_OK; 1194 } 1195 1196 /* 1197 ** Delete a file by name 1198 */ 1199 static int inmemDelete( 1200 sqlite3_vfs *pVfs, 1201 const char *zFilename, 1202 int syncdir 1203 ){ 1204 VFile *pVFile = findVFile(zFilename); 1205 if( pVFile==0 ) return SQLITE_OK; 1206 if( pVFile->nRef==0 ){ 1207 free(pVFile->zFilename); 1208 pVFile->zFilename = 0; 1209 pVFile->sz = -1; 1210 free(pVFile->a); 1211 pVFile->a = 0; 1212 return SQLITE_OK; 1213 } 1214 return SQLITE_IOERR_DELETE; 1215 } 1216 1217 /* Check for the existance of a file 1218 */ 1219 static int inmemAccess( 1220 sqlite3_vfs *pVfs, 1221 const char *zFilename, 1222 int flags, 1223 int *pResOut 1224 ){ 1225 VFile *pVFile = findVFile(zFilename); 1226 *pResOut = pVFile!=0; 1227 return SQLITE_OK; 1228 } 1229 1230 /* Get the canonical pathname for a file 1231 */ 1232 static int inmemFullPathname( 1233 sqlite3_vfs *pVfs, 1234 const char *zFilename, 1235 int nOut, 1236 char *zOut 1237 ){ 1238 sqlite3_snprintf(nOut, zOut, "%s", zFilename); 1239 return SQLITE_OK; 1240 } 1241 1242 /* Always use the same random see, for repeatability. 1243 */ 1244 static int inmemRandomness(sqlite3_vfs *NotUsed, int nBuf, char *zBuf){ 1245 memset(zBuf, 0, nBuf); 1246 memcpy(zBuf, &g.uRandom, nBuf<sizeof(g.uRandom) ? nBuf : sizeof(g.uRandom)); 1247 return nBuf; 1248 } 1249 1250 /* 1251 ** Register the VFS that reads from the g.aFile[] set of files. 1252 */ 1253 static void inmemVfsRegister(int makeDefault){ 1254 static sqlite3_vfs inmemVfs; 1255 sqlite3_vfs *pDefault = sqlite3_vfs_find(0); 1256 inmemVfs.iVersion = 3; 1257 inmemVfs.szOsFile = sizeof(VHandle); 1258 inmemVfs.mxPathname = 200; 1259 inmemVfs.zName = "inmem"; 1260 inmemVfs.xOpen = inmemOpen; 1261 inmemVfs.xDelete = inmemDelete; 1262 inmemVfs.xAccess = inmemAccess; 1263 inmemVfs.xFullPathname = inmemFullPathname; 1264 inmemVfs.xRandomness = inmemRandomness; 1265 inmemVfs.xSleep = pDefault->xSleep; 1266 inmemVfs.xCurrentTimeInt64 = pDefault->xCurrentTimeInt64; 1267 sqlite3_vfs_register(&inmemVfs, makeDefault); 1268 }; 1269 1270 /* 1271 ** Allowed values for the runFlags parameter to runSql() 1272 */ 1273 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */ 1274 #define SQL_OUTPUT 0x0002 /* Show the SQL output */ 1275 1276 /* 1277 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not 1278 ** stop if an error is encountered. 1279 */ 1280 static void runSql(sqlite3 *db, const char *zSql, unsigned runFlags){ 1281 const char *zMore; 1282 sqlite3_stmt *pStmt; 1283 1284 while( zSql && zSql[0] ){ 1285 zMore = 0; 1286 pStmt = 0; 1287 sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zMore); 1288 if( zMore==zSql ) break; 1289 if( runFlags & SQL_TRACE ){ 1290 const char *z = zSql; 1291 int n; 1292 while( z<zMore && ISSPACE(z[0]) ) z++; 1293 n = (int)(zMore - z); 1294 while( n>0 && ISSPACE(z[n-1]) ) n--; 1295 if( n==0 ) break; 1296 if( pStmt==0 ){ 1297 printf("TRACE: %.*s (error: %s)\n", n, z, sqlite3_errmsg(db)); 1298 }else{ 1299 printf("TRACE: %.*s\n", n, z); 1300 } 1301 } 1302 zSql = zMore; 1303 if( pStmt ){ 1304 if( (runFlags & SQL_OUTPUT)==0 ){ 1305 while( SQLITE_ROW==sqlite3_step(pStmt) ){} 1306 }else{ 1307 int nCol = -1; 1308 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1309 int i; 1310 if( nCol<0 ){ 1311 nCol = sqlite3_column_count(pStmt); 1312 }else if( nCol>0 ){ 1313 printf("--------------------------------------------\n"); 1314 } 1315 for(i=0; i<nCol; i++){ 1316 int eType = sqlite3_column_type(pStmt,i); 1317 printf("%s = ", sqlite3_column_name(pStmt,i)); 1318 switch( eType ){ 1319 case SQLITE_NULL: { 1320 printf("NULL\n"); 1321 break; 1322 } 1323 case SQLITE_INTEGER: { 1324 printf("INT %s\n", sqlite3_column_text(pStmt,i)); 1325 break; 1326 } 1327 case SQLITE_FLOAT: { 1328 printf("FLOAT %s\n", sqlite3_column_text(pStmt,i)); 1329 break; 1330 } 1331 case SQLITE_TEXT: { 1332 printf("TEXT [%s]\n", sqlite3_column_text(pStmt,i)); 1333 break; 1334 } 1335 case SQLITE_BLOB: { 1336 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt,i)); 1337 break; 1338 } 1339 } 1340 } 1341 } 1342 } 1343 sqlite3_finalize(pStmt); 1344 } 1345 } 1346 } 1347 1348 /* 1349 ** Rebuild the database file. 1350 ** 1351 ** (1) Remove duplicate entries 1352 ** (2) Put all entries in order 1353 ** (3) Vacuum 1354 */ 1355 static void rebuild_database(sqlite3 *db, int dbSqlOnly){ 1356 int rc; 1357 char *zSql; 1358 zSql = sqlite3_mprintf( 1359 "BEGIN;\n" 1360 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n" 1361 "DELETE FROM db;\n" 1362 "INSERT INTO db(dbid, dbcontent) " 1363 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n" 1364 "DROP TABLE dbx;\n" 1365 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n" 1366 "DELETE FROM xsql;\n" 1367 "INSERT INTO xsql(sqlid,sqltext) " 1368 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n" 1369 "DROP TABLE sx;\n" 1370 "COMMIT;\n" 1371 "PRAGMA page_size=1024;\n" 1372 "VACUUM;\n", 1373 dbSqlOnly ? " WHERE isdbsql(sqltext)" : "" 1374 ); 1375 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1376 sqlite3_free(zSql); 1377 if( rc ) fatalError("cannot rebuild: %s", sqlite3_errmsg(db)); 1378 } 1379 1380 /* 1381 ** Return the value of a hexadecimal digit. Return -1 if the input 1382 ** is not a hex digit. 1383 */ 1384 static int hexDigitValue(char c){ 1385 if( c>='0' && c<='9' ) return c - '0'; 1386 if( c>='a' && c<='f' ) return c - 'a' + 10; 1387 if( c>='A' && c<='F' ) return c - 'A' + 10; 1388 return -1; 1389 } 1390 1391 /* 1392 ** Interpret zArg as an integer value, possibly with suffixes. 1393 */ 1394 static int integerValue(const char *zArg){ 1395 sqlite3_int64 v = 0; 1396 static const struct { char *zSuffix; int iMult; } aMult[] = { 1397 { "KiB", 1024 }, 1398 { "MiB", 1024*1024 }, 1399 { "GiB", 1024*1024*1024 }, 1400 { "KB", 1000 }, 1401 { "MB", 1000000 }, 1402 { "GB", 1000000000 }, 1403 { "K", 1000 }, 1404 { "M", 1000000 }, 1405 { "G", 1000000000 }, 1406 }; 1407 int i; 1408 int isNeg = 0; 1409 if( zArg[0]=='-' ){ 1410 isNeg = 1; 1411 zArg++; 1412 }else if( zArg[0]=='+' ){ 1413 zArg++; 1414 } 1415 if( zArg[0]=='0' && zArg[1]=='x' ){ 1416 int x; 1417 zArg += 2; 1418 while( (x = hexDigitValue(zArg[0]))>=0 ){ 1419 v = (v<<4) + x; 1420 zArg++; 1421 } 1422 }else{ 1423 while( ISDIGIT(zArg[0]) ){ 1424 v = v*10 + zArg[0] - '0'; 1425 zArg++; 1426 } 1427 } 1428 for(i=0; i<sizeof(aMult)/sizeof(aMult[0]); i++){ 1429 if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){ 1430 v *= aMult[i].iMult; 1431 break; 1432 } 1433 } 1434 if( v>0x7fffffff ) fatalError("parameter too large - max 2147483648"); 1435 return (int)(isNeg? -v : v); 1436 } 1437 1438 /* 1439 ** Return the number of "v" characters in a string. Return 0 if there 1440 ** are any characters in the string other than "v". 1441 */ 1442 static int numberOfVChar(const char *z){ 1443 int N = 0; 1444 while( z[0] && z[0]=='v' ){ 1445 z++; 1446 N++; 1447 } 1448 return z[0]==0 ? N : 0; 1449 } 1450 1451 /* 1452 ** Print sketchy documentation for this utility program 1453 */ 1454 static void showHelp(void){ 1455 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g.zArgv0); 1456 printf( 1457 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n" 1458 "each database, checking for crashes and memory leaks.\n" 1459 "Options:\n" 1460 " --cell-size-check Set the PRAGMA cell_size_check=ON\n" 1461 " --dbid N Use only the database where dbid=N\n" 1462 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n" 1463 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n" 1464 " --help Show this help text\n" 1465 " --info Show information about SOURCE-DB w/o running tests\n" 1466 " --limit-depth N Limit expression depth to N. Default: 500\n" 1467 " --limit-heap N Limit heap memory to N. Default: 100M\n" 1468 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n" 1469 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n" 1470 " --load-sql FILE.. Load SQL scripts fron files into SOURCE-DB\n" 1471 " --load-db FILE.. Load template databases from files into SOURCE_DB\n" 1472 " --load-dbsql FILE.. Load dbsqlfuzz outputs into the xsql table\n" 1473 " ^^^^------ Use \"-\" for FILE to read filenames from stdin\n" 1474 " -m TEXT Add a description to the database\n" 1475 " --native-vfs Use the native VFS for initially empty database files\n" 1476 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n" 1477 " --oss-fuzz Enable OSS-FUZZ testing\n" 1478 " --prng-seed N Seed value for the PRGN inside of SQLite\n" 1479 " -q|--quiet Reduced output\n" 1480 " --rebuild Rebuild and vacuum the database file\n" 1481 " --result-trace Show the results of each SQL command\n" 1482 " --skip N Skip the first N test cases\n" 1483 " --spinner Use a spinner to show progress\n" 1484 " --sqlid N Use only SQL where sqlid=N\n" 1485 " --timeout N Maximum time for any one test in N millseconds\n" 1486 " -v|--verbose Increased output. Repeat for more output.\n" 1487 " --vdbe-debug Activate VDBE debugging.\n" 1488 ); 1489 } 1490 1491 int main(int argc, char **argv){ 1492 sqlite3_int64 iBegin; /* Start time of this program */ 1493 int quietFlag = 0; /* True if --quiet or -q */ 1494 int verboseFlag = 0; /* True if --verbose or -v */ 1495 char *zInsSql = 0; /* SQL statement for --load-db or --load-sql */ 1496 int iFirstInsArg = 0; /* First argv[] for --load-db or --load-sql */ 1497 sqlite3 *db = 0; /* The open database connection */ 1498 sqlite3_stmt *pStmt; /* A prepared statement */ 1499 int rc; /* Result code from SQLite interface calls */ 1500 Blob *pSql; /* For looping over SQL scripts */ 1501 Blob *pDb; /* For looping over template databases */ 1502 int i; /* Loop index for the argv[] loop */ 1503 int dbSqlOnly = 0; /* Only use scripts that are dbsqlfuzz */ 1504 int onlySqlid = -1; /* --sqlid */ 1505 int onlyDbid = -1; /* --dbid */ 1506 int nativeFlag = 0; /* --native-vfs */ 1507 int rebuildFlag = 0; /* --rebuild */ 1508 int vdbeLimitFlag = 0; /* --limit-vdbe */ 1509 int infoFlag = 0; /* --info */ 1510 int nSkip = 0; /* --skip */ 1511 int bSpinner = 0; /* True for --spinner */ 1512 int timeoutTest = 0; /* undocumented --timeout-test flag */ 1513 int runFlags = 0; /* Flags sent to runSql() */ 1514 char *zMsg = 0; /* Add this message */ 1515 int nSrcDb = 0; /* Number of source databases */ 1516 char **azSrcDb = 0; /* Array of source database names */ 1517 int iSrcDb; /* Loop over all source databases */ 1518 int nTest = 0; /* Total number of tests performed */ 1519 char *zDbName = ""; /* Appreviated name of a source database */ 1520 const char *zFailCode = 0; /* Value of the TEST_FAILURE env variable */ 1521 int cellSzCkFlag = 0; /* --cell-size-check */ 1522 int sqlFuzz = 0; /* True for SQL fuzz. False for DB fuzz */ 1523 int iTimeout = 120000; /* Default 120-second timeout */ 1524 int nMem = 0; /* Memory limit override */ 1525 int nMemThisDb = 0; /* Memory limit set by the CONFIG table */ 1526 char *zExpDb = 0; /* Write Databases to files in this directory */ 1527 char *zExpSql = 0; /* Write SQL to files in this directory */ 1528 void *pHeap = 0; /* Heap for use by SQLite */ 1529 int ossFuzz = 0; /* enable OSS-FUZZ testing */ 1530 int ossFuzzThisDb = 0; /* ossFuzz value for this particular database */ 1531 int nativeMalloc = 0; /* Turn off MEMSYS3/5 and lookaside if true */ 1532 sqlite3_vfs *pDfltVfs; /* The default VFS */ 1533 int openFlags4Data; /* Flags for sqlite3_open_v2() */ 1534 int bTimer = 0; /* Show elapse time for each test */ 1535 int nV; /* How much to increase verbosity with -vvvv */ 1536 sqlite3_int64 tmStart; /* Start of each test */ 1537 1538 sqlite3_config(SQLITE_CONFIG_URI,1); 1539 registerOomSimulator(); 1540 sqlite3_initialize(); 1541 iBegin = timeOfDay(); 1542 #ifdef __unix__ 1543 signal(SIGALRM, signalHandler); 1544 signal(SIGSEGV, signalHandler); 1545 signal(SIGABRT, signalHandler); 1546 #endif 1547 g.zArgv0 = argv[0]; 1548 openFlags4Data = SQLITE_OPEN_READONLY; 1549 zFailCode = getenv("TEST_FAILURE"); 1550 pDfltVfs = sqlite3_vfs_find(0); 1551 inmemVfsRegister(1); 1552 for(i=1; i<argc; i++){ 1553 const char *z = argv[i]; 1554 if( z[0]=='-' ){ 1555 z++; 1556 if( z[0]=='-' ) z++; 1557 if( strcmp(z,"cell-size-check")==0 ){ 1558 cellSzCkFlag = 1; 1559 }else 1560 if( strcmp(z,"dbid")==0 ){ 1561 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1562 onlyDbid = integerValue(argv[++i]); 1563 }else 1564 if( strcmp(z,"export-db")==0 ){ 1565 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1566 zExpDb = argv[++i]; 1567 }else 1568 if( strcmp(z,"export-sql")==0 || strcmp(z,"export-dbsql")==0 ){ 1569 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1570 zExpSql = argv[++i]; 1571 }else 1572 if( strcmp(z,"help")==0 ){ 1573 showHelp(); 1574 return 0; 1575 }else 1576 if( strcmp(z,"info")==0 ){ 1577 infoFlag = 1; 1578 }else 1579 if( strcmp(z,"limit-depth")==0 ){ 1580 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1581 depthLimit = integerValue(argv[++i]); 1582 }else 1583 if( strcmp(z,"limit-heap")==0 ){ 1584 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1585 heapLimit = integerValue(argv[++i]); 1586 }else 1587 if( strcmp(z,"limit-mem")==0 ){ 1588 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1589 nMem = integerValue(argv[++i]); 1590 }else 1591 if( strcmp(z,"limit-vdbe")==0 ){ 1592 vdbeLimitFlag = 1; 1593 }else 1594 if( strcmp(z,"load-sql")==0 ){ 1595 zInsSql = "INSERT INTO xsql(sqltext)" 1596 "VALUES(CAST(readtextfile(?1) AS text))"; 1597 iFirstInsArg = i+1; 1598 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1599 break; 1600 }else 1601 if( strcmp(z,"load-db")==0 ){ 1602 zInsSql = "INSERT INTO db(dbcontent) VALUES(readfile(?1))"; 1603 iFirstInsArg = i+1; 1604 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1605 break; 1606 }else 1607 if( strcmp(z,"load-dbsql")==0 ){ 1608 zInsSql = "INSERT INTO xsql(sqltext)" 1609 "VALUES(CAST(readtextfile(?1) AS text))"; 1610 iFirstInsArg = i+1; 1611 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1612 dbSqlOnly = 1; 1613 break; 1614 }else 1615 if( strcmp(z,"m")==0 ){ 1616 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1617 zMsg = argv[++i]; 1618 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1619 }else 1620 if( strcmp(z,"native-malloc")==0 ){ 1621 nativeMalloc = 1; 1622 }else 1623 if( strcmp(z,"native-vfs")==0 ){ 1624 nativeFlag = 1; 1625 }else 1626 if( strcmp(z,"oss-fuzz")==0 ){ 1627 ossFuzz = 1; 1628 }else 1629 if( strcmp(z,"prng-seed")==0 ){ 1630 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1631 g.uRandom = atoi(argv[++i]); 1632 }else 1633 if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){ 1634 quietFlag = 1; 1635 verboseFlag = 0; 1636 eVerbosity = 0; 1637 }else 1638 if( strcmp(z,"rebuild")==0 ){ 1639 rebuildFlag = 1; 1640 openFlags4Data = SQLITE_OPEN_READWRITE; 1641 }else 1642 if( strcmp(z,"result-trace")==0 ){ 1643 runFlags |= SQL_OUTPUT; 1644 }else 1645 if( strcmp(z,"skip")==0 ){ 1646 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1647 nSkip = atoi(argv[++i]); 1648 }else 1649 if( strcmp(z,"spinner")==0 ){ 1650 bSpinner = 1; 1651 }else 1652 if( strcmp(z,"timer")==0 ){ 1653 bTimer = 1; 1654 }else 1655 if( strcmp(z,"sqlid")==0 ){ 1656 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1657 onlySqlid = integerValue(argv[++i]); 1658 }else 1659 if( strcmp(z,"timeout")==0 ){ 1660 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1661 iTimeout = integerValue(argv[++i]); 1662 }else 1663 if( strcmp(z,"timeout-test")==0 ){ 1664 timeoutTest = 1; 1665 #ifndef __unix__ 1666 fatalError("timeout is not available on non-unix systems"); 1667 #endif 1668 }else 1669 if( strcmp(z,"vdbe-debug")==0 ){ 1670 bVdbeDebug = 1; 1671 }else 1672 if( strcmp(z,"verbose")==0 ){ 1673 quietFlag = 0; 1674 verboseFlag++; 1675 eVerbosity++; 1676 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1677 }else 1678 if( (nV = numberOfVChar(z))>=1 ){ 1679 quietFlag = 0; 1680 verboseFlag += nV; 1681 eVerbosity += nV; 1682 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1683 }else 1684 if( strcmp(z,"version")==0 ){ 1685 int ii; 1686 const char *zz; 1687 printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid()); 1688 for(ii=0; (zz = sqlite3_compileoption_get(ii))!=0; ii++){ 1689 printf("%s\n", zz); 1690 } 1691 return 0; 1692 }else 1693 { 1694 fatalError("unknown option: %s", argv[i]); 1695 } 1696 }else{ 1697 nSrcDb++; 1698 azSrcDb = safe_realloc(azSrcDb, nSrcDb*sizeof(azSrcDb[0])); 1699 azSrcDb[nSrcDb-1] = argv[i]; 1700 } 1701 } 1702 if( nSrcDb==0 ) fatalError("no source database specified"); 1703 if( nSrcDb>1 ){ 1704 if( zMsg ){ 1705 fatalError("cannot change the description of more than one database"); 1706 } 1707 if( zInsSql ){ 1708 fatalError("cannot import into more than one database"); 1709 } 1710 } 1711 1712 /* Process each source database separately */ 1713 for(iSrcDb=0; iSrcDb<nSrcDb; iSrcDb++){ 1714 char *zRawData = 0; 1715 long nRawData = 0; 1716 g.zDbFile = azSrcDb[iSrcDb]; 1717 rc = sqlite3_open_v2(azSrcDb[iSrcDb], &db, 1718 openFlags4Data, pDfltVfs->zName); 1719 if( rc==SQLITE_OK ){ 1720 rc = sqlite3_exec(db, "SELECT count(*) FROM sqlite_schema", 0, 0, 0); 1721 } 1722 if( rc ){ 1723 sqlite3_close(db); 1724 zRawData = readFile(azSrcDb[iSrcDb], &nRawData); 1725 if( zRawData==0 ){ 1726 fatalError("input file \"%s\" is not recognized\n", azSrcDb[iSrcDb]); 1727 } 1728 sqlite3_open(":memory:", &db); 1729 } 1730 1731 /* Print the description, if there is one */ 1732 if( infoFlag ){ 1733 int n; 1734 zDbName = azSrcDb[iSrcDb]; 1735 i = (int)strlen(zDbName) - 1; 1736 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1737 zDbName += i; 1738 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1739 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1740 printf("%s: %s", zDbName, sqlite3_column_text(pStmt,0)); 1741 }else{ 1742 printf("%s: (empty \"readme\")", zDbName); 1743 } 1744 sqlite3_finalize(pStmt); 1745 sqlite3_prepare_v2(db, "SELECT count(*) FROM db", -1, &pStmt, 0); 1746 if( pStmt 1747 && sqlite3_step(pStmt)==SQLITE_ROW 1748 && (n = sqlite3_column_int(pStmt,0))>0 1749 ){ 1750 printf(" - %d DBs", n); 1751 } 1752 sqlite3_finalize(pStmt); 1753 sqlite3_prepare_v2(db, "SELECT count(*) FROM xsql", -1, &pStmt, 0); 1754 if( pStmt 1755 && sqlite3_step(pStmt)==SQLITE_ROW 1756 && (n = sqlite3_column_int(pStmt,0))>0 1757 ){ 1758 printf(" - %d scripts", n); 1759 } 1760 sqlite3_finalize(pStmt); 1761 printf("\n"); 1762 sqlite3_close(db); 1763 sqlite3_free(zRawData); 1764 continue; 1765 } 1766 1767 rc = sqlite3_exec(db, 1768 "CREATE TABLE IF NOT EXISTS db(\n" 1769 " dbid INTEGER PRIMARY KEY, -- database id\n" 1770 " dbcontent BLOB -- database disk file image\n" 1771 ");\n" 1772 "CREATE TABLE IF NOT EXISTS xsql(\n" 1773 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n" 1774 " sqltext TEXT -- Text of SQL statements to run\n" 1775 ");" 1776 "CREATE TABLE IF NOT EXISTS readme(\n" 1777 " msg TEXT -- Human-readable description of this file\n" 1778 ");", 0, 0, 0); 1779 if( rc ) fatalError("cannot create schema: %s", sqlite3_errmsg(db)); 1780 if( zMsg ){ 1781 char *zSql; 1782 zSql = sqlite3_mprintf( 1783 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg); 1784 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1785 sqlite3_free(zSql); 1786 if( rc ) fatalError("cannot change description: %s", sqlite3_errmsg(db)); 1787 } 1788 if( zRawData ){ 1789 zInsSql = "INSERT INTO xsql(sqltext) VALUES(?1)"; 1790 rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0); 1791 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1792 zInsSql, sqlite3_errmsg(db)); 1793 sqlite3_bind_text(pStmt, 1, zRawData, nRawData, SQLITE_STATIC); 1794 sqlite3_step(pStmt); 1795 rc = sqlite3_reset(pStmt); 1796 if( rc ) fatalError("insert failed for %s", argv[i]); 1797 sqlite3_finalize(pStmt); 1798 rebuild_database(db, dbSqlOnly); 1799 zInsSql = 0; 1800 sqlite3_free(zRawData); 1801 zRawData = 0; 1802 } 1803 ossFuzzThisDb = ossFuzz; 1804 1805 /* If the CONFIG(name,value) table exists, read db-specific settings 1806 ** from that table */ 1807 if( sqlite3_table_column_metadata(db,0,"config",0,0,0,0,0,0)==SQLITE_OK ){ 1808 rc = sqlite3_prepare_v2(db, "SELECT name, value FROM config", 1809 -1, &pStmt, 0); 1810 if( rc ) fatalError("cannot prepare query of CONFIG table: %s", 1811 sqlite3_errmsg(db)); 1812 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1813 const char *zName = (const char *)sqlite3_column_text(pStmt,0); 1814 if( zName==0 ) continue; 1815 if( strcmp(zName, "oss-fuzz")==0 ){ 1816 ossFuzzThisDb = sqlite3_column_int(pStmt,1); 1817 if( verboseFlag ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb); 1818 } 1819 if( strcmp(zName, "limit-mem")==0 ){ 1820 nMemThisDb = sqlite3_column_int(pStmt,1); 1821 if( verboseFlag ) printf("Config: limit-mem=%d\n", nMemThisDb); 1822 } 1823 } 1824 sqlite3_finalize(pStmt); 1825 } 1826 1827 if( zInsSql ){ 1828 sqlite3_create_function(db, "readfile", 1, SQLITE_UTF8, 0, 1829 readfileFunc, 0, 0); 1830 sqlite3_create_function(db, "readtextfile", 1, SQLITE_UTF8, 0, 1831 readtextfileFunc, 0, 0); 1832 sqlite3_create_function(db, "isdbsql", 1, SQLITE_UTF8, 0, 1833 isDbSqlFunc, 0, 0); 1834 rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0); 1835 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1836 zInsSql, sqlite3_errmsg(db)); 1837 rc = sqlite3_exec(db, "BEGIN", 0, 0, 0); 1838 if( rc ) fatalError("cannot start a transaction"); 1839 for(i=iFirstInsArg; i<argc; i++){ 1840 if( strcmp(argv[i],"-")==0 ){ 1841 /* A filename of "-" means read multiple filenames from stdin */ 1842 char zLine[2000]; 1843 while( rc==0 && fgets(zLine,sizeof(zLine),stdin)!=0 ){ 1844 size_t kk = strlen(zLine); 1845 while( kk>0 && zLine[kk-1]<=' ' ) kk--; 1846 sqlite3_bind_text(pStmt, 1, zLine, (int)kk, SQLITE_STATIC); 1847 if( verboseFlag ) printf("loading %.*s\n", (int)kk, zLine); 1848 sqlite3_step(pStmt); 1849 rc = sqlite3_reset(pStmt); 1850 if( rc ) fatalError("insert failed for %s", zLine); 1851 } 1852 }else{ 1853 sqlite3_bind_text(pStmt, 1, argv[i], -1, SQLITE_STATIC); 1854 if( verboseFlag ) printf("loading %s\n", argv[i]); 1855 sqlite3_step(pStmt); 1856 rc = sqlite3_reset(pStmt); 1857 if( rc ) fatalError("insert failed for %s", argv[i]); 1858 } 1859 } 1860 sqlite3_finalize(pStmt); 1861 rc = sqlite3_exec(db, "COMMIT", 0, 0, 0); 1862 if( rc ) fatalError("cannot commit the transaction: %s", 1863 sqlite3_errmsg(db)); 1864 rebuild_database(db, dbSqlOnly); 1865 sqlite3_close(db); 1866 return 0; 1867 } 1868 rc = sqlite3_exec(db, "PRAGMA query_only=1;", 0, 0, 0); 1869 if( rc ) fatalError("cannot set database to query-only"); 1870 if( zExpDb!=0 || zExpSql!=0 ){ 1871 sqlite3_create_function(db, "writefile", 2, SQLITE_UTF8, 0, 1872 writefileFunc, 0, 0); 1873 if( zExpDb!=0 ){ 1874 const char *zExDb = 1875 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent)," 1876 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)" 1877 " FROM db WHERE ?2<0 OR dbid=?2;"; 1878 rc = sqlite3_prepare_v2(db, zExDb, -1, &pStmt, 0); 1879 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1880 zExDb, sqlite3_errmsg(db)); 1881 sqlite3_bind_text64(pStmt, 1, zExpDb, strlen(zExpDb), 1882 SQLITE_STATIC, SQLITE_UTF8); 1883 sqlite3_bind_int(pStmt, 2, onlyDbid); 1884 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1885 printf("write db-%d (%d bytes) into %s\n", 1886 sqlite3_column_int(pStmt,1), 1887 sqlite3_column_int(pStmt,3), 1888 sqlite3_column_text(pStmt,2)); 1889 } 1890 sqlite3_finalize(pStmt); 1891 } 1892 if( zExpSql!=0 ){ 1893 const char *zExSql = 1894 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext)," 1895 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)" 1896 " FROM xsql WHERE ?2<0 OR sqlid=?2;"; 1897 rc = sqlite3_prepare_v2(db, zExSql, -1, &pStmt, 0); 1898 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1899 zExSql, sqlite3_errmsg(db)); 1900 sqlite3_bind_text64(pStmt, 1, zExpSql, strlen(zExpSql), 1901 SQLITE_STATIC, SQLITE_UTF8); 1902 sqlite3_bind_int(pStmt, 2, onlySqlid); 1903 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1904 printf("write sql-%d (%d bytes) into %s\n", 1905 sqlite3_column_int(pStmt,1), 1906 sqlite3_column_int(pStmt,3), 1907 sqlite3_column_text(pStmt,2)); 1908 } 1909 sqlite3_finalize(pStmt); 1910 } 1911 sqlite3_close(db); 1912 return 0; 1913 } 1914 1915 /* Load all SQL script content and all initial database images from the 1916 ** source db 1917 */ 1918 blobListLoadFromDb(db, "SELECT sqlid, sqltext FROM xsql", onlySqlid, 1919 &g.nSql, &g.pFirstSql); 1920 if( g.nSql==0 ) fatalError("need at least one SQL script"); 1921 blobListLoadFromDb(db, "SELECT dbid, dbcontent FROM db", onlyDbid, 1922 &g.nDb, &g.pFirstDb); 1923 if( g.nDb==0 ){ 1924 g.pFirstDb = safe_realloc(0, sizeof(Blob)); 1925 memset(g.pFirstDb, 0, sizeof(Blob)); 1926 g.pFirstDb->id = 1; 1927 g.pFirstDb->seq = 0; 1928 g.nDb = 1; 1929 sqlFuzz = 1; 1930 } 1931 1932 /* Print the description, if there is one */ 1933 if( !quietFlag ){ 1934 zDbName = azSrcDb[iSrcDb]; 1935 i = (int)strlen(zDbName) - 1; 1936 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1937 zDbName += i; 1938 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1939 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1940 printf("%s: %s\n", zDbName, sqlite3_column_text(pStmt,0)); 1941 } 1942 sqlite3_finalize(pStmt); 1943 } 1944 1945 /* Rebuild the database, if requested */ 1946 if( rebuildFlag ){ 1947 if( !quietFlag ){ 1948 printf("%s: rebuilding... ", zDbName); 1949 fflush(stdout); 1950 } 1951 rebuild_database(db, 0); 1952 if( !quietFlag ) printf("done\n"); 1953 } 1954 1955 /* Close the source database. Verify that no SQLite memory allocations are 1956 ** outstanding. 1957 */ 1958 sqlite3_close(db); 1959 if( sqlite3_memory_used()>0 ){ 1960 fatalError("SQLite has memory in use before the start of testing"); 1961 } 1962 1963 /* Limit available memory, if requested */ 1964 sqlite3_shutdown(); 1965 1966 if( nMemThisDb>0 && nMem==0 ){ 1967 if( !nativeMalloc ){ 1968 pHeap = realloc(pHeap, nMemThisDb); 1969 if( pHeap==0 ){ 1970 fatalError("failed to allocate %d bytes of heap memory", nMem); 1971 } 1972 sqlite3_config(SQLITE_CONFIG_HEAP, pHeap, nMemThisDb, 128); 1973 }else{ 1974 sqlite3_hard_heap_limit64((sqlite3_int64)nMemThisDb); 1975 } 1976 }else{ 1977 sqlite3_hard_heap_limit64(0); 1978 } 1979 1980 /* Disable lookaside with the --native-malloc option */ 1981 if( nativeMalloc ){ 1982 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, 0, 0); 1983 } 1984 1985 /* Reset the in-memory virtual filesystem */ 1986 formatVfs(); 1987 1988 /* Run a test using each SQL script against each database. 1989 */ 1990 if( !verboseFlag && !quietFlag && !bSpinner ) printf("%s:", zDbName); 1991 for(pSql=g.pFirstSql; pSql; pSql=pSql->pNext){ 1992 tmStart = timeOfDay(); 1993 if( isDbSql(pSql->a, pSql->sz) ){ 1994 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d",pSql->id); 1995 if( bSpinner ){ 1996 int nTotal =g.nSql; 1997 int idx = pSql->seq; 1998 printf("\r%s: %d/%d ", zDbName, idx, nTotal); 1999 fflush(stdout); 2000 }else if( verboseFlag ){ 2001 printf("%s\n", g.zTestName); 2002 fflush(stdout); 2003 }else if( !quietFlag ){ 2004 static int prevAmt = -1; 2005 int idx = pSql->seq; 2006 int amt = idx*10/(g.nSql); 2007 if( amt!=prevAmt ){ 2008 printf(" %d%%", amt*10); 2009 fflush(stdout); 2010 prevAmt = amt; 2011 } 2012 } 2013 if( nSkip>0 ){ 2014 nSkip--; 2015 }else{ 2016 runCombinedDbSqlInput(pSql->a, pSql->sz, iTimeout); 2017 } 2018 nTest++; 2019 if( bTimer ){ 2020 sqlite3_int64 tmEnd = timeOfDay(); 2021 printf("%lld %s\n", tmEnd - tmStart, g.zTestName); 2022 } 2023 g.zTestName[0] = 0; 2024 disableOom(); 2025 continue; 2026 } 2027 for(pDb=g.pFirstDb; pDb; pDb=pDb->pNext){ 2028 int openFlags; 2029 const char *zVfs = "inmem"; 2030 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d,dbid=%d", 2031 pSql->id, pDb->id); 2032 if( bSpinner ){ 2033 int nTotal = g.nDb*g.nSql; 2034 int idx = pSql->seq*g.nDb + pDb->id - 1; 2035 printf("\r%s: %d/%d ", zDbName, idx, nTotal); 2036 fflush(stdout); 2037 }else if( verboseFlag ){ 2038 printf("%s\n", g.zTestName); 2039 fflush(stdout); 2040 }else if( !quietFlag ){ 2041 static int prevAmt = -1; 2042 int idx = pSql->seq*g.nDb + pDb->id - 1; 2043 int amt = idx*10/(g.nDb*g.nSql); 2044 if( amt!=prevAmt ){ 2045 printf(" %d%%", amt*10); 2046 fflush(stdout); 2047 prevAmt = amt; 2048 } 2049 } 2050 if( nSkip>0 ){ 2051 nSkip--; 2052 continue; 2053 } 2054 createVFile("main.db", pDb->sz, pDb->a); 2055 sqlite3_randomness(0,0); 2056 if( ossFuzzThisDb ){ 2057 #ifndef SQLITE_OSS_FUZZ 2058 fatalError("--oss-fuzz not supported: recompile" 2059 " with -DSQLITE_OSS_FUZZ"); 2060 #else 2061 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t); 2062 LLVMFuzzerTestOneInput((const uint8_t*)pSql->a, (size_t)pSql->sz); 2063 #endif 2064 }else{ 2065 openFlags = SQLITE_OPEN_CREATE | SQLITE_OPEN_READWRITE; 2066 if( nativeFlag && pDb->sz==0 ){ 2067 openFlags |= SQLITE_OPEN_MEMORY; 2068 zVfs = 0; 2069 } 2070 rc = sqlite3_open_v2("main.db", &db, openFlags, zVfs); 2071 if( rc ) fatalError("cannot open inmem database"); 2072 sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 100000000); 2073 sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 50); 2074 if( cellSzCkFlag ) runSql(db, "PRAGMA cell_size_check=ON", runFlags); 2075 setAlarm((iTimeout+999)/1000); 2076 /* Enable test functions */ 2077 sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS, db); 2078 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 2079 if( sqlFuzz || vdbeLimitFlag ){ 2080 sqlite3_progress_handler(db, 100000, progressHandler, 2081 &vdbeLimitFlag); 2082 } 2083 #endif 2084 #ifdef SQLITE_TESTCTRL_PRNG_SEED 2085 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db); 2086 #endif 2087 if( bVdbeDebug ){ 2088 sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 2089 } 2090 do{ 2091 runSql(db, (char*)pSql->a, runFlags); 2092 }while( timeoutTest ); 2093 setAlarm(0); 2094 sqlite3_exec(db, "PRAGMA temp_store_directory=''", 0, 0, 0); 2095 sqlite3_close(db); 2096 } 2097 if( sqlite3_memory_used()>0 ){ 2098 fatalError("memory leak: %lld bytes outstanding", 2099 sqlite3_memory_used()); 2100 } 2101 reformatVfs(); 2102 nTest++; 2103 if( bTimer ){ 2104 sqlite3_int64 tmEnd = timeOfDay(); 2105 printf("%lld %s\n", tmEnd - tmStart, g.zTestName); 2106 } 2107 g.zTestName[0] = 0; 2108 2109 /* Simulate an error if the TEST_FAILURE environment variable is "5". 2110 ** This is used to verify that automated test script really do spot 2111 ** errors that occur in this test program. 2112 */ 2113 if( zFailCode ){ 2114 if( zFailCode[0]=='5' && zFailCode[1]==0 ){ 2115 fatalError("simulated failure"); 2116 }else if( zFailCode[0]!=0 ){ 2117 /* If TEST_FAILURE is something other than 5, just exit the test 2118 ** early */ 2119 printf("\nExit early due to TEST_FAILURE being set\n"); 2120 iSrcDb = nSrcDb-1; 2121 goto sourcedb_cleanup; 2122 } 2123 } 2124 } 2125 } 2126 if( bSpinner ){ 2127 int nTotal = g.nDb*g.nSql; 2128 printf("\r%s: %d/%d \n", zDbName, nTotal, nTotal); 2129 }else if( !quietFlag && !verboseFlag ){ 2130 printf(" 100%% - %d tests\n", g.nDb*g.nSql); 2131 } 2132 2133 /* Clean up at the end of processing a single source database 2134 */ 2135 sourcedb_cleanup: 2136 blobListFree(g.pFirstSql); 2137 blobListFree(g.pFirstDb); 2138 reformatVfs(); 2139 2140 } /* End loop over all source databases */ 2141 2142 if( !quietFlag ){ 2143 sqlite3_int64 iElapse = timeOfDay() - iBegin; 2144 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n" 2145 "SQLite %s %s\n", 2146 nTest, (int)(iElapse/1000), (int)(iElapse%1000), 2147 sqlite3_libversion(), sqlite3_sourceid()); 2148 } 2149 free(azSrcDb); 2150 free(pHeap); 2151 return 0; 2152 } 2153