1 /* 2 ** 2015-05-25 3 ** 4 ** The author disclaims copyright to this source code. In place of 5 ** a legal notice, here is a blessing: 6 ** 7 ** May you do good and not evil. 8 ** May you find forgiveness for yourself and forgive others. 9 ** May you share freely, never taking more than you give. 10 ** 11 ************************************************************************* 12 ** 13 ** This is a utility program designed to aid running regressions tests on 14 ** the SQLite library using data from external fuzzers. 15 ** 16 ** This program reads content from an SQLite database file with the following 17 ** schema: 18 ** 19 ** CREATE TABLE db( 20 ** dbid INTEGER PRIMARY KEY, -- database id 21 ** dbcontent BLOB -- database disk file image 22 ** ); 23 ** CREATE TABLE xsql( 24 ** sqlid INTEGER PRIMARY KEY, -- SQL script id 25 ** sqltext TEXT -- Text of SQL statements to run 26 ** ); 27 ** CREATE TABLE IF NOT EXISTS readme( 28 ** msg TEXT -- Human-readable description of this test collection 29 ** ); 30 ** 31 ** For each database file in the DB table, the SQL text in the XSQL table 32 ** is run against that database. All README.MSG values are printed prior 33 ** to the start of the test (unless the --quiet option is used). If the 34 ** DB table is empty, then all entries in XSQL are run against an empty 35 ** in-memory database. 36 ** 37 ** This program is looking for crashes, assertion faults, and/or memory leaks. 38 ** No attempt is made to verify the output. The assumption is that either all 39 ** of the database files or all of the SQL statements are malformed inputs, 40 ** generated by a fuzzer, that need to be checked to make sure they do not 41 ** present a security risk. 42 ** 43 ** This program also includes some command-line options to help with 44 ** creation and maintenance of the source content database. The command 45 ** 46 ** ./fuzzcheck database.db --load-sql FILE... 47 ** 48 ** Loads all FILE... arguments into the XSQL table. The --load-db option 49 ** works the same but loads the files into the DB table. The -m option can 50 ** be used to initialize the README table. The "database.db" file is created 51 ** if it does not previously exist. Example: 52 ** 53 ** ./fuzzcheck new.db --load-sql *.sql 54 ** ./fuzzcheck new.db --load-db *.db 55 ** ./fuzzcheck new.db -m 'New test cases' 56 ** 57 ** The three commands above will create the "new.db" file and initialize all 58 ** tables. Then do "./fuzzcheck new.db" to run the tests. 59 ** 60 ** DEBUGGING HINTS: 61 ** 62 ** If fuzzcheck does crash, it can be run in the debugger and the content 63 ** of the global variable g.zTextName[] will identify the specific XSQL and 64 ** DB values that were running when the crash occurred. 65 ** 66 ** DBSQLFUZZ: 67 ** 68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against 69 ** that database in its input. This utility can now process dbsqlfuzz 70 ** input files. Load such files using the "--load-dbsql FILE ..." command-line 71 ** option. 72 ** 73 ** Dbsqlfuzz inputs are ordinary text. The first part of the file is text 74 ** that describes the content of the database (using a lot of hexadecimal), 75 ** then there is a divider line followed by the SQL to run against the 76 ** database. Because they are ordinary text, dbsqlfuzz inputs are stored 77 ** in the XSQL table, as if they were ordinary SQL inputs. The isDbSql() 78 ** function can look at a text string and determine whether or not it is 79 ** a valid dbsqlfuzz input. 80 */ 81 #include <stdio.h> 82 #include <stdlib.h> 83 #include <string.h> 84 #include <stdarg.h> 85 #include <ctype.h> 86 #include <assert.h> 87 #include "sqlite3.h" 88 #define ISSPACE(X) isspace((unsigned char)(X)) 89 #define ISDIGIT(X) isdigit((unsigned char)(X)) 90 91 92 #ifdef __unix__ 93 # include <signal.h> 94 # include <unistd.h> 95 #endif 96 97 #include <stddef.h> 98 #if !defined(_MSC_VER) 99 # include <stdint.h> 100 #endif 101 102 #if defined(_MSC_VER) 103 typedef unsigned char uint8_t; 104 #endif 105 106 /* 107 ** Files in the virtual file system. 108 */ 109 typedef struct VFile VFile; 110 struct VFile { 111 char *zFilename; /* Filename. NULL for delete-on-close. From malloc() */ 112 int sz; /* Size of the file in bytes */ 113 int nRef; /* Number of references to this file */ 114 unsigned char *a; /* Content of the file. From malloc() */ 115 }; 116 typedef struct VHandle VHandle; 117 struct VHandle { 118 sqlite3_file base; /* Base class. Must be first */ 119 VFile *pVFile; /* The underlying file */ 120 }; 121 122 /* 123 ** The value of a database file template, or of an SQL script 124 */ 125 typedef struct Blob Blob; 126 struct Blob { 127 Blob *pNext; /* Next in a list */ 128 int id; /* Id of this Blob */ 129 int seq; /* Sequence number */ 130 int sz; /* Size of this Blob in bytes */ 131 unsigned char a[1]; /* Blob content. Extra space allocated as needed. */ 132 }; 133 134 /* 135 ** Maximum number of files in the in-memory virtual filesystem. 136 */ 137 #define MX_FILE 10 138 139 /* 140 ** Maximum allowed file size 141 */ 142 #define MX_FILE_SZ 10000000 143 144 /* 145 ** All global variables are gathered into the "g" singleton. 146 */ 147 static struct GlobalVars { 148 const char *zArgv0; /* Name of program */ 149 const char *zDbFile; /* Name of database file */ 150 VFile aFile[MX_FILE]; /* The virtual filesystem */ 151 int nDb; /* Number of template databases */ 152 Blob *pFirstDb; /* Content of first template database */ 153 int nSql; /* Number of SQL scripts */ 154 Blob *pFirstSql; /* First SQL script */ 155 unsigned int uRandom; /* Seed for the SQLite PRNG */ 156 char zTestName[100]; /* Name of current test */ 157 } g; 158 159 /* 160 ** Print an error message and quit. 161 */ 162 static void fatalError(const char *zFormat, ...){ 163 va_list ap; 164 fprintf(stderr, "%s", g.zArgv0); 165 if( g.zDbFile ) fprintf(stderr, " %s", g.zDbFile); 166 if( g.zTestName[0] ) fprintf(stderr, " (%s)", g.zTestName); 167 fprintf(stderr, ": "); 168 va_start(ap, zFormat); 169 vfprintf(stderr, zFormat, ap); 170 va_end(ap); 171 fprintf(stderr, "\n"); 172 exit(1); 173 } 174 175 /* 176 ** signal handler 177 */ 178 #ifdef __unix__ 179 static void signalHandler(int signum){ 180 const char *zSig; 181 if( signum==SIGABRT ){ 182 zSig = "abort"; 183 }else if( signum==SIGALRM ){ 184 zSig = "timeout"; 185 }else if( signum==SIGSEGV ){ 186 zSig = "segfault"; 187 }else{ 188 zSig = "signal"; 189 } 190 fatalError(zSig); 191 } 192 #endif 193 194 /* 195 ** Set the an alarm to go off after N seconds. Disable the alarm 196 ** if N==0 197 */ 198 static void setAlarm(int N){ 199 #ifdef __unix__ 200 alarm(N); 201 #else 202 (void)N; 203 #endif 204 } 205 206 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 207 /* 208 ** This an SQL progress handler. After an SQL statement has run for 209 ** many steps, we want to interrupt it. This guards against infinite 210 ** loops from recursive common table expressions. 211 ** 212 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used. 213 ** In that case, hitting the progress handler is a fatal error. 214 */ 215 static int progressHandler(void *pVdbeLimitFlag){ 216 if( *(int*)pVdbeLimitFlag ) fatalError("too many VDBE cycles"); 217 return 1; 218 } 219 #endif 220 221 /* 222 ** Reallocate memory. Show and error and quit if unable. 223 */ 224 static void *safe_realloc(void *pOld, int szNew){ 225 void *pNew = realloc(pOld, szNew<=0 ? 1 : szNew); 226 if( pNew==0 ) fatalError("unable to realloc for %d bytes", szNew); 227 return pNew; 228 } 229 230 /* 231 ** Initialize the virtual file system. 232 */ 233 static void formatVfs(void){ 234 int i; 235 for(i=0; i<MX_FILE; i++){ 236 g.aFile[i].sz = -1; 237 g.aFile[i].zFilename = 0; 238 g.aFile[i].a = 0; 239 g.aFile[i].nRef = 0; 240 } 241 } 242 243 244 /* 245 ** Erase all information in the virtual file system. 246 */ 247 static void reformatVfs(void){ 248 int i; 249 for(i=0; i<MX_FILE; i++){ 250 if( g.aFile[i].sz<0 ) continue; 251 if( g.aFile[i].zFilename ){ 252 free(g.aFile[i].zFilename); 253 g.aFile[i].zFilename = 0; 254 } 255 if( g.aFile[i].nRef>0 ){ 256 fatalError("file %d still open. nRef=%d", i, g.aFile[i].nRef); 257 } 258 g.aFile[i].sz = -1; 259 free(g.aFile[i].a); 260 g.aFile[i].a = 0; 261 g.aFile[i].nRef = 0; 262 } 263 } 264 265 /* 266 ** Find a VFile by name 267 */ 268 static VFile *findVFile(const char *zName){ 269 int i; 270 if( zName==0 ) return 0; 271 for(i=0; i<MX_FILE; i++){ 272 if( g.aFile[i].zFilename==0 ) continue; 273 if( strcmp(g.aFile[i].zFilename, zName)==0 ) return &g.aFile[i]; 274 } 275 return 0; 276 } 277 278 /* 279 ** Find a VFile by name. Create it if it does not already exist and 280 ** initialize it to the size and content given. 281 ** 282 ** Return NULL only if the filesystem is full. 283 */ 284 static VFile *createVFile(const char *zName, int sz, unsigned char *pData){ 285 VFile *pNew = findVFile(zName); 286 int i; 287 if( pNew ) return pNew; 288 for(i=0; i<MX_FILE && g.aFile[i].sz>=0; i++){} 289 if( i>=MX_FILE ) return 0; 290 pNew = &g.aFile[i]; 291 if( zName ){ 292 int nName = (int)strlen(zName)+1; 293 pNew->zFilename = safe_realloc(0, nName); 294 memcpy(pNew->zFilename, zName, nName); 295 }else{ 296 pNew->zFilename = 0; 297 } 298 pNew->nRef = 0; 299 pNew->sz = sz; 300 pNew->a = safe_realloc(0, sz); 301 if( sz>0 ) memcpy(pNew->a, pData, sz); 302 return pNew; 303 } 304 305 306 /* 307 ** Implementation of the "readfile(X)" SQL function. The entire content 308 ** of the file named X is read and returned as a BLOB. NULL is returned 309 ** if the file does not exist or is unreadable. 310 */ 311 static void readfileFunc( 312 sqlite3_context *context, 313 int argc, 314 sqlite3_value **argv 315 ){ 316 const char *zName; 317 FILE *in; 318 long nIn; 319 void *pBuf; 320 321 zName = (const char*)sqlite3_value_text(argv[0]); 322 if( zName==0 ) return; 323 in = fopen(zName, "rb"); 324 if( in==0 ) return; 325 fseek(in, 0, SEEK_END); 326 nIn = ftell(in); 327 rewind(in); 328 pBuf = sqlite3_malloc64( nIn ); 329 if( pBuf && 1==fread(pBuf, nIn, 1, in) ){ 330 sqlite3_result_blob(context, pBuf, nIn, sqlite3_free); 331 }else{ 332 sqlite3_free(pBuf); 333 } 334 fclose(in); 335 } 336 337 /* 338 ** Implementation of the "readtextfile(X)" SQL function. The text content 339 ** of the file named X through the end of the file or to the first \000 340 ** character, whichever comes first, is read and returned as TEXT. NULL 341 ** is returned if the file does not exist or is unreadable. 342 */ 343 static void readtextfileFunc( 344 sqlite3_context *context, 345 int argc, 346 sqlite3_value **argv 347 ){ 348 const char *zName; 349 FILE *in; 350 long nIn; 351 char *pBuf; 352 353 zName = (const char*)sqlite3_value_text(argv[0]); 354 if( zName==0 ) return; 355 in = fopen(zName, "rb"); 356 if( in==0 ) return; 357 fseek(in, 0, SEEK_END); 358 nIn = ftell(in); 359 rewind(in); 360 pBuf = sqlite3_malloc64( nIn+1 ); 361 if( pBuf && 1==fread(pBuf, nIn, 1, in) ){ 362 pBuf[nIn] = 0; 363 sqlite3_result_text(context, pBuf, -1, sqlite3_free); 364 }else{ 365 sqlite3_free(pBuf); 366 } 367 fclose(in); 368 } 369 370 /* 371 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y 372 ** is written into file X. The number of bytes written is returned. Or 373 ** NULL is returned if something goes wrong, such as being unable to open 374 ** file X for writing. 375 */ 376 static void writefileFunc( 377 sqlite3_context *context, 378 int argc, 379 sqlite3_value **argv 380 ){ 381 FILE *out; 382 const char *z; 383 sqlite3_int64 rc; 384 const char *zFile; 385 386 (void)argc; 387 zFile = (const char*)sqlite3_value_text(argv[0]); 388 if( zFile==0 ) return; 389 out = fopen(zFile, "wb"); 390 if( out==0 ) return; 391 z = (const char*)sqlite3_value_blob(argv[1]); 392 if( z==0 ){ 393 rc = 0; 394 }else{ 395 rc = fwrite(z, 1, sqlite3_value_bytes(argv[1]), out); 396 } 397 fclose(out); 398 sqlite3_result_int64(context, rc); 399 } 400 401 402 /* 403 ** Load a list of Blob objects from the database 404 */ 405 static void blobListLoadFromDb( 406 sqlite3 *db, /* Read from this database */ 407 const char *zSql, /* Query used to extract the blobs */ 408 int onlyId, /* Only load where id is this value */ 409 int *pN, /* OUT: Write number of blobs loaded here */ 410 Blob **ppList /* OUT: Write the head of the blob list here */ 411 ){ 412 Blob head; 413 Blob *p; 414 sqlite3_stmt *pStmt; 415 int n = 0; 416 int rc; 417 char *z2; 418 419 if( onlyId>0 ){ 420 z2 = sqlite3_mprintf("%s WHERE rowid=%d", zSql, onlyId); 421 }else{ 422 z2 = sqlite3_mprintf("%s", zSql); 423 } 424 rc = sqlite3_prepare_v2(db, z2, -1, &pStmt, 0); 425 sqlite3_free(z2); 426 if( rc ) fatalError("%s", sqlite3_errmsg(db)); 427 head.pNext = 0; 428 p = &head; 429 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 430 int sz = sqlite3_column_bytes(pStmt, 1); 431 Blob *pNew = safe_realloc(0, sizeof(*pNew)+sz ); 432 pNew->id = sqlite3_column_int(pStmt, 0); 433 pNew->sz = sz; 434 pNew->seq = n++; 435 pNew->pNext = 0; 436 memcpy(pNew->a, sqlite3_column_blob(pStmt,1), sz); 437 pNew->a[sz] = 0; 438 p->pNext = pNew; 439 p = pNew; 440 } 441 sqlite3_finalize(pStmt); 442 *pN = n; 443 *ppList = head.pNext; 444 } 445 446 /* 447 ** Free a list of Blob objects 448 */ 449 static void blobListFree(Blob *p){ 450 Blob *pNext; 451 while( p ){ 452 pNext = p->pNext; 453 free(p); 454 p = pNext; 455 } 456 } 457 458 /* Return the current wall-clock time 459 ** 460 ** The number of milliseconds since the julian epoch. 461 ** 1907-01-01 00:00:00 -> 210866716800000 462 ** 2021-01-01 00:00:00 -> 212476176000000 463 */ 464 static sqlite3_int64 timeOfDay(void){ 465 static sqlite3_vfs *clockVfs = 0; 466 sqlite3_int64 t; 467 if( clockVfs==0 ){ 468 clockVfs = sqlite3_vfs_find(0); 469 if( clockVfs==0 ) return 0; 470 } 471 if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){ 472 clockVfs->xCurrentTimeInt64(clockVfs, &t); 473 }else{ 474 double r; 475 clockVfs->xCurrentTime(clockVfs, &r); 476 t = (sqlite3_int64)(r*86400000.0); 477 } 478 return t; 479 } 480 481 /*************************************************************************** 482 ** Code to process combined database+SQL scripts generated by the 483 ** dbsqlfuzz fuzzer. 484 */ 485 486 /* An instance of the following object is passed by pointer as the 487 ** client data to various callbacks. 488 */ 489 typedef struct FuzzCtx { 490 sqlite3 *db; /* The database connection */ 491 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */ 492 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */ 493 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */ 494 unsigned nCb; /* Number of progress callbacks */ 495 unsigned mxCb; /* Maximum number of progress callbacks allowed */ 496 unsigned execCnt; /* Number of calls to the sqlite3_exec callback */ 497 int timeoutHit; /* True when reaching a timeout */ 498 } FuzzCtx; 499 500 /* Verbosity level for the dbsqlfuzz test runner */ 501 static int eVerbosity = 0; 502 503 /* True to activate PRAGMA vdbe_debug=on */ 504 static int bVdbeDebug = 0; 505 506 /* Timeout for each fuzzing attempt, in milliseconds */ 507 static int giTimeout = 10000; /* Defaults to 10 seconds */ 508 509 /* Maximum number of progress handler callbacks */ 510 static unsigned int mxProgressCb = 2000; 511 512 /* Maximum string length in SQLite */ 513 static int lengthLimit = 1000000; 514 515 /* Maximum expression depth */ 516 static int depthLimit = 500; 517 518 /* Limit on the amount of heap memory that can be used */ 519 static sqlite3_int64 heapLimit = 100000000; 520 521 /* Maximum byte-code program length in SQLite */ 522 static int vdbeOpLimit = 25000; 523 524 /* Maximum size of the in-memory database */ 525 static sqlite3_int64 maxDbSize = 104857600; 526 /* OOM simulation parameters */ 527 static unsigned int oomCounter = 0; /* Simulate OOM when equals 1 */ 528 static unsigned int oomRepeat = 0; /* Number of OOMs in a row */ 529 static void*(*defaultMalloc)(int) = 0; /* The low-level malloc routine */ 530 531 /* This routine is called when a simulated OOM occurs. It is broken 532 ** out as a separate routine to make it easy to set a breakpoint on 533 ** the OOM 534 */ 535 void oomFault(void){ 536 if( eVerbosity ){ 537 printf("Simulated OOM fault\n"); 538 } 539 if( oomRepeat>0 ){ 540 oomRepeat--; 541 }else{ 542 oomCounter--; 543 } 544 } 545 546 /* This routine is a replacement malloc() that is used to simulate 547 ** Out-Of-Memory (OOM) errors for testing purposes. 548 */ 549 static void *oomMalloc(int nByte){ 550 if( oomCounter ){ 551 if( oomCounter==1 ){ 552 oomFault(); 553 return 0; 554 }else{ 555 oomCounter--; 556 } 557 } 558 return defaultMalloc(nByte); 559 } 560 561 /* Register the OOM simulator. This must occur before any memory 562 ** allocations */ 563 static void registerOomSimulator(void){ 564 sqlite3_mem_methods mem; 565 sqlite3_shutdown(); 566 sqlite3_config(SQLITE_CONFIG_GETMALLOC, &mem); 567 defaultMalloc = mem.xMalloc; 568 mem.xMalloc = oomMalloc; 569 sqlite3_config(SQLITE_CONFIG_MALLOC, &mem); 570 } 571 572 /* Turn off any pending OOM simulation */ 573 static void disableOom(void){ 574 oomCounter = 0; 575 oomRepeat = 0; 576 } 577 578 /* 579 ** Translate a single byte of Hex into an integer. 580 ** This routine only works if h really is a valid hexadecimal 581 ** character: 0..9a..fA..F 582 */ 583 static unsigned char hexToInt(unsigned int h){ 584 #ifdef SQLITE_EBCDIC 585 h += 9*(1&~(h>>4)); /* EBCDIC */ 586 #else 587 h += 9*(1&(h>>6)); /* ASCII */ 588 #endif 589 return h & 0xf; 590 } 591 592 /* 593 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine 594 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it 595 ** does it makes corresponding changes to the *pK value and *pI value 596 ** and returns true. If the input buffer does not match the patterns, 597 ** no changes are made to either *pK or *pI and this routine returns false. 598 */ 599 static int isOffset( 600 const unsigned char *zIn, /* Text input */ 601 int nIn, /* Bytes of input */ 602 unsigned int *pK, /* half-byte cursor to adjust */ 603 unsigned int *pI /* Input index to adjust */ 604 ){ 605 int i; 606 unsigned int k = 0; 607 unsigned char c; 608 for(i=1; i<nIn && (c = zIn[i])!=']'; i++){ 609 if( !isxdigit(c) ) return 0; 610 k = k*16 + hexToInt(c); 611 } 612 if( i==nIn ) return 0; 613 *pK = 2*k; 614 *pI += i; 615 return 1; 616 } 617 618 /* 619 ** Decode the text starting at zIn into a binary database file. 620 ** The maximum length of zIn is nIn bytes. Compute the binary database 621 ** file contain in space obtained from sqlite3_malloc(). 622 ** 623 ** Return the number of bytes of zIn consumed. Or return -1 if there 624 ** is an error. One potential error is that the recipe specifies a 625 ** database file larger than MX_FILE_SZ bytes. 626 ** 627 ** Abort on an OOM. 628 */ 629 static int decodeDatabase( 630 const unsigned char *zIn, /* Input text to be decoded */ 631 int nIn, /* Bytes of input text */ 632 unsigned char **paDecode, /* OUT: decoded database file */ 633 int *pnDecode /* OUT: Size of decoded database */ 634 ){ 635 unsigned char *a, *aNew; /* Database under construction */ 636 int mx = 0; /* Current size of the database */ 637 sqlite3_uint64 nAlloc = 4096; /* Space allocated in a[] */ 638 unsigned int i; /* Next byte of zIn[] to read */ 639 unsigned int j; /* Temporary integer */ 640 unsigned int k; /* half-byte cursor index for output */ 641 unsigned int n; /* Number of bytes of input */ 642 unsigned char b = 0; 643 if( nIn<4 ) return -1; 644 n = (unsigned int)nIn; 645 a = sqlite3_malloc64( nAlloc ); 646 if( a==0 ){ 647 fprintf(stderr, "Out of memory!\n"); 648 exit(1); 649 } 650 memset(a, 0, (size_t)nAlloc); 651 for(i=k=0; i<n; i++){ 652 unsigned char c = (unsigned char)zIn[i]; 653 if( isxdigit(c) ){ 654 k++; 655 if( k & 1 ){ 656 b = hexToInt(c)*16; 657 }else{ 658 b += hexToInt(c); 659 j = k/2 - 1; 660 if( j>=nAlloc ){ 661 sqlite3_uint64 newSize; 662 if( nAlloc==MX_FILE_SZ || j>=MX_FILE_SZ ){ 663 if( eVerbosity ){ 664 fprintf(stderr, "Input database too big: max %d bytes\n", 665 MX_FILE_SZ); 666 } 667 sqlite3_free(a); 668 return -1; 669 } 670 newSize = nAlloc*2; 671 if( newSize<=j ){ 672 newSize = (j+4096)&~4095; 673 } 674 if( newSize>MX_FILE_SZ ){ 675 if( j>=MX_FILE_SZ ){ 676 sqlite3_free(a); 677 return -1; 678 } 679 newSize = MX_FILE_SZ; 680 } 681 aNew = sqlite3_realloc64( a, newSize ); 682 if( aNew==0 ){ 683 sqlite3_free(a); 684 return -1; 685 } 686 a = aNew; 687 assert( newSize > nAlloc ); 688 memset(a+nAlloc, 0, (size_t)(newSize - nAlloc)); 689 nAlloc = newSize; 690 } 691 if( j>=(unsigned)mx ){ 692 mx = (j + 4095)&~4095; 693 if( mx>MX_FILE_SZ ) mx = MX_FILE_SZ; 694 } 695 assert( j<nAlloc ); 696 a[j] = b; 697 } 698 }else if( zIn[i]=='[' && i<n-3 && isOffset(zIn+i, nIn-i, &k, &i) ){ 699 continue; 700 }else if( zIn[i]=='\n' && i<n-4 && memcmp(zIn+i,"\n--\n",4)==0 ){ 701 i += 4; 702 break; 703 } 704 } 705 *pnDecode = mx; 706 *paDecode = a; 707 return i; 708 } 709 710 /* 711 ** Progress handler callback. 712 ** 713 ** The argument is the cutoff-time after which all processing should 714 ** stop. So return non-zero if the cut-off time is exceeded. 715 */ 716 static int progress_handler(void *pClientData) { 717 FuzzCtx *p = (FuzzCtx*)pClientData; 718 sqlite3_int64 iNow = timeOfDay(); 719 int rc = iNow>=p->iCutoffTime; 720 sqlite3_int64 iDiff = iNow - p->iLastCb; 721 /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */ 722 if( iDiff > p->mxInterval ) p->mxInterval = iDiff; 723 p->nCb++; 724 if( rc==0 && p->mxCb>0 && p->mxCb<=p->nCb ) rc = 1; 725 if( rc && !p->timeoutHit && eVerbosity>=2 ){ 726 printf("Timeout on progress callback %d\n", p->nCb); 727 fflush(stdout); 728 p->timeoutHit = 1; 729 } 730 return rc; 731 } 732 733 /* 734 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and 735 ** "PRAGMA parser_trace" since they can dramatically increase the 736 ** amount of output without actually testing anything useful. 737 ** 738 ** Also block ATTACH if attaching a file from the filesystem. 739 */ 740 static int block_troublesome_sql( 741 void *Notused, 742 int eCode, 743 const char *zArg1, 744 const char *zArg2, 745 const char *zArg3, 746 const char *zArg4 747 ){ 748 (void)Notused; 749 (void)zArg2; 750 (void)zArg3; 751 (void)zArg4; 752 if( eCode==SQLITE_PRAGMA ){ 753 if( eVerbosity==0 ){ 754 if( sqlite3_strnicmp("vdbe_", zArg1, 5)==0 755 || sqlite3_stricmp("parser_trace", zArg1)==0 756 || sqlite3_stricmp("temp_store_directory", zArg1)==0 757 ){ 758 return SQLITE_DENY; 759 } 760 }else if( sqlite3_stricmp("oom",zArg1)==0 761 && zArg2!=0 && zArg2[0]!=0 ){ 762 oomCounter = atoi(zArg2); 763 } 764 }else if( eCode==SQLITE_ATTACH ){ 765 if( zArg1==0 || (zArg1[0]!=0 && strcmp(zArg1,":memory:")!=0) ){ 766 return SQLITE_DENY; 767 } 768 } 769 return SQLITE_OK; 770 } 771 772 /* 773 ** Run the SQL text 774 */ 775 static int runDbSql(sqlite3 *db, const char *zSql){ 776 int rc; 777 sqlite3_stmt *pStmt; 778 while( isspace(zSql[0]&0x7f) ) zSql++; 779 if( zSql[0]==0 ) return SQLITE_OK; 780 if( eVerbosity>=4 ){ 781 printf("RUNNING-SQL: [%s]\n", zSql); 782 fflush(stdout); 783 } 784 rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0); 785 if( rc==SQLITE_OK ){ 786 while( (rc = sqlite3_step(pStmt))==SQLITE_ROW ){ 787 if( eVerbosity>=5 ){ 788 int j; 789 for(j=0; j<sqlite3_column_count(pStmt); j++){ 790 if( j ) printf(","); 791 switch( sqlite3_column_type(pStmt, j) ){ 792 case SQLITE_NULL: { 793 printf("NULL"); 794 break; 795 } 796 case SQLITE_INTEGER: 797 case SQLITE_FLOAT: { 798 printf("%s", sqlite3_column_text(pStmt, j)); 799 break; 800 } 801 case SQLITE_BLOB: { 802 int n = sqlite3_column_bytes(pStmt, j); 803 int i; 804 const unsigned char *a; 805 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 806 printf("x'"); 807 for(i=0; i<n; i++){ 808 printf("%02x", a[i]); 809 } 810 printf("'"); 811 break; 812 } 813 case SQLITE_TEXT: { 814 int n = sqlite3_column_bytes(pStmt, j); 815 int i; 816 const unsigned char *a; 817 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 818 printf("'"); 819 for(i=0; i<n; i++){ 820 if( a[i]=='\'' ){ 821 printf("''"); 822 }else{ 823 putchar(a[i]); 824 } 825 } 826 printf("'"); 827 break; 828 } 829 } /* End switch() */ 830 } /* End for() */ 831 printf("\n"); 832 fflush(stdout); 833 } /* End if( eVerbosity>=5 ) */ 834 } /* End while( SQLITE_ROW */ 835 if( rc!=SQLITE_DONE && eVerbosity>=4 ){ 836 printf("SQL-ERROR: (%d) %s\n", rc, sqlite3_errmsg(db)); 837 fflush(stdout); 838 } 839 }else if( eVerbosity>=4 ){ 840 printf("SQL-ERROR (%d): %s\n", rc, sqlite3_errmsg(db)); 841 fflush(stdout); 842 } /* End if( SQLITE_OK ) */ 843 return sqlite3_finalize(pStmt); 844 } 845 846 /* Invoke this routine to run a single test case */ 847 int runCombinedDbSqlInput(const uint8_t *aData, size_t nByte, int iTimeout){ 848 int rc; /* SQLite API return value */ 849 int iSql; /* Index in aData[] of start of SQL */ 850 unsigned char *aDb = 0; /* Decoded database content */ 851 int nDb = 0; /* Size of the decoded database */ 852 int i; /* Loop counter */ 853 int j; /* Start of current SQL statement */ 854 char *zSql = 0; /* SQL text to run */ 855 int nSql; /* Bytes of SQL text */ 856 FuzzCtx cx; /* Fuzzing context */ 857 858 if( nByte<10 ) return 0; 859 if( sqlite3_initialize() ) return 0; 860 if( sqlite3_memory_used()!=0 ){ 861 int nAlloc = 0; 862 int nNotUsed = 0; 863 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 864 fprintf(stderr,"memory leak prior to test start:" 865 " %lld bytes in %d allocations\n", 866 sqlite3_memory_used(), nAlloc); 867 exit(1); 868 } 869 memset(&cx, 0, sizeof(cx)); 870 iSql = decodeDatabase((unsigned char*)aData, (int)nByte, &aDb, &nDb); 871 if( iSql<0 ) return 0; 872 nSql = (int)(nByte - iSql); 873 if( eVerbosity>=3 ){ 874 printf( 875 "****** %d-byte input, %d-byte database, %d-byte script " 876 "******\n", (int)nByte, nDb, nSql); 877 fflush(stdout); 878 } 879 rc = sqlite3_open(0, &cx.db); 880 if( rc ){ 881 sqlite3_free(aDb); 882 return 1; 883 } 884 if( bVdbeDebug ){ 885 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 886 } 887 888 /* Invoke the progress handler frequently to check to see if we 889 ** are taking too long. The progress handler will return true 890 ** (which will block further processing) if more than giTimeout seconds have 891 ** elapsed since the start of the test. 892 */ 893 cx.iLastCb = timeOfDay(); 894 cx.iCutoffTime = cx.iLastCb + (iTimeout<giTimeout ? iTimeout : giTimeout); 895 cx.mxCb = mxProgressCb; 896 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 897 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx); 898 #endif 899 900 /* Set a limit on the maximum size of a prepared statement, and the 901 ** maximum length of a string or blob */ 902 if( vdbeOpLimit>0 ){ 903 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, vdbeOpLimit); 904 } 905 if( lengthLimit>0 ){ 906 sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, lengthLimit); 907 } 908 if( depthLimit>0 ){ 909 sqlite3_limit(cx.db, SQLITE_LIMIT_EXPR_DEPTH, depthLimit); 910 } 911 sqlite3_limit(cx.db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 100); 912 sqlite3_hard_heap_limit64(heapLimit); 913 914 if( nDb>=20 && aDb[18]==2 && aDb[19]==2 ){ 915 aDb[18] = aDb[19] = 1; 916 } 917 rc = sqlite3_deserialize(cx.db, "main", aDb, nDb, nDb, 918 SQLITE_DESERIALIZE_RESIZEABLE | 919 SQLITE_DESERIALIZE_FREEONCLOSE); 920 if( rc ){ 921 fprintf(stderr, "sqlite3_deserialize() failed with %d\n", rc); 922 goto testrun_finished; 923 } 924 if( maxDbSize>0 ){ 925 sqlite3_int64 x = maxDbSize; 926 sqlite3_file_control(cx.db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x); 927 } 928 929 /* For high debugging levels, turn on debug mode */ 930 if( eVerbosity>=5 ){ 931 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON;", 0, 0, 0); 932 } 933 934 /* Block debug pragmas and ATTACH/DETACH. But wait until after 935 ** deserialize to do this because deserialize depends on ATTACH */ 936 sqlite3_set_authorizer(cx.db, block_troublesome_sql, 0); 937 938 /* Consistent PRNG seed */ 939 sqlite3_randomness(0,0); 940 941 zSql = sqlite3_malloc( nSql + 1 ); 942 if( zSql==0 ){ 943 fprintf(stderr, "Out of memory!\n"); 944 }else{ 945 memcpy(zSql, aData+iSql, nSql); 946 zSql[nSql] = 0; 947 for(i=j=0; zSql[i]; i++){ 948 if( zSql[i]==';' ){ 949 char cSaved = zSql[i+1]; 950 zSql[i+1] = 0; 951 if( sqlite3_complete(zSql+j) ){ 952 rc = runDbSql(cx.db, zSql+j); 953 j = i+1; 954 } 955 zSql[i+1] = cSaved; 956 if( rc==SQLITE_INTERRUPT || progress_handler(&cx) ){ 957 goto testrun_finished; 958 } 959 } 960 } 961 if( j<i ){ 962 runDbSql(cx.db, zSql+j); 963 } 964 } 965 testrun_finished: 966 sqlite3_free(zSql); 967 rc = sqlite3_close(cx.db); 968 if( rc!=SQLITE_OK ){ 969 fprintf(stdout, "sqlite3_close() returns %d\n", rc); 970 } 971 if( eVerbosity>=2 ){ 972 fprintf(stdout, "Peak memory usages: %f MB\n", 973 sqlite3_memory_highwater(1) / 1000000.0); 974 } 975 if( sqlite3_memory_used()!=0 ){ 976 int nAlloc = 0; 977 int nNotUsed = 0; 978 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 979 fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n", 980 sqlite3_memory_used(), nAlloc); 981 exit(1); 982 } 983 return 0; 984 } 985 986 /* 987 ** END of the dbsqlfuzz code 988 ***************************************************************************/ 989 990 /* Look at a SQL text and try to determine if it begins with a database 991 ** description, such as would be found in a dbsqlfuzz test case. Return 992 ** true if this does appear to be a dbsqlfuzz test case and false otherwise. 993 */ 994 static int isDbSql(unsigned char *a, int n){ 995 unsigned char buf[12]; 996 int i; 997 if( n>4 && memcmp(a,"\n--\n",4)==0 ) return 1; 998 while( n>0 && isspace(a[0]) ){ a++; n--; } 999 for(i=0; n>0 && i<8; n--, a++){ 1000 if( isxdigit(a[0]) ) buf[i++] = a[0]; 1001 } 1002 if( i==8 && memcmp(buf,"53514c69",8)==0 ) return 1; 1003 return 0; 1004 } 1005 1006 /* Implementation of the isdbsql(TEXT) SQL function. 1007 */ 1008 static void isDbSqlFunc( 1009 sqlite3_context *context, 1010 int argc, 1011 sqlite3_value **argv 1012 ){ 1013 int n = sqlite3_value_bytes(argv[0]); 1014 unsigned char *a = (unsigned char*)sqlite3_value_blob(argv[0]); 1015 sqlite3_result_int(context, a!=0 && n>0 && isDbSql(a,n)); 1016 } 1017 1018 /* Methods for the VHandle object 1019 */ 1020 static int inmemClose(sqlite3_file *pFile){ 1021 VHandle *p = (VHandle*)pFile; 1022 VFile *pVFile = p->pVFile; 1023 pVFile->nRef--; 1024 if( pVFile->nRef==0 && pVFile->zFilename==0 ){ 1025 pVFile->sz = -1; 1026 free(pVFile->a); 1027 pVFile->a = 0; 1028 } 1029 return SQLITE_OK; 1030 } 1031 static int inmemRead( 1032 sqlite3_file *pFile, /* Read from this open file */ 1033 void *pData, /* Store content in this buffer */ 1034 int iAmt, /* Bytes of content */ 1035 sqlite3_int64 iOfst /* Start reading here */ 1036 ){ 1037 VHandle *pHandle = (VHandle*)pFile; 1038 VFile *pVFile = pHandle->pVFile; 1039 if( iOfst<0 || iOfst>=pVFile->sz ){ 1040 memset(pData, 0, iAmt); 1041 return SQLITE_IOERR_SHORT_READ; 1042 } 1043 if( iOfst+iAmt>pVFile->sz ){ 1044 memset(pData, 0, iAmt); 1045 iAmt = (int)(pVFile->sz - iOfst); 1046 memcpy(pData, pVFile->a + iOfst, iAmt); 1047 return SQLITE_IOERR_SHORT_READ; 1048 } 1049 memcpy(pData, pVFile->a + iOfst, iAmt); 1050 return SQLITE_OK; 1051 } 1052 static int inmemWrite( 1053 sqlite3_file *pFile, /* Write to this file */ 1054 const void *pData, /* Content to write */ 1055 int iAmt, /* bytes to write */ 1056 sqlite3_int64 iOfst /* Start writing here */ 1057 ){ 1058 VHandle *pHandle = (VHandle*)pFile; 1059 VFile *pVFile = pHandle->pVFile; 1060 if( iOfst+iAmt > pVFile->sz ){ 1061 if( iOfst+iAmt >= MX_FILE_SZ ){ 1062 return SQLITE_FULL; 1063 } 1064 pVFile->a = safe_realloc(pVFile->a, (int)(iOfst+iAmt)); 1065 if( iOfst > pVFile->sz ){ 1066 memset(pVFile->a + pVFile->sz, 0, (int)(iOfst - pVFile->sz)); 1067 } 1068 pVFile->sz = (int)(iOfst + iAmt); 1069 } 1070 memcpy(pVFile->a + iOfst, pData, iAmt); 1071 return SQLITE_OK; 1072 } 1073 static int inmemTruncate(sqlite3_file *pFile, sqlite3_int64 iSize){ 1074 VHandle *pHandle = (VHandle*)pFile; 1075 VFile *pVFile = pHandle->pVFile; 1076 if( pVFile->sz>iSize && iSize>=0 ) pVFile->sz = (int)iSize; 1077 return SQLITE_OK; 1078 } 1079 static int inmemSync(sqlite3_file *pFile, int flags){ 1080 return SQLITE_OK; 1081 } 1082 static int inmemFileSize(sqlite3_file *pFile, sqlite3_int64 *pSize){ 1083 *pSize = ((VHandle*)pFile)->pVFile->sz; 1084 return SQLITE_OK; 1085 } 1086 static int inmemLock(sqlite3_file *pFile, int type){ 1087 return SQLITE_OK; 1088 } 1089 static int inmemUnlock(sqlite3_file *pFile, int type){ 1090 return SQLITE_OK; 1091 } 1092 static int inmemCheckReservedLock(sqlite3_file *pFile, int *pOut){ 1093 *pOut = 0; 1094 return SQLITE_OK; 1095 } 1096 static int inmemFileControl(sqlite3_file *pFile, int op, void *pArg){ 1097 return SQLITE_NOTFOUND; 1098 } 1099 static int inmemSectorSize(sqlite3_file *pFile){ 1100 return 512; 1101 } 1102 static int inmemDeviceCharacteristics(sqlite3_file *pFile){ 1103 return 1104 SQLITE_IOCAP_SAFE_APPEND | 1105 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN | 1106 SQLITE_IOCAP_POWERSAFE_OVERWRITE; 1107 } 1108 1109 1110 /* Method table for VHandle 1111 */ 1112 static sqlite3_io_methods VHandleMethods = { 1113 /* iVersion */ 1, 1114 /* xClose */ inmemClose, 1115 /* xRead */ inmemRead, 1116 /* xWrite */ inmemWrite, 1117 /* xTruncate */ inmemTruncate, 1118 /* xSync */ inmemSync, 1119 /* xFileSize */ inmemFileSize, 1120 /* xLock */ inmemLock, 1121 /* xUnlock */ inmemUnlock, 1122 /* xCheck... */ inmemCheckReservedLock, 1123 /* xFileCtrl */ inmemFileControl, 1124 /* xSectorSz */ inmemSectorSize, 1125 /* xDevchar */ inmemDeviceCharacteristics, 1126 /* xShmMap */ 0, 1127 /* xShmLock */ 0, 1128 /* xShmBarrier */ 0, 1129 /* xShmUnmap */ 0, 1130 /* xFetch */ 0, 1131 /* xUnfetch */ 0 1132 }; 1133 1134 /* 1135 ** Open a new file in the inmem VFS. All files are anonymous and are 1136 ** delete-on-close. 1137 */ 1138 static int inmemOpen( 1139 sqlite3_vfs *pVfs, 1140 const char *zFilename, 1141 sqlite3_file *pFile, 1142 int openFlags, 1143 int *pOutFlags 1144 ){ 1145 VFile *pVFile = createVFile(zFilename, 0, (unsigned char*)""); 1146 VHandle *pHandle = (VHandle*)pFile; 1147 if( pVFile==0 ){ 1148 return SQLITE_FULL; 1149 } 1150 pHandle->pVFile = pVFile; 1151 pVFile->nRef++; 1152 pFile->pMethods = &VHandleMethods; 1153 if( pOutFlags ) *pOutFlags = openFlags; 1154 return SQLITE_OK; 1155 } 1156 1157 /* 1158 ** Delete a file by name 1159 */ 1160 static int inmemDelete( 1161 sqlite3_vfs *pVfs, 1162 const char *zFilename, 1163 int syncdir 1164 ){ 1165 VFile *pVFile = findVFile(zFilename); 1166 if( pVFile==0 ) return SQLITE_OK; 1167 if( pVFile->nRef==0 ){ 1168 free(pVFile->zFilename); 1169 pVFile->zFilename = 0; 1170 pVFile->sz = -1; 1171 free(pVFile->a); 1172 pVFile->a = 0; 1173 return SQLITE_OK; 1174 } 1175 return SQLITE_IOERR_DELETE; 1176 } 1177 1178 /* Check for the existance of a file 1179 */ 1180 static int inmemAccess( 1181 sqlite3_vfs *pVfs, 1182 const char *zFilename, 1183 int flags, 1184 int *pResOut 1185 ){ 1186 VFile *pVFile = findVFile(zFilename); 1187 *pResOut = pVFile!=0; 1188 return SQLITE_OK; 1189 } 1190 1191 /* Get the canonical pathname for a file 1192 */ 1193 static int inmemFullPathname( 1194 sqlite3_vfs *pVfs, 1195 const char *zFilename, 1196 int nOut, 1197 char *zOut 1198 ){ 1199 sqlite3_snprintf(nOut, zOut, "%s", zFilename); 1200 return SQLITE_OK; 1201 } 1202 1203 /* Always use the same random see, for repeatability. 1204 */ 1205 static int inmemRandomness(sqlite3_vfs *NotUsed, int nBuf, char *zBuf){ 1206 memset(zBuf, 0, nBuf); 1207 memcpy(zBuf, &g.uRandom, nBuf<sizeof(g.uRandom) ? nBuf : sizeof(g.uRandom)); 1208 return nBuf; 1209 } 1210 1211 /* 1212 ** Register the VFS that reads from the g.aFile[] set of files. 1213 */ 1214 static void inmemVfsRegister(int makeDefault){ 1215 static sqlite3_vfs inmemVfs; 1216 sqlite3_vfs *pDefault = sqlite3_vfs_find(0); 1217 inmemVfs.iVersion = 3; 1218 inmemVfs.szOsFile = sizeof(VHandle); 1219 inmemVfs.mxPathname = 200; 1220 inmemVfs.zName = "inmem"; 1221 inmemVfs.xOpen = inmemOpen; 1222 inmemVfs.xDelete = inmemDelete; 1223 inmemVfs.xAccess = inmemAccess; 1224 inmemVfs.xFullPathname = inmemFullPathname; 1225 inmemVfs.xRandomness = inmemRandomness; 1226 inmemVfs.xSleep = pDefault->xSleep; 1227 inmemVfs.xCurrentTimeInt64 = pDefault->xCurrentTimeInt64; 1228 sqlite3_vfs_register(&inmemVfs, makeDefault); 1229 }; 1230 1231 /* 1232 ** Allowed values for the runFlags parameter to runSql() 1233 */ 1234 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */ 1235 #define SQL_OUTPUT 0x0002 /* Show the SQL output */ 1236 1237 /* 1238 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not 1239 ** stop if an error is encountered. 1240 */ 1241 static void runSql(sqlite3 *db, const char *zSql, unsigned runFlags){ 1242 const char *zMore; 1243 sqlite3_stmt *pStmt; 1244 1245 while( zSql && zSql[0] ){ 1246 zMore = 0; 1247 pStmt = 0; 1248 sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zMore); 1249 if( zMore==zSql ) break; 1250 if( runFlags & SQL_TRACE ){ 1251 const char *z = zSql; 1252 int n; 1253 while( z<zMore && ISSPACE(z[0]) ) z++; 1254 n = (int)(zMore - z); 1255 while( n>0 && ISSPACE(z[n-1]) ) n--; 1256 if( n==0 ) break; 1257 if( pStmt==0 ){ 1258 printf("TRACE: %.*s (error: %s)\n", n, z, sqlite3_errmsg(db)); 1259 }else{ 1260 printf("TRACE: %.*s\n", n, z); 1261 } 1262 } 1263 zSql = zMore; 1264 if( pStmt ){ 1265 if( (runFlags & SQL_OUTPUT)==0 ){ 1266 while( SQLITE_ROW==sqlite3_step(pStmt) ){} 1267 }else{ 1268 int nCol = -1; 1269 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1270 int i; 1271 if( nCol<0 ){ 1272 nCol = sqlite3_column_count(pStmt); 1273 }else if( nCol>0 ){ 1274 printf("--------------------------------------------\n"); 1275 } 1276 for(i=0; i<nCol; i++){ 1277 int eType = sqlite3_column_type(pStmt,i); 1278 printf("%s = ", sqlite3_column_name(pStmt,i)); 1279 switch( eType ){ 1280 case SQLITE_NULL: { 1281 printf("NULL\n"); 1282 break; 1283 } 1284 case SQLITE_INTEGER: { 1285 printf("INT %s\n", sqlite3_column_text(pStmt,i)); 1286 break; 1287 } 1288 case SQLITE_FLOAT: { 1289 printf("FLOAT %s\n", sqlite3_column_text(pStmt,i)); 1290 break; 1291 } 1292 case SQLITE_TEXT: { 1293 printf("TEXT [%s]\n", sqlite3_column_text(pStmt,i)); 1294 break; 1295 } 1296 case SQLITE_BLOB: { 1297 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt,i)); 1298 break; 1299 } 1300 } 1301 } 1302 } 1303 } 1304 sqlite3_finalize(pStmt); 1305 } 1306 } 1307 } 1308 1309 /* 1310 ** Rebuild the database file. 1311 ** 1312 ** (1) Remove duplicate entries 1313 ** (2) Put all entries in order 1314 ** (3) Vacuum 1315 */ 1316 static void rebuild_database(sqlite3 *db, int dbSqlOnly){ 1317 int rc; 1318 char *zSql; 1319 zSql = sqlite3_mprintf( 1320 "BEGIN;\n" 1321 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n" 1322 "DELETE FROM db;\n" 1323 "INSERT INTO db(dbid, dbcontent) " 1324 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n" 1325 "DROP TABLE dbx;\n" 1326 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n" 1327 "DELETE FROM xsql;\n" 1328 "INSERT INTO xsql(sqlid,sqltext) " 1329 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n" 1330 "DROP TABLE sx;\n" 1331 "COMMIT;\n" 1332 "PRAGMA page_size=1024;\n" 1333 "VACUUM;\n", 1334 dbSqlOnly ? " WHERE isdbsql(sqltext)" : "" 1335 ); 1336 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1337 sqlite3_free(zSql); 1338 if( rc ) fatalError("cannot rebuild: %s", sqlite3_errmsg(db)); 1339 } 1340 1341 /* 1342 ** Return the value of a hexadecimal digit. Return -1 if the input 1343 ** is not a hex digit. 1344 */ 1345 static int hexDigitValue(char c){ 1346 if( c>='0' && c<='9' ) return c - '0'; 1347 if( c>='a' && c<='f' ) return c - 'a' + 10; 1348 if( c>='A' && c<='F' ) return c - 'A' + 10; 1349 return -1; 1350 } 1351 1352 /* 1353 ** Interpret zArg as an integer value, possibly with suffixes. 1354 */ 1355 static int integerValue(const char *zArg){ 1356 sqlite3_int64 v = 0; 1357 static const struct { char *zSuffix; int iMult; } aMult[] = { 1358 { "KiB", 1024 }, 1359 { "MiB", 1024*1024 }, 1360 { "GiB", 1024*1024*1024 }, 1361 { "KB", 1000 }, 1362 { "MB", 1000000 }, 1363 { "GB", 1000000000 }, 1364 { "K", 1000 }, 1365 { "M", 1000000 }, 1366 { "G", 1000000000 }, 1367 }; 1368 int i; 1369 int isNeg = 0; 1370 if( zArg[0]=='-' ){ 1371 isNeg = 1; 1372 zArg++; 1373 }else if( zArg[0]=='+' ){ 1374 zArg++; 1375 } 1376 if( zArg[0]=='0' && zArg[1]=='x' ){ 1377 int x; 1378 zArg += 2; 1379 while( (x = hexDigitValue(zArg[0]))>=0 ){ 1380 v = (v<<4) + x; 1381 zArg++; 1382 } 1383 }else{ 1384 while( ISDIGIT(zArg[0]) ){ 1385 v = v*10 + zArg[0] - '0'; 1386 zArg++; 1387 } 1388 } 1389 for(i=0; i<sizeof(aMult)/sizeof(aMult[0]); i++){ 1390 if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){ 1391 v *= aMult[i].iMult; 1392 break; 1393 } 1394 } 1395 if( v>0x7fffffff ) fatalError("parameter too large - max 2147483648"); 1396 return (int)(isNeg? -v : v); 1397 } 1398 1399 /* 1400 ** Return the number of "v" characters in a string. Return 0 if there 1401 ** are any characters in the string other than "v". 1402 */ 1403 static int numberOfVChar(const char *z){ 1404 int N = 0; 1405 while( z[0] && z[0]=='v' ){ 1406 z++; 1407 N++; 1408 } 1409 return z[0]==0 ? N : 0; 1410 } 1411 1412 /* 1413 ** Print sketchy documentation for this utility program 1414 */ 1415 static void showHelp(void){ 1416 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g.zArgv0); 1417 printf( 1418 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n" 1419 "each database, checking for crashes and memory leaks.\n" 1420 "Options:\n" 1421 " --cell-size-check Set the PRAGMA cell_size_check=ON\n" 1422 " --dbid N Use only the database where dbid=N\n" 1423 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n" 1424 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n" 1425 " --help Show this help text\n" 1426 " --info Show information about SOURCE-DB w/o running tests\n" 1427 " --limit-depth N Limit expression depth to N. Default: 500\n" 1428 " --limit-heap N Limit heap memory to N. Default: 100M\n" 1429 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n" 1430 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n" 1431 " --load-sql ARGS... Load SQL scripts fron files into SOURCE-DB\n" 1432 " --load-db ARGS... Load template databases from files into SOURCE_DB\n" 1433 " --load-dbsql ARGS.. Load dbsqlfuzz outputs into the xsql table\n" 1434 " -m TEXT Add a description to the database\n" 1435 " --native-vfs Use the native VFS for initially empty database files\n" 1436 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n" 1437 " --oss-fuzz Enable OSS-FUZZ testing\n" 1438 " --prng-seed N Seed value for the PRGN inside of SQLite\n" 1439 " -q|--quiet Reduced output\n" 1440 " --rebuild Rebuild and vacuum the database file\n" 1441 " --result-trace Show the results of each SQL command\n" 1442 " --skip N Skip the first N test cases\n" 1443 " --spinner Use a spinner to show progress\n" 1444 " --sqlid N Use only SQL where sqlid=N\n" 1445 " --timeout N Maximum time for any one test in N millseconds\n" 1446 " -v|--verbose Increased output. Repeat for more output.\n" 1447 " --vdbe-debug Activate VDBE debugging.\n" 1448 ); 1449 } 1450 1451 int main(int argc, char **argv){ 1452 sqlite3_int64 iBegin; /* Start time of this program */ 1453 int quietFlag = 0; /* True if --quiet or -q */ 1454 int verboseFlag = 0; /* True if --verbose or -v */ 1455 char *zInsSql = 0; /* SQL statement for --load-db or --load-sql */ 1456 int iFirstInsArg = 0; /* First argv[] for --load-db or --load-sql */ 1457 sqlite3 *db = 0; /* The open database connection */ 1458 sqlite3_stmt *pStmt; /* A prepared statement */ 1459 int rc; /* Result code from SQLite interface calls */ 1460 Blob *pSql; /* For looping over SQL scripts */ 1461 Blob *pDb; /* For looping over template databases */ 1462 int i; /* Loop index for the argv[] loop */ 1463 int dbSqlOnly = 0; /* Only use scripts that are dbsqlfuzz */ 1464 int onlySqlid = -1; /* --sqlid */ 1465 int onlyDbid = -1; /* --dbid */ 1466 int nativeFlag = 0; /* --native-vfs */ 1467 int rebuildFlag = 0; /* --rebuild */ 1468 int vdbeLimitFlag = 0; /* --limit-vdbe */ 1469 int infoFlag = 0; /* --info */ 1470 int nSkip = 0; /* --skip */ 1471 int bSpinner = 0; /* True for --spinner */ 1472 int timeoutTest = 0; /* undocumented --timeout-test flag */ 1473 int runFlags = 0; /* Flags sent to runSql() */ 1474 char *zMsg = 0; /* Add this message */ 1475 int nSrcDb = 0; /* Number of source databases */ 1476 char **azSrcDb = 0; /* Array of source database names */ 1477 int iSrcDb; /* Loop over all source databases */ 1478 int nTest = 0; /* Total number of tests performed */ 1479 char *zDbName = ""; /* Appreviated name of a source database */ 1480 const char *zFailCode = 0; /* Value of the TEST_FAILURE env variable */ 1481 int cellSzCkFlag = 0; /* --cell-size-check */ 1482 int sqlFuzz = 0; /* True for SQL fuzz. False for DB fuzz */ 1483 int iTimeout = 120000; /* Default 120-second timeout */ 1484 int nMem = 0; /* Memory limit override */ 1485 int nMemThisDb = 0; /* Memory limit set by the CONFIG table */ 1486 char *zExpDb = 0; /* Write Databases to files in this directory */ 1487 char *zExpSql = 0; /* Write SQL to files in this directory */ 1488 void *pHeap = 0; /* Heap for use by SQLite */ 1489 int ossFuzz = 0; /* enable OSS-FUZZ testing */ 1490 int ossFuzzThisDb = 0; /* ossFuzz value for this particular database */ 1491 int nativeMalloc = 0; /* Turn off MEMSYS3/5 and lookaside if true */ 1492 sqlite3_vfs *pDfltVfs; /* The default VFS */ 1493 int openFlags4Data; /* Flags for sqlite3_open_v2() */ 1494 int bTimer = 0; /* Show elapse time for each test */ 1495 int nV; /* How much to increase verbosity with -vvvv */ 1496 sqlite3_int64 tmStart; /* Start of each test */ 1497 1498 registerOomSimulator(); 1499 sqlite3_initialize(); 1500 iBegin = timeOfDay(); 1501 #ifdef __unix__ 1502 signal(SIGALRM, signalHandler); 1503 signal(SIGSEGV, signalHandler); 1504 signal(SIGABRT, signalHandler); 1505 #endif 1506 g.zArgv0 = argv[0]; 1507 openFlags4Data = SQLITE_OPEN_READONLY; 1508 zFailCode = getenv("TEST_FAILURE"); 1509 pDfltVfs = sqlite3_vfs_find(0); 1510 inmemVfsRegister(1); 1511 for(i=1; i<argc; i++){ 1512 const char *z = argv[i]; 1513 if( z[0]=='-' ){ 1514 z++; 1515 if( z[0]=='-' ) z++; 1516 if( strcmp(z,"cell-size-check")==0 ){ 1517 cellSzCkFlag = 1; 1518 }else 1519 if( strcmp(z,"dbid")==0 ){ 1520 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1521 onlyDbid = integerValue(argv[++i]); 1522 }else 1523 if( strcmp(z,"export-db")==0 ){ 1524 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1525 zExpDb = argv[++i]; 1526 }else 1527 if( strcmp(z,"export-sql")==0 || strcmp(z,"export-dbsql")==0 ){ 1528 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1529 zExpSql = argv[++i]; 1530 }else 1531 if( strcmp(z,"help")==0 ){ 1532 showHelp(); 1533 return 0; 1534 }else 1535 if( strcmp(z,"info")==0 ){ 1536 infoFlag = 1; 1537 }else 1538 if( strcmp(z,"limit-depth")==0 ){ 1539 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1540 depthLimit = integerValue(argv[++i]); 1541 }else 1542 if( strcmp(z,"limit-heap")==0 ){ 1543 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1544 heapLimit = integerValue(argv[++i]); 1545 }else 1546 if( strcmp(z,"limit-mem")==0 ){ 1547 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1548 nMem = integerValue(argv[++i]); 1549 }else 1550 if( strcmp(z,"limit-vdbe")==0 ){ 1551 vdbeLimitFlag = 1; 1552 }else 1553 if( strcmp(z,"load-sql")==0 ){ 1554 zInsSql = "INSERT INTO xsql(sqltext)" 1555 "VALUES(CAST(readtextfile(?1) AS text))"; 1556 iFirstInsArg = i+1; 1557 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1558 break; 1559 }else 1560 if( strcmp(z,"load-db")==0 ){ 1561 zInsSql = "INSERT INTO db(dbcontent) VALUES(readfile(?1))"; 1562 iFirstInsArg = i+1; 1563 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1564 break; 1565 }else 1566 if( strcmp(z,"load-dbsql")==0 ){ 1567 zInsSql = "INSERT INTO xsql(sqltext)" 1568 "VALUES(CAST(readtextfile(?1) AS text))"; 1569 iFirstInsArg = i+1; 1570 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1571 dbSqlOnly = 1; 1572 break; 1573 }else 1574 if( strcmp(z,"m")==0 ){ 1575 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1576 zMsg = argv[++i]; 1577 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1578 }else 1579 if( strcmp(z,"native-malloc")==0 ){ 1580 nativeMalloc = 1; 1581 }else 1582 if( strcmp(z,"native-vfs")==0 ){ 1583 nativeFlag = 1; 1584 }else 1585 if( strcmp(z,"oss-fuzz")==0 ){ 1586 ossFuzz = 1; 1587 }else 1588 if( strcmp(z,"prng-seed")==0 ){ 1589 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1590 g.uRandom = atoi(argv[++i]); 1591 }else 1592 if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){ 1593 quietFlag = 1; 1594 verboseFlag = 0; 1595 eVerbosity = 0; 1596 }else 1597 if( strcmp(z,"rebuild")==0 ){ 1598 rebuildFlag = 1; 1599 openFlags4Data = SQLITE_OPEN_READWRITE; 1600 }else 1601 if( strcmp(z,"result-trace")==0 ){ 1602 runFlags |= SQL_OUTPUT; 1603 }else 1604 if( strcmp(z,"skip")==0 ){ 1605 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1606 nSkip = atoi(argv[++i]); 1607 }else 1608 if( strcmp(z,"spinner")==0 ){ 1609 bSpinner = 1; 1610 }else 1611 if( strcmp(z,"timer")==0 ){ 1612 bTimer = 1; 1613 }else 1614 if( strcmp(z,"sqlid")==0 ){ 1615 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1616 onlySqlid = integerValue(argv[++i]); 1617 }else 1618 if( strcmp(z,"timeout")==0 ){ 1619 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1620 iTimeout = integerValue(argv[++i]); 1621 }else 1622 if( strcmp(z,"timeout-test")==0 ){ 1623 timeoutTest = 1; 1624 #ifndef __unix__ 1625 fatalError("timeout is not available on non-unix systems"); 1626 #endif 1627 }else 1628 if( strcmp(z,"vdbe-debug")==0 ){ 1629 bVdbeDebug = 1; 1630 }else 1631 if( strcmp(z,"verbose")==0 ){ 1632 quietFlag = 0; 1633 verboseFlag++; 1634 eVerbosity++; 1635 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1636 }else 1637 if( (nV = numberOfVChar(z))>=1 ){ 1638 quietFlag = 0; 1639 verboseFlag += nV; 1640 eVerbosity += nV; 1641 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1642 }else 1643 if( strcmp(z,"version")==0 ){ 1644 int ii; 1645 const char *zz; 1646 printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid()); 1647 for(ii=0; (zz = sqlite3_compileoption_get(ii))!=0; ii++){ 1648 printf("%s\n", zz); 1649 } 1650 return 0; 1651 }else 1652 { 1653 fatalError("unknown option: %s", argv[i]); 1654 } 1655 }else{ 1656 nSrcDb++; 1657 azSrcDb = safe_realloc(azSrcDb, nSrcDb*sizeof(azSrcDb[0])); 1658 azSrcDb[nSrcDb-1] = argv[i]; 1659 } 1660 } 1661 if( nSrcDb==0 ) fatalError("no source database specified"); 1662 if( nSrcDb>1 ){ 1663 if( zMsg ){ 1664 fatalError("cannot change the description of more than one database"); 1665 } 1666 if( zInsSql ){ 1667 fatalError("cannot import into more than one database"); 1668 } 1669 } 1670 1671 /* Process each source database separately */ 1672 for(iSrcDb=0; iSrcDb<nSrcDb; iSrcDb++){ 1673 g.zDbFile = azSrcDb[iSrcDb]; 1674 rc = sqlite3_open_v2(azSrcDb[iSrcDb], &db, 1675 openFlags4Data, pDfltVfs->zName); 1676 if( rc ){ 1677 fatalError("cannot open source database %s - %s", 1678 azSrcDb[iSrcDb], sqlite3_errmsg(db)); 1679 } 1680 1681 /* Print the description, if there is one */ 1682 if( infoFlag ){ 1683 int n; 1684 zDbName = azSrcDb[iSrcDb]; 1685 i = (int)strlen(zDbName) - 1; 1686 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1687 zDbName += i; 1688 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1689 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1690 printf("%s: %s", zDbName, sqlite3_column_text(pStmt,0)); 1691 }else{ 1692 printf("%s: (empty \"readme\")", zDbName); 1693 } 1694 sqlite3_finalize(pStmt); 1695 sqlite3_prepare_v2(db, "SELECT count(*) FROM db", -1, &pStmt, 0); 1696 if( pStmt 1697 && sqlite3_step(pStmt)==SQLITE_ROW 1698 && (n = sqlite3_column_int(pStmt,0))>0 1699 ){ 1700 printf(" - %d DBs", n); 1701 } 1702 sqlite3_finalize(pStmt); 1703 sqlite3_prepare_v2(db, "SELECT count(*) FROM xsql", -1, &pStmt, 0); 1704 if( pStmt 1705 && sqlite3_step(pStmt)==SQLITE_ROW 1706 && (n = sqlite3_column_int(pStmt,0))>0 1707 ){ 1708 printf(" - %d scripts", n); 1709 } 1710 sqlite3_finalize(pStmt); 1711 printf("\n"); 1712 sqlite3_close(db); 1713 continue; 1714 } 1715 1716 rc = sqlite3_exec(db, 1717 "CREATE TABLE IF NOT EXISTS db(\n" 1718 " dbid INTEGER PRIMARY KEY, -- database id\n" 1719 " dbcontent BLOB -- database disk file image\n" 1720 ");\n" 1721 "CREATE TABLE IF NOT EXISTS xsql(\n" 1722 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n" 1723 " sqltext TEXT -- Text of SQL statements to run\n" 1724 ");" 1725 "CREATE TABLE IF NOT EXISTS readme(\n" 1726 " msg TEXT -- Human-readable description of this file\n" 1727 ");", 0, 0, 0); 1728 if( rc ) fatalError("cannot create schema: %s", sqlite3_errmsg(db)); 1729 if( zMsg ){ 1730 char *zSql; 1731 zSql = sqlite3_mprintf( 1732 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg); 1733 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1734 sqlite3_free(zSql); 1735 if( rc ) fatalError("cannot change description: %s", sqlite3_errmsg(db)); 1736 } 1737 ossFuzzThisDb = ossFuzz; 1738 1739 /* If the CONFIG(name,value) table exists, read db-specific settings 1740 ** from that table */ 1741 if( sqlite3_table_column_metadata(db,0,"config",0,0,0,0,0,0)==SQLITE_OK ){ 1742 rc = sqlite3_prepare_v2(db, "SELECT name, value FROM config", 1743 -1, &pStmt, 0); 1744 if( rc ) fatalError("cannot prepare query of CONFIG table: %s", 1745 sqlite3_errmsg(db)); 1746 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1747 const char *zName = (const char *)sqlite3_column_text(pStmt,0); 1748 if( zName==0 ) continue; 1749 if( strcmp(zName, "oss-fuzz")==0 ){ 1750 ossFuzzThisDb = sqlite3_column_int(pStmt,1); 1751 if( verboseFlag ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb); 1752 } 1753 if( strcmp(zName, "limit-mem")==0 ){ 1754 nMemThisDb = sqlite3_column_int(pStmt,1); 1755 if( verboseFlag ) printf("Config: limit-mem=%d\n", nMemThisDb); 1756 } 1757 } 1758 sqlite3_finalize(pStmt); 1759 } 1760 1761 if( zInsSql ){ 1762 sqlite3_create_function(db, "readfile", 1, SQLITE_UTF8, 0, 1763 readfileFunc, 0, 0); 1764 sqlite3_create_function(db, "readtextfile", 1, SQLITE_UTF8, 0, 1765 readtextfileFunc, 0, 0); 1766 sqlite3_create_function(db, "isdbsql", 1, SQLITE_UTF8, 0, 1767 isDbSqlFunc, 0, 0); 1768 rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0); 1769 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1770 zInsSql, sqlite3_errmsg(db)); 1771 rc = sqlite3_exec(db, "BEGIN", 0, 0, 0); 1772 if( rc ) fatalError("cannot start a transaction"); 1773 for(i=iFirstInsArg; i<argc; i++){ 1774 sqlite3_bind_text(pStmt, 1, argv[i], -1, SQLITE_STATIC); 1775 sqlite3_step(pStmt); 1776 rc = sqlite3_reset(pStmt); 1777 if( rc ) fatalError("insert failed for %s", argv[i]); 1778 } 1779 sqlite3_finalize(pStmt); 1780 rc = sqlite3_exec(db, "COMMIT", 0, 0, 0); 1781 if( rc ) fatalError("cannot commit the transaction: %s", 1782 sqlite3_errmsg(db)); 1783 rebuild_database(db, dbSqlOnly); 1784 sqlite3_close(db); 1785 return 0; 1786 } 1787 rc = sqlite3_exec(db, "PRAGMA query_only=1;", 0, 0, 0); 1788 if( rc ) fatalError("cannot set database to query-only"); 1789 if( zExpDb!=0 || zExpSql!=0 ){ 1790 sqlite3_create_function(db, "writefile", 2, SQLITE_UTF8, 0, 1791 writefileFunc, 0, 0); 1792 if( zExpDb!=0 ){ 1793 const char *zExDb = 1794 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent)," 1795 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)" 1796 " FROM db WHERE ?2<0 OR dbid=?2;"; 1797 rc = sqlite3_prepare_v2(db, zExDb, -1, &pStmt, 0); 1798 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1799 zExDb, sqlite3_errmsg(db)); 1800 sqlite3_bind_text64(pStmt, 1, zExpDb, strlen(zExpDb), 1801 SQLITE_STATIC, SQLITE_UTF8); 1802 sqlite3_bind_int(pStmt, 2, onlyDbid); 1803 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1804 printf("write db-%d (%d bytes) into %s\n", 1805 sqlite3_column_int(pStmt,1), 1806 sqlite3_column_int(pStmt,3), 1807 sqlite3_column_text(pStmt,2)); 1808 } 1809 sqlite3_finalize(pStmt); 1810 } 1811 if( zExpSql!=0 ){ 1812 const char *zExSql = 1813 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext)," 1814 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)" 1815 " FROM xsql WHERE ?2<0 OR sqlid=?2;"; 1816 rc = sqlite3_prepare_v2(db, zExSql, -1, &pStmt, 0); 1817 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1818 zExSql, sqlite3_errmsg(db)); 1819 sqlite3_bind_text64(pStmt, 1, zExpSql, strlen(zExpSql), 1820 SQLITE_STATIC, SQLITE_UTF8); 1821 sqlite3_bind_int(pStmt, 2, onlySqlid); 1822 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1823 printf("write sql-%d (%d bytes) into %s\n", 1824 sqlite3_column_int(pStmt,1), 1825 sqlite3_column_int(pStmt,3), 1826 sqlite3_column_text(pStmt,2)); 1827 } 1828 sqlite3_finalize(pStmt); 1829 } 1830 sqlite3_close(db); 1831 return 0; 1832 } 1833 1834 /* Load all SQL script content and all initial database images from the 1835 ** source db 1836 */ 1837 blobListLoadFromDb(db, "SELECT sqlid, sqltext FROM xsql", onlySqlid, 1838 &g.nSql, &g.pFirstSql); 1839 if( g.nSql==0 ) fatalError("need at least one SQL script"); 1840 blobListLoadFromDb(db, "SELECT dbid, dbcontent FROM db", onlyDbid, 1841 &g.nDb, &g.pFirstDb); 1842 if( g.nDb==0 ){ 1843 g.pFirstDb = safe_realloc(0, sizeof(Blob)); 1844 memset(g.pFirstDb, 0, sizeof(Blob)); 1845 g.pFirstDb->id = 1; 1846 g.pFirstDb->seq = 0; 1847 g.nDb = 1; 1848 sqlFuzz = 1; 1849 } 1850 1851 /* Print the description, if there is one */ 1852 if( !quietFlag ){ 1853 zDbName = azSrcDb[iSrcDb]; 1854 i = (int)strlen(zDbName) - 1; 1855 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1856 zDbName += i; 1857 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1858 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1859 printf("%s: %s\n", zDbName, sqlite3_column_text(pStmt,0)); 1860 } 1861 sqlite3_finalize(pStmt); 1862 } 1863 1864 /* Rebuild the database, if requested */ 1865 if( rebuildFlag ){ 1866 if( !quietFlag ){ 1867 printf("%s: rebuilding... ", zDbName); 1868 fflush(stdout); 1869 } 1870 rebuild_database(db, 0); 1871 if( !quietFlag ) printf("done\n"); 1872 } 1873 1874 /* Close the source database. Verify that no SQLite memory allocations are 1875 ** outstanding. 1876 */ 1877 sqlite3_close(db); 1878 if( sqlite3_memory_used()>0 ){ 1879 fatalError("SQLite has memory in use before the start of testing"); 1880 } 1881 1882 /* Limit available memory, if requested */ 1883 sqlite3_shutdown(); 1884 1885 if( nMemThisDb>0 && nMem==0 ){ 1886 if( !nativeMalloc ){ 1887 pHeap = realloc(pHeap, nMemThisDb); 1888 if( pHeap==0 ){ 1889 fatalError("failed to allocate %d bytes of heap memory", nMem); 1890 } 1891 sqlite3_config(SQLITE_CONFIG_HEAP, pHeap, nMemThisDb, 128); 1892 }else{ 1893 sqlite3_hard_heap_limit64((sqlite3_int64)nMemThisDb); 1894 } 1895 }else{ 1896 sqlite3_hard_heap_limit64(0); 1897 } 1898 1899 /* Disable lookaside with the --native-malloc option */ 1900 if( nativeMalloc ){ 1901 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, 0, 0); 1902 } 1903 1904 /* Reset the in-memory virtual filesystem */ 1905 formatVfs(); 1906 1907 /* Run a test using each SQL script against each database. 1908 */ 1909 if( !verboseFlag && !quietFlag && !bSpinner ) printf("%s:", zDbName); 1910 for(pSql=g.pFirstSql; pSql; pSql=pSql->pNext){ 1911 tmStart = timeOfDay(); 1912 if( isDbSql(pSql->a, pSql->sz) ){ 1913 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d",pSql->id); 1914 if( bSpinner ){ 1915 int nTotal =g.nSql; 1916 int idx = pSql->seq; 1917 printf("\r%s: %d/%d ", zDbName, idx, nTotal); 1918 fflush(stdout); 1919 }else if( verboseFlag ){ 1920 printf("%s\n", g.zTestName); 1921 fflush(stdout); 1922 }else if( !quietFlag ){ 1923 static int prevAmt = -1; 1924 int idx = pSql->seq; 1925 int amt = idx*10/(g.nSql); 1926 if( amt!=prevAmt ){ 1927 printf(" %d%%", amt*10); 1928 fflush(stdout); 1929 prevAmt = amt; 1930 } 1931 } 1932 if( nSkip>0 ){ 1933 nSkip--; 1934 }else{ 1935 runCombinedDbSqlInput(pSql->a, pSql->sz, iTimeout); 1936 } 1937 nTest++; 1938 if( bTimer ){ 1939 sqlite3_int64 tmEnd = timeOfDay(); 1940 printf("%lld %s\n", tmEnd - tmStart, g.zTestName); 1941 } 1942 g.zTestName[0] = 0; 1943 disableOom(); 1944 continue; 1945 } 1946 for(pDb=g.pFirstDb; pDb; pDb=pDb->pNext){ 1947 int openFlags; 1948 const char *zVfs = "inmem"; 1949 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d,dbid=%d", 1950 pSql->id, pDb->id); 1951 if( bSpinner ){ 1952 int nTotal = g.nDb*g.nSql; 1953 int idx = pSql->seq*g.nDb + pDb->id - 1; 1954 printf("\r%s: %d/%d ", zDbName, idx, nTotal); 1955 fflush(stdout); 1956 }else if( verboseFlag ){ 1957 printf("%s\n", g.zTestName); 1958 fflush(stdout); 1959 }else if( !quietFlag ){ 1960 static int prevAmt = -1; 1961 int idx = pSql->seq*g.nDb + pDb->id - 1; 1962 int amt = idx*10/(g.nDb*g.nSql); 1963 if( amt!=prevAmt ){ 1964 printf(" %d%%", amt*10); 1965 fflush(stdout); 1966 prevAmt = amt; 1967 } 1968 } 1969 if( nSkip>0 ){ 1970 nSkip--; 1971 continue; 1972 } 1973 createVFile("main.db", pDb->sz, pDb->a); 1974 sqlite3_randomness(0,0); 1975 if( ossFuzzThisDb ){ 1976 #ifndef SQLITE_OSS_FUZZ 1977 fatalError("--oss-fuzz not supported: recompile" 1978 " with -DSQLITE_OSS_FUZZ"); 1979 #else 1980 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t); 1981 LLVMFuzzerTestOneInput((const uint8_t*)pSql->a, (size_t)pSql->sz); 1982 #endif 1983 }else{ 1984 openFlags = SQLITE_OPEN_CREATE | SQLITE_OPEN_READWRITE; 1985 if( nativeFlag && pDb->sz==0 ){ 1986 openFlags |= SQLITE_OPEN_MEMORY; 1987 zVfs = 0; 1988 } 1989 rc = sqlite3_open_v2("main.db", &db, openFlags, zVfs); 1990 if( rc ) fatalError("cannot open inmem database"); 1991 sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 100000000); 1992 sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 50); 1993 if( cellSzCkFlag ) runSql(db, "PRAGMA cell_size_check=ON", runFlags); 1994 setAlarm((iTimeout+999)/1000); 1995 /* Enable test functions */ 1996 sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS, db); 1997 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 1998 if( sqlFuzz || vdbeLimitFlag ){ 1999 sqlite3_progress_handler(db, 100000, progressHandler, 2000 &vdbeLimitFlag); 2001 } 2002 #endif 2003 #ifdef SQLITE_TESTCTRL_PRNG_SEED 2004 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db); 2005 #endif 2006 if( bVdbeDebug ){ 2007 sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 2008 } 2009 do{ 2010 runSql(db, (char*)pSql->a, runFlags); 2011 }while( timeoutTest ); 2012 setAlarm(0); 2013 sqlite3_exec(db, "PRAGMA temp_store_directory=''", 0, 0, 0); 2014 sqlite3_close(db); 2015 } 2016 if( sqlite3_memory_used()>0 ){ 2017 fatalError("memory leak: %lld bytes outstanding", 2018 sqlite3_memory_used()); 2019 } 2020 reformatVfs(); 2021 nTest++; 2022 if( bTimer ){ 2023 sqlite3_int64 tmEnd = timeOfDay(); 2024 printf("%lld %s\n", tmEnd - tmStart, g.zTestName); 2025 } 2026 g.zTestName[0] = 0; 2027 2028 /* Simulate an error if the TEST_FAILURE environment variable is "5". 2029 ** This is used to verify that automated test script really do spot 2030 ** errors that occur in this test program. 2031 */ 2032 if( zFailCode ){ 2033 if( zFailCode[0]=='5' && zFailCode[1]==0 ){ 2034 fatalError("simulated failure"); 2035 }else if( zFailCode[0]!=0 ){ 2036 /* If TEST_FAILURE is something other than 5, just exit the test 2037 ** early */ 2038 printf("\nExit early due to TEST_FAILURE being set\n"); 2039 iSrcDb = nSrcDb-1; 2040 goto sourcedb_cleanup; 2041 } 2042 } 2043 } 2044 } 2045 if( bSpinner ){ 2046 printf("\n"); 2047 }else if( !quietFlag && !verboseFlag ){ 2048 printf(" 100%% - %d tests\n", g.nDb*g.nSql); 2049 } 2050 2051 /* Clean up at the end of processing a single source database 2052 */ 2053 sourcedb_cleanup: 2054 blobListFree(g.pFirstSql); 2055 blobListFree(g.pFirstDb); 2056 reformatVfs(); 2057 2058 } /* End loop over all source databases */ 2059 2060 if( !quietFlag ){ 2061 sqlite3_int64 iElapse = timeOfDay() - iBegin; 2062 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n" 2063 "SQLite %s %s\n", 2064 nTest, (int)(iElapse/1000), (int)(iElapse%1000), 2065 sqlite3_libversion(), sqlite3_sourceid()); 2066 } 2067 free(azSrcDb); 2068 free(pHeap); 2069 return 0; 2070 } 2071