xref: /sqlite-3.40.0/test/fuzzcheck.c (revision 9cffb0ff)
1 /*
2 ** 2015-05-25
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This is a utility program designed to aid running regressions tests on
14 ** the SQLite library using data from external fuzzers.
15 **
16 ** This program reads content from an SQLite database file with the following
17 ** schema:
18 **
19 **     CREATE TABLE db(
20 **       dbid INTEGER PRIMARY KEY, -- database id
21 **       dbcontent BLOB            -- database disk file image
22 **     );
23 **     CREATE TABLE xsql(
24 **       sqlid INTEGER PRIMARY KEY,   -- SQL script id
25 **       sqltext TEXT                 -- Text of SQL statements to run
26 **     );
27 **     CREATE TABLE IF NOT EXISTS readme(
28 **       msg TEXT -- Human-readable description of this test collection
29 **     );
30 **
31 ** For each database file in the DB table, the SQL text in the XSQL table
32 ** is run against that database.  All README.MSG values are printed prior
33 ** to the start of the test (unless the --quiet option is used).  If the
34 ** DB table is empty, then all entries in XSQL are run against an empty
35 ** in-memory database.
36 **
37 ** This program is looking for crashes, assertion faults, and/or memory leaks.
38 ** No attempt is made to verify the output.  The assumption is that either all
39 ** of the database files or all of the SQL statements are malformed inputs,
40 ** generated by a fuzzer, that need to be checked to make sure they do not
41 ** present a security risk.
42 **
43 ** This program also includes some command-line options to help with
44 ** creation and maintenance of the source content database.  The command
45 **
46 **     ./fuzzcheck database.db --load-sql FILE...
47 **
48 ** Loads all FILE... arguments into the XSQL table.  The --load-db option
49 ** works the same but loads the files into the DB table.  The -m option can
50 ** be used to initialize the README table.  The "database.db" file is created
51 ** if it does not previously exist.  Example:
52 **
53 **     ./fuzzcheck new.db --load-sql *.sql
54 **     ./fuzzcheck new.db --load-db *.db
55 **     ./fuzzcheck new.db -m 'New test cases'
56 **
57 ** The three commands above will create the "new.db" file and initialize all
58 ** tables.  Then do "./fuzzcheck new.db" to run the tests.
59 **
60 ** DEBUGGING HINTS:
61 **
62 ** If fuzzcheck does crash, it can be run in the debugger and the content
63 ** of the global variable g.zTextName[] will identify the specific XSQL and
64 ** DB values that were running when the crash occurred.
65 **
66 ** DBSQLFUZZ:
67 **
68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against
69 ** that database in its input.  This utility can now process dbsqlfuzz
70 ** input files.  Load such files using the "--load-dbsql FILE ..." command-line
71 ** option.
72 **
73 ** Dbsqlfuzz inputs are ordinary text.  The first part of the file is text
74 ** that describes the content of the database (using a lot of hexadecimal),
75 ** then there is a divider line followed by the SQL to run against the
76 ** database.  Because they are ordinary text, dbsqlfuzz inputs are stored
77 ** in the XSQL table, as if they were ordinary SQL inputs.  The isDbSql()
78 ** function can look at a text string and determine whether or not it is
79 ** a valid dbsqlfuzz input.
80 */
81 #include <stdio.h>
82 #include <stdlib.h>
83 #include <string.h>
84 #include <stdarg.h>
85 #include <ctype.h>
86 #include <assert.h>
87 #include "sqlite3.h"
88 #define ISSPACE(X) isspace((unsigned char)(X))
89 #define ISDIGIT(X) isdigit((unsigned char)(X))
90 
91 
92 #ifdef __unix__
93 # include <signal.h>
94 # include <unistd.h>
95 #endif
96 
97 #include <stddef.h>
98 #if !defined(_MSC_VER)
99 # include <stdint.h>
100 #endif
101 
102 #if defined(_MSC_VER)
103 typedef unsigned char uint8_t;
104 #endif
105 
106 /*
107 ** Files in the virtual file system.
108 */
109 typedef struct VFile VFile;
110 struct VFile {
111   char *zFilename;        /* Filename.  NULL for delete-on-close. From malloc() */
112   int sz;                 /* Size of the file in bytes */
113   int nRef;               /* Number of references to this file */
114   unsigned char *a;       /* Content of the file.  From malloc() */
115 };
116 typedef struct VHandle VHandle;
117 struct VHandle {
118   sqlite3_file base;      /* Base class.  Must be first */
119   VFile *pVFile;          /* The underlying file */
120 };
121 
122 /*
123 ** The value of a database file template, or of an SQL script
124 */
125 typedef struct Blob Blob;
126 struct Blob {
127   Blob *pNext;            /* Next in a list */
128   int id;                 /* Id of this Blob */
129   int seq;                /* Sequence number */
130   int sz;                 /* Size of this Blob in bytes */
131   unsigned char a[1];     /* Blob content.  Extra space allocated as needed. */
132 };
133 
134 /*
135 ** Maximum number of files in the in-memory virtual filesystem.
136 */
137 #define MX_FILE  10
138 
139 /*
140 ** Maximum allowed file size
141 */
142 #define MX_FILE_SZ 10000000
143 
144 /*
145 ** All global variables are gathered into the "g" singleton.
146 */
147 static struct GlobalVars {
148   const char *zArgv0;              /* Name of program */
149   const char *zDbFile;             /* Name of database file */
150   VFile aFile[MX_FILE];            /* The virtual filesystem */
151   int nDb;                         /* Number of template databases */
152   Blob *pFirstDb;                  /* Content of first template database */
153   int nSql;                        /* Number of SQL scripts */
154   Blob *pFirstSql;                 /* First SQL script */
155   unsigned int uRandom;            /* Seed for the SQLite PRNG */
156   char zTestName[100];             /* Name of current test */
157 } g;
158 
159 /*
160 ** Print an error message and quit.
161 */
162 static void fatalError(const char *zFormat, ...){
163   va_list ap;
164   fprintf(stderr, "%s", g.zArgv0);
165   if( g.zDbFile ) fprintf(stderr, " %s", g.zDbFile);
166   if( g.zTestName[0] ) fprintf(stderr, " (%s)", g.zTestName);
167   fprintf(stderr, ": ");
168   va_start(ap, zFormat);
169   vfprintf(stderr, zFormat, ap);
170   va_end(ap);
171   fprintf(stderr, "\n");
172   exit(1);
173 }
174 
175 /*
176 ** signal handler
177 */
178 #ifdef __unix__
179 static void signalHandler(int signum){
180   const char *zSig;
181   if( signum==SIGABRT ){
182     zSig = "abort";
183   }else if( signum==SIGALRM ){
184     zSig = "timeout";
185   }else if( signum==SIGSEGV ){
186     zSig = "segfault";
187   }else{
188     zSig = "signal";
189   }
190   fatalError(zSig);
191 }
192 #endif
193 
194 /*
195 ** Set the an alarm to go off after N seconds.  Disable the alarm
196 ** if N==0
197 */
198 static void setAlarm(int N){
199 #ifdef __unix__
200   alarm(N);
201 #else
202   (void)N;
203 #endif
204 }
205 
206 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
207 /*
208 ** This an SQL progress handler.  After an SQL statement has run for
209 ** many steps, we want to interrupt it.  This guards against infinite
210 ** loops from recursive common table expressions.
211 **
212 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used.
213 ** In that case, hitting the progress handler is a fatal error.
214 */
215 static int progressHandler(void *pVdbeLimitFlag){
216   if( *(int*)pVdbeLimitFlag ) fatalError("too many VDBE cycles");
217   return 1;
218 }
219 #endif
220 
221 /*
222 ** Reallocate memory.  Show and error and quit if unable.
223 */
224 static void *safe_realloc(void *pOld, int szNew){
225   void *pNew = realloc(pOld, szNew<=0 ? 1 : szNew);
226   if( pNew==0 ) fatalError("unable to realloc for %d bytes", szNew);
227   return pNew;
228 }
229 
230 /*
231 ** Initialize the virtual file system.
232 */
233 static void formatVfs(void){
234   int i;
235   for(i=0; i<MX_FILE; i++){
236     g.aFile[i].sz = -1;
237     g.aFile[i].zFilename = 0;
238     g.aFile[i].a = 0;
239     g.aFile[i].nRef = 0;
240   }
241 }
242 
243 
244 /*
245 ** Erase all information in the virtual file system.
246 */
247 static void reformatVfs(void){
248   int i;
249   for(i=0; i<MX_FILE; i++){
250     if( g.aFile[i].sz<0 ) continue;
251     if( g.aFile[i].zFilename ){
252       free(g.aFile[i].zFilename);
253       g.aFile[i].zFilename = 0;
254     }
255     if( g.aFile[i].nRef>0 ){
256       fatalError("file %d still open.  nRef=%d", i, g.aFile[i].nRef);
257     }
258     g.aFile[i].sz = -1;
259     free(g.aFile[i].a);
260     g.aFile[i].a = 0;
261     g.aFile[i].nRef = 0;
262   }
263 }
264 
265 /*
266 ** Find a VFile by name
267 */
268 static VFile *findVFile(const char *zName){
269   int i;
270   if( zName==0 ) return 0;
271   for(i=0; i<MX_FILE; i++){
272     if( g.aFile[i].zFilename==0 ) continue;
273     if( strcmp(g.aFile[i].zFilename, zName)==0 ) return &g.aFile[i];
274   }
275   return 0;
276 }
277 
278 /*
279 ** Find a VFile by name.  Create it if it does not already exist and
280 ** initialize it to the size and content given.
281 **
282 ** Return NULL only if the filesystem is full.
283 */
284 static VFile *createVFile(const char *zName, int sz, unsigned char *pData){
285   VFile *pNew = findVFile(zName);
286   int i;
287   if( pNew ) return pNew;
288   for(i=0; i<MX_FILE && g.aFile[i].sz>=0; i++){}
289   if( i>=MX_FILE ) return 0;
290   pNew = &g.aFile[i];
291   if( zName ){
292     int nName = (int)strlen(zName)+1;
293     pNew->zFilename = safe_realloc(0, nName);
294     memcpy(pNew->zFilename, zName, nName);
295   }else{
296     pNew->zFilename = 0;
297   }
298   pNew->nRef = 0;
299   pNew->sz = sz;
300   pNew->a = safe_realloc(0, sz);
301   if( sz>0 ) memcpy(pNew->a, pData, sz);
302   return pNew;
303 }
304 
305 
306 /*
307 ** Implementation of the "readfile(X)" SQL function.  The entire content
308 ** of the file named X is read and returned as a BLOB.  NULL is returned
309 ** if the file does not exist or is unreadable.
310 */
311 static void readfileFunc(
312   sqlite3_context *context,
313   int argc,
314   sqlite3_value **argv
315 ){
316   const char *zName;
317   FILE *in;
318   long nIn;
319   void *pBuf;
320 
321   zName = (const char*)sqlite3_value_text(argv[0]);
322   if( zName==0 ) return;
323   in = fopen(zName, "rb");
324   if( in==0 ) return;
325   fseek(in, 0, SEEK_END);
326   nIn = ftell(in);
327   rewind(in);
328   pBuf = sqlite3_malloc64( nIn );
329   if( pBuf && 1==fread(pBuf, nIn, 1, in) ){
330     sqlite3_result_blob(context, pBuf, nIn, sqlite3_free);
331   }else{
332     sqlite3_free(pBuf);
333   }
334   fclose(in);
335 }
336 
337 /*
338 ** Implementation of the "readtextfile(X)" SQL function.  The text content
339 ** of the file named X through the end of the file or to the first \000
340 ** character, whichever comes first, is read and returned as TEXT.  NULL
341 ** is returned if the file does not exist or is unreadable.
342 */
343 static void readtextfileFunc(
344   sqlite3_context *context,
345   int argc,
346   sqlite3_value **argv
347 ){
348   const char *zName;
349   FILE *in;
350   long nIn;
351   char *pBuf;
352 
353   zName = (const char*)sqlite3_value_text(argv[0]);
354   if( zName==0 ) return;
355   in = fopen(zName, "rb");
356   if( in==0 ) return;
357   fseek(in, 0, SEEK_END);
358   nIn = ftell(in);
359   rewind(in);
360   pBuf = sqlite3_malloc64( nIn+1 );
361   if( pBuf && 1==fread(pBuf, nIn, 1, in) ){
362     pBuf[nIn] = 0;
363     sqlite3_result_text(context, pBuf, -1, sqlite3_free);
364   }else{
365     sqlite3_free(pBuf);
366   }
367   fclose(in);
368 }
369 
370 /*
371 ** Implementation of the "writefile(X,Y)" SQL function.  The argument Y
372 ** is written into file X.  The number of bytes written is returned.  Or
373 ** NULL is returned if something goes wrong, such as being unable to open
374 ** file X for writing.
375 */
376 static void writefileFunc(
377   sqlite3_context *context,
378   int argc,
379   sqlite3_value **argv
380 ){
381   FILE *out;
382   const char *z;
383   sqlite3_int64 rc;
384   const char *zFile;
385 
386   (void)argc;
387   zFile = (const char*)sqlite3_value_text(argv[0]);
388   if( zFile==0 ) return;
389   out = fopen(zFile, "wb");
390   if( out==0 ) return;
391   z = (const char*)sqlite3_value_blob(argv[1]);
392   if( z==0 ){
393     rc = 0;
394   }else{
395     rc = fwrite(z, 1, sqlite3_value_bytes(argv[1]), out);
396   }
397   fclose(out);
398   sqlite3_result_int64(context, rc);
399 }
400 
401 
402 /*
403 ** Load a list of Blob objects from the database
404 */
405 static void blobListLoadFromDb(
406   sqlite3 *db,             /* Read from this database */
407   const char *zSql,        /* Query used to extract the blobs */
408   int onlyId,              /* Only load where id is this value */
409   int *pN,                 /* OUT: Write number of blobs loaded here */
410   Blob **ppList            /* OUT: Write the head of the blob list here */
411 ){
412   Blob head;
413   Blob *p;
414   sqlite3_stmt *pStmt;
415   int n = 0;
416   int rc;
417   char *z2;
418 
419   if( onlyId>0 ){
420     z2 = sqlite3_mprintf("%s WHERE rowid=%d", zSql, onlyId);
421   }else{
422     z2 = sqlite3_mprintf("%s", zSql);
423   }
424   rc = sqlite3_prepare_v2(db, z2, -1, &pStmt, 0);
425   sqlite3_free(z2);
426   if( rc ) fatalError("%s", sqlite3_errmsg(db));
427   head.pNext = 0;
428   p = &head;
429   while( SQLITE_ROW==sqlite3_step(pStmt) ){
430     int sz = sqlite3_column_bytes(pStmt, 1);
431     Blob *pNew = safe_realloc(0, sizeof(*pNew)+sz );
432     pNew->id = sqlite3_column_int(pStmt, 0);
433     pNew->sz = sz;
434     pNew->seq = n++;
435     pNew->pNext = 0;
436     memcpy(pNew->a, sqlite3_column_blob(pStmt,1), sz);
437     pNew->a[sz] = 0;
438     p->pNext = pNew;
439     p = pNew;
440   }
441   sqlite3_finalize(pStmt);
442   *pN = n;
443   *ppList = head.pNext;
444 }
445 
446 /*
447 ** Free a list of Blob objects
448 */
449 static void blobListFree(Blob *p){
450   Blob *pNext;
451   while( p ){
452     pNext = p->pNext;
453     free(p);
454     p = pNext;
455   }
456 }
457 
458 /* Return the current wall-clock time
459 **
460 ** The number of milliseconds since the julian epoch.
461 ** 1907-01-01 00:00:00  ->  210866716800000
462 ** 2021-01-01 00:00:00  ->  212476176000000
463 */
464 static sqlite3_int64 timeOfDay(void){
465   static sqlite3_vfs *clockVfs = 0;
466   sqlite3_int64 t;
467   if( clockVfs==0 ){
468     clockVfs = sqlite3_vfs_find(0);
469     if( clockVfs==0 ) return 0;
470   }
471   if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){
472     clockVfs->xCurrentTimeInt64(clockVfs, &t);
473   }else{
474     double r;
475     clockVfs->xCurrentTime(clockVfs, &r);
476     t = (sqlite3_int64)(r*86400000.0);
477   }
478   return t;
479 }
480 
481 /***************************************************************************
482 ** Code to process combined database+SQL scripts generated by the
483 ** dbsqlfuzz fuzzer.
484 */
485 
486 /* An instance of the following object is passed by pointer as the
487 ** client data to various callbacks.
488 */
489 typedef struct FuzzCtx {
490   sqlite3 *db;               /* The database connection */
491   sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
492   sqlite3_int64 iLastCb;     /* Time recorded for previous progress callback */
493   sqlite3_int64 mxInterval;  /* Longest interval between two progress calls */
494   unsigned nCb;              /* Number of progress callbacks */
495   unsigned mxCb;             /* Maximum number of progress callbacks allowed */
496   unsigned execCnt;          /* Number of calls to the sqlite3_exec callback */
497   int timeoutHit;            /* True when reaching a timeout */
498 } FuzzCtx;
499 
500 /* Verbosity level for the dbsqlfuzz test runner */
501 static int eVerbosity = 0;
502 
503 /* True to activate PRAGMA vdbe_debug=on */
504 static int bVdbeDebug = 0;
505 
506 /* Timeout for each fuzzing attempt, in milliseconds */
507 static int giTimeout = 10000;   /* Defaults to 10 seconds */
508 
509 /* Maximum number of progress handler callbacks */
510 static unsigned int mxProgressCb = 2000;
511 
512 /* Maximum string length in SQLite */
513 static int lengthLimit = 1000000;
514 
515 /* Maximum expression depth */
516 static int depthLimit = 500;
517 
518 /* Limit on the amount of heap memory that can be used */
519 static sqlite3_int64 heapLimit = 100000000;
520 
521 /* Maximum byte-code program length in SQLite */
522 static int vdbeOpLimit = 25000;
523 
524 /* Maximum size of the in-memory database */
525 static sqlite3_int64 maxDbSize = 104857600;
526 /* OOM simulation parameters */
527 static unsigned int oomCounter = 0;    /* Simulate OOM when equals 1 */
528 static unsigned int oomRepeat = 0;     /* Number of OOMs in a row */
529 static void*(*defaultMalloc)(int) = 0; /* The low-level malloc routine */
530 
531 /* This routine is called when a simulated OOM occurs.  It is broken
532 ** out as a separate routine to make it easy to set a breakpoint on
533 ** the OOM
534 */
535 void oomFault(void){
536   if( eVerbosity ){
537     printf("Simulated OOM fault\n");
538   }
539   if( oomRepeat>0 ){
540     oomRepeat--;
541   }else{
542     oomCounter--;
543   }
544 }
545 
546 /* This routine is a replacement malloc() that is used to simulate
547 ** Out-Of-Memory (OOM) errors for testing purposes.
548 */
549 static void *oomMalloc(int nByte){
550   if( oomCounter ){
551     if( oomCounter==1 ){
552       oomFault();
553       return 0;
554     }else{
555       oomCounter--;
556     }
557   }
558   return defaultMalloc(nByte);
559 }
560 
561 /* Register the OOM simulator.  This must occur before any memory
562 ** allocations */
563 static void registerOomSimulator(void){
564   sqlite3_mem_methods mem;
565   sqlite3_shutdown();
566   sqlite3_config(SQLITE_CONFIG_GETMALLOC, &mem);
567   defaultMalloc = mem.xMalloc;
568   mem.xMalloc = oomMalloc;
569   sqlite3_config(SQLITE_CONFIG_MALLOC, &mem);
570 }
571 
572 /* Turn off any pending OOM simulation */
573 static void disableOom(void){
574   oomCounter = 0;
575   oomRepeat = 0;
576 }
577 
578 /*
579 ** Translate a single byte of Hex into an integer.
580 ** This routine only works if h really is a valid hexadecimal
581 ** character:  0..9a..fA..F
582 */
583 static unsigned char hexToInt(unsigned int h){
584 #ifdef SQLITE_EBCDIC
585   h += 9*(1&~(h>>4));   /* EBCDIC */
586 #else
587   h += 9*(1&(h>>6));    /* ASCII */
588 #endif
589   return h & 0xf;
590 }
591 
592 /*
593 ** The first character of buffer zIn[0..nIn-1] is a '['.  This routine
594 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it
595 ** does it makes corresponding changes to the *pK value and *pI value
596 ** and returns true.  If the input buffer does not match the patterns,
597 ** no changes are made to either *pK or *pI and this routine returns false.
598 */
599 static int isOffset(
600   const unsigned char *zIn,  /* Text input */
601   int nIn,                   /* Bytes of input */
602   unsigned int *pK,          /* half-byte cursor to adjust */
603   unsigned int *pI           /* Input index to adjust */
604 ){
605   int i;
606   unsigned int k = 0;
607   unsigned char c;
608   for(i=1; i<nIn && (c = zIn[i])!=']'; i++){
609     if( !isxdigit(c) ) return 0;
610     k = k*16 + hexToInt(c);
611   }
612   if( i==nIn ) return 0;
613   *pK = 2*k;
614   *pI += i;
615   return 1;
616 }
617 
618 /*
619 ** Decode the text starting at zIn into a binary database file.
620 ** The maximum length of zIn is nIn bytes.  Compute the binary database
621 ** file contain in space obtained from sqlite3_malloc().
622 **
623 ** Return the number of bytes of zIn consumed.  Or return -1 if there
624 ** is an error.  One potential error is that the recipe specifies a
625 ** database file larger than MX_FILE_SZ bytes.
626 **
627 ** Abort on an OOM.
628 */
629 static int decodeDatabase(
630   const unsigned char *zIn,      /* Input text to be decoded */
631   int nIn,                       /* Bytes of input text */
632   unsigned char **paDecode,      /* OUT: decoded database file */
633   int *pnDecode                  /* OUT: Size of decoded database */
634 ){
635   unsigned char *a, *aNew;       /* Database under construction */
636   int mx = 0;                    /* Current size of the database */
637   sqlite3_uint64 nAlloc = 4096;  /* Space allocated in a[] */
638   unsigned int i;                /* Next byte of zIn[] to read */
639   unsigned int j;                /* Temporary integer */
640   unsigned int k;                /* half-byte cursor index for output */
641   unsigned int n;                /* Number of bytes of input */
642   unsigned char b = 0;
643   if( nIn<4 ) return -1;
644   n = (unsigned int)nIn;
645   a = sqlite3_malloc64( nAlloc );
646   if( a==0 ){
647     fprintf(stderr, "Out of memory!\n");
648     exit(1);
649   }
650   memset(a, 0, (size_t)nAlloc);
651   for(i=k=0; i<n; i++){
652     unsigned char c = (unsigned char)zIn[i];
653     if( isxdigit(c) ){
654       k++;
655       if( k & 1 ){
656         b = hexToInt(c)*16;
657       }else{
658         b += hexToInt(c);
659         j = k/2 - 1;
660         if( j>=nAlloc ){
661           sqlite3_uint64 newSize;
662           if( nAlloc==MX_FILE_SZ || j>=MX_FILE_SZ ){
663             if( eVerbosity ){
664               fprintf(stderr, "Input database too big: max %d bytes\n",
665                       MX_FILE_SZ);
666             }
667             sqlite3_free(a);
668             return -1;
669           }
670           newSize = nAlloc*2;
671           if( newSize<=j ){
672             newSize = (j+4096)&~4095;
673           }
674           if( newSize>MX_FILE_SZ ){
675             if( j>=MX_FILE_SZ ){
676               sqlite3_free(a);
677               return -1;
678             }
679             newSize = MX_FILE_SZ;
680           }
681           aNew = sqlite3_realloc64( a, newSize );
682           if( aNew==0 ){
683             sqlite3_free(a);
684             return -1;
685           }
686           a = aNew;
687           assert( newSize > nAlloc );
688           memset(a+nAlloc, 0, (size_t)(newSize - nAlloc));
689           nAlloc = newSize;
690         }
691         if( j>=(unsigned)mx ){
692           mx = (j + 4095)&~4095;
693           if( mx>MX_FILE_SZ ) mx = MX_FILE_SZ;
694         }
695         assert( j<nAlloc );
696         a[j] = b;
697       }
698     }else if( zIn[i]=='[' && i<n-3 && isOffset(zIn+i, nIn-i, &k, &i) ){
699       continue;
700    }else if( zIn[i]=='\n' && i<n-4 && memcmp(zIn+i,"\n--\n",4)==0 ){
701       i += 4;
702       break;
703     }
704   }
705   *pnDecode = mx;
706   *paDecode = a;
707   return i;
708 }
709 
710 /*
711 ** Progress handler callback.
712 **
713 ** The argument is the cutoff-time after which all processing should
714 ** stop.  So return non-zero if the cut-off time is exceeded.
715 */
716 static int progress_handler(void *pClientData) {
717   FuzzCtx *p = (FuzzCtx*)pClientData;
718   sqlite3_int64 iNow = timeOfDay();
719   int rc = iNow>=p->iCutoffTime;
720   sqlite3_int64 iDiff = iNow - p->iLastCb;
721   /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */
722   if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
723   p->nCb++;
724   if( rc==0 && p->mxCb>0 && p->mxCb<=p->nCb ) rc = 1;
725   if( rc && !p->timeoutHit && eVerbosity>=2 ){
726     printf("Timeout on progress callback %d\n", p->nCb);
727     fflush(stdout);
728     p->timeoutHit = 1;
729   }
730   return rc;
731 }
732 
733 /*
734 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
735 ** "PRAGMA parser_trace" since they can dramatically increase the
736 ** amount of output without actually testing anything useful.
737 **
738 ** Also block ATTACH if attaching a file from the filesystem.
739 */
740 static int block_troublesome_sql(
741   void *Notused,
742   int eCode,
743   const char *zArg1,
744   const char *zArg2,
745   const char *zArg3,
746   const char *zArg4
747 ){
748   (void)Notused;
749   (void)zArg2;
750   (void)zArg3;
751   (void)zArg4;
752   if( eCode==SQLITE_PRAGMA ){
753    if( eVerbosity==0 ){
754       if( sqlite3_strnicmp("vdbe_", zArg1, 5)==0
755        || sqlite3_stricmp("parser_trace", zArg1)==0
756        || sqlite3_stricmp("temp_store_directory", zArg1)==0
757       ){
758         return SQLITE_DENY;
759       }
760     }else if( sqlite3_stricmp("oom",zArg1)==0
761              && zArg2!=0 && zArg2[0]!=0 ){
762       oomCounter = atoi(zArg2);
763     }
764   }else if( eCode==SQLITE_ATTACH ){
765     if( zArg1==0 || (zArg1[0]!=0 && strcmp(zArg1,":memory:")!=0) ){
766       return SQLITE_DENY;
767     }
768   }
769   return SQLITE_OK;
770 }
771 
772 /*
773 ** Run the SQL text
774 */
775 static int runDbSql(sqlite3 *db, const char *zSql){
776   int rc;
777   sqlite3_stmt *pStmt;
778   while( isspace(zSql[0]&0x7f) ) zSql++;
779   if( zSql[0]==0 ) return SQLITE_OK;
780   if( eVerbosity>=4 ){
781     printf("RUNNING-SQL: [%s]\n", zSql);
782     fflush(stdout);
783   }
784   rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0);
785   if( rc==SQLITE_OK ){
786     while( (rc = sqlite3_step(pStmt))==SQLITE_ROW ){
787       if( eVerbosity>=5 ){
788         int j;
789         for(j=0; j<sqlite3_column_count(pStmt); j++){
790           if( j ) printf(",");
791           switch( sqlite3_column_type(pStmt, j) ){
792             case SQLITE_NULL: {
793               printf("NULL");
794               break;
795             }
796             case SQLITE_INTEGER:
797             case SQLITE_FLOAT: {
798               printf("%s", sqlite3_column_text(pStmt, j));
799               break;
800             }
801             case SQLITE_BLOB: {
802               int n = sqlite3_column_bytes(pStmt, j);
803               int i;
804               const unsigned char *a;
805               a = (const unsigned char*)sqlite3_column_blob(pStmt, j);
806               printf("x'");
807               for(i=0; i<n; i++){
808                 printf("%02x", a[i]);
809               }
810               printf("'");
811               break;
812             }
813             case SQLITE_TEXT: {
814               int n = sqlite3_column_bytes(pStmt, j);
815               int i;
816               const unsigned char *a;
817               a = (const unsigned char*)sqlite3_column_blob(pStmt, j);
818               printf("'");
819               for(i=0; i<n; i++){
820                 if( a[i]=='\'' ){
821                   printf("''");
822                 }else{
823                   putchar(a[i]);
824                 }
825               }
826               printf("'");
827               break;
828             }
829           } /* End switch() */
830         } /* End for() */
831         printf("\n");
832         fflush(stdout);
833       } /* End if( eVerbosity>=5 ) */
834     } /* End while( SQLITE_ROW */
835     if( rc!=SQLITE_DONE && eVerbosity>=4 ){
836       printf("SQL-ERROR: (%d) %s\n", rc, sqlite3_errmsg(db));
837       fflush(stdout);
838     }
839   }else if( eVerbosity>=4 ){
840     printf("SQL-ERROR (%d): %s\n", rc, sqlite3_errmsg(db));
841     fflush(stdout);
842   } /* End if( SQLITE_OK ) */
843   return sqlite3_finalize(pStmt);
844 }
845 
846 /* Invoke this routine to run a single test case */
847 int runCombinedDbSqlInput(const uint8_t *aData, size_t nByte, int iTimeout){
848   int rc;                    /* SQLite API return value */
849   int iSql;                  /* Index in aData[] of start of SQL */
850   unsigned char *aDb = 0;    /* Decoded database content */
851   int nDb = 0;               /* Size of the decoded database */
852   int i;                     /* Loop counter */
853   int j;                     /* Start of current SQL statement */
854   char *zSql = 0;            /* SQL text to run */
855   int nSql;                  /* Bytes of SQL text */
856   FuzzCtx cx;                /* Fuzzing context */
857 
858   if( nByte<10 ) return 0;
859   if( sqlite3_initialize() ) return 0;
860   if( sqlite3_memory_used()!=0 ){
861     int nAlloc = 0;
862     int nNotUsed = 0;
863     sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0);
864     fprintf(stderr,"memory leak prior to test start:"
865                    " %lld bytes in %d allocations\n",
866             sqlite3_memory_used(), nAlloc);
867     exit(1);
868   }
869   memset(&cx, 0, sizeof(cx));
870   iSql = decodeDatabase((unsigned char*)aData, (int)nByte, &aDb, &nDb);
871   if( iSql<0 ) return 0;
872   nSql = (int)(nByte - iSql);
873   if( eVerbosity>=3 ){
874     printf(
875       "****** %d-byte input, %d-byte database, %d-byte script "
876       "******\n", (int)nByte, nDb, nSql);
877     fflush(stdout);
878   }
879   rc = sqlite3_open(0, &cx.db);
880   if( rc ){
881     sqlite3_free(aDb);
882     return 1;
883   }
884   if( bVdbeDebug ){
885     sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON", 0, 0, 0);
886   }
887 
888   /* Invoke the progress handler frequently to check to see if we
889   ** are taking too long.  The progress handler will return true
890   ** (which will block further processing) if more than giTimeout seconds have
891   ** elapsed since the start of the test.
892   */
893   cx.iLastCb = timeOfDay();
894   cx.iCutoffTime = cx.iLastCb + (iTimeout<giTimeout ? iTimeout : giTimeout);
895   cx.mxCb = mxProgressCb;
896 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
897   sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
898 #endif
899 
900   /* Set a limit on the maximum size of a prepared statement, and the
901   ** maximum length of a string or blob */
902   if( vdbeOpLimit>0 ){
903     sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, vdbeOpLimit);
904   }
905   if( lengthLimit>0 ){
906     sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, lengthLimit);
907   }
908   if( depthLimit>0 ){
909     sqlite3_limit(cx.db, SQLITE_LIMIT_EXPR_DEPTH, depthLimit);
910   }
911   sqlite3_limit(cx.db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 100);
912   sqlite3_hard_heap_limit64(heapLimit);
913 
914   if( nDb>=20 && aDb[18]==2 && aDb[19]==2 ){
915     aDb[18] = aDb[19] = 1;
916   }
917   rc = sqlite3_deserialize(cx.db, "main", aDb, nDb, nDb,
918           SQLITE_DESERIALIZE_RESIZEABLE |
919           SQLITE_DESERIALIZE_FREEONCLOSE);
920   if( rc ){
921     fprintf(stderr, "sqlite3_deserialize() failed with %d\n", rc);
922     goto testrun_finished;
923   }
924   if( maxDbSize>0 ){
925     sqlite3_int64 x = maxDbSize;
926     sqlite3_file_control(cx.db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x);
927   }
928 
929   /* For high debugging levels, turn on debug mode */
930   if( eVerbosity>=5 ){
931     sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON;", 0, 0, 0);
932   }
933 
934   /* Block debug pragmas and ATTACH/DETACH.  But wait until after
935   ** deserialize to do this because deserialize depends on ATTACH */
936   sqlite3_set_authorizer(cx.db, block_troublesome_sql, 0);
937 
938   /* Consistent PRNG seed */
939   sqlite3_randomness(0,0);
940 
941   zSql = sqlite3_malloc( nSql + 1 );
942   if( zSql==0 ){
943     fprintf(stderr, "Out of memory!\n");
944   }else{
945     memcpy(zSql, aData+iSql, nSql);
946     zSql[nSql] = 0;
947     for(i=j=0; zSql[i]; i++){
948       if( zSql[i]==';' ){
949         char cSaved = zSql[i+1];
950         zSql[i+1] = 0;
951         if( sqlite3_complete(zSql+j) ){
952           rc = runDbSql(cx.db, zSql+j);
953           j = i+1;
954         }
955         zSql[i+1] = cSaved;
956         if( rc==SQLITE_INTERRUPT || progress_handler(&cx) ){
957           goto testrun_finished;
958         }
959       }
960     }
961     if( j<i ){
962       runDbSql(cx.db, zSql+j);
963     }
964   }
965 testrun_finished:
966   sqlite3_free(zSql);
967   rc = sqlite3_close(cx.db);
968   if( rc!=SQLITE_OK ){
969     fprintf(stdout, "sqlite3_close() returns %d\n", rc);
970   }
971   if( eVerbosity>=2 ){
972     fprintf(stdout, "Peak memory usages: %f MB\n",
973        sqlite3_memory_highwater(1) / 1000000.0);
974   }
975   if( sqlite3_memory_used()!=0 ){
976     int nAlloc = 0;
977     int nNotUsed = 0;
978     sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0);
979     fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n",
980             sqlite3_memory_used(), nAlloc);
981     exit(1);
982   }
983   return 0;
984 }
985 
986 /*
987 ** END of the dbsqlfuzz code
988 ***************************************************************************/
989 
990 /* Look at a SQL text and try to determine if it begins with a database
991 ** description, such as would be found in a dbsqlfuzz test case.  Return
992 ** true if this does appear to be a dbsqlfuzz test case and false otherwise.
993 */
994 static int isDbSql(unsigned char *a, int n){
995   unsigned char buf[12];
996   int i;
997   if( n>4 && memcmp(a,"\n--\n",4)==0 ) return 1;
998   while( n>0 && isspace(a[0]) ){ a++; n--; }
999   for(i=0; n>0 && i<8; n--, a++){
1000     if( isxdigit(a[0]) ) buf[i++] = a[0];
1001   }
1002   if( i==8 && memcmp(buf,"53514c69",8)==0 ) return 1;
1003   return 0;
1004 }
1005 
1006 /* Implementation of the isdbsql(TEXT) SQL function.
1007 */
1008 static void isDbSqlFunc(
1009   sqlite3_context *context,
1010   int argc,
1011   sqlite3_value **argv
1012 ){
1013   int n = sqlite3_value_bytes(argv[0]);
1014   unsigned char *a = (unsigned char*)sqlite3_value_blob(argv[0]);
1015   sqlite3_result_int(context, a!=0 && n>0 && isDbSql(a,n));
1016 }
1017 
1018 /* Methods for the VHandle object
1019 */
1020 static int inmemClose(sqlite3_file *pFile){
1021   VHandle *p = (VHandle*)pFile;
1022   VFile *pVFile = p->pVFile;
1023   pVFile->nRef--;
1024   if( pVFile->nRef==0 && pVFile->zFilename==0 ){
1025     pVFile->sz = -1;
1026     free(pVFile->a);
1027     pVFile->a = 0;
1028   }
1029   return SQLITE_OK;
1030 }
1031 static int inmemRead(
1032   sqlite3_file *pFile,   /* Read from this open file */
1033   void *pData,           /* Store content in this buffer */
1034   int iAmt,              /* Bytes of content */
1035   sqlite3_int64 iOfst    /* Start reading here */
1036 ){
1037   VHandle *pHandle = (VHandle*)pFile;
1038   VFile *pVFile = pHandle->pVFile;
1039   if( iOfst<0 || iOfst>=pVFile->sz ){
1040     memset(pData, 0, iAmt);
1041     return SQLITE_IOERR_SHORT_READ;
1042   }
1043   if( iOfst+iAmt>pVFile->sz ){
1044     memset(pData, 0, iAmt);
1045     iAmt = (int)(pVFile->sz - iOfst);
1046     memcpy(pData, pVFile->a + iOfst, iAmt);
1047     return SQLITE_IOERR_SHORT_READ;
1048   }
1049   memcpy(pData, pVFile->a + iOfst, iAmt);
1050   return SQLITE_OK;
1051 }
1052 static int inmemWrite(
1053   sqlite3_file *pFile,   /* Write to this file */
1054   const void *pData,     /* Content to write */
1055   int iAmt,              /* bytes to write */
1056   sqlite3_int64 iOfst    /* Start writing here */
1057 ){
1058   VHandle *pHandle = (VHandle*)pFile;
1059   VFile *pVFile = pHandle->pVFile;
1060   if( iOfst+iAmt > pVFile->sz ){
1061     if( iOfst+iAmt >= MX_FILE_SZ ){
1062       return SQLITE_FULL;
1063     }
1064     pVFile->a = safe_realloc(pVFile->a, (int)(iOfst+iAmt));
1065     if( iOfst > pVFile->sz ){
1066       memset(pVFile->a + pVFile->sz, 0, (int)(iOfst - pVFile->sz));
1067     }
1068     pVFile->sz = (int)(iOfst + iAmt);
1069   }
1070   memcpy(pVFile->a + iOfst, pData, iAmt);
1071   return SQLITE_OK;
1072 }
1073 static int inmemTruncate(sqlite3_file *pFile, sqlite3_int64 iSize){
1074   VHandle *pHandle = (VHandle*)pFile;
1075   VFile *pVFile = pHandle->pVFile;
1076   if( pVFile->sz>iSize && iSize>=0 ) pVFile->sz = (int)iSize;
1077   return SQLITE_OK;
1078 }
1079 static int inmemSync(sqlite3_file *pFile, int flags){
1080   return SQLITE_OK;
1081 }
1082 static int inmemFileSize(sqlite3_file *pFile, sqlite3_int64 *pSize){
1083   *pSize = ((VHandle*)pFile)->pVFile->sz;
1084   return SQLITE_OK;
1085 }
1086 static int inmemLock(sqlite3_file *pFile, int type){
1087   return SQLITE_OK;
1088 }
1089 static int inmemUnlock(sqlite3_file *pFile, int type){
1090   return SQLITE_OK;
1091 }
1092 static int inmemCheckReservedLock(sqlite3_file *pFile, int *pOut){
1093   *pOut = 0;
1094   return SQLITE_OK;
1095 }
1096 static int inmemFileControl(sqlite3_file *pFile, int op, void *pArg){
1097   return SQLITE_NOTFOUND;
1098 }
1099 static int inmemSectorSize(sqlite3_file *pFile){
1100   return 512;
1101 }
1102 static int inmemDeviceCharacteristics(sqlite3_file *pFile){
1103   return
1104       SQLITE_IOCAP_SAFE_APPEND |
1105       SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN |
1106       SQLITE_IOCAP_POWERSAFE_OVERWRITE;
1107 }
1108 
1109 
1110 /* Method table for VHandle
1111 */
1112 static sqlite3_io_methods VHandleMethods = {
1113   /* iVersion  */    1,
1114   /* xClose    */    inmemClose,
1115   /* xRead     */    inmemRead,
1116   /* xWrite    */    inmemWrite,
1117   /* xTruncate */    inmemTruncate,
1118   /* xSync     */    inmemSync,
1119   /* xFileSize */    inmemFileSize,
1120   /* xLock     */    inmemLock,
1121   /* xUnlock   */    inmemUnlock,
1122   /* xCheck... */    inmemCheckReservedLock,
1123   /* xFileCtrl */    inmemFileControl,
1124   /* xSectorSz */    inmemSectorSize,
1125   /* xDevchar  */    inmemDeviceCharacteristics,
1126   /* xShmMap   */    0,
1127   /* xShmLock  */    0,
1128   /* xShmBarrier */  0,
1129   /* xShmUnmap */    0,
1130   /* xFetch    */    0,
1131   /* xUnfetch  */    0
1132 };
1133 
1134 /*
1135 ** Open a new file in the inmem VFS.  All files are anonymous and are
1136 ** delete-on-close.
1137 */
1138 static int inmemOpen(
1139   sqlite3_vfs *pVfs,
1140   const char *zFilename,
1141   sqlite3_file *pFile,
1142   int openFlags,
1143   int *pOutFlags
1144 ){
1145   VFile *pVFile = createVFile(zFilename, 0, (unsigned char*)"");
1146   VHandle *pHandle = (VHandle*)pFile;
1147   if( pVFile==0 ){
1148     return SQLITE_FULL;
1149   }
1150   pHandle->pVFile = pVFile;
1151   pVFile->nRef++;
1152   pFile->pMethods = &VHandleMethods;
1153   if( pOutFlags ) *pOutFlags = openFlags;
1154   return SQLITE_OK;
1155 }
1156 
1157 /*
1158 ** Delete a file by name
1159 */
1160 static int inmemDelete(
1161   sqlite3_vfs *pVfs,
1162   const char *zFilename,
1163   int syncdir
1164 ){
1165   VFile *pVFile = findVFile(zFilename);
1166   if( pVFile==0 ) return SQLITE_OK;
1167   if( pVFile->nRef==0 ){
1168     free(pVFile->zFilename);
1169     pVFile->zFilename = 0;
1170     pVFile->sz = -1;
1171     free(pVFile->a);
1172     pVFile->a = 0;
1173     return SQLITE_OK;
1174   }
1175   return SQLITE_IOERR_DELETE;
1176 }
1177 
1178 /* Check for the existance of a file
1179 */
1180 static int inmemAccess(
1181   sqlite3_vfs *pVfs,
1182   const char *zFilename,
1183   int flags,
1184   int *pResOut
1185 ){
1186   VFile *pVFile = findVFile(zFilename);
1187   *pResOut =  pVFile!=0;
1188   return SQLITE_OK;
1189 }
1190 
1191 /* Get the canonical pathname for a file
1192 */
1193 static int inmemFullPathname(
1194   sqlite3_vfs *pVfs,
1195   const char *zFilename,
1196   int nOut,
1197   char *zOut
1198 ){
1199   sqlite3_snprintf(nOut, zOut, "%s", zFilename);
1200   return SQLITE_OK;
1201 }
1202 
1203 /* Always use the same random see, for repeatability.
1204 */
1205 static int inmemRandomness(sqlite3_vfs *NotUsed, int nBuf, char *zBuf){
1206   memset(zBuf, 0, nBuf);
1207   memcpy(zBuf, &g.uRandom, nBuf<sizeof(g.uRandom) ? nBuf : sizeof(g.uRandom));
1208   return nBuf;
1209 }
1210 
1211 /*
1212 ** Register the VFS that reads from the g.aFile[] set of files.
1213 */
1214 static void inmemVfsRegister(int makeDefault){
1215   static sqlite3_vfs inmemVfs;
1216   sqlite3_vfs *pDefault = sqlite3_vfs_find(0);
1217   inmemVfs.iVersion = 3;
1218   inmemVfs.szOsFile = sizeof(VHandle);
1219   inmemVfs.mxPathname = 200;
1220   inmemVfs.zName = "inmem";
1221   inmemVfs.xOpen = inmemOpen;
1222   inmemVfs.xDelete = inmemDelete;
1223   inmemVfs.xAccess = inmemAccess;
1224   inmemVfs.xFullPathname = inmemFullPathname;
1225   inmemVfs.xRandomness = inmemRandomness;
1226   inmemVfs.xSleep = pDefault->xSleep;
1227   inmemVfs.xCurrentTimeInt64 = pDefault->xCurrentTimeInt64;
1228   sqlite3_vfs_register(&inmemVfs, makeDefault);
1229 };
1230 
1231 /*
1232 ** Allowed values for the runFlags parameter to runSql()
1233 */
1234 #define SQL_TRACE  0x0001     /* Print each SQL statement as it is prepared */
1235 #define SQL_OUTPUT 0x0002     /* Show the SQL output */
1236 
1237 /*
1238 ** Run multiple commands of SQL.  Similar to sqlite3_exec(), but does not
1239 ** stop if an error is encountered.
1240 */
1241 static void runSql(sqlite3 *db, const char *zSql, unsigned  runFlags){
1242   const char *zMore;
1243   sqlite3_stmt *pStmt;
1244 
1245   while( zSql && zSql[0] ){
1246     zMore = 0;
1247     pStmt = 0;
1248     sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zMore);
1249     if( zMore==zSql ) break;
1250     if( runFlags & SQL_TRACE ){
1251       const char *z = zSql;
1252       int n;
1253       while( z<zMore && ISSPACE(z[0]) ) z++;
1254       n = (int)(zMore - z);
1255       while( n>0 && ISSPACE(z[n-1]) ) n--;
1256       if( n==0 ) break;
1257       if( pStmt==0 ){
1258         printf("TRACE: %.*s (error: %s)\n", n, z, sqlite3_errmsg(db));
1259       }else{
1260         printf("TRACE: %.*s\n", n, z);
1261       }
1262     }
1263     zSql = zMore;
1264     if( pStmt ){
1265       if( (runFlags & SQL_OUTPUT)==0 ){
1266         while( SQLITE_ROW==sqlite3_step(pStmt) ){}
1267       }else{
1268         int nCol = -1;
1269         while( SQLITE_ROW==sqlite3_step(pStmt) ){
1270           int i;
1271           if( nCol<0 ){
1272             nCol = sqlite3_column_count(pStmt);
1273           }else if( nCol>0 ){
1274             printf("--------------------------------------------\n");
1275           }
1276           for(i=0; i<nCol; i++){
1277             int eType = sqlite3_column_type(pStmt,i);
1278             printf("%s = ", sqlite3_column_name(pStmt,i));
1279             switch( eType ){
1280               case SQLITE_NULL: {
1281                 printf("NULL\n");
1282                 break;
1283               }
1284               case SQLITE_INTEGER: {
1285                 printf("INT %s\n", sqlite3_column_text(pStmt,i));
1286                 break;
1287               }
1288               case SQLITE_FLOAT: {
1289                 printf("FLOAT %s\n", sqlite3_column_text(pStmt,i));
1290                 break;
1291               }
1292               case SQLITE_TEXT: {
1293                 printf("TEXT [%s]\n", sqlite3_column_text(pStmt,i));
1294                 break;
1295               }
1296               case SQLITE_BLOB: {
1297                 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt,i));
1298                 break;
1299               }
1300             }
1301           }
1302         }
1303       }
1304       sqlite3_finalize(pStmt);
1305     }
1306   }
1307 }
1308 
1309 /*
1310 ** Rebuild the database file.
1311 **
1312 **    (1)  Remove duplicate entries
1313 **    (2)  Put all entries in order
1314 **    (3)  Vacuum
1315 */
1316 static void rebuild_database(sqlite3 *db, int dbSqlOnly){
1317   int rc;
1318   char *zSql;
1319   zSql = sqlite3_mprintf(
1320      "BEGIN;\n"
1321      "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n"
1322      "DELETE FROM db;\n"
1323      "INSERT INTO db(dbid, dbcontent) "
1324         " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n"
1325      "DROP TABLE dbx;\n"
1326      "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n"
1327      "DELETE FROM xsql;\n"
1328      "INSERT INTO xsql(sqlid,sqltext) "
1329         " SELECT NULL, sqltext FROM sx ORDER BY 2;\n"
1330      "DROP TABLE sx;\n"
1331      "COMMIT;\n"
1332      "PRAGMA page_size=1024;\n"
1333      "VACUUM;\n",
1334      dbSqlOnly ? " WHERE isdbsql(sqltext)" : ""
1335   );
1336   rc = sqlite3_exec(db, zSql, 0, 0, 0);
1337   sqlite3_free(zSql);
1338   if( rc ) fatalError("cannot rebuild: %s", sqlite3_errmsg(db));
1339 }
1340 
1341 /*
1342 ** Return the value of a hexadecimal digit.  Return -1 if the input
1343 ** is not a hex digit.
1344 */
1345 static int hexDigitValue(char c){
1346   if( c>='0' && c<='9' ) return c - '0';
1347   if( c>='a' && c<='f' ) return c - 'a' + 10;
1348   if( c>='A' && c<='F' ) return c - 'A' + 10;
1349   return -1;
1350 }
1351 
1352 /*
1353 ** Interpret zArg as an integer value, possibly with suffixes.
1354 */
1355 static int integerValue(const char *zArg){
1356   sqlite3_int64 v = 0;
1357   static const struct { char *zSuffix; int iMult; } aMult[] = {
1358     { "KiB", 1024 },
1359     { "MiB", 1024*1024 },
1360     { "GiB", 1024*1024*1024 },
1361     { "KB",  1000 },
1362     { "MB",  1000000 },
1363     { "GB",  1000000000 },
1364     { "K",   1000 },
1365     { "M",   1000000 },
1366     { "G",   1000000000 },
1367   };
1368   int i;
1369   int isNeg = 0;
1370   if( zArg[0]=='-' ){
1371     isNeg = 1;
1372     zArg++;
1373   }else if( zArg[0]=='+' ){
1374     zArg++;
1375   }
1376   if( zArg[0]=='0' && zArg[1]=='x' ){
1377     int x;
1378     zArg += 2;
1379     while( (x = hexDigitValue(zArg[0]))>=0 ){
1380       v = (v<<4) + x;
1381       zArg++;
1382     }
1383   }else{
1384     while( ISDIGIT(zArg[0]) ){
1385       v = v*10 + zArg[0] - '0';
1386       zArg++;
1387     }
1388   }
1389   for(i=0; i<sizeof(aMult)/sizeof(aMult[0]); i++){
1390     if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){
1391       v *= aMult[i].iMult;
1392       break;
1393     }
1394   }
1395   if( v>0x7fffffff ) fatalError("parameter too large - max 2147483648");
1396   return (int)(isNeg? -v : v);
1397 }
1398 
1399 /*
1400 ** Return the number of "v" characters in a string.  Return 0 if there
1401 ** are any characters in the string other than "v".
1402 */
1403 static int numberOfVChar(const char *z){
1404   int N = 0;
1405   while( z[0] && z[0]=='v' ){
1406     z++;
1407     N++;
1408   }
1409   return z[0]==0 ? N : 0;
1410 }
1411 
1412 /*
1413 ** Print sketchy documentation for this utility program
1414 */
1415 static void showHelp(void){
1416   printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g.zArgv0);
1417   printf(
1418 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n"
1419 "each database, checking for crashes and memory leaks.\n"
1420 "Options:\n"
1421 "  --cell-size-check    Set the PRAGMA cell_size_check=ON\n"
1422 "  --dbid N             Use only the database where dbid=N\n"
1423 "  --export-db DIR      Write databases to files(s) in DIR. Works with --dbid\n"
1424 "  --export-sql DIR     Write SQL to file(s) in DIR. Also works with --sqlid\n"
1425 "  --help               Show this help text\n"
1426 "  --info               Show information about SOURCE-DB w/o running tests\n"
1427 "  --limit-depth N      Limit expression depth to N.  Default: 500\n"
1428 "  --limit-heap N       Limit heap memory to N.  Default: 100M\n"
1429 "  --limit-mem N        Limit memory used by test SQLite instance to N bytes\n"
1430 "  --limit-vdbe         Panic if any test runs for more than 100,000 cycles\n"
1431 "  --load-sql ARGS...   Load SQL scripts fron files into SOURCE-DB\n"
1432 "  --load-db ARGS...    Load template databases from files into SOURCE_DB\n"
1433 "  --load-dbsql ARGS..  Load dbsqlfuzz outputs into the xsql table\n"
1434 "  -m TEXT              Add a description to the database\n"
1435 "  --native-vfs         Use the native VFS for initially empty database files\n"
1436 "  --native-malloc      Turn off MEMSYS3/5 and Lookaside\n"
1437 "  --oss-fuzz           Enable OSS-FUZZ testing\n"
1438 "  --prng-seed N        Seed value for the PRGN inside of SQLite\n"
1439 "  -q|--quiet           Reduced output\n"
1440 "  --rebuild            Rebuild and vacuum the database file\n"
1441 "  --result-trace       Show the results of each SQL command\n"
1442 "  --skip N             Skip the first N test cases\n"
1443 "  --spinner            Use a spinner to show progress\n"
1444 "  --sqlid N            Use only SQL where sqlid=N\n"
1445 "  --timeout N          Maximum time for any one test in N millseconds\n"
1446 "  -v|--verbose         Increased output.  Repeat for more output.\n"
1447 "  --vdbe-debug         Activate VDBE debugging.\n"
1448   );
1449 }
1450 
1451 int main(int argc, char **argv){
1452   sqlite3_int64 iBegin;        /* Start time of this program */
1453   int quietFlag = 0;           /* True if --quiet or -q */
1454   int verboseFlag = 0;         /* True if --verbose or -v */
1455   char *zInsSql = 0;           /* SQL statement for --load-db or --load-sql */
1456   int iFirstInsArg = 0;        /* First argv[] for --load-db or --load-sql */
1457   sqlite3 *db = 0;             /* The open database connection */
1458   sqlite3_stmt *pStmt;         /* A prepared statement */
1459   int rc;                      /* Result code from SQLite interface calls */
1460   Blob *pSql;                  /* For looping over SQL scripts */
1461   Blob *pDb;                   /* For looping over template databases */
1462   int i;                       /* Loop index for the argv[] loop */
1463   int dbSqlOnly = 0;           /* Only use scripts that are dbsqlfuzz */
1464   int onlySqlid = -1;          /* --sqlid */
1465   int onlyDbid = -1;           /* --dbid */
1466   int nativeFlag = 0;          /* --native-vfs */
1467   int rebuildFlag = 0;         /* --rebuild */
1468   int vdbeLimitFlag = 0;       /* --limit-vdbe */
1469   int infoFlag = 0;            /* --info */
1470   int nSkip = 0;               /* --skip */
1471   int bSpinner = 0;            /* True for --spinner */
1472   int timeoutTest = 0;         /* undocumented --timeout-test flag */
1473   int runFlags = 0;            /* Flags sent to runSql() */
1474   char *zMsg = 0;              /* Add this message */
1475   int nSrcDb = 0;              /* Number of source databases */
1476   char **azSrcDb = 0;          /* Array of source database names */
1477   int iSrcDb;                  /* Loop over all source databases */
1478   int nTest = 0;               /* Total number of tests performed */
1479   char *zDbName = "";          /* Appreviated name of a source database */
1480   const char *zFailCode = 0;   /* Value of the TEST_FAILURE env variable */
1481   int cellSzCkFlag = 0;        /* --cell-size-check */
1482   int sqlFuzz = 0;             /* True for SQL fuzz. False for DB fuzz */
1483   int iTimeout = 120000;       /* Default 120-second timeout */
1484   int nMem = 0;                /* Memory limit override */
1485   int nMemThisDb = 0;          /* Memory limit set by the CONFIG table */
1486   char *zExpDb = 0;            /* Write Databases to files in this directory */
1487   char *zExpSql = 0;           /* Write SQL to files in this directory */
1488   void *pHeap = 0;             /* Heap for use by SQLite */
1489   int ossFuzz = 0;             /* enable OSS-FUZZ testing */
1490   int ossFuzzThisDb = 0;       /* ossFuzz value for this particular database */
1491   int nativeMalloc = 0;        /* Turn off MEMSYS3/5 and lookaside if true */
1492   sqlite3_vfs *pDfltVfs;       /* The default VFS */
1493   int openFlags4Data;          /* Flags for sqlite3_open_v2() */
1494   int bTimer = 0;              /* Show elapse time for each test */
1495   int nV;                      /* How much to increase verbosity with -vvvv */
1496   sqlite3_int64 tmStart;       /* Start of each test */
1497 
1498   registerOomSimulator();
1499   sqlite3_initialize();
1500   iBegin = timeOfDay();
1501 #ifdef __unix__
1502   signal(SIGALRM, signalHandler);
1503   signal(SIGSEGV, signalHandler);
1504   signal(SIGABRT, signalHandler);
1505 #endif
1506   g.zArgv0 = argv[0];
1507   openFlags4Data = SQLITE_OPEN_READONLY;
1508   zFailCode = getenv("TEST_FAILURE");
1509   pDfltVfs = sqlite3_vfs_find(0);
1510   inmemVfsRegister(1);
1511   for(i=1; i<argc; i++){
1512     const char *z = argv[i];
1513     if( z[0]=='-' ){
1514       z++;
1515       if( z[0]=='-' ) z++;
1516       if( strcmp(z,"cell-size-check")==0 ){
1517         cellSzCkFlag = 1;
1518       }else
1519       if( strcmp(z,"dbid")==0 ){
1520         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1521         onlyDbid = integerValue(argv[++i]);
1522       }else
1523       if( strcmp(z,"export-db")==0 ){
1524         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1525         zExpDb = argv[++i];
1526       }else
1527       if( strcmp(z,"export-sql")==0 || strcmp(z,"export-dbsql")==0 ){
1528         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1529         zExpSql = argv[++i];
1530       }else
1531       if( strcmp(z,"help")==0 ){
1532         showHelp();
1533         return 0;
1534       }else
1535       if( strcmp(z,"info")==0 ){
1536         infoFlag = 1;
1537       }else
1538       if( strcmp(z,"limit-depth")==0 ){
1539         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1540         depthLimit = integerValue(argv[++i]);
1541       }else
1542       if( strcmp(z,"limit-heap")==0 ){
1543         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1544         heapLimit = integerValue(argv[++i]);
1545       }else
1546       if( strcmp(z,"limit-mem")==0 ){
1547         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1548         nMem = integerValue(argv[++i]);
1549       }else
1550       if( strcmp(z,"limit-vdbe")==0 ){
1551         vdbeLimitFlag = 1;
1552       }else
1553       if( strcmp(z,"load-sql")==0 ){
1554         zInsSql = "INSERT INTO xsql(sqltext)"
1555                   "VALUES(CAST(readtextfile(?1) AS text))";
1556         iFirstInsArg = i+1;
1557         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
1558         break;
1559       }else
1560       if( strcmp(z,"load-db")==0 ){
1561         zInsSql = "INSERT INTO db(dbcontent) VALUES(readfile(?1))";
1562         iFirstInsArg = i+1;
1563         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
1564         break;
1565       }else
1566       if( strcmp(z,"load-dbsql")==0 ){
1567         zInsSql = "INSERT INTO xsql(sqltext)"
1568                   "VALUES(CAST(readtextfile(?1) AS text))";
1569         iFirstInsArg = i+1;
1570         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
1571         dbSqlOnly = 1;
1572         break;
1573       }else
1574       if( strcmp(z,"m")==0 ){
1575         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1576         zMsg = argv[++i];
1577         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
1578       }else
1579       if( strcmp(z,"native-malloc")==0 ){
1580         nativeMalloc = 1;
1581       }else
1582       if( strcmp(z,"native-vfs")==0 ){
1583         nativeFlag = 1;
1584       }else
1585       if( strcmp(z,"oss-fuzz")==0 ){
1586         ossFuzz = 1;
1587       }else
1588       if( strcmp(z,"prng-seed")==0 ){
1589         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1590         g.uRandom = atoi(argv[++i]);
1591       }else
1592       if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){
1593         quietFlag = 1;
1594         verboseFlag = 0;
1595         eVerbosity = 0;
1596       }else
1597       if( strcmp(z,"rebuild")==0 ){
1598         rebuildFlag = 1;
1599         openFlags4Data = SQLITE_OPEN_READWRITE;
1600       }else
1601       if( strcmp(z,"result-trace")==0 ){
1602         runFlags |= SQL_OUTPUT;
1603       }else
1604       if( strcmp(z,"skip")==0 ){
1605         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1606         nSkip = atoi(argv[++i]);
1607       }else
1608       if( strcmp(z,"spinner")==0 ){
1609         bSpinner = 1;
1610       }else
1611       if( strcmp(z,"timer")==0 ){
1612         bTimer = 1;
1613       }else
1614       if( strcmp(z,"sqlid")==0 ){
1615         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1616         onlySqlid = integerValue(argv[++i]);
1617       }else
1618       if( strcmp(z,"timeout")==0 ){
1619         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
1620         iTimeout = integerValue(argv[++i]);
1621       }else
1622       if( strcmp(z,"timeout-test")==0 ){
1623         timeoutTest = 1;
1624 #ifndef __unix__
1625         fatalError("timeout is not available on non-unix systems");
1626 #endif
1627       }else
1628       if( strcmp(z,"vdbe-debug")==0 ){
1629         bVdbeDebug = 1;
1630       }else
1631       if( strcmp(z,"verbose")==0 ){
1632         quietFlag = 0;
1633         verboseFlag++;
1634         eVerbosity++;
1635         if( verboseFlag>1 ) runFlags |= SQL_TRACE;
1636       }else
1637       if( (nV = numberOfVChar(z))>=1 ){
1638         quietFlag = 0;
1639         verboseFlag += nV;
1640         eVerbosity += nV;
1641         if( verboseFlag>1 ) runFlags |= SQL_TRACE;
1642       }else
1643       if( strcmp(z,"version")==0 ){
1644         int ii;
1645         const char *zz;
1646         printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid());
1647         for(ii=0; (zz = sqlite3_compileoption_get(ii))!=0; ii++){
1648           printf("%s\n", zz);
1649         }
1650         return 0;
1651       }else
1652       {
1653         fatalError("unknown option: %s", argv[i]);
1654       }
1655     }else{
1656       nSrcDb++;
1657       azSrcDb = safe_realloc(azSrcDb, nSrcDb*sizeof(azSrcDb[0]));
1658       azSrcDb[nSrcDb-1] = argv[i];
1659     }
1660   }
1661   if( nSrcDb==0 ) fatalError("no source database specified");
1662   if( nSrcDb>1 ){
1663     if( zMsg ){
1664       fatalError("cannot change the description of more than one database");
1665     }
1666     if( zInsSql ){
1667       fatalError("cannot import into more than one database");
1668     }
1669   }
1670 
1671   /* Process each source database separately */
1672   for(iSrcDb=0; iSrcDb<nSrcDb; iSrcDb++){
1673     g.zDbFile = azSrcDb[iSrcDb];
1674     rc = sqlite3_open_v2(azSrcDb[iSrcDb], &db,
1675                          openFlags4Data, pDfltVfs->zName);
1676     if( rc ){
1677       fatalError("cannot open source database %s - %s",
1678       azSrcDb[iSrcDb], sqlite3_errmsg(db));
1679     }
1680 
1681     /* Print the description, if there is one */
1682     if( infoFlag ){
1683       int n;
1684       zDbName = azSrcDb[iSrcDb];
1685       i = (int)strlen(zDbName) - 1;
1686       while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; }
1687       zDbName += i;
1688       sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0);
1689       if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){
1690         printf("%s: %s", zDbName, sqlite3_column_text(pStmt,0));
1691       }else{
1692         printf("%s: (empty \"readme\")", zDbName);
1693       }
1694       sqlite3_finalize(pStmt);
1695       sqlite3_prepare_v2(db, "SELECT count(*) FROM db", -1, &pStmt, 0);
1696       if( pStmt
1697        && sqlite3_step(pStmt)==SQLITE_ROW
1698        && (n = sqlite3_column_int(pStmt,0))>0
1699       ){
1700         printf(" - %d DBs", n);
1701       }
1702       sqlite3_finalize(pStmt);
1703       sqlite3_prepare_v2(db, "SELECT count(*) FROM xsql", -1, &pStmt, 0);
1704       if( pStmt
1705        && sqlite3_step(pStmt)==SQLITE_ROW
1706        && (n = sqlite3_column_int(pStmt,0))>0
1707       ){
1708         printf(" - %d scripts", n);
1709       }
1710       sqlite3_finalize(pStmt);
1711       printf("\n");
1712       sqlite3_close(db);
1713       continue;
1714     }
1715 
1716     rc = sqlite3_exec(db,
1717        "CREATE TABLE IF NOT EXISTS db(\n"
1718        "  dbid INTEGER PRIMARY KEY, -- database id\n"
1719        "  dbcontent BLOB            -- database disk file image\n"
1720        ");\n"
1721        "CREATE TABLE IF NOT EXISTS xsql(\n"
1722        "  sqlid INTEGER PRIMARY KEY,   -- SQL script id\n"
1723        "  sqltext TEXT                 -- Text of SQL statements to run\n"
1724        ");"
1725        "CREATE TABLE IF NOT EXISTS readme(\n"
1726        "  msg TEXT -- Human-readable description of this file\n"
1727        ");", 0, 0, 0);
1728     if( rc ) fatalError("cannot create schema: %s", sqlite3_errmsg(db));
1729     if( zMsg ){
1730       char *zSql;
1731       zSql = sqlite3_mprintf(
1732                "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg);
1733       rc = sqlite3_exec(db, zSql, 0, 0, 0);
1734       sqlite3_free(zSql);
1735       if( rc ) fatalError("cannot change description: %s", sqlite3_errmsg(db));
1736     }
1737     ossFuzzThisDb = ossFuzz;
1738 
1739     /* If the CONFIG(name,value) table exists, read db-specific settings
1740     ** from that table */
1741     if( sqlite3_table_column_metadata(db,0,"config",0,0,0,0,0,0)==SQLITE_OK ){
1742       rc = sqlite3_prepare_v2(db, "SELECT name, value FROM config",
1743                                   -1, &pStmt, 0);
1744       if( rc ) fatalError("cannot prepare query of CONFIG table: %s",
1745                           sqlite3_errmsg(db));
1746       while( SQLITE_ROW==sqlite3_step(pStmt) ){
1747         const char *zName = (const char *)sqlite3_column_text(pStmt,0);
1748         if( zName==0 ) continue;
1749         if( strcmp(zName, "oss-fuzz")==0 ){
1750           ossFuzzThisDb = sqlite3_column_int(pStmt,1);
1751           if( verboseFlag ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb);
1752         }
1753         if( strcmp(zName, "limit-mem")==0 ){
1754           nMemThisDb = sqlite3_column_int(pStmt,1);
1755           if( verboseFlag ) printf("Config: limit-mem=%d\n", nMemThisDb);
1756         }
1757       }
1758       sqlite3_finalize(pStmt);
1759     }
1760 
1761     if( zInsSql ){
1762       sqlite3_create_function(db, "readfile", 1, SQLITE_UTF8, 0,
1763                               readfileFunc, 0, 0);
1764       sqlite3_create_function(db, "readtextfile", 1, SQLITE_UTF8, 0,
1765                               readtextfileFunc, 0, 0);
1766       sqlite3_create_function(db, "isdbsql", 1, SQLITE_UTF8, 0,
1767                               isDbSqlFunc, 0, 0);
1768       rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0);
1769       if( rc ) fatalError("cannot prepare statement [%s]: %s",
1770                           zInsSql, sqlite3_errmsg(db));
1771       rc = sqlite3_exec(db, "BEGIN", 0, 0, 0);
1772       if( rc ) fatalError("cannot start a transaction");
1773       for(i=iFirstInsArg; i<argc; i++){
1774         sqlite3_bind_text(pStmt, 1, argv[i], -1, SQLITE_STATIC);
1775         sqlite3_step(pStmt);
1776         rc = sqlite3_reset(pStmt);
1777         if( rc ) fatalError("insert failed for %s", argv[i]);
1778       }
1779       sqlite3_finalize(pStmt);
1780       rc = sqlite3_exec(db, "COMMIT", 0, 0, 0);
1781       if( rc ) fatalError("cannot commit the transaction: %s",
1782                           sqlite3_errmsg(db));
1783       rebuild_database(db, dbSqlOnly);
1784       sqlite3_close(db);
1785       return 0;
1786     }
1787     rc = sqlite3_exec(db, "PRAGMA query_only=1;", 0, 0, 0);
1788     if( rc ) fatalError("cannot set database to query-only");
1789     if( zExpDb!=0 || zExpSql!=0 ){
1790       sqlite3_create_function(db, "writefile", 2, SQLITE_UTF8, 0,
1791                               writefileFunc, 0, 0);
1792       if( zExpDb!=0 ){
1793         const char *zExDb =
1794           "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent),"
1795           "       dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)"
1796           "  FROM db WHERE ?2<0 OR dbid=?2;";
1797         rc = sqlite3_prepare_v2(db, zExDb, -1, &pStmt, 0);
1798         if( rc ) fatalError("cannot prepare statement [%s]: %s",
1799                             zExDb, sqlite3_errmsg(db));
1800         sqlite3_bind_text64(pStmt, 1, zExpDb, strlen(zExpDb),
1801                             SQLITE_STATIC, SQLITE_UTF8);
1802         sqlite3_bind_int(pStmt, 2, onlyDbid);
1803         while( sqlite3_step(pStmt)==SQLITE_ROW ){
1804           printf("write db-%d (%d bytes) into %s\n",
1805              sqlite3_column_int(pStmt,1),
1806              sqlite3_column_int(pStmt,3),
1807              sqlite3_column_text(pStmt,2));
1808         }
1809         sqlite3_finalize(pStmt);
1810       }
1811       if( zExpSql!=0 ){
1812         const char *zExSql =
1813           "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext),"
1814           "       sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)"
1815           "  FROM xsql WHERE ?2<0 OR sqlid=?2;";
1816         rc = sqlite3_prepare_v2(db, zExSql, -1, &pStmt, 0);
1817         if( rc ) fatalError("cannot prepare statement [%s]: %s",
1818                             zExSql, sqlite3_errmsg(db));
1819         sqlite3_bind_text64(pStmt, 1, zExpSql, strlen(zExpSql),
1820                             SQLITE_STATIC, SQLITE_UTF8);
1821         sqlite3_bind_int(pStmt, 2, onlySqlid);
1822         while( sqlite3_step(pStmt)==SQLITE_ROW ){
1823           printf("write sql-%d (%d bytes) into %s\n",
1824              sqlite3_column_int(pStmt,1),
1825              sqlite3_column_int(pStmt,3),
1826              sqlite3_column_text(pStmt,2));
1827         }
1828         sqlite3_finalize(pStmt);
1829       }
1830       sqlite3_close(db);
1831       return 0;
1832     }
1833 
1834     /* Load all SQL script content and all initial database images from the
1835     ** source db
1836     */
1837     blobListLoadFromDb(db, "SELECT sqlid, sqltext FROM xsql", onlySqlid,
1838                            &g.nSql, &g.pFirstSql);
1839     if( g.nSql==0 ) fatalError("need at least one SQL script");
1840     blobListLoadFromDb(db, "SELECT dbid, dbcontent FROM db", onlyDbid,
1841                        &g.nDb, &g.pFirstDb);
1842     if( g.nDb==0 ){
1843       g.pFirstDb = safe_realloc(0, sizeof(Blob));
1844       memset(g.pFirstDb, 0, sizeof(Blob));
1845       g.pFirstDb->id = 1;
1846       g.pFirstDb->seq = 0;
1847       g.nDb = 1;
1848       sqlFuzz = 1;
1849     }
1850 
1851     /* Print the description, if there is one */
1852     if( !quietFlag ){
1853       zDbName = azSrcDb[iSrcDb];
1854       i = (int)strlen(zDbName) - 1;
1855       while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; }
1856       zDbName += i;
1857       sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0);
1858       if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){
1859         printf("%s: %s\n", zDbName, sqlite3_column_text(pStmt,0));
1860       }
1861       sqlite3_finalize(pStmt);
1862     }
1863 
1864     /* Rebuild the database, if requested */
1865     if( rebuildFlag ){
1866       if( !quietFlag ){
1867         printf("%s: rebuilding... ", zDbName);
1868         fflush(stdout);
1869       }
1870       rebuild_database(db, 0);
1871       if( !quietFlag ) printf("done\n");
1872     }
1873 
1874     /* Close the source database.  Verify that no SQLite memory allocations are
1875     ** outstanding.
1876     */
1877     sqlite3_close(db);
1878     if( sqlite3_memory_used()>0 ){
1879       fatalError("SQLite has memory in use before the start of testing");
1880     }
1881 
1882     /* Limit available memory, if requested */
1883     sqlite3_shutdown();
1884 
1885     if( nMemThisDb>0 && nMem==0 ){
1886       if( !nativeMalloc ){
1887         pHeap = realloc(pHeap, nMemThisDb);
1888         if( pHeap==0 ){
1889           fatalError("failed to allocate %d bytes of heap memory", nMem);
1890         }
1891         sqlite3_config(SQLITE_CONFIG_HEAP, pHeap, nMemThisDb, 128);
1892       }else{
1893         sqlite3_hard_heap_limit64((sqlite3_int64)nMemThisDb);
1894       }
1895     }else{
1896       sqlite3_hard_heap_limit64(0);
1897     }
1898 
1899     /* Disable lookaside with the --native-malloc option */
1900     if( nativeMalloc ){
1901       sqlite3_config(SQLITE_CONFIG_LOOKASIDE, 0, 0);
1902     }
1903 
1904     /* Reset the in-memory virtual filesystem */
1905     formatVfs();
1906 
1907     /* Run a test using each SQL script against each database.
1908     */
1909     if( !verboseFlag && !quietFlag && !bSpinner ) printf("%s:", zDbName);
1910     for(pSql=g.pFirstSql; pSql; pSql=pSql->pNext){
1911       tmStart = timeOfDay();
1912       if( isDbSql(pSql->a, pSql->sz) ){
1913         sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d",pSql->id);
1914         if( bSpinner ){
1915           int nTotal =g.nSql;
1916           int idx = pSql->seq;
1917           printf("\r%s: %d/%d   ", zDbName, idx, nTotal);
1918           fflush(stdout);
1919         }else if( verboseFlag ){
1920           printf("%s\n", g.zTestName);
1921           fflush(stdout);
1922         }else if( !quietFlag ){
1923           static int prevAmt = -1;
1924           int idx = pSql->seq;
1925           int amt = idx*10/(g.nSql);
1926           if( amt!=prevAmt ){
1927             printf(" %d%%", amt*10);
1928             fflush(stdout);
1929             prevAmt = amt;
1930           }
1931         }
1932         if( nSkip>0 ){
1933           nSkip--;
1934         }else{
1935           runCombinedDbSqlInput(pSql->a, pSql->sz, iTimeout);
1936         }
1937         nTest++;
1938         if( bTimer ){
1939           sqlite3_int64 tmEnd = timeOfDay();
1940           printf("%lld %s\n", tmEnd - tmStart, g.zTestName);
1941         }
1942         g.zTestName[0] = 0;
1943         disableOom();
1944         continue;
1945       }
1946       for(pDb=g.pFirstDb; pDb; pDb=pDb->pNext){
1947         int openFlags;
1948         const char *zVfs = "inmem";
1949         sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d,dbid=%d",
1950                          pSql->id, pDb->id);
1951         if( bSpinner ){
1952           int nTotal = g.nDb*g.nSql;
1953           int idx = pSql->seq*g.nDb + pDb->id - 1;
1954           printf("\r%s: %d/%d   ", zDbName, idx, nTotal);
1955           fflush(stdout);
1956         }else if( verboseFlag ){
1957           printf("%s\n", g.zTestName);
1958           fflush(stdout);
1959         }else if( !quietFlag ){
1960           static int prevAmt = -1;
1961           int idx = pSql->seq*g.nDb + pDb->id - 1;
1962           int amt = idx*10/(g.nDb*g.nSql);
1963           if( amt!=prevAmt ){
1964             printf(" %d%%", amt*10);
1965             fflush(stdout);
1966             prevAmt = amt;
1967           }
1968         }
1969         if( nSkip>0 ){
1970           nSkip--;
1971           continue;
1972         }
1973         createVFile("main.db", pDb->sz, pDb->a);
1974         sqlite3_randomness(0,0);
1975         if( ossFuzzThisDb ){
1976 #ifndef SQLITE_OSS_FUZZ
1977           fatalError("--oss-fuzz not supported: recompile"
1978                      " with -DSQLITE_OSS_FUZZ");
1979 #else
1980           extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t);
1981           LLVMFuzzerTestOneInput((const uint8_t*)pSql->a, (size_t)pSql->sz);
1982 #endif
1983         }else{
1984           openFlags = SQLITE_OPEN_CREATE | SQLITE_OPEN_READWRITE;
1985           if( nativeFlag && pDb->sz==0 ){
1986             openFlags |= SQLITE_OPEN_MEMORY;
1987             zVfs = 0;
1988           }
1989           rc = sqlite3_open_v2("main.db", &db, openFlags, zVfs);
1990           if( rc ) fatalError("cannot open inmem database");
1991           sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 100000000);
1992           sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 50);
1993           if( cellSzCkFlag ) runSql(db, "PRAGMA cell_size_check=ON", runFlags);
1994           setAlarm((iTimeout+999)/1000);
1995           /* Enable test functions */
1996           sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS, db);
1997 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
1998           if( sqlFuzz || vdbeLimitFlag ){
1999             sqlite3_progress_handler(db, 100000, progressHandler,
2000                                      &vdbeLimitFlag);
2001           }
2002 #endif
2003 #ifdef SQLITE_TESTCTRL_PRNG_SEED
2004           sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db);
2005 #endif
2006           if( bVdbeDebug ){
2007             sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0);
2008           }
2009           do{
2010             runSql(db, (char*)pSql->a, runFlags);
2011           }while( timeoutTest );
2012           setAlarm(0);
2013           sqlite3_exec(db, "PRAGMA temp_store_directory=''", 0, 0, 0);
2014           sqlite3_close(db);
2015         }
2016         if( sqlite3_memory_used()>0 ){
2017            fatalError("memory leak: %lld bytes outstanding",
2018                       sqlite3_memory_used());
2019         }
2020         reformatVfs();
2021         nTest++;
2022         if( bTimer ){
2023           sqlite3_int64 tmEnd = timeOfDay();
2024           printf("%lld %s\n", tmEnd - tmStart, g.zTestName);
2025         }
2026         g.zTestName[0] = 0;
2027 
2028         /* Simulate an error if the TEST_FAILURE environment variable is "5".
2029         ** This is used to verify that automated test script really do spot
2030         ** errors that occur in this test program.
2031         */
2032         if( zFailCode ){
2033           if( zFailCode[0]=='5' && zFailCode[1]==0 ){
2034             fatalError("simulated failure");
2035           }else if( zFailCode[0]!=0 ){
2036             /* If TEST_FAILURE is something other than 5, just exit the test
2037             ** early */
2038             printf("\nExit early due to TEST_FAILURE being set\n");
2039             iSrcDb = nSrcDb-1;
2040             goto sourcedb_cleanup;
2041           }
2042         }
2043       }
2044     }
2045     if( bSpinner ){
2046       printf("\n");
2047     }else if( !quietFlag && !verboseFlag ){
2048       printf(" 100%% - %d tests\n", g.nDb*g.nSql);
2049     }
2050 
2051     /* Clean up at the end of processing a single source database
2052     */
2053   sourcedb_cleanup:
2054     blobListFree(g.pFirstSql);
2055     blobListFree(g.pFirstDb);
2056     reformatVfs();
2057 
2058   } /* End loop over all source databases */
2059 
2060   if( !quietFlag ){
2061     sqlite3_int64 iElapse = timeOfDay() - iBegin;
2062     printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n"
2063            "SQLite %s %s\n",
2064            nTest, (int)(iElapse/1000), (int)(iElapse%1000),
2065            sqlite3_libversion(), sqlite3_sourceid());
2066   }
2067   free(azSrcDb);
2068   free(pHeap);
2069   return 0;
2070 }
2071