1 /* 2 ** 2015-05-25 3 ** 4 ** The author disclaims copyright to this source code. In place of 5 ** a legal notice, here is a blessing: 6 ** 7 ** May you do good and not evil. 8 ** May you find forgiveness for yourself and forgive others. 9 ** May you share freely, never taking more than you give. 10 ** 11 ************************************************************************* 12 ** 13 ** This is a utility program designed to aid running regressions tests on 14 ** the SQLite library using data from an external fuzzer, such as American 15 ** Fuzzy Lop (AFL) (http://lcamtuf.coredump.cx/afl/). 16 ** 17 ** This program reads content from an SQLite database file with the following 18 ** schema: 19 ** 20 ** CREATE TABLE db( 21 ** dbid INTEGER PRIMARY KEY, -- database id 22 ** dbcontent BLOB -- database disk file image 23 ** ); 24 ** CREATE TABLE xsql( 25 ** sqlid INTEGER PRIMARY KEY, -- SQL script id 26 ** sqltext TEXT -- Text of SQL statements to run 27 ** ); 28 ** CREATE TABLE IF NOT EXISTS readme( 29 ** msg TEXT -- Human-readable description of this test collection 30 ** ); 31 ** 32 ** For each database file in the DB table, the SQL text in the XSQL table 33 ** is run against that database. All README.MSG values are printed prior 34 ** to the start of the test (unless the --quiet option is used). If the 35 ** DB table is empty, then all entries in XSQL are run against an empty 36 ** in-memory database. 37 ** 38 ** This program is looking for crashes, assertion faults, and/or memory leaks. 39 ** No attempt is made to verify the output. The assumption is that either all 40 ** of the database files or all of the SQL statements are malformed inputs, 41 ** generated by a fuzzer, that need to be checked to make sure they do not 42 ** present a security risk. 43 ** 44 ** This program also includes some command-line options to help with 45 ** creation and maintenance of the source content database. The command 46 ** 47 ** ./fuzzcheck database.db --load-sql FILE... 48 ** 49 ** Loads all FILE... arguments into the XSQL table. The --load-db option 50 ** works the same but loads the files into the DB table. The -m option can 51 ** be used to initialize the README table. The "database.db" file is created 52 ** if it does not previously exist. Example: 53 ** 54 ** ./fuzzcheck new.db --load-sql *.sql 55 ** ./fuzzcheck new.db --load-db *.db 56 ** ./fuzzcheck new.db -m 'New test cases' 57 ** 58 ** The three commands above will create the "new.db" file and initialize all 59 ** tables. Then do "./fuzzcheck new.db" to run the tests. 60 ** 61 ** DEBUGGING HINTS: 62 ** 63 ** If fuzzcheck does crash, it can be run in the debugger and the content 64 ** of the global variable g.zTextName[] will identify the specific XSQL and 65 ** DB values that were running when the crash occurred. 66 */ 67 #include <stdio.h> 68 #include <stdlib.h> 69 #include <string.h> 70 #include <stdarg.h> 71 #include <ctype.h> 72 #include <assert.h> 73 #include "sqlite3.h" 74 #define ISSPACE(X) isspace((unsigned char)(X)) 75 #define ISDIGIT(X) isdigit((unsigned char)(X)) 76 77 78 #ifdef __unix__ 79 # include <signal.h> 80 # include <unistd.h> 81 #endif 82 83 #ifdef SQLITE_OSS_FUZZ 84 # include <stddef.h> 85 # if !defined(_MSC_VER) 86 # include <stdint.h> 87 # endif 88 #endif 89 90 #if defined(_MSC_VER) 91 typedef unsigned char uint8_t; 92 #endif 93 94 /* 95 ** Files in the virtual file system. 96 */ 97 typedef struct VFile VFile; 98 struct VFile { 99 char *zFilename; /* Filename. NULL for delete-on-close. From malloc() */ 100 int sz; /* Size of the file in bytes */ 101 int nRef; /* Number of references to this file */ 102 unsigned char *a; /* Content of the file. From malloc() */ 103 }; 104 typedef struct VHandle VHandle; 105 struct VHandle { 106 sqlite3_file base; /* Base class. Must be first */ 107 VFile *pVFile; /* The underlying file */ 108 }; 109 110 /* 111 ** The value of a database file template, or of an SQL script 112 */ 113 typedef struct Blob Blob; 114 struct Blob { 115 Blob *pNext; /* Next in a list */ 116 int id; /* Id of this Blob */ 117 int seq; /* Sequence number */ 118 int sz; /* Size of this Blob in bytes */ 119 unsigned char a[1]; /* Blob content. Extra space allocated as needed. */ 120 }; 121 122 /* 123 ** Maximum number of files in the in-memory virtual filesystem. 124 */ 125 #define MX_FILE 10 126 127 /* 128 ** Maximum allowed file size 129 */ 130 #define MX_FILE_SZ 10000000 131 132 /* 133 ** All global variables are gathered into the "g" singleton. 134 */ 135 static struct GlobalVars { 136 const char *zArgv0; /* Name of program */ 137 const char *zDbFile; /* Name of database file */ 138 VFile aFile[MX_FILE]; /* The virtual filesystem */ 139 int nDb; /* Number of template databases */ 140 Blob *pFirstDb; /* Content of first template database */ 141 int nSql; /* Number of SQL scripts */ 142 Blob *pFirstSql; /* First SQL script */ 143 unsigned int uRandom; /* Seed for the SQLite PRNG */ 144 char zTestName[100]; /* Name of current test */ 145 } g; 146 147 /* 148 ** Print an error message and quit. 149 */ 150 static void fatalError(const char *zFormat, ...){ 151 va_list ap; 152 fprintf(stderr, "%s", g.zArgv0); 153 if( g.zDbFile ) fprintf(stderr, " %s", g.zDbFile); 154 if( g.zTestName[0] ) fprintf(stderr, " (%s)", g.zTestName); 155 fprintf(stderr, ": "); 156 va_start(ap, zFormat); 157 vfprintf(stderr, zFormat, ap); 158 va_end(ap); 159 fprintf(stderr, "\n"); 160 exit(1); 161 } 162 163 /* 164 ** signal handler 165 */ 166 #ifdef __unix__ 167 static void signalHandler(int signum){ 168 const char *zSig; 169 if( signum==SIGABRT ){ 170 zSig = "abort"; 171 }else if( signum==SIGALRM ){ 172 zSig = "timeout"; 173 }else if( signum==SIGSEGV ){ 174 zSig = "segfault"; 175 }else{ 176 zSig = "signal"; 177 } 178 fatalError(zSig); 179 } 180 #endif 181 182 /* 183 ** Set the an alarm to go off after N seconds. Disable the alarm 184 ** if N==0 185 */ 186 static void setAlarm(int N){ 187 #ifdef __unix__ 188 alarm(N); 189 #else 190 (void)N; 191 #endif 192 } 193 194 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 195 /* 196 ** This an SQL progress handler. After an SQL statement has run for 197 ** many steps, we want to interrupt it. This guards against infinite 198 ** loops from recursive common table expressions. 199 ** 200 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used. 201 ** In that case, hitting the progress handler is a fatal error. 202 */ 203 static int progressHandler(void *pVdbeLimitFlag){ 204 if( *(int*)pVdbeLimitFlag ) fatalError("too many VDBE cycles"); 205 return 1; 206 } 207 #endif 208 209 /* 210 ** Reallocate memory. Show and error and quit if unable. 211 */ 212 static void *safe_realloc(void *pOld, int szNew){ 213 void *pNew = realloc(pOld, szNew<=0 ? 1 : szNew); 214 if( pNew==0 ) fatalError("unable to realloc for %d bytes", szNew); 215 return pNew; 216 } 217 218 /* 219 ** Initialize the virtual file system. 220 */ 221 static void formatVfs(void){ 222 int i; 223 for(i=0; i<MX_FILE; i++){ 224 g.aFile[i].sz = -1; 225 g.aFile[i].zFilename = 0; 226 g.aFile[i].a = 0; 227 g.aFile[i].nRef = 0; 228 } 229 } 230 231 232 /* 233 ** Erase all information in the virtual file system. 234 */ 235 static void reformatVfs(void){ 236 int i; 237 for(i=0; i<MX_FILE; i++){ 238 if( g.aFile[i].sz<0 ) continue; 239 if( g.aFile[i].zFilename ){ 240 free(g.aFile[i].zFilename); 241 g.aFile[i].zFilename = 0; 242 } 243 if( g.aFile[i].nRef>0 ){ 244 fatalError("file %d still open. nRef=%d", i, g.aFile[i].nRef); 245 } 246 g.aFile[i].sz = -1; 247 free(g.aFile[i].a); 248 g.aFile[i].a = 0; 249 g.aFile[i].nRef = 0; 250 } 251 } 252 253 /* 254 ** Find a VFile by name 255 */ 256 static VFile *findVFile(const char *zName){ 257 int i; 258 if( zName==0 ) return 0; 259 for(i=0; i<MX_FILE; i++){ 260 if( g.aFile[i].zFilename==0 ) continue; 261 if( strcmp(g.aFile[i].zFilename, zName)==0 ) return &g.aFile[i]; 262 } 263 return 0; 264 } 265 266 /* 267 ** Find a VFile by name. Create it if it does not already exist and 268 ** initialize it to the size and content given. 269 ** 270 ** Return NULL only if the filesystem is full. 271 */ 272 static VFile *createVFile(const char *zName, int sz, unsigned char *pData){ 273 VFile *pNew = findVFile(zName); 274 int i; 275 if( pNew ) return pNew; 276 for(i=0; i<MX_FILE && g.aFile[i].sz>=0; i++){} 277 if( i>=MX_FILE ) return 0; 278 pNew = &g.aFile[i]; 279 if( zName ){ 280 int nName = (int)strlen(zName)+1; 281 pNew->zFilename = safe_realloc(0, nName); 282 memcpy(pNew->zFilename, zName, nName); 283 }else{ 284 pNew->zFilename = 0; 285 } 286 pNew->nRef = 0; 287 pNew->sz = sz; 288 pNew->a = safe_realloc(0, sz); 289 if( sz>0 ) memcpy(pNew->a, pData, sz); 290 return pNew; 291 } 292 293 294 /* 295 ** Implementation of the "readfile(X)" SQL function. The entire content 296 ** of the file named X is read and returned as a BLOB. NULL is returned 297 ** if the file does not exist or is unreadable. 298 */ 299 static void readfileFunc( 300 sqlite3_context *context, 301 int argc, 302 sqlite3_value **argv 303 ){ 304 const char *zName; 305 FILE *in; 306 long nIn; 307 void *pBuf; 308 309 zName = (const char*)sqlite3_value_text(argv[0]); 310 if( zName==0 ) return; 311 in = fopen(zName, "rb"); 312 if( in==0 ) return; 313 fseek(in, 0, SEEK_END); 314 nIn = ftell(in); 315 rewind(in); 316 pBuf = sqlite3_malloc64( nIn ); 317 if( pBuf && 1==fread(pBuf, nIn, 1, in) ){ 318 sqlite3_result_blob(context, pBuf, nIn, sqlite3_free); 319 }else{ 320 sqlite3_free(pBuf); 321 } 322 fclose(in); 323 } 324 325 /* 326 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y 327 ** is written into file X. The number of bytes written is returned. Or 328 ** NULL is returned if something goes wrong, such as being unable to open 329 ** file X for writing. 330 */ 331 static void writefileFunc( 332 sqlite3_context *context, 333 int argc, 334 sqlite3_value **argv 335 ){ 336 FILE *out; 337 const char *z; 338 sqlite3_int64 rc; 339 const char *zFile; 340 341 (void)argc; 342 zFile = (const char*)sqlite3_value_text(argv[0]); 343 if( zFile==0 ) return; 344 out = fopen(zFile, "wb"); 345 if( out==0 ) return; 346 z = (const char*)sqlite3_value_blob(argv[1]); 347 if( z==0 ){ 348 rc = 0; 349 }else{ 350 rc = fwrite(z, 1, sqlite3_value_bytes(argv[1]), out); 351 } 352 fclose(out); 353 sqlite3_result_int64(context, rc); 354 } 355 356 357 /* 358 ** Load a list of Blob objects from the database 359 */ 360 static void blobListLoadFromDb( 361 sqlite3 *db, /* Read from this database */ 362 const char *zSql, /* Query used to extract the blobs */ 363 int onlyId, /* Only load where id is this value */ 364 int *pN, /* OUT: Write number of blobs loaded here */ 365 Blob **ppList /* OUT: Write the head of the blob list here */ 366 ){ 367 Blob head; 368 Blob *p; 369 sqlite3_stmt *pStmt; 370 int n = 0; 371 int rc; 372 char *z2; 373 374 if( onlyId>0 ){ 375 z2 = sqlite3_mprintf("%s WHERE rowid=%d", zSql, onlyId); 376 }else{ 377 z2 = sqlite3_mprintf("%s", zSql); 378 } 379 rc = sqlite3_prepare_v2(db, z2, -1, &pStmt, 0); 380 sqlite3_free(z2); 381 if( rc ) fatalError("%s", sqlite3_errmsg(db)); 382 head.pNext = 0; 383 p = &head; 384 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 385 int sz = sqlite3_column_bytes(pStmt, 1); 386 Blob *pNew = safe_realloc(0, sizeof(*pNew)+sz ); 387 pNew->id = sqlite3_column_int(pStmt, 0); 388 pNew->sz = sz; 389 pNew->seq = n++; 390 pNew->pNext = 0; 391 memcpy(pNew->a, sqlite3_column_blob(pStmt,1), sz); 392 pNew->a[sz] = 0; 393 p->pNext = pNew; 394 p = pNew; 395 } 396 sqlite3_finalize(pStmt); 397 *pN = n; 398 *ppList = head.pNext; 399 } 400 401 /* 402 ** Free a list of Blob objects 403 */ 404 static void blobListFree(Blob *p){ 405 Blob *pNext; 406 while( p ){ 407 pNext = p->pNext; 408 free(p); 409 p = pNext; 410 } 411 } 412 413 /* Return the current wall-clock time */ 414 static sqlite3_int64 timeOfDay(void){ 415 static sqlite3_vfs *clockVfs = 0; 416 sqlite3_int64 t; 417 if( clockVfs==0 ){ 418 clockVfs = sqlite3_vfs_find(0); 419 if( clockVfs==0 ) return 0; 420 } 421 if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){ 422 clockVfs->xCurrentTimeInt64(clockVfs, &t); 423 }else{ 424 double r; 425 clockVfs->xCurrentTime(clockVfs, &r); 426 t = (sqlite3_int64)(r*86400000.0); 427 } 428 return t; 429 } 430 431 /*************************************************************************** 432 ** Code to process combined database+SQL scripts generated by the 433 ** dbsqlfuzz fuzzer. 434 */ 435 436 /* An instance of the following object is passed by pointer as the 437 ** client data to various callbacks. 438 */ 439 typedef struct FuzzCtx { 440 sqlite3 *db; /* The database connection */ 441 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */ 442 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */ 443 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */ 444 unsigned nCb; /* Number of progress callbacks */ 445 unsigned mxCb; /* Maximum number of progress callbacks allowed */ 446 unsigned execCnt; /* Number of calls to the sqlite3_exec callback */ 447 int timeoutHit; /* True when reaching a timeout */ 448 } FuzzCtx; 449 450 /* Verbosity level for the dbsqlfuzz test runner */ 451 static int eVerbosity = 0; 452 453 /* True to activate PRAGMA vdbe_debug=on */ 454 static int bVdbeDebug = 0; 455 456 /* Timeout for each fuzzing attempt, in milliseconds */ 457 static int giTimeout = 10000; /* Defaults to 10 seconds */ 458 459 /* Maximum number of progress handler callbacks */ 460 static unsigned int mxProgressCb = 2000; 461 462 /* Maximum string length in SQLite */ 463 static int lengthLimit = 1000000; 464 465 /* Maximum expression depth */ 466 static int depthLimit = 500; 467 468 /* Limit on the amount of heap memory that can be used */ 469 static sqlite3_int64 heapLimit = 1000000000; 470 471 /* Maximum byte-code program length in SQLite */ 472 static int vdbeOpLimit = 25000; 473 474 /* Maximum size of the in-memory database */ 475 static sqlite3_int64 maxDbSize = 104857600; 476 477 /* 478 ** Translate a single byte of Hex into an integer. 479 ** This routine only works if h really is a valid hexadecimal 480 ** character: 0..9a..fA..F 481 */ 482 static unsigned char hexToInt(unsigned int h){ 483 #ifdef SQLITE_EBCDIC 484 h += 9*(1&~(h>>4)); /* EBCDIC */ 485 #else 486 h += 9*(1&(h>>6)); /* ASCII */ 487 #endif 488 return h & 0xf; 489 } 490 491 /* 492 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine 493 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it 494 ** does it makes corresponding changes to the *pK value and *pI value 495 ** and returns true. If the input buffer does not match the patterns, 496 ** no changes are made to either *pK or *pI and this routine returns false. 497 */ 498 static int isOffset( 499 const unsigned char *zIn, /* Text input */ 500 int nIn, /* Bytes of input */ 501 unsigned int *pK, /* half-byte cursor to adjust */ 502 unsigned int *pI /* Input index to adjust */ 503 ){ 504 int i; 505 unsigned int k = 0; 506 unsigned char c; 507 for(i=1; i<nIn && (c = zIn[i])!=']'; i++){ 508 if( !isxdigit(c) ) return 0; 509 k = k*16 + hexToInt(c); 510 } 511 if( i==nIn ) return 0; 512 *pK = 2*k; 513 *pI += i; 514 return 1; 515 } 516 517 /* 518 ** Decode the text starting at zIn into a binary database file. 519 ** The maximum length of zIn is nIn bytes. Compute the binary database 520 ** file contain in space obtained from sqlite3_malloc(). 521 ** 522 ** Return the number of bytes of zIn consumed. Or return -1 if there 523 ** is an error. One potential error is that the recipe specifies a 524 ** database file larger than MX_FILE_SZ bytes. 525 ** 526 ** Abort on an OOM. 527 */ 528 static int decodeDatabase( 529 const unsigned char *zIn, /* Input text to be decoded */ 530 int nIn, /* Bytes of input text */ 531 unsigned char **paDecode, /* OUT: decoded database file */ 532 int *pnDecode /* OUT: Size of decoded database */ 533 ){ 534 unsigned char *a; /* Database under construction */ 535 int mx = 0; /* Current size of the database */ 536 sqlite3_uint64 nAlloc = 4096; /* Space allocated in a[] */ 537 unsigned int i; /* Next byte of zIn[] to read */ 538 unsigned int j; /* Temporary integer */ 539 unsigned int k; /* half-byte cursor index for output */ 540 unsigned int n; /* Number of bytes of input */ 541 unsigned char b = 0; 542 if( nIn<4 ) return -1; 543 n = (unsigned int)nIn; 544 a = sqlite3_malloc64( nAlloc ); 545 if( a==0 ){ 546 fprintf(stderr, "Out of memory!\n"); 547 exit(1); 548 } 549 memset(a, 0, (size_t)nAlloc); 550 for(i=k=0; i<n; i++){ 551 unsigned char c = (unsigned char)zIn[i]; 552 if( isxdigit(c) ){ 553 k++; 554 if( k & 1 ){ 555 b = hexToInt(c)*16; 556 }else{ 557 b += hexToInt(c); 558 j = k/2 - 1; 559 if( j>=nAlloc ){ 560 sqlite3_uint64 newSize; 561 if( nAlloc==MX_FILE_SZ || j>=MX_FILE_SZ ){ 562 if( eVerbosity ){ 563 fprintf(stderr, "Input database too big: max %d bytes\n", 564 MX_FILE_SZ); 565 } 566 sqlite3_free(a); 567 return -1; 568 } 569 newSize = nAlloc*2; 570 if( newSize<=j ){ 571 newSize = (j+4096)&~4095; 572 } 573 if( newSize>MX_FILE_SZ ){ 574 if( j>=MX_FILE_SZ ){ 575 sqlite3_free(a); 576 return -1; 577 } 578 newSize = MX_FILE_SZ; 579 } 580 a = sqlite3_realloc64( a, newSize ); 581 if( a==0 ){ 582 fprintf(stderr, "Out of memory!\n"); 583 exit(1); 584 } 585 assert( newSize > nAlloc ); 586 memset(a+nAlloc, 0, (size_t)(newSize - nAlloc)); 587 nAlloc = newSize; 588 } 589 if( j>=(unsigned)mx ){ 590 mx = (j + 4095)&~4095; 591 if( mx>MX_FILE_SZ ) mx = MX_FILE_SZ; 592 } 593 assert( j<nAlloc ); 594 a[j] = b; 595 } 596 }else if( zIn[i]=='[' && i<n-3 && isOffset(zIn+i, nIn-i, &k, &i) ){ 597 continue; 598 }else if( zIn[i]=='\n' && i<n-4 && memcmp(zIn+i,"\n--\n",4)==0 ){ 599 i += 4; 600 break; 601 } 602 } 603 *pnDecode = mx; 604 *paDecode = a; 605 return i; 606 } 607 608 /* 609 ** Progress handler callback. 610 ** 611 ** The argument is the cutoff-time after which all processing should 612 ** stop. So return non-zero if the cut-off time is exceeded. 613 */ 614 static int progress_handler(void *pClientData) { 615 FuzzCtx *p = (FuzzCtx*)pClientData; 616 sqlite3_int64 iNow = timeOfDay(); 617 int rc = iNow>=p->iCutoffTime; 618 sqlite3_int64 iDiff = iNow - p->iLastCb; 619 if( iDiff > p->mxInterval ) p->mxInterval = iDiff; 620 p->nCb++; 621 if( rc==0 && p->mxCb>0 && p->mxCb<=p->nCb ) rc = 1; 622 if( rc && !p->timeoutHit && eVerbosity>=2 ){ 623 printf("Timeout on progress callback %d\n", p->nCb); 624 fflush(stdout); 625 p->timeoutHit = 1; 626 } 627 return rc; 628 } 629 630 /* 631 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and 632 ** "PRAGMA parser_trace" since they can dramatically increase the 633 ** amount of output without actually testing anything useful. 634 ** 635 ** Also block ATTACH and DETACH 636 */ 637 static int block_troublesome_sql( 638 void *Notused, 639 int eCode, 640 const char *zArg1, 641 const char *zArg2, 642 const char *zArg3, 643 const char *zArg4 644 ){ 645 (void)Notused; 646 (void)zArg2; 647 (void)zArg3; 648 (void)zArg4; 649 if( eCode==SQLITE_PRAGMA ){ 650 if( sqlite3_strnicmp("vdbe_", zArg1, 5)==0 651 || sqlite3_stricmp("parser_trace", zArg1)==0 652 || sqlite3_stricmp("temp_store_directory", zArg1)==0 653 ){ 654 return SQLITE_DENY; 655 } 656 }else if( (eCode==SQLITE_ATTACH || eCode==SQLITE_DETACH) 657 && zArg1 && zArg1[0] ){ 658 return SQLITE_DENY; 659 } 660 return SQLITE_OK; 661 } 662 663 /* 664 ** Run the SQL text 665 */ 666 static int runDbSql(sqlite3 *db, const char *zSql){ 667 int rc; 668 sqlite3_stmt *pStmt; 669 while( isspace(zSql[0]&0x7f) ) zSql++; 670 if( zSql[0]==0 ) return SQLITE_OK; 671 if( eVerbosity>=4 ){ 672 printf("RUNNING-SQL: [%s]\n", zSql); 673 fflush(stdout); 674 } 675 rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0); 676 if( rc==SQLITE_OK ){ 677 while( (rc = sqlite3_step(pStmt))==SQLITE_ROW ){ 678 if( eVerbosity>=5 ){ 679 int j; 680 for(j=0; j<sqlite3_column_count(pStmt); j++){ 681 if( j ) printf(","); 682 switch( sqlite3_column_type(pStmt, j) ){ 683 case SQLITE_NULL: { 684 printf("NULL"); 685 break; 686 } 687 case SQLITE_INTEGER: 688 case SQLITE_FLOAT: { 689 printf("%s", sqlite3_column_text(pStmt, j)); 690 break; 691 } 692 case SQLITE_BLOB: { 693 int n = sqlite3_column_bytes(pStmt, j); 694 int i; 695 const unsigned char *a; 696 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 697 printf("x'"); 698 for(i=0; i<n; i++){ 699 printf("%02x", a[i]); 700 } 701 printf("'"); 702 break; 703 } 704 case SQLITE_TEXT: { 705 int n = sqlite3_column_bytes(pStmt, j); 706 int i; 707 const unsigned char *a; 708 a = (const unsigned char*)sqlite3_column_blob(pStmt, j); 709 printf("'"); 710 for(i=0; i<n; i++){ 711 if( a[i]=='\'' ){ 712 printf("''"); 713 }else{ 714 putchar(a[i]); 715 } 716 } 717 printf("'"); 718 break; 719 } 720 } /* End switch() */ 721 } /* End for() */ 722 printf("\n"); 723 fflush(stdout); 724 } /* End if( eVerbosity>=5 ) */ 725 } /* End while( SQLITE_ROW */ 726 if( rc!=SQLITE_DONE && eVerbosity>=4 ){ 727 printf("SQL-ERROR: (%d) %s\n", rc, sqlite3_errmsg(db)); 728 fflush(stdout); 729 } 730 }else if( eVerbosity>=4 ){ 731 printf("SQL-ERROR (%d): %s\n", rc, sqlite3_errmsg(db)); 732 fflush(stdout); 733 } /* End if( SQLITE_OK ) */ 734 return sqlite3_finalize(pStmt); 735 } 736 737 /* Invoke this routine to run a single test case */ 738 int runCombinedDbSqlInput(const uint8_t *aData, size_t nByte){ 739 int rc; /* SQLite API return value */ 740 int iSql; /* Index in aData[] of start of SQL */ 741 unsigned char *aDb = 0; /* Decoded database content */ 742 int nDb = 0; /* Size of the decoded database */ 743 int i; /* Loop counter */ 744 int j; /* Start of current SQL statement */ 745 char *zSql = 0; /* SQL text to run */ 746 int nSql; /* Bytes of SQL text */ 747 FuzzCtx cx; /* Fuzzing context */ 748 749 if( nByte<10 ) return 0; 750 if( sqlite3_initialize() ) return 0; 751 if( sqlite3_memory_used()!=0 ){ 752 int nAlloc = 0; 753 int nNotUsed = 0; 754 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 755 fprintf(stderr,"Memory leak in mutator: %lld bytes in %d allocations\n", 756 sqlite3_memory_used(), nAlloc); 757 exit(1); 758 } 759 memset(&cx, 0, sizeof(cx)); 760 iSql = decodeDatabase((unsigned char*)aData, (int)nByte, &aDb, &nDb); 761 if( iSql<0 ) return 0; 762 nSql = (int)(nByte - iSql); 763 if( eVerbosity>=3 ){ 764 printf( 765 "****** %d-byte input, %d-byte database, %d-byte script " 766 "******\n", (int)nByte, nDb, nSql); 767 fflush(stdout); 768 } 769 rc = sqlite3_open(0, &cx.db); 770 if( rc ) return 1; 771 if( bVdbeDebug ){ 772 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 773 } 774 775 /* Invoke the progress handler frequently to check to see if we 776 ** are taking too long. The progress handler will return true 777 ** (which will block further processing) if more than giTimeout seconds have 778 ** elapsed since the start of the test. 779 */ 780 cx.iLastCb = timeOfDay(); 781 cx.iCutoffTime = cx.iLastCb + giTimeout; /* Now + giTimeout seconds */ 782 cx.mxCb = mxProgressCb; 783 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 784 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx); 785 #endif 786 787 /* Set a limit on the maximum size of a prepared statement, and the 788 ** maximum length of a string or blob */ 789 if( vdbeOpLimit>0 ){ 790 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, vdbeOpLimit); 791 } 792 if( lengthLimit>0 ){ 793 sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, lengthLimit); 794 } 795 if( depthLimit>0 ){ 796 sqlite3_limit(cx.db, SQLITE_LIMIT_EXPR_DEPTH, depthLimit); 797 } 798 sqlite3_hard_heap_limit64(heapLimit); 799 800 if( nDb>=20 && aDb[18]==2 && aDb[19]==2 ){ 801 aDb[18] = aDb[19] = 1; 802 } 803 rc = sqlite3_deserialize(cx.db, "main", aDb, nDb, nDb, 804 SQLITE_DESERIALIZE_RESIZEABLE | 805 SQLITE_DESERIALIZE_FREEONCLOSE); 806 if( rc ){ 807 fprintf(stderr, "sqlite3_deserialize() failed with %d\n", rc); 808 goto testrun_finished; 809 } 810 if( maxDbSize>0 ){ 811 sqlite3_int64 x = maxDbSize; 812 sqlite3_file_control(cx.db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x); 813 } 814 815 /* For high debugging levels, turn on debug mode */ 816 if( eVerbosity>=5 ){ 817 sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON;", 0, 0, 0); 818 } 819 820 /* Block debug pragmas and ATTACH/DETACH. But wait until after 821 ** deserialize to do this because deserialize depends on ATTACH */ 822 sqlite3_set_authorizer(cx.db, block_troublesome_sql, 0); 823 824 /* Consistent PRNG seed */ 825 sqlite3_randomness(0,0); 826 827 zSql = sqlite3_malloc( nSql + 1 ); 828 if( zSql==0 ){ 829 fprintf(stderr, "Out of memory!\n"); 830 }else{ 831 memcpy(zSql, aData+iSql, nSql); 832 zSql[nSql] = 0; 833 for(i=j=0; zSql[i]; i++){ 834 if( zSql[i]==';' ){ 835 char cSaved = zSql[i+1]; 836 zSql[i+1] = 0; 837 if( sqlite3_complete(zSql+j) ){ 838 rc = runDbSql(cx.db, zSql+j); 839 j = i+1; 840 } 841 zSql[i+1] = cSaved; 842 if( rc==SQLITE_INTERRUPT || progress_handler(&cx) ){ 843 goto testrun_finished; 844 } 845 } 846 } 847 if( j<i ){ 848 runDbSql(cx.db, zSql+j); 849 } 850 } 851 testrun_finished: 852 sqlite3_free(zSql); 853 rc = sqlite3_close(cx.db); 854 if( rc!=SQLITE_OK ){ 855 fprintf(stdout, "sqlite3_close() returns %d\n", rc); 856 } 857 if( eVerbosity>=2 ){ 858 fprintf(stdout, "Peak memory usages: %f MB\n", 859 sqlite3_memory_highwater(1) / 1000000.0); 860 } 861 if( sqlite3_memory_used()!=0 ){ 862 int nAlloc = 0; 863 int nNotUsed = 0; 864 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0); 865 fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n", 866 sqlite3_memory_used(), nAlloc); 867 exit(1); 868 } 869 return 0; 870 } 871 872 /* 873 ** END of the dbsqlfuzz code 874 ***************************************************************************/ 875 876 /* Look at a SQL text and try to determine if it begins with a database 877 ** description, such as would be found in a dbsqlfuzz test case. Return 878 ** true if this does appear to be a dbsqlfuzz test case and false otherwise. 879 */ 880 static int isDbSql(unsigned char *a, int n){ 881 unsigned char buf[12]; 882 int i; 883 if( n>4 && memcmp(a,"\n--\n",4)==0 ) return 1; 884 while( n>0 && isspace(a[0]) ){ a++; n--; } 885 for(i=0; n>0 && i<8; n--, a++){ 886 if( isxdigit(a[0]) ) buf[i++] = a[0]; 887 } 888 if( i==8 && memcmp(buf,"53514c69",8)==0 ) return 1; 889 return 0; 890 } 891 892 /* Implementation of the isdbsql(TEXT) SQL function. 893 */ 894 static void isDbSqlFunc( 895 sqlite3_context *context, 896 int argc, 897 sqlite3_value **argv 898 ){ 899 int n = sqlite3_value_bytes(argv[0]); 900 unsigned char *a = (unsigned char*)sqlite3_value_blob(argv[0]); 901 sqlite3_result_int(context, a!=0 && n>0 && isDbSql(a,n)); 902 } 903 904 /* Methods for the VHandle object 905 */ 906 static int inmemClose(sqlite3_file *pFile){ 907 VHandle *p = (VHandle*)pFile; 908 VFile *pVFile = p->pVFile; 909 pVFile->nRef--; 910 if( pVFile->nRef==0 && pVFile->zFilename==0 ){ 911 pVFile->sz = -1; 912 free(pVFile->a); 913 pVFile->a = 0; 914 } 915 return SQLITE_OK; 916 } 917 static int inmemRead( 918 sqlite3_file *pFile, /* Read from this open file */ 919 void *pData, /* Store content in this buffer */ 920 int iAmt, /* Bytes of content */ 921 sqlite3_int64 iOfst /* Start reading here */ 922 ){ 923 VHandle *pHandle = (VHandle*)pFile; 924 VFile *pVFile = pHandle->pVFile; 925 if( iOfst<0 || iOfst>=pVFile->sz ){ 926 memset(pData, 0, iAmt); 927 return SQLITE_IOERR_SHORT_READ; 928 } 929 if( iOfst+iAmt>pVFile->sz ){ 930 memset(pData, 0, iAmt); 931 iAmt = (int)(pVFile->sz - iOfst); 932 memcpy(pData, pVFile->a + iOfst, iAmt); 933 return SQLITE_IOERR_SHORT_READ; 934 } 935 memcpy(pData, pVFile->a + iOfst, iAmt); 936 return SQLITE_OK; 937 } 938 static int inmemWrite( 939 sqlite3_file *pFile, /* Write to this file */ 940 const void *pData, /* Content to write */ 941 int iAmt, /* bytes to write */ 942 sqlite3_int64 iOfst /* Start writing here */ 943 ){ 944 VHandle *pHandle = (VHandle*)pFile; 945 VFile *pVFile = pHandle->pVFile; 946 if( iOfst+iAmt > pVFile->sz ){ 947 if( iOfst+iAmt >= MX_FILE_SZ ){ 948 return SQLITE_FULL; 949 } 950 pVFile->a = safe_realloc(pVFile->a, (int)(iOfst+iAmt)); 951 if( iOfst > pVFile->sz ){ 952 memset(pVFile->a + pVFile->sz, 0, (int)(iOfst - pVFile->sz)); 953 } 954 pVFile->sz = (int)(iOfst + iAmt); 955 } 956 memcpy(pVFile->a + iOfst, pData, iAmt); 957 return SQLITE_OK; 958 } 959 static int inmemTruncate(sqlite3_file *pFile, sqlite3_int64 iSize){ 960 VHandle *pHandle = (VHandle*)pFile; 961 VFile *pVFile = pHandle->pVFile; 962 if( pVFile->sz>iSize && iSize>=0 ) pVFile->sz = (int)iSize; 963 return SQLITE_OK; 964 } 965 static int inmemSync(sqlite3_file *pFile, int flags){ 966 return SQLITE_OK; 967 } 968 static int inmemFileSize(sqlite3_file *pFile, sqlite3_int64 *pSize){ 969 *pSize = ((VHandle*)pFile)->pVFile->sz; 970 return SQLITE_OK; 971 } 972 static int inmemLock(sqlite3_file *pFile, int type){ 973 return SQLITE_OK; 974 } 975 static int inmemUnlock(sqlite3_file *pFile, int type){ 976 return SQLITE_OK; 977 } 978 static int inmemCheckReservedLock(sqlite3_file *pFile, int *pOut){ 979 *pOut = 0; 980 return SQLITE_OK; 981 } 982 static int inmemFileControl(sqlite3_file *pFile, int op, void *pArg){ 983 return SQLITE_NOTFOUND; 984 } 985 static int inmemSectorSize(sqlite3_file *pFile){ 986 return 512; 987 } 988 static int inmemDeviceCharacteristics(sqlite3_file *pFile){ 989 return 990 SQLITE_IOCAP_SAFE_APPEND | 991 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN | 992 SQLITE_IOCAP_POWERSAFE_OVERWRITE; 993 } 994 995 996 /* Method table for VHandle 997 */ 998 static sqlite3_io_methods VHandleMethods = { 999 /* iVersion */ 1, 1000 /* xClose */ inmemClose, 1001 /* xRead */ inmemRead, 1002 /* xWrite */ inmemWrite, 1003 /* xTruncate */ inmemTruncate, 1004 /* xSync */ inmemSync, 1005 /* xFileSize */ inmemFileSize, 1006 /* xLock */ inmemLock, 1007 /* xUnlock */ inmemUnlock, 1008 /* xCheck... */ inmemCheckReservedLock, 1009 /* xFileCtrl */ inmemFileControl, 1010 /* xSectorSz */ inmemSectorSize, 1011 /* xDevchar */ inmemDeviceCharacteristics, 1012 /* xShmMap */ 0, 1013 /* xShmLock */ 0, 1014 /* xShmBarrier */ 0, 1015 /* xShmUnmap */ 0, 1016 /* xFetch */ 0, 1017 /* xUnfetch */ 0 1018 }; 1019 1020 /* 1021 ** Open a new file in the inmem VFS. All files are anonymous and are 1022 ** delete-on-close. 1023 */ 1024 static int inmemOpen( 1025 sqlite3_vfs *pVfs, 1026 const char *zFilename, 1027 sqlite3_file *pFile, 1028 int openFlags, 1029 int *pOutFlags 1030 ){ 1031 VFile *pVFile = createVFile(zFilename, 0, (unsigned char*)""); 1032 VHandle *pHandle = (VHandle*)pFile; 1033 if( pVFile==0 ){ 1034 return SQLITE_FULL; 1035 } 1036 pHandle->pVFile = pVFile; 1037 pVFile->nRef++; 1038 pFile->pMethods = &VHandleMethods; 1039 if( pOutFlags ) *pOutFlags = openFlags; 1040 return SQLITE_OK; 1041 } 1042 1043 /* 1044 ** Delete a file by name 1045 */ 1046 static int inmemDelete( 1047 sqlite3_vfs *pVfs, 1048 const char *zFilename, 1049 int syncdir 1050 ){ 1051 VFile *pVFile = findVFile(zFilename); 1052 if( pVFile==0 ) return SQLITE_OK; 1053 if( pVFile->nRef==0 ){ 1054 free(pVFile->zFilename); 1055 pVFile->zFilename = 0; 1056 pVFile->sz = -1; 1057 free(pVFile->a); 1058 pVFile->a = 0; 1059 return SQLITE_OK; 1060 } 1061 return SQLITE_IOERR_DELETE; 1062 } 1063 1064 /* Check for the existance of a file 1065 */ 1066 static int inmemAccess( 1067 sqlite3_vfs *pVfs, 1068 const char *zFilename, 1069 int flags, 1070 int *pResOut 1071 ){ 1072 VFile *pVFile = findVFile(zFilename); 1073 *pResOut = pVFile!=0; 1074 return SQLITE_OK; 1075 } 1076 1077 /* Get the canonical pathname for a file 1078 */ 1079 static int inmemFullPathname( 1080 sqlite3_vfs *pVfs, 1081 const char *zFilename, 1082 int nOut, 1083 char *zOut 1084 ){ 1085 sqlite3_snprintf(nOut, zOut, "%s", zFilename); 1086 return SQLITE_OK; 1087 } 1088 1089 /* Always use the same random see, for repeatability. 1090 */ 1091 static int inmemRandomness(sqlite3_vfs *NotUsed, int nBuf, char *zBuf){ 1092 memset(zBuf, 0, nBuf); 1093 memcpy(zBuf, &g.uRandom, nBuf<sizeof(g.uRandom) ? nBuf : sizeof(g.uRandom)); 1094 return nBuf; 1095 } 1096 1097 /* 1098 ** Register the VFS that reads from the g.aFile[] set of files. 1099 */ 1100 static void inmemVfsRegister(int makeDefault){ 1101 static sqlite3_vfs inmemVfs; 1102 sqlite3_vfs *pDefault = sqlite3_vfs_find(0); 1103 inmemVfs.iVersion = 3; 1104 inmemVfs.szOsFile = sizeof(VHandle); 1105 inmemVfs.mxPathname = 200; 1106 inmemVfs.zName = "inmem"; 1107 inmemVfs.xOpen = inmemOpen; 1108 inmemVfs.xDelete = inmemDelete; 1109 inmemVfs.xAccess = inmemAccess; 1110 inmemVfs.xFullPathname = inmemFullPathname; 1111 inmemVfs.xRandomness = inmemRandomness; 1112 inmemVfs.xSleep = pDefault->xSleep; 1113 inmemVfs.xCurrentTimeInt64 = pDefault->xCurrentTimeInt64; 1114 sqlite3_vfs_register(&inmemVfs, makeDefault); 1115 }; 1116 1117 /* 1118 ** Allowed values for the runFlags parameter to runSql() 1119 */ 1120 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */ 1121 #define SQL_OUTPUT 0x0002 /* Show the SQL output */ 1122 1123 /* 1124 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not 1125 ** stop if an error is encountered. 1126 */ 1127 static void runSql(sqlite3 *db, const char *zSql, unsigned runFlags){ 1128 const char *zMore; 1129 sqlite3_stmt *pStmt; 1130 1131 while( zSql && zSql[0] ){ 1132 zMore = 0; 1133 pStmt = 0; 1134 sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zMore); 1135 if( zMore==zSql ) break; 1136 if( runFlags & SQL_TRACE ){ 1137 const char *z = zSql; 1138 int n; 1139 while( z<zMore && ISSPACE(z[0]) ) z++; 1140 n = (int)(zMore - z); 1141 while( n>0 && ISSPACE(z[n-1]) ) n--; 1142 if( n==0 ) break; 1143 if( pStmt==0 ){ 1144 printf("TRACE: %.*s (error: %s)\n", n, z, sqlite3_errmsg(db)); 1145 }else{ 1146 printf("TRACE: %.*s\n", n, z); 1147 } 1148 } 1149 zSql = zMore; 1150 if( pStmt ){ 1151 if( (runFlags & SQL_OUTPUT)==0 ){ 1152 while( SQLITE_ROW==sqlite3_step(pStmt) ){} 1153 }else{ 1154 int nCol = -1; 1155 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1156 int i; 1157 if( nCol<0 ){ 1158 nCol = sqlite3_column_count(pStmt); 1159 }else if( nCol>0 ){ 1160 printf("--------------------------------------------\n"); 1161 } 1162 for(i=0; i<nCol; i++){ 1163 int eType = sqlite3_column_type(pStmt,i); 1164 printf("%s = ", sqlite3_column_name(pStmt,i)); 1165 switch( eType ){ 1166 case SQLITE_NULL: { 1167 printf("NULL\n"); 1168 break; 1169 } 1170 case SQLITE_INTEGER: { 1171 printf("INT %s\n", sqlite3_column_text(pStmt,i)); 1172 break; 1173 } 1174 case SQLITE_FLOAT: { 1175 printf("FLOAT %s\n", sqlite3_column_text(pStmt,i)); 1176 break; 1177 } 1178 case SQLITE_TEXT: { 1179 printf("TEXT [%s]\n", sqlite3_column_text(pStmt,i)); 1180 break; 1181 } 1182 case SQLITE_BLOB: { 1183 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt,i)); 1184 break; 1185 } 1186 } 1187 } 1188 } 1189 } 1190 sqlite3_finalize(pStmt); 1191 } 1192 } 1193 } 1194 1195 /* 1196 ** Rebuild the database file. 1197 ** 1198 ** (1) Remove duplicate entries 1199 ** (2) Put all entries in order 1200 ** (3) Vacuum 1201 */ 1202 static void rebuild_database(sqlite3 *db, int dbSqlOnly){ 1203 int rc; 1204 char *zSql; 1205 zSql = sqlite3_mprintf( 1206 "BEGIN;\n" 1207 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n" 1208 "DELETE FROM db;\n" 1209 "INSERT INTO db(dbid, dbcontent) " 1210 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n" 1211 "DROP TABLE dbx;\n" 1212 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n" 1213 "DELETE FROM xsql;\n" 1214 "INSERT INTO xsql(sqlid,sqltext) " 1215 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n" 1216 "DROP TABLE sx;\n" 1217 "COMMIT;\n" 1218 "PRAGMA page_size=1024;\n" 1219 "VACUUM;\n", 1220 dbSqlOnly ? " WHERE isdbsql(sqltext)" : "" 1221 ); 1222 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1223 sqlite3_free(zSql); 1224 if( rc ) fatalError("cannot rebuild: %s", sqlite3_errmsg(db)); 1225 } 1226 1227 /* 1228 ** Return the value of a hexadecimal digit. Return -1 if the input 1229 ** is not a hex digit. 1230 */ 1231 static int hexDigitValue(char c){ 1232 if( c>='0' && c<='9' ) return c - '0'; 1233 if( c>='a' && c<='f' ) return c - 'a' + 10; 1234 if( c>='A' && c<='F' ) return c - 'A' + 10; 1235 return -1; 1236 } 1237 1238 /* 1239 ** Interpret zArg as an integer value, possibly with suffixes. 1240 */ 1241 static int integerValue(const char *zArg){ 1242 sqlite3_int64 v = 0; 1243 static const struct { char *zSuffix; int iMult; } aMult[] = { 1244 { "KiB", 1024 }, 1245 { "MiB", 1024*1024 }, 1246 { "GiB", 1024*1024*1024 }, 1247 { "KB", 1000 }, 1248 { "MB", 1000000 }, 1249 { "GB", 1000000000 }, 1250 { "K", 1000 }, 1251 { "M", 1000000 }, 1252 { "G", 1000000000 }, 1253 }; 1254 int i; 1255 int isNeg = 0; 1256 if( zArg[0]=='-' ){ 1257 isNeg = 1; 1258 zArg++; 1259 }else if( zArg[0]=='+' ){ 1260 zArg++; 1261 } 1262 if( zArg[0]=='0' && zArg[1]=='x' ){ 1263 int x; 1264 zArg += 2; 1265 while( (x = hexDigitValue(zArg[0]))>=0 ){ 1266 v = (v<<4) + x; 1267 zArg++; 1268 } 1269 }else{ 1270 while( ISDIGIT(zArg[0]) ){ 1271 v = v*10 + zArg[0] - '0'; 1272 zArg++; 1273 } 1274 } 1275 for(i=0; i<sizeof(aMult)/sizeof(aMult[0]); i++){ 1276 if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){ 1277 v *= aMult[i].iMult; 1278 break; 1279 } 1280 } 1281 if( v>0x7fffffff ) fatalError("parameter too large - max 2147483648"); 1282 return (int)(isNeg? -v : v); 1283 } 1284 1285 /* 1286 ** Return the number of "v" characters in a string. Return 0 if there 1287 ** are any characters in the string other than "v". 1288 */ 1289 static int numberOfVChar(const char *z){ 1290 int N = 0; 1291 while( z[0] && z[0]=='v' ){ 1292 z++; 1293 N++; 1294 } 1295 return z[0]==0 ? N : 0; 1296 } 1297 1298 /* 1299 ** Print sketchy documentation for this utility program 1300 */ 1301 static void showHelp(void){ 1302 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g.zArgv0); 1303 printf( 1304 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n" 1305 "each database, checking for crashes and memory leaks.\n" 1306 "Options:\n" 1307 " --cell-size-check Set the PRAGMA cell_size_check=ON\n" 1308 " --dbid N Use only the database where dbid=N\n" 1309 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n" 1310 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n" 1311 " --help Show this help text\n" 1312 " --info Show information about SOURCE-DB w/o running tests\n" 1313 " --limit-depth N Limit expression depth to N\n" 1314 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n" 1315 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n" 1316 " --load-sql ARGS... Load SQL scripts fron files into SOURCE-DB\n" 1317 " --load-db ARGS... Load template databases from files into SOURCE_DB\n" 1318 " --load-dbsql ARGS.. Load dbsqlfuzz outputs into the xsql table\n" 1319 " -m TEXT Add a description to the database\n" 1320 " --native-vfs Use the native VFS for initially empty database files\n" 1321 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n" 1322 " --oss-fuzz Enable OSS-FUZZ testing\n" 1323 " --prng-seed N Seed value for the PRGN inside of SQLite\n" 1324 " -q|--quiet Reduced output\n" 1325 " --rebuild Rebuild and vacuum the database file\n" 1326 " --result-trace Show the results of each SQL command\n" 1327 " --sqlid N Use only SQL where sqlid=N\n" 1328 " --timeout N Abort if any single test needs more than N seconds\n" 1329 " -v|--verbose Increased output. Repeat for more output.\n" 1330 " --vdbe-debug Activate VDBE debugging.\n" 1331 ); 1332 } 1333 1334 int main(int argc, char **argv){ 1335 sqlite3_int64 iBegin; /* Start time of this program */ 1336 int quietFlag = 0; /* True if --quiet or -q */ 1337 int verboseFlag = 0; /* True if --verbose or -v */ 1338 char *zInsSql = 0; /* SQL statement for --load-db or --load-sql */ 1339 int iFirstInsArg = 0; /* First argv[] for --load-db or --load-sql */ 1340 sqlite3 *db = 0; /* The open database connection */ 1341 sqlite3_stmt *pStmt; /* A prepared statement */ 1342 int rc; /* Result code from SQLite interface calls */ 1343 Blob *pSql; /* For looping over SQL scripts */ 1344 Blob *pDb; /* For looping over template databases */ 1345 int i; /* Loop index for the argv[] loop */ 1346 int dbSqlOnly = 0; /* Only use scripts that are dbsqlfuzz */ 1347 int onlySqlid = -1; /* --sqlid */ 1348 int onlyDbid = -1; /* --dbid */ 1349 int nativeFlag = 0; /* --native-vfs */ 1350 int rebuildFlag = 0; /* --rebuild */ 1351 int vdbeLimitFlag = 0; /* --limit-vdbe */ 1352 int infoFlag = 0; /* --info */ 1353 int timeoutTest = 0; /* undocumented --timeout-test flag */ 1354 int runFlags = 0; /* Flags sent to runSql() */ 1355 char *zMsg = 0; /* Add this message */ 1356 int nSrcDb = 0; /* Number of source databases */ 1357 char **azSrcDb = 0; /* Array of source database names */ 1358 int iSrcDb; /* Loop over all source databases */ 1359 int nTest = 0; /* Total number of tests performed */ 1360 char *zDbName = ""; /* Appreviated name of a source database */ 1361 const char *zFailCode = 0; /* Value of the TEST_FAILURE env variable */ 1362 int cellSzCkFlag = 0; /* --cell-size-check */ 1363 int sqlFuzz = 0; /* True for SQL fuzz. False for DB fuzz */ 1364 int iTimeout = 120; /* Default 120-second timeout */ 1365 int nMem = 0; /* Memory limit override */ 1366 int nMemThisDb = 0; /* Memory limit set by the CONFIG table */ 1367 char *zExpDb = 0; /* Write Databases to files in this directory */ 1368 char *zExpSql = 0; /* Write SQL to files in this directory */ 1369 void *pHeap = 0; /* Heap for use by SQLite */ 1370 int ossFuzz = 0; /* enable OSS-FUZZ testing */ 1371 int ossFuzzThisDb = 0; /* ossFuzz value for this particular database */ 1372 int nativeMalloc = 0; /* Turn off MEMSYS3/5 and lookaside if true */ 1373 sqlite3_vfs *pDfltVfs; /* The default VFS */ 1374 int openFlags4Data; /* Flags for sqlite3_open_v2() */ 1375 int nV; /* How much to increase verbosity with -vvvv */ 1376 1377 sqlite3_initialize(); 1378 iBegin = timeOfDay(); 1379 #ifdef __unix__ 1380 signal(SIGALRM, signalHandler); 1381 signal(SIGSEGV, signalHandler); 1382 signal(SIGABRT, signalHandler); 1383 #endif 1384 g.zArgv0 = argv[0]; 1385 openFlags4Data = SQLITE_OPEN_READONLY; 1386 zFailCode = getenv("TEST_FAILURE"); 1387 pDfltVfs = sqlite3_vfs_find(0); 1388 inmemVfsRegister(1); 1389 for(i=1; i<argc; i++){ 1390 const char *z = argv[i]; 1391 if( z[0]=='-' ){ 1392 z++; 1393 if( z[0]=='-' ) z++; 1394 if( strcmp(z,"cell-size-check")==0 ){ 1395 cellSzCkFlag = 1; 1396 }else 1397 if( strcmp(z,"dbid")==0 ){ 1398 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1399 onlyDbid = integerValue(argv[++i]); 1400 }else 1401 if( strcmp(z,"export-db")==0 ){ 1402 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1403 zExpDb = argv[++i]; 1404 }else 1405 if( strcmp(z,"export-sql")==0 || strcmp(z,"export-dbsql")==0 ){ 1406 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1407 zExpSql = argv[++i]; 1408 }else 1409 if( strcmp(z,"help")==0 ){ 1410 showHelp(); 1411 return 0; 1412 }else 1413 if( strcmp(z,"info")==0 ){ 1414 infoFlag = 1; 1415 }else 1416 if( strcmp(z,"limit-depth")==0 ){ 1417 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1418 depthLimit = integerValue(argv[++i]); 1419 }else 1420 if( strcmp(z,"limit-mem")==0 ){ 1421 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1422 nMem = integerValue(argv[++i]); 1423 }else 1424 if( strcmp(z,"limit-vdbe")==0 ){ 1425 vdbeLimitFlag = 1; 1426 }else 1427 if( strcmp(z,"load-sql")==0 ){ 1428 zInsSql = "INSERT INTO xsql(sqltext)VALUES(CAST(readfile(?1) AS text))"; 1429 iFirstInsArg = i+1; 1430 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1431 break; 1432 }else 1433 if( strcmp(z,"load-db")==0 ){ 1434 zInsSql = "INSERT INTO db(dbcontent) VALUES(readfile(?1))"; 1435 iFirstInsArg = i+1; 1436 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1437 break; 1438 }else 1439 if( strcmp(z,"load-dbsql")==0 ){ 1440 zInsSql = "INSERT INTO xsql(sqltext)VALUES(CAST(readfile(?1) AS text))"; 1441 iFirstInsArg = i+1; 1442 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1443 dbSqlOnly = 1; 1444 break; 1445 }else 1446 if( strcmp(z,"m")==0 ){ 1447 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1448 zMsg = argv[++i]; 1449 openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE; 1450 }else 1451 if( strcmp(z,"native-malloc")==0 ){ 1452 nativeMalloc = 1; 1453 }else 1454 if( strcmp(z,"native-vfs")==0 ){ 1455 nativeFlag = 1; 1456 }else 1457 if( strcmp(z,"oss-fuzz")==0 ){ 1458 ossFuzz = 1; 1459 }else 1460 if( strcmp(z,"prng-seed")==0 ){ 1461 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1462 g.uRandom = atoi(argv[++i]); 1463 }else 1464 if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){ 1465 quietFlag = 1; 1466 verboseFlag = 0; 1467 eVerbosity = 0; 1468 }else 1469 if( strcmp(z,"rebuild")==0 ){ 1470 rebuildFlag = 1; 1471 openFlags4Data = SQLITE_OPEN_READWRITE; 1472 }else 1473 if( strcmp(z,"result-trace")==0 ){ 1474 runFlags |= SQL_OUTPUT; 1475 }else 1476 if( strcmp(z,"sqlid")==0 ){ 1477 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1478 onlySqlid = integerValue(argv[++i]); 1479 }else 1480 if( strcmp(z,"timeout")==0 ){ 1481 if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]); 1482 iTimeout = integerValue(argv[++i]); 1483 }else 1484 if( strcmp(z,"timeout-test")==0 ){ 1485 timeoutTest = 1; 1486 #ifndef __unix__ 1487 fatalError("timeout is not available on non-unix systems"); 1488 #endif 1489 }else 1490 if( strcmp(z,"vdbe-debug")==0 ){ 1491 bVdbeDebug = 1; 1492 }else 1493 if( strcmp(z,"verbose")==0 ){ 1494 quietFlag = 0; 1495 verboseFlag++; 1496 eVerbosity++; 1497 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1498 }else 1499 if( (nV = numberOfVChar(z))>=1 ){ 1500 quietFlag = 0; 1501 verboseFlag += nV; 1502 eVerbosity += nV; 1503 if( verboseFlag>1 ) runFlags |= SQL_TRACE; 1504 }else 1505 if( strcmp(z,"version")==0 ){ 1506 int ii; 1507 const char *zz; 1508 printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid()); 1509 for(ii=0; (zz = sqlite3_compileoption_get(ii))!=0; ii++){ 1510 printf("%s\n", zz); 1511 } 1512 return 0; 1513 }else 1514 { 1515 fatalError("unknown option: %s", argv[i]); 1516 } 1517 }else{ 1518 nSrcDb++; 1519 azSrcDb = safe_realloc(azSrcDb, nSrcDb*sizeof(azSrcDb[0])); 1520 azSrcDb[nSrcDb-1] = argv[i]; 1521 } 1522 } 1523 if( nSrcDb==0 ) fatalError("no source database specified"); 1524 if( nSrcDb>1 ){ 1525 if( zMsg ){ 1526 fatalError("cannot change the description of more than one database"); 1527 } 1528 if( zInsSql ){ 1529 fatalError("cannot import into more than one database"); 1530 } 1531 } 1532 1533 /* Process each source database separately */ 1534 for(iSrcDb=0; iSrcDb<nSrcDb; iSrcDb++){ 1535 g.zDbFile = azSrcDb[iSrcDb]; 1536 rc = sqlite3_open_v2(azSrcDb[iSrcDb], &db, 1537 openFlags4Data, pDfltVfs->zName); 1538 if( rc ){ 1539 fatalError("cannot open source database %s - %s", 1540 azSrcDb[iSrcDb], sqlite3_errmsg(db)); 1541 } 1542 1543 /* Print the description, if there is one */ 1544 if( infoFlag ){ 1545 int n; 1546 zDbName = azSrcDb[iSrcDb]; 1547 i = (int)strlen(zDbName) - 1; 1548 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1549 zDbName += i; 1550 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1551 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1552 printf("%s: %s", zDbName, sqlite3_column_text(pStmt,0)); 1553 }else{ 1554 printf("%s: (empty \"readme\")", zDbName); 1555 } 1556 sqlite3_finalize(pStmt); 1557 sqlite3_prepare_v2(db, "SELECT count(*) FROM db", -1, &pStmt, 0); 1558 if( pStmt 1559 && sqlite3_step(pStmt)==SQLITE_ROW 1560 && (n = sqlite3_column_int(pStmt,0))>0 1561 ){ 1562 printf(" - %d DBs", n); 1563 } 1564 sqlite3_finalize(pStmt); 1565 sqlite3_prepare_v2(db, "SELECT count(*) FROM xsql", -1, &pStmt, 0); 1566 if( pStmt 1567 && sqlite3_step(pStmt)==SQLITE_ROW 1568 && (n = sqlite3_column_int(pStmt,0))>0 1569 ){ 1570 printf(" - %d scripts", n); 1571 } 1572 sqlite3_finalize(pStmt); 1573 printf("\n"); 1574 sqlite3_close(db); 1575 continue; 1576 } 1577 1578 rc = sqlite3_exec(db, 1579 "CREATE TABLE IF NOT EXISTS db(\n" 1580 " dbid INTEGER PRIMARY KEY, -- database id\n" 1581 " dbcontent BLOB -- database disk file image\n" 1582 ");\n" 1583 "CREATE TABLE IF NOT EXISTS xsql(\n" 1584 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n" 1585 " sqltext TEXT -- Text of SQL statements to run\n" 1586 ");" 1587 "CREATE TABLE IF NOT EXISTS readme(\n" 1588 " msg TEXT -- Human-readable description of this file\n" 1589 ");", 0, 0, 0); 1590 if( rc ) fatalError("cannot create schema: %s", sqlite3_errmsg(db)); 1591 if( zMsg ){ 1592 char *zSql; 1593 zSql = sqlite3_mprintf( 1594 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg); 1595 rc = sqlite3_exec(db, zSql, 0, 0, 0); 1596 sqlite3_free(zSql); 1597 if( rc ) fatalError("cannot change description: %s", sqlite3_errmsg(db)); 1598 } 1599 ossFuzzThisDb = ossFuzz; 1600 1601 /* If the CONFIG(name,value) table exists, read db-specific settings 1602 ** from that table */ 1603 if( sqlite3_table_column_metadata(db,0,"config",0,0,0,0,0,0)==SQLITE_OK ){ 1604 rc = sqlite3_prepare_v2(db, "SELECT name, value FROM config", 1605 -1, &pStmt, 0); 1606 if( rc ) fatalError("cannot prepare query of CONFIG table: %s", 1607 sqlite3_errmsg(db)); 1608 while( SQLITE_ROW==sqlite3_step(pStmt) ){ 1609 const char *zName = (const char *)sqlite3_column_text(pStmt,0); 1610 if( zName==0 ) continue; 1611 if( strcmp(zName, "oss-fuzz")==0 ){ 1612 ossFuzzThisDb = sqlite3_column_int(pStmt,1); 1613 if( verboseFlag ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb); 1614 } 1615 if( strcmp(zName, "limit-mem")==0 ){ 1616 nMemThisDb = sqlite3_column_int(pStmt,1); 1617 if( verboseFlag ) printf("Config: limit-mem=%d\n", nMemThisDb); 1618 } 1619 } 1620 sqlite3_finalize(pStmt); 1621 } 1622 1623 if( zInsSql ){ 1624 sqlite3_create_function(db, "readfile", 1, SQLITE_UTF8, 0, 1625 readfileFunc, 0, 0); 1626 sqlite3_create_function(db, "isdbsql", 1, SQLITE_UTF8, 0, 1627 isDbSqlFunc, 0, 0); 1628 rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0); 1629 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1630 zInsSql, sqlite3_errmsg(db)); 1631 rc = sqlite3_exec(db, "BEGIN", 0, 0, 0); 1632 if( rc ) fatalError("cannot start a transaction"); 1633 for(i=iFirstInsArg; i<argc; i++){ 1634 sqlite3_bind_text(pStmt, 1, argv[i], -1, SQLITE_STATIC); 1635 sqlite3_step(pStmt); 1636 rc = sqlite3_reset(pStmt); 1637 if( rc ) fatalError("insert failed for %s", argv[i]); 1638 } 1639 sqlite3_finalize(pStmt); 1640 rc = sqlite3_exec(db, "COMMIT", 0, 0, 0); 1641 if( rc ) fatalError("cannot commit the transaction: %s", 1642 sqlite3_errmsg(db)); 1643 rebuild_database(db, dbSqlOnly); 1644 sqlite3_close(db); 1645 return 0; 1646 } 1647 rc = sqlite3_exec(db, "PRAGMA query_only=1;", 0, 0, 0); 1648 if( rc ) fatalError("cannot set database to query-only"); 1649 if( zExpDb!=0 || zExpSql!=0 ){ 1650 sqlite3_create_function(db, "writefile", 2, SQLITE_UTF8, 0, 1651 writefileFunc, 0, 0); 1652 if( zExpDb!=0 ){ 1653 const char *zExDb = 1654 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent)," 1655 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)" 1656 " FROM db WHERE ?2<0 OR dbid=?2;"; 1657 rc = sqlite3_prepare_v2(db, zExDb, -1, &pStmt, 0); 1658 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1659 zExDb, sqlite3_errmsg(db)); 1660 sqlite3_bind_text64(pStmt, 1, zExpDb, strlen(zExpDb), 1661 SQLITE_STATIC, SQLITE_UTF8); 1662 sqlite3_bind_int(pStmt, 2, onlyDbid); 1663 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1664 printf("write db-%d (%d bytes) into %s\n", 1665 sqlite3_column_int(pStmt,1), 1666 sqlite3_column_int(pStmt,3), 1667 sqlite3_column_text(pStmt,2)); 1668 } 1669 sqlite3_finalize(pStmt); 1670 } 1671 if( zExpSql!=0 ){ 1672 const char *zExSql = 1673 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext)," 1674 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)" 1675 " FROM xsql WHERE ?2<0 OR sqlid=?2;"; 1676 rc = sqlite3_prepare_v2(db, zExSql, -1, &pStmt, 0); 1677 if( rc ) fatalError("cannot prepare statement [%s]: %s", 1678 zExSql, sqlite3_errmsg(db)); 1679 sqlite3_bind_text64(pStmt, 1, zExpSql, strlen(zExpSql), 1680 SQLITE_STATIC, SQLITE_UTF8); 1681 sqlite3_bind_int(pStmt, 2, onlySqlid); 1682 while( sqlite3_step(pStmt)==SQLITE_ROW ){ 1683 printf("write sql-%d (%d bytes) into %s\n", 1684 sqlite3_column_int(pStmt,1), 1685 sqlite3_column_int(pStmt,3), 1686 sqlite3_column_text(pStmt,2)); 1687 } 1688 sqlite3_finalize(pStmt); 1689 } 1690 sqlite3_close(db); 1691 return 0; 1692 } 1693 1694 /* Load all SQL script content and all initial database images from the 1695 ** source db 1696 */ 1697 blobListLoadFromDb(db, "SELECT sqlid, sqltext FROM xsql", onlySqlid, 1698 &g.nSql, &g.pFirstSql); 1699 if( g.nSql==0 ) fatalError("need at least one SQL script"); 1700 blobListLoadFromDb(db, "SELECT dbid, dbcontent FROM db", onlyDbid, 1701 &g.nDb, &g.pFirstDb); 1702 if( g.nDb==0 ){ 1703 g.pFirstDb = safe_realloc(0, sizeof(Blob)); 1704 memset(g.pFirstDb, 0, sizeof(Blob)); 1705 g.pFirstDb->id = 1; 1706 g.pFirstDb->seq = 0; 1707 g.nDb = 1; 1708 sqlFuzz = 1; 1709 } 1710 1711 /* Print the description, if there is one */ 1712 if( !quietFlag ){ 1713 zDbName = azSrcDb[iSrcDb]; 1714 i = (int)strlen(zDbName) - 1; 1715 while( i>0 && zDbName[i-1]!='/' && zDbName[i-1]!='\\' ){ i--; } 1716 zDbName += i; 1717 sqlite3_prepare_v2(db, "SELECT msg FROM readme", -1, &pStmt, 0); 1718 if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){ 1719 printf("%s: %s\n", zDbName, sqlite3_column_text(pStmt,0)); 1720 } 1721 sqlite3_finalize(pStmt); 1722 } 1723 1724 /* Rebuild the database, if requested */ 1725 if( rebuildFlag ){ 1726 if( !quietFlag ){ 1727 printf("%s: rebuilding... ", zDbName); 1728 fflush(stdout); 1729 } 1730 rebuild_database(db, 0); 1731 if( !quietFlag ) printf("done\n"); 1732 } 1733 1734 /* Close the source database. Verify that no SQLite memory allocations are 1735 ** outstanding. 1736 */ 1737 sqlite3_close(db); 1738 if( sqlite3_memory_used()>0 ){ 1739 fatalError("SQLite has memory in use before the start of testing"); 1740 } 1741 1742 /* Limit available memory, if requested */ 1743 sqlite3_shutdown(); 1744 if( nMemThisDb>0 && nMem==0 ){ 1745 if( !nativeMalloc ){ 1746 pHeap = realloc(pHeap, nMemThisDb); 1747 if( pHeap==0 ){ 1748 fatalError("failed to allocate %d bytes of heap memory", nMem); 1749 } 1750 sqlite3_config(SQLITE_CONFIG_HEAP, pHeap, nMemThisDb, 128); 1751 }else{ 1752 sqlite3_hard_heap_limit64((sqlite3_int64)nMemThisDb); 1753 } 1754 }else{ 1755 sqlite3_hard_heap_limit64(0); 1756 } 1757 1758 /* Disable lookaside with the --native-malloc option */ 1759 if( nativeMalloc ){ 1760 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, 0, 0); 1761 } 1762 1763 /* Reset the in-memory virtual filesystem */ 1764 formatVfs(); 1765 1766 /* Run a test using each SQL script against each database. 1767 */ 1768 if( !verboseFlag && !quietFlag ) printf("%s:", zDbName); 1769 for(pSql=g.pFirstSql; pSql; pSql=pSql->pNext){ 1770 if( isDbSql(pSql->a, pSql->sz) ){ 1771 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d",pSql->id); 1772 if( verboseFlag ){ 1773 printf("%s\n", g.zTestName); 1774 fflush(stdout); 1775 }else if( !quietFlag ){ 1776 static int prevAmt = -1; 1777 int idx = pSql->seq; 1778 int amt = idx*10/(g.nSql); 1779 if( amt!=prevAmt ){ 1780 printf(" %d%%", amt*10); 1781 fflush(stdout); 1782 prevAmt = amt; 1783 } 1784 } 1785 runCombinedDbSqlInput(pSql->a, pSql->sz); 1786 nTest++; 1787 g.zTestName[0] = 0; 1788 continue; 1789 } 1790 for(pDb=g.pFirstDb; pDb; pDb=pDb->pNext){ 1791 int openFlags; 1792 const char *zVfs = "inmem"; 1793 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d,dbid=%d", 1794 pSql->id, pDb->id); 1795 if( verboseFlag ){ 1796 printf("%s\n", g.zTestName); 1797 fflush(stdout); 1798 }else if( !quietFlag ){ 1799 static int prevAmt = -1; 1800 int idx = pSql->seq*g.nDb + pDb->id - 1; 1801 int amt = idx*10/(g.nDb*g.nSql); 1802 if( amt!=prevAmt ){ 1803 printf(" %d%%", amt*10); 1804 fflush(stdout); 1805 prevAmt = amt; 1806 } 1807 } 1808 createVFile("main.db", pDb->sz, pDb->a); 1809 sqlite3_randomness(0,0); 1810 if( ossFuzzThisDb ){ 1811 #ifndef SQLITE_OSS_FUZZ 1812 fatalError("--oss-fuzz not supported: recompile" 1813 " with -DSQLITE_OSS_FUZZ"); 1814 #else 1815 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t); 1816 LLVMFuzzerTestOneInput((const uint8_t*)pSql->a, (size_t)pSql->sz); 1817 #endif 1818 }else{ 1819 openFlags = SQLITE_OPEN_CREATE | SQLITE_OPEN_READWRITE; 1820 if( nativeFlag && pDb->sz==0 ){ 1821 openFlags |= SQLITE_OPEN_MEMORY; 1822 zVfs = 0; 1823 } 1824 rc = sqlite3_open_v2("main.db", &db, openFlags, zVfs); 1825 if( rc ) fatalError("cannot open inmem database"); 1826 sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 100000000); 1827 sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 50); 1828 if( cellSzCkFlag ) runSql(db, "PRAGMA cell_size_check=ON", runFlags); 1829 setAlarm(iTimeout); 1830 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 1831 if( sqlFuzz || vdbeLimitFlag ){ 1832 sqlite3_progress_handler(db, 100000, progressHandler, 1833 &vdbeLimitFlag); 1834 } 1835 #endif 1836 #ifdef SQLITE_TESTCTRL_PRNG_SEED 1837 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED, 1, db); 1838 #endif 1839 if( bVdbeDebug ){ 1840 sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0); 1841 } 1842 do{ 1843 runSql(db, (char*)pSql->a, runFlags); 1844 }while( timeoutTest ); 1845 setAlarm(0); 1846 sqlite3_exec(db, "PRAGMA temp_store_directory=''", 0, 0, 0); 1847 sqlite3_close(db); 1848 } 1849 if( sqlite3_memory_used()>0 ){ 1850 fatalError("memory leak: %lld bytes outstanding", 1851 sqlite3_memory_used()); 1852 } 1853 reformatVfs(); 1854 nTest++; 1855 g.zTestName[0] = 0; 1856 1857 /* Simulate an error if the TEST_FAILURE environment variable is "5". 1858 ** This is used to verify that automated test script really do spot 1859 ** errors that occur in this test program. 1860 */ 1861 if( zFailCode ){ 1862 if( zFailCode[0]=='5' && zFailCode[1]==0 ){ 1863 fatalError("simulated failure"); 1864 }else if( zFailCode[0]!=0 ){ 1865 /* If TEST_FAILURE is something other than 5, just exit the test 1866 ** early */ 1867 printf("\nExit early due to TEST_FAILURE being set\n"); 1868 iSrcDb = nSrcDb-1; 1869 goto sourcedb_cleanup; 1870 } 1871 } 1872 } 1873 } 1874 if( !quietFlag && !verboseFlag ){ 1875 printf(" 100%% - %d tests\n", g.nDb*g.nSql); 1876 } 1877 1878 /* Clean up at the end of processing a single source database 1879 */ 1880 sourcedb_cleanup: 1881 blobListFree(g.pFirstSql); 1882 blobListFree(g.pFirstDb); 1883 reformatVfs(); 1884 1885 } /* End loop over all source databases */ 1886 1887 if( !quietFlag ){ 1888 sqlite3_int64 iElapse = timeOfDay() - iBegin; 1889 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n" 1890 "SQLite %s %s\n", 1891 nTest, (int)(iElapse/1000), (int)(iElapse%1000), 1892 sqlite3_libversion(), sqlite3_sourceid()); 1893 } 1894 free(azSrcDb); 1895 free(pHeap); 1896 return 0; 1897 } 1898