1 /* 2 ** 2022-06-14 3 ** 4 ** The author disclaims copyright to this source code. In place of 5 ** a legal notice, here is a blessing: 6 ** 7 ** May you do good and not evil. 8 ** May you find forgiveness for yourself and forgive others. 9 ** May you share freely, never taking more than you give. 10 ** 11 ************************************************************************* 12 ** 13 ** This library is used by fuzzcheck to test query invariants. 14 ** 15 ** An sqlite3_stmt is passed in that has just returned SQLITE_ROW. This 16 ** routine does: 17 ** 18 ** * Record the output of the current row 19 ** * Construct an alternative query that should return the same row 20 ** * Run the alternative query and verify that it does in fact return 21 ** the same row 22 ** 23 */ 24 #include "sqlite3.h" 25 #include <stdio.h> 26 #include <stdlib.h> 27 #include <string.h> 28 #include <ctype.h> 29 30 /* Forward references */ 31 static char *fuzz_invariant_sql(sqlite3_stmt*, int); 32 static int sameValue(sqlite3_stmt*,int,sqlite3_stmt*,int); 33 static void reportInvariantFailed(sqlite3_stmt*,sqlite3_stmt*,int); 34 35 /* 36 ** Do an invariant check on pStmt. iCnt determines which invariant check to 37 ** perform. The first check is iCnt==0. 38 ** 39 ** *pbCorrupt is a flag that, if true, indicates that the database file 40 ** is known to be corrupt. A value of non-zero means "yes, the database 41 ** is corrupt". A zero value means "we do not know whether or not the 42 ** database is corrupt". The value might be set prior to entry, or this 43 ** routine might set the value. 44 ** 45 ** Return values: 46 ** 47 ** SQLITE_OK This check was successful. 48 ** 49 ** SQLITE_DONE iCnt is out of range. The caller typically sets 50 ** up a loop on iCnt starting with zero, and increments 51 ** iCnt until this code is returned. 52 ** 53 ** SQLITE_CORRUPT The invariant failed, but the underlying database 54 ** file is indicating that it is corrupt, which might 55 ** be the cause of the malfunction. The *pCorrupt 56 ** value will also be set. 57 ** 58 ** SQLITE_INTERNAL The invariant failed, and the database file is not 59 ** corrupt. (This never happens because this function 60 ** will call abort() following an invariant failure.) 61 ** 62 ** (other) Some other kind of error occurred. 63 */ 64 int fuzz_invariant( 65 sqlite3 *db, /* The database connection */ 66 sqlite3_stmt *pStmt, /* Test statement stopped on an SQLITE_ROW */ 67 int iCnt, /* Invariant sequence number, starting at 0 */ 68 int iRow, /* Current row number */ 69 int nRow, /* Number of output rows from pStmt */ 70 int *pbCorrupt, /* IN/OUT: Flag indicating a corrupt database file */ 71 int eVerbosity /* How much debugging output */ 72 ){ 73 char *zTest; 74 sqlite3_stmt *pTestStmt = 0; 75 int rc; 76 int i; 77 int nCol; 78 int nParam; 79 80 if( *pbCorrupt ) return SQLITE_DONE; 81 nParam = sqlite3_bind_parameter_count(pStmt); 82 if( nParam>100 ) return SQLITE_DONE; 83 zTest = fuzz_invariant_sql(pStmt, iCnt); 84 if( zTest==0 ) return SQLITE_DONE; 85 rc = sqlite3_prepare_v2(db, zTest, -1, &pTestStmt, 0); 86 if( rc ){ 87 if( eVerbosity ){ 88 printf("invariant compile failed: %s\n%s\n", 89 sqlite3_errmsg(db), zTest); 90 } 91 sqlite3_free(zTest); 92 sqlite3_finalize(pTestStmt); 93 return rc; 94 } 95 sqlite3_free(zTest); 96 nCol = sqlite3_column_count(pStmt); 97 for(i=0; i<nCol; i++){ 98 rc = sqlite3_bind_value(pTestStmt,i+1+nParam,sqlite3_column_value(pStmt,i)); 99 if( rc!=SQLITE_OK && rc!=SQLITE_RANGE ){ 100 sqlite3_finalize(pTestStmt); 101 return rc; 102 } 103 } 104 if( eVerbosity>=2 ){ 105 char *zSql = sqlite3_expanded_sql(pTestStmt); 106 printf("invariant-sql #%d:\n%s\n", iCnt, zSql); 107 sqlite3_free(zSql); 108 } 109 while( (rc = sqlite3_step(pTestStmt))==SQLITE_ROW ){ 110 for(i=0; i<nCol; i++){ 111 if( !sameValue(pStmt, i, pTestStmt, i) ) break; 112 } 113 if( i>=nCol ) break; 114 } 115 if( rc==SQLITE_DONE ){ 116 /* No matching output row found */ 117 sqlite3_stmt *pCk = 0; 118 rc = sqlite3_prepare_v2(db, "PRAGMA integrity_check", -1, &pCk, 0); 119 if( rc ){ 120 sqlite3_finalize(pCk); 121 sqlite3_finalize(pTestStmt); 122 return rc; 123 } 124 rc = sqlite3_step(pCk); 125 if( rc!=SQLITE_ROW 126 || sqlite3_column_text(pCk, 0)==0 127 || strcmp((const char*)sqlite3_column_text(pCk,0),"ok")!=0 128 ){ 129 *pbCorrupt = 1; 130 sqlite3_finalize(pCk); 131 sqlite3_finalize(pTestStmt); 132 return SQLITE_CORRUPT; 133 } 134 sqlite3_finalize(pCk); 135 if( sqlite3_strlike("%group%by%order%by%desc%",sqlite3_sql(pStmt),0)==0 ){ 136 /* dbsqlfuzz crash-647c162051c9b23ce091b7bbbe5125ce5f00e922 137 ** Original statement is: 138 ** 139 ** SELECT a,c,d,b,'' FROM t1 GROUP BY 1 HAVING d<>345 ORDER BY a DESC; 140 ** 141 ** The values of c, d, and b are indeterminate and change when the 142 ** enclosed in the test query because the DESC is dropped. 143 ** 144 ** SELECT * FROM (...) WHERE "a"==0 145 */ 146 goto not_a_fault; 147 } 148 if( sqlite3_strlike("%limit%)%order%by%", sqlite3_sql(pTestStmt),0)==0 ){ 149 /* crash-89bd6a6f8c6166e9a4c5f47b3e70b225f69b76c6 150 ** Original statement is: 151 ** 152 ** SELECT a,b,c* FROM t1 LIMIT 1%5<4 153 ** 154 ** When running: 155 ** 156 ** SELECT * FROM (...) ORDER BY 1 157 ** 158 ** A different subset of the rows come out 159 */ 160 goto not_a_fault; 161 } 162 rc = sqlite3_prepare_v2(db, 163 "SELECT 1 FROM bytecode(?1) WHERE opcode='VOpen'", -1, &pCk, 0); 164 if( rc==SQLITE_OK ){ 165 sqlite3_bind_pointer(pCk, 1, pStmt, "stmt-pointer", 0); 166 rc = sqlite3_step(pCk); 167 } 168 sqlite3_finalize(pCk); 169 if( rc==SQLITE_DONE ){ 170 reportInvariantFailed(pStmt, pTestStmt, iRow); 171 return SQLITE_INTERNAL; 172 }else if( eVerbosity>0 ){ 173 printf("invariant-error ignored due to the use of virtual tables\n"); 174 } 175 } 176 not_a_fault: 177 sqlite3_finalize(pTestStmt); 178 return SQLITE_OK; 179 } 180 181 182 /* 183 ** Generate SQL used to test a statement invariant. 184 ** 185 ** Return 0 if the iCnt is out of range. 186 ** 187 ** iCnt meanings: 188 ** 189 ** 0 SELECT * FROM (<query>) 190 ** 1 SELECT DISTINCT * FROM (<query>) 191 ** 2 SELECT * FROM (<query>) WHERE ORDER BY 1 192 ** 3 SELECT DISTINCT * FROM (<query>) ORDER BY 1 193 ** 4 SELECT * FROM (<query>) WHERE <all-columns>=<all-values> 194 ** 5 SELECT DISTINCT * FROM (<query>) WHERE <all-columns=<all-values 195 ** 6 SELECT * FROM (<query>) WHERE <all-column>=<all-value> ORDER BY 1 196 ** 7 SELECT DISTINCT * FROM (<query>) WHERE <all-column>=<all-value> 197 ** ORDER BY 1 198 ** N+0 SELECT * FROM (<query>) WHERE <nth-column>=<value> 199 ** N+1 SELECT DISTINCT * FROM (<query>) WHERE <Nth-column>=<value> 200 ** N+2 SELECT * FROM (<query>) WHERE <Nth-column>=<value> ORDER BY 1 201 ** N+3 SELECT DISTINCT * FROM (<query>) WHERE <Nth-column>=<value> 202 ** ORDER BY N 203 ** 204 */ 205 static char *fuzz_invariant_sql(sqlite3_stmt *pStmt, int iCnt){ 206 const char *zIn; 207 size_t nIn; 208 const char *zAnd = "WHERE"; 209 int i; 210 sqlite3_str *pTest; 211 sqlite3_stmt *pBase = 0; 212 sqlite3 *db = sqlite3_db_handle(pStmt); 213 int rc; 214 int nCol = sqlite3_column_count(pStmt); 215 int mxCnt; 216 int bDistinct = 0; 217 int bOrderBy = 0; 218 int nParam = sqlite3_bind_parameter_count(pStmt); 219 220 switch( iCnt % 4 ){ 221 case 1: bDistinct = 1; break; 222 case 2: bOrderBy = 1; break; 223 case 3: bDistinct = bOrderBy = 1; break; 224 } 225 iCnt /= 4; 226 mxCnt = nCol; 227 if( iCnt<0 || iCnt>mxCnt ) return 0; 228 zIn = sqlite3_sql(pStmt); 229 if( zIn==0 ) return 0; 230 nIn = strlen(zIn); 231 while( nIn>0 && (isspace(zIn[nIn-1]) || zIn[nIn-1]==';') ) nIn--; 232 if( strchr(zIn, '?') ) return 0; 233 pTest = sqlite3_str_new(0); 234 sqlite3_str_appendf(pTest, "SELECT %s* FROM (", 235 bDistinct ? "DISTINCT " : ""); 236 sqlite3_str_append(pTest, zIn, nIn); 237 sqlite3_str_append(pTest, ")", 1); 238 rc = sqlite3_prepare_v2(db, sqlite3_str_value(pTest), -1, &pBase, 0); 239 if( rc ){ 240 sqlite3_finalize(pBase); 241 pBase = pStmt; 242 } 243 for(i=0; i<sqlite3_column_count(pStmt); i++){ 244 const char *zColName = sqlite3_column_name(pBase,i); 245 const char *zSuffix = zColName ? strrchr(zColName, ':') : 0; 246 if( zSuffix 247 && isdigit(zSuffix[1]) 248 && (zSuffix[1]>'3' || isdigit(zSuffix[2])) 249 ){ 250 /* This is a randomized column name and so cannot be used in the 251 ** WHERE clause. */ 252 continue; 253 } 254 if( iCnt==0 ) continue; 255 if( iCnt>1 && i+2!=iCnt ) continue; 256 if( zColName==0 ) continue; 257 if( sqlite3_column_type(pStmt, i)==SQLITE_NULL ){ 258 sqlite3_str_appendf(pTest, " %s \"%w\" ISNULL", zAnd, zColName); 259 }else{ 260 sqlite3_str_appendf(pTest, " %s \"%w\"=?%d", zAnd, zColName, 261 i+1+nParam); 262 } 263 zAnd = "AND"; 264 } 265 if( pBase!=pStmt ) sqlite3_finalize(pBase); 266 if( bOrderBy ){ 267 sqlite3_str_appendf(pTest, " ORDER BY %d", iCnt>2 ? iCnt-1 : 1); 268 } 269 return sqlite3_str_finish(pTest); 270 } 271 272 /* 273 ** Return true if and only if v1 and is the same as v2. 274 */ 275 static int sameValue(sqlite3_stmt *pS1, int i1, sqlite3_stmt *pS2, int i2){ 276 int x = 1; 277 int t1 = sqlite3_column_type(pS1,i1); 278 int t2 = sqlite3_column_type(pS2,i2); 279 if( t1!=t2 ){ 280 if( (t1==SQLITE_INTEGER && t2==SQLITE_FLOAT) 281 || (t1==SQLITE_FLOAT && t2==SQLITE_INTEGER) 282 ){ 283 /* Comparison of numerics is ok */ 284 }else{ 285 return 0; 286 } 287 } 288 switch( sqlite3_column_type(pS1,i1) ){ 289 case SQLITE_INTEGER: { 290 x = sqlite3_column_int64(pS1,i1)==sqlite3_column_int64(pS2,i2); 291 break; 292 } 293 case SQLITE_FLOAT: { 294 x = sqlite3_column_double(pS1,i1)==sqlite3_column_double(pS2,i2); 295 break; 296 } 297 case SQLITE_TEXT: { 298 int e1 = sqlite3_value_encoding(sqlite3_column_value(pS1,i1)); 299 int e2 = sqlite3_value_encoding(sqlite3_column_value(pS2,i2)); 300 if( e1!=e2 ){ 301 const char *z1 = (const char*)sqlite3_column_text(pS1,i1); 302 const char *z2 = (const char*)sqlite3_column_text(pS2,i2); 303 x = ((z1==0 && z2==0) || (z1!=0 && z2!=0 && strcmp(z1,z1)==0)); 304 printf("Encodings differ. %d on left and %d on right\n", e1, e2); 305 break; 306 } 307 if( e1!=SQLITE_UTF8 ){ 308 int len1 = sqlite3_column_bytes16(pS1,i1); 309 const unsigned char *b1 = sqlite3_column_blob(pS1,i1); 310 int len2 = sqlite3_column_bytes16(pS2,i2); 311 const unsigned char *b2 = sqlite3_column_blob(pS2,i2); 312 if( len1!=len2 ){ 313 x = 0; 314 }else if( len1==0 ){ 315 x = 1; 316 }else{ 317 x = (b1!=0 && b2!=0 && memcmp(b1,b2,len1)==0); 318 } 319 break; 320 } 321 /* Fall through into the SQLITE_BLOB case */ 322 } 323 case SQLITE_BLOB: { 324 int len1 = sqlite3_column_bytes(pS1,i1); 325 const unsigned char *b1 = sqlite3_column_blob(pS1,i1); 326 int len2 = sqlite3_column_bytes(pS2,i2); 327 const unsigned char *b2 = sqlite3_column_blob(pS2,i2); 328 if( len1!=len2 ){ 329 x = 0; 330 }else if( len1==0 ){ 331 x = 1; 332 }else{ 333 x = (b1!=0 && b2!=0 && memcmp(b1,b2,len1)==0); 334 } 335 break; 336 } 337 } 338 return x; 339 } 340 341 /* 342 ** Print binary data as hex 343 */ 344 static void printHex(const unsigned char *a, int n, int mx){ 345 int j; 346 for(j=0; j<mx && j<n; j++){ 347 printf("%02x", a[j]); 348 } 349 if( j<n ) printf("..."); 350 } 351 352 /* 353 ** Print a single row from the prepared statement 354 */ 355 static void printRow(sqlite3_stmt *pStmt, int iRow){ 356 int i, n, nCol; 357 unsigned const char *data; 358 nCol = sqlite3_column_count(pStmt); 359 for(i=0; i<nCol; i++){ 360 printf("row%d.col%d = ", iRow, i); 361 switch( sqlite3_column_type(pStmt, i) ){ 362 case SQLITE_NULL: { 363 printf("NULL\n"); 364 break; 365 } 366 case SQLITE_INTEGER: { 367 printf("(integer) %lld\n", sqlite3_column_int64(pStmt, i)); 368 break; 369 } 370 case SQLITE_FLOAT: { 371 printf("(float) %f\n", sqlite3_column_double(pStmt, i)); 372 break; 373 } 374 case SQLITE_TEXT: { 375 switch( sqlite3_value_encoding(sqlite3_column_value(pStmt,i)) ){ 376 case SQLITE_UTF8: { 377 printf("(utf8) x'"); 378 n = sqlite3_column_bytes(pStmt, i); 379 data = sqlite3_column_blob(pStmt, i); 380 printHex(data, n, 35); 381 printf("'\n"); 382 break; 383 } 384 case SQLITE_UTF16BE: { 385 printf("(utf16be) x'"); 386 n = sqlite3_column_bytes16(pStmt, i); 387 data = sqlite3_column_blob(pStmt, i); 388 printHex(data, n, 35); 389 printf("'\n"); 390 break; 391 } 392 case SQLITE_UTF16LE: { 393 printf("(utf16le) x'"); 394 n = sqlite3_column_bytes16(pStmt, i); 395 data = sqlite3_column_blob(pStmt, i); 396 printHex(data, n, 35); 397 printf("'\n"); 398 break; 399 } 400 default: { 401 printf("Illegal return from sqlite3_value_encoding(): %d\n", 402 sqlite3_value_encoding(sqlite3_column_value(pStmt,i))); 403 abort(); 404 } 405 } 406 break; 407 } 408 case SQLITE_BLOB: { 409 n = sqlite3_column_bytes(pStmt, i); 410 data = sqlite3_column_blob(pStmt, i); 411 printf("(blob %d bytes) x'", n); 412 printHex(data, n, 35); 413 printf("'\n"); 414 break; 415 } 416 } 417 } 418 } 419 420 /* 421 ** Report a failure of the invariant: The current output row of pOrig 422 ** does not appear in any row of the output from pTest. 423 */ 424 static void reportInvariantFailed( 425 sqlite3_stmt *pOrig, /* The original query */ 426 sqlite3_stmt *pTest, /* The alternative test query with a missing row */ 427 int iRow /* Row number in pOrig */ 428 ){ 429 int iTestRow = 0; 430 printf("Invariant check failed on row %d.\n", iRow); 431 printf("Original query --------------------------------------------------\n"); 432 printf("%s\n", sqlite3_expanded_sql(pOrig)); 433 printf("Alternative query -----------------------------------------------\n"); 434 printf("%s\n", sqlite3_expanded_sql(pTest)); 435 printf("Result row that is missing from the alternative -----------------\n"); 436 printRow(pOrig, iRow); 437 printf("Complete results from the alternative query ---------------------\n"); 438 sqlite3_reset(pTest); 439 while( sqlite3_step(pTest)==SQLITE_ROW ){ 440 iTestRow++; 441 printRow(pTest, iTestRow); 442 } 443 sqlite3_finalize(pTest); 444 abort(); 445 } 446