1 /* 2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service. 3 ** (https://github.com/google/oss-fuzz) 4 */ 5 #include <stddef.h> 6 #include <stdint.h> 7 #include <stdio.h> 8 #include <string.h> 9 #include "sqlite3.h" 10 11 /* Global debugging settings. OSS-Fuzz will have all debugging turned 12 ** off. But if LLVMFuzzerTestOneInput() is called interactively from 13 ** the ossshell utility program, then these flags might be set. 14 */ 15 static unsigned mDebug = 0; 16 #define FUZZ_SQL_TRACE 0x0001 /* Set an sqlite3_trace() callback */ 17 #define FUZZ_SHOW_MAX_DELAY 0x0002 /* Show maximum progress callback delay */ 18 #define FUZZ_SHOW_ERRORS 0x0004 /* Print error messages from SQLite */ 19 20 /* The ossshell utility program invokes this interface to see the 21 ** debugging flags. Unused by OSS-Fuzz. 22 */ 23 void ossfuzz_set_debug_flags(unsigned x){ 24 mDebug = x; 25 } 26 27 /* Return the current real-world time in milliseconds since the 28 ** Julian epoch (-4714-11-24). 29 */ 30 static sqlite3_int64 timeOfDay(void){ 31 static sqlite3_vfs *clockVfs = 0; 32 sqlite3_int64 t; 33 if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0); 34 if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){ 35 clockVfs->xCurrentTimeInt64(clockVfs, &t); 36 }else{ 37 double r; 38 clockVfs->xCurrentTime(clockVfs, &r); 39 t = (sqlite3_int64)(r*86400000.0); 40 } 41 return t; 42 } 43 44 /* An instance of the following object is passed by pointer as the 45 ** client data to various callbacks. 46 */ 47 typedef struct FuzzCtx { 48 sqlite3 *db; /* The database connection */ 49 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */ 50 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */ 51 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */ 52 unsigned nCb; /* Number of progress callbacks */ 53 } FuzzCtx; 54 55 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 56 /* 57 ** Progress handler callback. 58 ** 59 ** The argument is the cutoff-time after which all processing should 60 ** stop. So return non-zero if the cut-off time is exceeded. 61 */ 62 static int progress_handler(void *pClientData) { 63 FuzzCtx *p = (FuzzCtx*)pClientData; 64 sqlite3_int64 iNow = timeOfDay(); 65 int rc = iNow>=p->iCutoffTime; 66 sqlite3_int64 iDiff = iNow - p->iLastCb; 67 if( iDiff > p->mxInterval ) p->mxInterval = iDiff; 68 p->nCb++; 69 return rc; 70 } 71 #endif 72 73 /* 74 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and 75 ** "PRAGMA parser_trace" since they can dramatically increase the 76 ** amount of output without actually testing anything useful. 77 */ 78 static int block_debug_pragmas( 79 void *Notused, 80 int eCode, 81 const char *zArg1, 82 const char *zArg2, 83 const char *zArg3, 84 const char *zArg4 85 ){ 86 if( eCode==SQLITE_PRAGMA 87 && (sqlite3_strnicmp("vdbe_", zArg1, 5)==0 88 || sqlite3_stricmp("parser_trace", zArg1)==0) 89 ){ 90 return SQLITE_DENY; 91 } 92 return SQLITE_OK; 93 } 94 95 /* 96 ** Callback for sqlite3_exec(). 97 */ 98 static int exec_handler(void *pCnt, int argc, char **argv, char **namev){ 99 int i; 100 if( argv ){ 101 for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i])); 102 } 103 return ((*(int*)pCnt)--)<=0; 104 } 105 106 /* 107 ** Main entry point. The fuzzer invokes this function with each 108 ** fuzzed input. 109 */ 110 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 111 int execCnt = 0; /* Abort row callback when count reaches zero */ 112 char *zErrMsg = 0; /* Error message returned by sqlite_exec() */ 113 uint8_t uSelector; /* First byte of input data[] */ 114 int rc; /* Return code from various interfaces */ 115 char *zSql; /* Zero-terminated copy of data[] */ 116 FuzzCtx cx; /* Fuzzing context */ 117 118 memset(&cx, 0, sizeof(cx)); 119 if( size<3 ) return 0; /* Early out if unsufficient data */ 120 121 /* Extract the selector byte from the beginning of the input. But only 122 ** do this if the second byte is a \n. If the second byte is not \n, 123 ** then use a default selector */ 124 if( data[1]=='\n' ){ 125 uSelector = data[0]; data += 2; size -= 2; 126 }else{ 127 uSelector = 0xfd; 128 } 129 130 /* Open the database connection. Only use an in-memory database. */ 131 rc = sqlite3_open_v2("fuzz.db", &cx.db, 132 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0); 133 if( rc ) return 0; 134 135 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 136 /* Invoke the progress handler frequently to check to see if we 137 ** are taking too long. The progress handler will return true 138 ** (which will block further processing) if more than 10 seconds have 139 ** elapsed since the start of the test. 140 */ 141 cx.iLastCb = timeOfDay(); 142 cx.iCutoffTime = cx.iLastCb + 10000; /* Now + 10 seconds */ 143 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx); 144 #endif 145 146 /* Set a limit on the maximum size of a prepared statement */ 147 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000); 148 149 /* Bit 1 of the selector enables foreign key constraints */ 150 sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc); 151 uSelector >>= 1; 152 153 /* Do not allow debugging pragma statements that might cause excess output */ 154 sqlite3_set_authorizer(cx.db, block_debug_pragmas, 0); 155 156 /* Remaining bits of the selector determine a limit on the number of 157 ** output rows */ 158 execCnt = uSelector + 1; 159 160 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated 161 ** string, so make a copy. */ 162 zSql = sqlite3_mprintf("%.*s", (int)size, data); 163 sqlite3_exec(cx.db, zSql, exec_handler, (void*)&execCnt, &zErrMsg); 164 165 /* Show any errors */ 166 if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){ 167 printf("Error: %s\n", zErrMsg); 168 } 169 170 /* Cleanup and return */ 171 sqlite3_free(zErrMsg); 172 sqlite3_free(zSql); 173 sqlite3_exec(cx.db, "PRAGMA temp_store_directory=''", 0, 0, 0); 174 sqlite3_close(cx.db); 175 176 if( mDebug & FUZZ_SHOW_MAX_DELAY ){ 177 printf("Progress callback count....... %d\n", cx.nCb); 178 printf("Max time between callbacks.... %d ms\n", (int)cx.mxInterval); 179 } 180 return 0; 181 } 182