1 /* 2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service. 3 ** (https://github.com/google/oss-fuzz) 4 */ 5 #include <stddef.h> 6 #if !defined(_MSC_VER) 7 # include <stdint.h> 8 #endif 9 #include <stdio.h> 10 #include <string.h> 11 #include "sqlite3.h" 12 13 #if defined(_MSC_VER) 14 typedef unsigned char uint8_t; 15 #endif 16 17 /* Global debugging settings. OSS-Fuzz will have all debugging turned 18 ** off. But if LLVMFuzzerTestOneInput() is called interactively from 19 ** the ossshell utility program, then these flags might be set. 20 */ 21 static unsigned mDebug = 0; 22 #define FUZZ_SQL_TRACE 0x0001 /* Set an sqlite3_trace() callback */ 23 #define FUZZ_SHOW_MAX_DELAY 0x0002 /* Show maximum progress callback delay */ 24 #define FUZZ_SHOW_ERRORS 0x0004 /* Print error messages from SQLite */ 25 26 /* The ossshell utility program invokes this interface to see the 27 ** debugging flags. Unused by OSS-Fuzz. 28 */ 29 void ossfuzz_set_debug_flags(unsigned x){ 30 mDebug = x; 31 } 32 33 /* Return the current real-world time in milliseconds since the 34 ** Julian epoch (-4714-11-24). 35 */ 36 static sqlite3_int64 timeOfDay(void){ 37 static sqlite3_vfs *clockVfs = 0; 38 sqlite3_int64 t; 39 if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0); 40 if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){ 41 clockVfs->xCurrentTimeInt64(clockVfs, &t); 42 }else{ 43 double r; 44 clockVfs->xCurrentTime(clockVfs, &r); 45 t = (sqlite3_int64)(r*86400000.0); 46 } 47 return t; 48 } 49 50 /* An instance of the following object is passed by pointer as the 51 ** client data to various callbacks. 52 */ 53 typedef struct FuzzCtx { 54 sqlite3 *db; /* The database connection */ 55 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */ 56 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */ 57 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */ 58 unsigned nCb; /* Number of progress callbacks */ 59 } FuzzCtx; 60 61 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 62 /* 63 ** Progress handler callback. 64 ** 65 ** The argument is the cutoff-time after which all processing should 66 ** stop. So return non-zero if the cut-off time is exceeded. 67 */ 68 static int progress_handler(void *pClientData) { 69 FuzzCtx *p = (FuzzCtx*)pClientData; 70 sqlite3_int64 iNow = timeOfDay(); 71 int rc = iNow>=p->iCutoffTime; 72 sqlite3_int64 iDiff = iNow - p->iLastCb; 73 if( iDiff > p->mxInterval ) p->mxInterval = iDiff; 74 p->nCb++; 75 return rc; 76 } 77 #endif 78 79 /* 80 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and 81 ** "PRAGMA parser_trace" since they can dramatically increase the 82 ** amount of output without actually testing anything useful. 83 */ 84 static int block_debug_pragmas( 85 void *Notused, 86 int eCode, 87 const char *zArg1, 88 const char *zArg2, 89 const char *zArg3, 90 const char *zArg4 91 ){ 92 if( eCode==SQLITE_PRAGMA 93 && (sqlite3_strnicmp("vdbe_", zArg1, 5)==0 94 || sqlite3_stricmp("parser_trace", zArg1)==0) 95 ){ 96 return SQLITE_DENY; 97 } 98 return SQLITE_OK; 99 } 100 101 /* 102 ** Callback for sqlite3_exec(). 103 */ 104 static int exec_handler(void *pCnt, int argc, char **argv, char **namev){ 105 int i; 106 if( argv ){ 107 for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i])); 108 } 109 return ((*(int*)pCnt)--)<=0; 110 } 111 112 /* 113 ** Main entry point. The fuzzer invokes this function with each 114 ** fuzzed input. 115 */ 116 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 117 int execCnt = 0; /* Abort row callback when count reaches zero */ 118 char *zErrMsg = 0; /* Error message returned by sqlite_exec() */ 119 uint8_t uSelector; /* First byte of input data[] */ 120 int rc; /* Return code from various interfaces */ 121 char *zSql; /* Zero-terminated copy of data[] */ 122 FuzzCtx cx; /* Fuzzing context */ 123 124 memset(&cx, 0, sizeof(cx)); 125 if( size<3 ) return 0; /* Early out if unsufficient data */ 126 127 /* Extract the selector byte from the beginning of the input. But only 128 ** do this if the second byte is a \n. If the second byte is not \n, 129 ** then use a default selector */ 130 if( data[1]=='\n' ){ 131 uSelector = data[0]; data += 2; size -= 2; 132 }else{ 133 uSelector = 0xfd; 134 } 135 136 /* Open the database connection. Only use an in-memory database. */ 137 rc = sqlite3_open_v2("fuzz.db", &cx.db, 138 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0); 139 if( rc ) return 0; 140 141 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 142 /* Invoke the progress handler frequently to check to see if we 143 ** are taking too long. The progress handler will return true 144 ** (which will block further processing) if more than 10 seconds have 145 ** elapsed since the start of the test. 146 */ 147 cx.iLastCb = timeOfDay(); 148 cx.iCutoffTime = cx.iLastCb + 10000; /* Now + 10 seconds */ 149 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx); 150 #endif 151 152 /* Set a limit on the maximum size of a prepared statement */ 153 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000); 154 155 /* Bit 1 of the selector enables foreign key constraints */ 156 sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc); 157 uSelector >>= 1; 158 159 /* Do not allow debugging pragma statements that might cause excess output */ 160 sqlite3_set_authorizer(cx.db, block_debug_pragmas, 0); 161 162 /* Remaining bits of the selector determine a limit on the number of 163 ** output rows */ 164 execCnt = uSelector + 1; 165 166 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated 167 ** string, so make a copy. */ 168 zSql = sqlite3_mprintf("%.*s", (int)size, data); 169 #ifndef SQLITE_OMIT_COMPLETE 170 sqlite3_complete(zSql); 171 #endif 172 sqlite3_exec(cx.db, zSql, exec_handler, (void*)&execCnt, &zErrMsg); 173 174 /* Show any errors */ 175 if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){ 176 printf("Error: %s\n", zErrMsg); 177 } 178 179 /* Cleanup and return */ 180 sqlite3_free(zErrMsg); 181 sqlite3_free(zSql); 182 sqlite3_exec(cx.db, "PRAGMA temp_store_directory=''", 0, 0, 0); 183 sqlite3_close(cx.db); 184 185 if( mDebug & FUZZ_SHOW_MAX_DELAY ){ 186 printf("Progress callback count....... %d\n", cx.nCb); 187 printf("Max time between callbacks.... %d ms\n", (int)cx.mxInterval); 188 } 189 return 0; 190 } 191