1 /* 2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service. 3 ** (https://github.com/google/oss-fuzz) 4 */ 5 #include <stddef.h> 6 #include <stdint.h> 7 #include "sqlite3.h" 8 9 /* Return the current real-world time in milliseconds since the 10 ** Julian epoch (-4714-11-24). 11 */ 12 static sqlite3_int64 timeOfDay(void){ 13 static sqlite3_vfs *clockVfs = 0; 14 sqlite3_int64 t; 15 if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0); 16 if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){ 17 clockVfs->xCurrentTimeInt64(clockVfs, &t); 18 }else{ 19 double r; 20 clockVfs->xCurrentTime(clockVfs, &r); 21 t = (sqlite3_int64)(r*86400000.0); 22 } 23 return t; 24 } 25 26 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 27 /* 28 ** Progress handler callback. 29 ** 30 ** The argument is the cutoff-time after which all processing should 31 ** stop. So return non-zero if the cut-off time is exceeded. 32 */ 33 static int progress_handler(void *pReturn) { 34 sqlite3_int64 iCutoffTime = *(sqlite3_int64*)pReturn; 35 return timeOfDay()>=iCutoffTime; 36 } 37 #endif 38 39 /* 40 ** Callback for sqlite3_exec(). 41 */ 42 static int exec_handler(void *pCnt, int argc, char **argv, char **namev){ 43 int i; 44 if( argv ){ 45 for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i])); 46 } 47 return ((*(int*)pCnt)--)<=0; 48 } 49 50 /* 51 ** Main entry point. The fuzzer invokes this function with each 52 ** fuzzed input. 53 */ 54 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 55 int execCnt = 0; /* Abort row callback when count reaches zero */ 56 char *zErrMsg = 0; /* Error message returned by sqlite_exec() */ 57 sqlite3 *db; /* The database connection */ 58 uint8_t uSelector; /* First byte of input data[] */ 59 int rc; /* Return code from various interfaces */ 60 char *zSql; /* Zero-terminated copy of data[] */ 61 sqlite3_int64 iCutoff; /* Cutoff timer */ 62 63 if( size<3 ) return 0; /* Early out if unsufficient data */ 64 65 /* Extract the selector byte from the beginning of the input. But only 66 ** do this if the second byte is a \n. If the second byte is not \n, 67 ** then use a default selector */ 68 if( data[1]=='\n' ){ 69 uSelector = data[0]; data += 2; size -= 2; 70 }else{ 71 uSelector = 0xfd; 72 } 73 74 /* Open the database connection. Only use an in-memory database. */ 75 rc = sqlite3_open_v2("fuzz.db", &db, 76 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0); 77 if( rc ) return 0; 78 79 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK 80 /* Invoke the progress handler frequently to check to see if we 81 ** are taking too long. The progress handler will return true 82 ** (which will block further processing) if more than 10 seconds have 83 ** elapsed since the start of the test. 84 */ 85 iCutoff = timeOfDay() + 10000; /* Now + 10 seconds */ 86 sqlite3_progress_handler(db, 10, progress_handler, (void*)&iCutoff); 87 #endif 88 89 /* Bit 1 of the selector enables foreign key constraints */ 90 sqlite3_db_config(db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc); 91 uSelector >>= 1; 92 93 /* Remaining bits of the selector determine a limit on the number of 94 ** output rows */ 95 execCnt = uSelector + 1; 96 97 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated 98 ** string, so make a copy. */ 99 zSql = sqlite3_mprintf("%.*s", (int)size, data); 100 sqlite3_exec(db, zSql, exec_handler, (void*)&execCnt, &zErrMsg); 101 102 /* Cleanup and return */ 103 sqlite3_free(zErrMsg); 104 sqlite3_free(zSql); 105 sqlite3_close(db); 106 return 0; 107 } 108