Initial code for a fuzzing tool on database file that works with the

-fsanitize=fuzzer option of clang.

FossilOrigin-Name: 90d12094d36957fbded71545add8a5dc206798fdacc17d4d161d715569a7f991

diff --git a/manifest b/manifest
index 5268fa17f5c8eea12584ce0dd42cad7c083ff354..58e0c599f77683749219d01ec053c59e7493e516 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\sthe\ssqlite3session_config()\sinterface.\sFor\sconfiguring\sglobal\sparameters\nbelonging\sto\sthe\ssessions\smodule.
-D 2018-10-26T17:05:00.030
+C Initial\scode\sfor\sa\sfuzzing\stool\son\sdatabase\sfile\sthat\sworks\swith\sthe\n-fsanitize=fuzzer\soption\sof\sclang.
+D 2018-10-27T00:47:33.850
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in 01e95208a78b57d056131382c493c963518f36da4c42b12a97eb324401b3a334
@@ -770,6 +770,8 @@ F test/dataversion1.test 6e5e86ac681f0782e766ebcb56c019ae001522d114e0e111e5ebf68
 F test/date.test 9b73bbeb1b82d9c1f44dec5cf563bf7da58d2373
 F test/date2.test 74c234bece1b016e94dd4ef9c8cc7a199a8806c0e2291cab7ba64bace6350b10
 F test/dbfuzz.c 73047c920d6210e5912c87cdffd9a1c281d4252e
+F test/dbfuzz2-seed1.db e6225c6f3d7b63f9c5b6867146a5f329d997ab105bee64644dc2b3a2f2aebaee
+F test/dbfuzz2.c 726596ade432252e5a71d63ac1d14ebe499187091f3f32ad6302f7f1283229ff
 F test/dbpage.test dbf50a4d361f9e45a979432c727506065113124478a7d2db12074fa655e65d6c
 F test/dbstatus.test cd83aa623b8aab477269bc94cf8aa90c1e195a144561dd04a1620770aaa8524e
 F test/dbstatus2.test f5fe0afed3fa45e57cfa70d1147606c20d2ba23feac78e9a172f2fe8ab5b78ef
@@ -1772,7 +1774,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4d46685f282409f7154be288719cbea4b743d7ea5315a55a91462003497469f7
-R c10d7255298165478f73aa6752c71429
-U dan
-Z 0397ec87e4a63dd314f7afa18223a9dc
+P 1e69f3ff057b0be27a9e79842de2485f8299799f309e89bfa7597dd688e0975b
+R de82b9ab66221c495821cf10212a8a14
+U drh
+Z f0456761bef72ec9a03e18592dbe2afd

diff --git a/manifest.uuid b/manifest.uuid
index 9c1c574c1c0c08223e58dc835ad8735ff4f8ff69..9af6513d419dd4efde075665f69b3e2a2d7e864c 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-1e69f3ff057b0be27a9e79842de2485f8299799f309e89bfa7597dd688e0975b
\ No newline at end of file
+90d12094d36957fbded71545add8a5dc206798fdacc17d4d161d715569a7f991
\ No newline at end of file

diff --git a/test/dbfuzz2-seed1.db b/test/dbfuzz2-seed1.db
new file mode 100644 (file)
index 0000000..17f0550
Binary files /dev/null and b/test/dbfuzz2-seed1.db differ

diff --git a/test/dbfuzz2.c b/test/dbfuzz2.c
new file mode 100644 (file)
index 0000000..d676c70
--- /dev/null
+++ b/test/dbfuzz2.c
@@ -0,0 +1,83 @@
+/*
+** 2018-10-26
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+**
+** This program is designed for fuzz-testing SQLite database files using
+** the -fsanitize=fuzzer option of clang.
+**
+** The -fsanitize=fuzzer option causes a main() to be inserted automatically.
+** That main() invokes LLVMFuzzerTestOneInput(D,S) to be invoked repeatedly.
+** Each D is a fuzzed database file.  The code in this file runs various
+** SQL statements against that database, trying to provoke a failure.
+**
+** For best results the seed database files should have these tables:
+**
+**   Table "t1" with columns "a" and "b"
+**   Tables "t2" and "t3 with the same number of compatible columns
+**       "t3" should have a column names "x"
+**   Table "t4" with a column "x" that is compatible with t3.x.
+**
+** Any of these tables can be virtual tables, for example FTS or RTree tables.
+**
+** To run this test:
+**
+**     mkdir dir
+**     cp dbfuzz2-seed*.db dir
+**     clang-6.0 -I. -g -O1 -fsanitize=fuzzer \
+**       -DTHREADSAFE=0 -DSQLITE_ENABLE_DESERIALIZE \
+**       -DSQLITE_ENABLE_DBSTAT_VTAB dbfuzz2.c sqlite3.c -ldl
+**     ./a.out dir
+*/
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <ctype.h>
+#include <stdint.h>
+#include "sqlite3.h"
+
+/*
+** This is the is the SQL that is run against the database.
+*/
+static const char *azSql[] = {
+  "PRAGMA integrity_check;",
+  "SELECT * FROM sqlite_master;",
+  "SELECT sum(length(name)) FROM dbstat;",
+  "UPDATE t1 SET b=a, a=b WHERE a<b;",
+  "ALTER TABLE t1 RENAME TO alkjalkjdfiiiwuer987lkjwer82mx97sf98788s9789s;"
+  "INSERT INTO t3 SELECT * FROM t2;",
+  "DELETE FROM t3 WHERE x IN (SELECT x FROM t4);",
+  "REINDEX;"
+  "DROP TABLE t3;",
+  "VACUUM;",
+};
+
+int LLVMFuzzerTestOneInput(const uint8_t *aData, size_t nByte){
+  unsigned char *a;
+  sqlite3 *db;
+  int rc;
+  int i;
+
+  rc = sqlite3_open(":memory:", &db);
+  if( rc ) return 1;
+  a = sqlite3_malloc64(nByte);
+  if( a==0 ) return 1;
+  memcpy(a, aData, nByte);
+  sqlite3_deserialize(db, "main", a, nByte, nByte,
+        SQLITE_DESERIALIZE_RESIZEABLE |
+        SQLITE_DESERIALIZE_FREEONCLOSE);
+  for(i=0; i<sizeof(azSql)/sizeof(azSql[0]); i++){
+    sqlite3_exec(db, azSql[i], 0, 0, 0);
+  }
+  sqlite3_close(db);
+  return 0;
+}