4 ** The author disclaims copyright to this source code. In place of
5 ** a legal notice, here is a blessing:
7 ** May you do good and not evil.
8 ** May you find forgiveness for yourself and forgive others.
9 ** May you share freely, never taking more than you give.
11 *************************************************************************
13 ** This is a utility program designed to aid running regressions tests on
14 ** the SQLite library using data from external fuzzers.
16 ** This program reads content from an SQLite database file with the following
20 ** dbid INTEGER PRIMARY KEY, -- database id
21 ** dbcontent BLOB -- database disk file image
24 ** sqlid INTEGER PRIMARY KEY, -- SQL script id
25 ** sqltext TEXT -- Text of SQL statements to run
27 ** CREATE TABLE IF NOT EXISTS readme(
28 ** msg TEXT -- Human-readable description of this test collection
31 ** For each database file in the DB table, the SQL text in the XSQL table
32 ** is run against that database. All README.MSG values are printed prior
33 ** to the start of the test (unless the --quiet option is used). If the
34 ** DB table is empty, then all entries in XSQL are run against an empty
35 ** in-memory database.
37 ** This program is looking for crashes, assertion faults, and/or memory leaks.
38 ** No attempt is made to verify the output. The assumption is that either all
39 ** of the database files or all of the SQL statements are malformed inputs,
40 ** generated by a fuzzer, that need to be checked to make sure they do not
41 ** present a security risk.
43 ** This program also includes some command-line options to help with
44 ** creation and maintenance of the source content database. The command
46 ** ./fuzzcheck database.db --load-sql FILE...
48 ** Loads all FILE... arguments into the XSQL table. The --load-db option
49 ** works the same but loads the files into the DB table. The -m option can
50 ** be used to initialize the README table. The "database.db" file is created
51 ** if it does not previously exist. Example:
53 ** ./fuzzcheck new.db --load-sql *.sql
54 ** ./fuzzcheck new.db --load-db *.db
55 ** ./fuzzcheck new.db -m 'New test cases'
57 ** The three commands above will create the "new.db" file and initialize all
58 ** tables. Then do "./fuzzcheck new.db" to run the tests.
62 ** If fuzzcheck does crash, it can be run in the debugger and the content
63 ** of the global variable g.zTextName[] will identify the specific XSQL and
64 ** DB values that were running when the crash occurred.
66 ** DBSQLFUZZ: (Added 2020-02-25)
68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against
69 ** that database in its input. This utility can now process dbsqlfuzz
70 ** input files. Load such files using the "--load-dbsql FILE ..." command-line
73 ** Dbsqlfuzz inputs are ordinary text. The first part of the file is text
74 ** that describes the content of the database (using a lot of hexadecimal),
75 ** then there is a divider line followed by the SQL to run against the
76 ** database. Because they are ordinary text, dbsqlfuzz inputs are stored
77 ** in the XSQL table, as if they were ordinary SQL inputs. The isDbSql()
78 ** function can look at a text string and determine whether or not it is
79 ** a valid dbsqlfuzz input.
88 #define ISSPACE(X) isspace((unsigned char)(X))
89 #define ISDIGIT(X) isdigit((unsigned char)(X))
98 #if !defined(_MSC_VER)
102 #if defined(_MSC_VER)
103 typedef unsigned char uint8_t;
107 ** Files in the virtual file system.
109 typedef struct VFile VFile
;
111 char *zFilename
; /* Filename. NULL for delete-on-close. From malloc() */
112 int sz
; /* Size of the file in bytes */
113 int nRef
; /* Number of references to this file */
114 unsigned char *a
; /* Content of the file. From malloc() */
116 typedef struct VHandle VHandle
;
118 sqlite3_file base
; /* Base class. Must be first */
119 VFile
*pVFile
; /* The underlying file */
123 ** The value of a database file template, or of an SQL script
125 typedef struct Blob Blob
;
127 Blob
*pNext
; /* Next in a list */
128 int id
; /* Id of this Blob */
129 int seq
; /* Sequence number */
130 int sz
; /* Size of this Blob in bytes */
131 unsigned char a
[1]; /* Blob content. Extra space allocated as needed. */
135 ** Maximum number of files in the in-memory virtual filesystem.
140 ** Maximum allowed file size
142 #define MX_FILE_SZ 10000000
145 ** All global variables are gathered into the "g" singleton.
147 static struct GlobalVars
{
148 const char *zArgv0
; /* Name of program */
149 const char *zDbFile
; /* Name of database file */
150 VFile aFile
[MX_FILE
]; /* The virtual filesystem */
151 int nDb
; /* Number of template databases */
152 Blob
*pFirstDb
; /* Content of first template database */
153 int nSql
; /* Number of SQL scripts */
154 Blob
*pFirstSql
; /* First SQL script */
155 unsigned int uRandom
; /* Seed for the SQLite PRNG */
156 unsigned int nInvariant
; /* Number of invariant checks run */
157 char zTestName
[100]; /* Name of current test */
161 ** Include the external vt02.c module, if requested by compile-time
169 ** Print an error message and quit.
171 static void fatalError(const char *zFormat
, ...){
173 fprintf(stderr
, "%s", g
.zArgv0
);
174 if( g
.zDbFile
) fprintf(stderr
, " %s", g
.zDbFile
);
175 if( g
.zTestName
[0] ) fprintf(stderr
, " (%s)", g
.zTestName
);
176 fprintf(stderr
, ": ");
177 va_start(ap
, zFormat
);
178 vfprintf(stderr
, zFormat
, ap
);
180 fprintf(stderr
, "\n");
188 static void signalHandler(int signum
){
190 if( signum
==SIGABRT
){
192 }else if( signum
==SIGALRM
){
194 }else if( signum
==SIGSEGV
){
204 ** Set the an alarm to go off after N seconds. Disable the alarm
207 static void setAlarm(int N
){
215 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
217 ** This an SQL progress handler. After an SQL statement has run for
218 ** many steps, we want to interrupt it. This guards against infinite
219 ** loops from recursive common table expressions.
221 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used.
222 ** In that case, hitting the progress handler is a fatal error.
224 static int progressHandler(void *pVdbeLimitFlag
){
225 if( *(int*)pVdbeLimitFlag
) fatalError("too many VDBE cycles");
231 ** Reallocate memory. Show an error and quit if unable.
233 static void *safe_realloc(void *pOld
, int szNew
){
234 void *pNew
= realloc(pOld
, szNew
<=0 ? 1 : szNew
);
235 if( pNew
==0 ) fatalError("unable to realloc for %d bytes", szNew
);
240 ** Initialize the virtual file system.
242 static void formatVfs(void){
244 for(i
=0; i
<MX_FILE
; i
++){
246 g
.aFile
[i
].zFilename
= 0;
254 ** Erase all information in the virtual file system.
256 static void reformatVfs(void){
258 for(i
=0; i
<MX_FILE
; i
++){
259 if( g
.aFile
[i
].sz
<0 ) continue;
260 if( g
.aFile
[i
].zFilename
){
261 free(g
.aFile
[i
].zFilename
);
262 g
.aFile
[i
].zFilename
= 0;
264 if( g
.aFile
[i
].nRef
>0 ){
265 fatalError("file %d still open. nRef=%d", i
, g
.aFile
[i
].nRef
);
275 ** Find a VFile by name
277 static VFile
*findVFile(const char *zName
){
279 if( zName
==0 ) return 0;
280 for(i
=0; i
<MX_FILE
; i
++){
281 if( g
.aFile
[i
].zFilename
==0 ) continue;
282 if( strcmp(g
.aFile
[i
].zFilename
, zName
)==0 ) return &g
.aFile
[i
];
288 ** Find a VFile by name. Create it if it does not already exist and
289 ** initialize it to the size and content given.
291 ** Return NULL only if the filesystem is full.
293 static VFile
*createVFile(const char *zName
, int sz
, unsigned char *pData
){
294 VFile
*pNew
= findVFile(zName
);
296 if( pNew
) return pNew
;
297 for(i
=0; i
<MX_FILE
&& g
.aFile
[i
].sz
>=0; i
++){}
298 if( i
>=MX_FILE
) return 0;
301 int nName
= (int)strlen(zName
)+1;
302 pNew
->zFilename
= safe_realloc(0, nName
);
303 memcpy(pNew
->zFilename
, zName
, nName
);
309 pNew
->a
= safe_realloc(0, sz
);
310 if( sz
>0 ) memcpy(pNew
->a
, pData
, sz
);
314 /* Return true if the line is all zeros */
315 static int allZero(unsigned char *aLine
){
317 for(i
=0; i
<16 && aLine
[i
]==0; i
++){}
322 ** Render a database and query as text that can be input into
325 static void renderDbSqlForCLI(
326 FILE *out
, /* Write to this file */
327 const char *zFile
, /* Name of the database file */
328 unsigned char *aDb
, /* Database content */
329 int nDb
, /* Number of bytes in aDb[] */
330 unsigned char *zSql
, /* SQL content */
331 int nSql
/* Bytes of SQL */
333 fprintf(out
, ".print ******* %s *******\n", zFile
);
335 int i
, j
; /* Loop counters */
336 int pgsz
; /* Size of each page */
337 int lastPage
= 0; /* Last page number shown */
338 int iPage
; /* Current page number */
339 unsigned char *aLine
; /* Single line to display */
340 unsigned char buf
[16]; /* Fake line */
341 unsigned char bShow
[256]; /* Characters ok to display */
343 memset(bShow
, '.', sizeof(bShow
));
344 for(i
=' '; i
<='~'; i
++){
345 if( i
!='{' && i
!='}' && i
!='"' && i
!='\\' ) bShow
[i
] = i
;
347 pgsz
= (aDb
[16]<<8) | aDb
[17];
348 if( pgsz
==0 ) pgsz
= 65536;
349 if( pgsz
<512 || (pgsz
&(pgsz
-1))!=0 ) pgsz
= 4096;
350 fprintf(out
,".open --hexdb\n");
351 fprintf(out
,"| size %d pagesize %d filename %s\n",nDb
,pgsz
,zFile
);
352 for(i
=0; i
<nDb
; i
+= 16){
354 memset(buf
, 0, sizeof(buf
));
355 memcpy(buf
, aDb
+i
, nDb
-i
);
360 if( allZero(aLine
) ) continue;
362 if( lastPage
!=iPage
){
363 fprintf(out
,"| page %d offset %d\n", iPage
, (iPage
-1)*pgsz
);
366 fprintf(out
,"| %5d:", i
-(iPage
-1)*pgsz
);
367 for(j
=0; j
<16; j
++) fprintf(out
," %02x", aLine
[j
]);
370 unsigned char c
= (unsigned char)aLine
[j
];
371 fputc( bShow
[c
], stdout
);
375 fprintf(out
,"| end %s\n", zFile
);
377 fprintf(out
,".open :memory:\n");
379 fprintf(out
,".testctrl prng_seed 1 db\n");
380 fprintf(out
,".testctrl internal_functions\n");
381 fprintf(out
,"%.*s", nSql
, zSql
);
382 if( nSql
>0 && zSql
[nSql
-1]!='\n' ) fprintf(out
, "\n");
386 ** Read the complete content of a file into memory. Add a 0x00 terminator
387 ** and return a pointer to the result.
389 ** The file content is held in memory obtained from sqlite_malloc64() which
390 ** should be freed by the caller.
392 static char *readFile(const char *zFilename
, long *sz
){
398 if( zFilename
==0 ) return 0;
399 in
= fopen(zFilename
, "rb");
400 if( in
==0 ) return 0;
401 fseek(in
, 0, SEEK_END
);
402 *sz
= nIn
= ftell(in
);
404 pBuf
= sqlite3_malloc64( nIn
+1 );
405 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
418 ** Implementation of the "readfile(X)" SQL function. The entire content
419 ** of the file named X is read and returned as a BLOB. NULL is returned
420 ** if the file does not exist or is unreadable.
422 static void readfileFunc(
423 sqlite3_context
*context
,
429 const char *zName
= (const char*)sqlite3_value_text(argv
[0]);
431 if( zName
==0 ) return;
432 pBuf
= readFile(zName
, &nIn
);
434 sqlite3_result_blob(context
, pBuf
, nIn
, sqlite3_free
);
439 ** Implementation of the "readtextfile(X)" SQL function. The text content
440 ** of the file named X through the end of the file or to the first \000
441 ** character, whichever comes first, is read and returned as TEXT. NULL
442 ** is returned if the file does not exist or is unreadable.
444 static void readtextfileFunc(
445 sqlite3_context
*context
,
454 zName
= (const char*)sqlite3_value_text(argv
[0]);
455 if( zName
==0 ) return;
456 in
= fopen(zName
, "rb");
458 fseek(in
, 0, SEEK_END
);
461 pBuf
= sqlite3_malloc64( nIn
+1 );
462 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
464 sqlite3_result_text(context
, pBuf
, -1, sqlite3_free
);
472 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y
473 ** is written into file X. The number of bytes written is returned. Or
474 ** NULL is returned if something goes wrong, such as being unable to open
475 ** file X for writing.
477 static void writefileFunc(
478 sqlite3_context
*context
,
488 zFile
= (const char*)sqlite3_value_text(argv
[0]);
489 if( zFile
==0 ) return;
490 out
= fopen(zFile
, "wb");
492 z
= (const char*)sqlite3_value_blob(argv
[1]);
496 rc
= fwrite(z
, 1, sqlite3_value_bytes(argv
[1]), out
);
499 sqlite3_result_int64(context
, rc
);
504 ** Load a list of Blob objects from the database
506 static void blobListLoadFromDb(
507 sqlite3
*db
, /* Read from this database */
508 const char *zSql
, /* Query used to extract the blobs */
509 int onlyId
, /* Only load where id is this value */
510 int *pN
, /* OUT: Write number of blobs loaded here */
511 Blob
**ppList
/* OUT: Write the head of the blob list here */
521 z2
= sqlite3_mprintf("%s WHERE rowid=%d", zSql
, onlyId
);
523 z2
= sqlite3_mprintf("%s", zSql
);
525 rc
= sqlite3_prepare_v2(db
, z2
, -1, &pStmt
, 0);
527 if( rc
) fatalError("%s", sqlite3_errmsg(db
));
530 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
531 int sz
= sqlite3_column_bytes(pStmt
, 1);
532 Blob
*pNew
= safe_realloc(0, sizeof(*pNew
)+sz
);
533 pNew
->id
= sqlite3_column_int(pStmt
, 0);
537 memcpy(pNew
->a
, sqlite3_column_blob(pStmt
,1), sz
);
542 sqlite3_finalize(pStmt
);
544 *ppList
= head
.pNext
;
548 ** Free a list of Blob objects
550 static void blobListFree(Blob
*p
){
559 /* Return the current wall-clock time
561 ** The number of milliseconds since the julian epoch.
562 ** 1907-01-01 00:00:00 -> 210866716800000
563 ** 2021-01-01 00:00:00 -> 212476176000000
565 static sqlite3_int64
timeOfDay(void){
566 static sqlite3_vfs
*clockVfs
= 0;
569 clockVfs
= sqlite3_vfs_find(0);
570 if( clockVfs
==0 ) return 0;
572 if( clockVfs
->iVersion
>=1 && clockVfs
->xCurrentTimeInt64
!=0 ){
573 clockVfs
->xCurrentTimeInt64(clockVfs
, &t
);
576 clockVfs
->xCurrentTime(clockVfs
, &r
);
577 t
= (sqlite3_int64
)(r
*86400000.0);
582 /***************************************************************************
583 ** Code to process combined database+SQL scripts generated by the
587 /* An instance of the following object is passed by pointer as the
588 ** client data to various callbacks.
590 typedef struct FuzzCtx
{
591 sqlite3
*db
; /* The database connection */
592 sqlite3_int64 iCutoffTime
; /* Stop processing at this time. */
593 sqlite3_int64 iLastCb
; /* Time recorded for previous progress callback */
594 sqlite3_int64 mxInterval
; /* Longest interval between two progress calls */
595 unsigned nCb
; /* Number of progress callbacks */
596 unsigned mxCb
; /* Maximum number of progress callbacks allowed */
597 unsigned execCnt
; /* Number of calls to the sqlite3_exec callback */
598 int timeoutHit
; /* True when reaching a timeout */
601 /* Verbosity level for the dbsqlfuzz test runner */
602 static int eVerbosity
= 0;
604 /* True to activate PRAGMA vdbe_debug=on */
605 static int bVdbeDebug
= 0;
607 /* Timeout for each fuzzing attempt, in milliseconds */
608 static int giTimeout
= 10000; /* Defaults to 10 seconds */
610 /* Maximum number of progress handler callbacks */
611 static unsigned int mxProgressCb
= 2000;
613 /* Maximum string length in SQLite */
614 static int lengthLimit
= 1000000;
616 /* Maximum expression depth */
617 static int depthLimit
= 500;
619 /* Limit on the amount of heap memory that can be used */
620 static sqlite3_int64 heapLimit
= 100000000;
622 /* Maximum byte-code program length in SQLite */
623 static int vdbeOpLimit
= 25000;
625 /* Maximum size of the in-memory database */
626 static sqlite3_int64 maxDbSize
= 104857600;
627 /* OOM simulation parameters */
628 static unsigned int oomCounter
= 0; /* Simulate OOM when equals 1 */
629 static unsigned int oomRepeat
= 0; /* Number of OOMs in a row */
630 static void*(*defaultMalloc
)(int) = 0; /* The low-level malloc routine */
632 /* This routine is called when a simulated OOM occurs. It is broken
633 ** out as a separate routine to make it easy to set a breakpoint on
638 printf("Simulated OOM fault\n");
647 /* This routine is a replacement malloc() that is used to simulate
648 ** Out-Of-Memory (OOM) errors for testing purposes.
650 static void *oomMalloc(int nByte
){
659 return defaultMalloc(nByte
);
662 /* Register the OOM simulator. This must occur before any memory
664 static void registerOomSimulator(void){
665 sqlite3_mem_methods mem
;
667 sqlite3_config(SQLITE_CONFIG_GETMALLOC
, &mem
);
668 defaultMalloc
= mem
.xMalloc
;
669 mem
.xMalloc
= oomMalloc
;
670 sqlite3_config(SQLITE_CONFIG_MALLOC
, &mem
);
673 /* Turn off any pending OOM simulation */
674 static void disableOom(void){
680 ** Translate a single byte of Hex into an integer.
681 ** This routine only works if h really is a valid hexadecimal
682 ** character: 0..9a..fA..F
684 static unsigned char hexToInt(unsigned int h
){
686 h
+= 9*(1&~(h
>>4)); /* EBCDIC */
688 h
+= 9*(1&(h
>>6)); /* ASCII */
694 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine
695 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it
696 ** does it makes corresponding changes to the *pK value and *pI value
697 ** and returns true. If the input buffer does not match the patterns,
698 ** no changes are made to either *pK or *pI and this routine returns false.
701 const unsigned char *zIn
, /* Text input */
702 int nIn
, /* Bytes of input */
703 unsigned int *pK
, /* half-byte cursor to adjust */
704 unsigned int *pI
/* Input index to adjust */
709 for(i
=1; i
<nIn
&& (c
= zIn
[i
])!=']'; i
++){
710 if( !isxdigit(c
) ) return 0;
711 k
= k
*16 + hexToInt(c
);
713 if( i
==nIn
) return 0;
720 ** Decode the text starting at zIn into a binary database file.
721 ** The maximum length of zIn is nIn bytes. Store the binary database
722 ** file in space obtained from sqlite3_malloc().
724 ** Return the number of bytes of zIn consumed. Or return -1 if there
725 ** is an error. One potential error is that the recipe specifies a
726 ** database file larger than MX_FILE_SZ bytes.
730 static int decodeDatabase(
731 const unsigned char *zIn
, /* Input text to be decoded */
732 int nIn
, /* Bytes of input text */
733 unsigned char **paDecode
, /* OUT: decoded database file */
734 int *pnDecode
/* OUT: Size of decoded database */
736 unsigned char *a
, *aNew
; /* Database under construction */
737 int mx
= 0; /* Current size of the database */
738 sqlite3_uint64 nAlloc
= 4096; /* Space allocated in a[] */
739 unsigned int i
; /* Next byte of zIn[] to read */
740 unsigned int j
; /* Temporary integer */
741 unsigned int k
; /* half-byte cursor index for output */
742 unsigned int n
; /* Number of bytes of input */
744 if( nIn
<4 ) return -1;
745 n
= (unsigned int)nIn
;
746 a
= sqlite3_malloc64( nAlloc
);
748 fprintf(stderr
, "Out of memory!\n");
751 memset(a
, 0, (size_t)nAlloc
);
752 for(i
=k
=0; i
<n
; i
++){
753 unsigned char c
= (unsigned char)zIn
[i
];
762 sqlite3_uint64 newSize
;
763 if( nAlloc
==MX_FILE_SZ
|| j
>=MX_FILE_SZ
){
765 fprintf(stderr
, "Input database too big: max %d bytes\n",
773 newSize
= (j
+4096)&~4095;
775 if( newSize
>MX_FILE_SZ
){
780 newSize
= MX_FILE_SZ
;
782 aNew
= sqlite3_realloc64( a
, newSize
);
788 assert( newSize
> nAlloc
);
789 memset(a
+nAlloc
, 0, (size_t)(newSize
- nAlloc
));
792 if( j
>=(unsigned)mx
){
793 mx
= (j
+ 4095)&~4095;
794 if( mx
>MX_FILE_SZ
) mx
= MX_FILE_SZ
;
799 }else if( zIn
[i
]=='[' && i
<n
-3 && isOffset(zIn
+i
, nIn
-i
, &k
, &i
) ){
801 }else if( zIn
[i
]=='\n' && i
<n
-4 && memcmp(zIn
+i
,"\n--\n",4)==0 ){
812 ** Progress handler callback.
814 ** The argument is the cutoff-time after which all processing should
815 ** stop. So return non-zero if the cut-off time is exceeded.
817 static int progress_handler(void *pClientData
) {
818 FuzzCtx
*p
= (FuzzCtx
*)pClientData
;
819 sqlite3_int64 iNow
= timeOfDay();
820 int rc
= iNow
>=p
->iCutoffTime
;
821 sqlite3_int64 iDiff
= iNow
- p
->iLastCb
;
822 /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */
823 if( iDiff
> p
->mxInterval
) p
->mxInterval
= iDiff
;
825 if( rc
==0 && p
->mxCb
>0 && p
->mxCb
<=p
->nCb
) rc
= 1;
826 if( rc
&& !p
->timeoutHit
&& eVerbosity
>=2 ){
827 printf("Timeout on progress callback %d\n", p
->nCb
);
835 ** Flag bits set by block_troublesome_sql()
837 #define BTS_SELECT 0x000001
838 #define BTS_NONSELECT 0x000002
839 #define BTS_BADFUNC 0x000004
840 #define BTS_BADPRAGMA 0x000008 /* Sticky for rest of the script */
843 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
844 ** "PRAGMA parser_trace" since they can dramatically increase the
845 ** amount of output without actually testing anything useful.
847 ** Also block ATTACH if attaching a file from the filesystem.
849 static int block_troublesome_sql(
857 unsigned int *pBtsFlags
= (unsigned int*)pClientData
;
862 case SQLITE_PRAGMA
: {
863 if( sqlite3_stricmp("busy_timeout",zArg1
)==0
864 && (zArg2
==0 || strtoll(zArg2
,0,0)>100 || strtoll(zArg2
,0,10)>100)
867 }else if( sqlite3_stricmp("hard_heap_limit", zArg1
)==0
868 || sqlite3_stricmp("reverse_unordered_selects", zArg1
)==0
870 /* BTS_BADPRAGMA is sticky. A hard_heap_limit or
871 ** revert_unordered_selects should inhibit all future attempts
872 ** at verifying query invariants */
873 *pBtsFlags
|= BTS_BADPRAGMA
;
874 }else if( eVerbosity
==0 ){
875 if( sqlite3_strnicmp("vdbe_", zArg1
, 5)==0
876 || sqlite3_stricmp("parser_trace", zArg1
)==0
877 || sqlite3_stricmp("temp_store_directory", zArg1
)==0
881 }else if( sqlite3_stricmp("oom",zArg1
)==0
882 && zArg2
!=0 && zArg2
[0]!=0 ){
883 oomCounter
= atoi(zArg2
);
885 *pBtsFlags
|= BTS_NONSELECT
;
888 case SQLITE_ATTACH
: {
889 /* Deny the ATTACH if it is attaching anything other than an in-memory
891 *pBtsFlags
|= BTS_NONSELECT
;
892 if( zArg1
==0 ) return SQLITE_DENY
;
893 if( strcmp(zArg1
,":memory:")==0 ) return SQLITE_OK
;
894 if( sqlite3_strglob("file:*[?]vfs=memdb", zArg1
)==0
895 && sqlite3_strglob("file:*[^/a-zA-Z0-9_.]*[?]vfs=memdb", zArg1
)!=0
901 case SQLITE_SELECT
: {
902 *pBtsFlags
|= BTS_SELECT
;
905 case SQLITE_FUNCTION
: {
906 static const char *azBadFuncs
[] = {
918 "geopoly_group_bbox",
920 "implies_nonnull_row",
945 last
= sizeof(azBadFuncs
)/sizeof(azBadFuncs
[0]) - 1;
947 int mid
= (first
+last
)/2;
948 int c
= sqlite3_stricmp(azBadFuncs
[mid
], zArg2
);
954 *pBtsFlags
|= BTS_BADFUNC
;
957 }while( first
<=last
);
965 *pBtsFlags
|= BTS_NONSELECT
;
971 /* Implementation found in fuzzinvariant.c */
973 sqlite3
*db
, /* The database connection */
974 sqlite3_stmt
*pStmt
, /* Test statement stopped on an SQLITE_ROW */
975 int iCnt
, /* Invariant sequence number, starting at 0 */
976 int iRow
, /* The row number for pStmt */
977 int nRow
, /* Total number of output rows */
978 int *pbCorrupt
, /* IN/OUT: Flag indicating a corrupt database file */
979 int eVerbosity
/* How much debugging output */
985 static int runDbSql(sqlite3
*db
, const char *zSql
, unsigned int *pBtsFlags
){
989 while( isspace(zSql
[0]&0x7f) ) zSql
++;
990 if( zSql
[0]==0 ) return SQLITE_OK
;
992 printf("RUNNING-SQL: [%s]\n", zSql
);
995 (*pBtsFlags
) &= ~BTS_BADPRAGMA
;
996 rc
= sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, 0);
999 while( (rc
= sqlite3_step(pStmt
))==SQLITE_ROW
){
1001 if( eVerbosity
>=4 ){
1003 for(j
=0; j
<sqlite3_column_count(pStmt
); j
++){
1004 if( j
) printf(",");
1005 switch( sqlite3_column_type(pStmt
, j
) ){
1010 case SQLITE_INTEGER
:
1011 case SQLITE_FLOAT
: {
1012 printf("%s", sqlite3_column_text(pStmt
, j
));
1016 int n
= sqlite3_column_bytes(pStmt
, j
);
1018 const unsigned char *a
;
1019 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1022 printf("%02x", a
[i
]);
1028 int n
= sqlite3_column_bytes(pStmt
, j
);
1030 const unsigned char *a
;
1031 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1043 } /* End switch() */
1047 } /* End if( eVerbosity>=5 ) */
1048 } /* End while( SQLITE_ROW */
1049 if( rc
==SQLITE_DONE
){
1050 if( (*pBtsFlags
)==BTS_SELECT
1051 && !sqlite3_stmt_isexplain(pStmt
)
1055 sqlite3_reset(pStmt
);
1056 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
1059 for(iCnt
=0; iCnt
<99999; iCnt
++){
1060 rc
= fuzz_invariant(db
, pStmt
, iCnt
, iRow
, nRow
,
1061 &bCorrupt
, eVerbosity
);
1062 if( rc
==SQLITE_DONE
) break;
1063 if( rc
!=SQLITE_ERROR
) g
.nInvariant
++;
1065 if( rc
==SQLITE_OK
){
1066 printf("invariant-check: ok\n");
1067 }else if( rc
==SQLITE_CORRUPT
){
1068 printf("invariant-check: failed due to database corruption\n");
1074 }else if( eVerbosity
>=4 ){
1075 printf("SQL-ERROR: (%d) %s\n", rc
, sqlite3_errmsg(db
));
1078 }else if( eVerbosity
>=4 ){
1079 printf("SQL-ERROR (%d): %s\n", rc
, sqlite3_errmsg(db
));
1081 } /* End if( SQLITE_OK ) */
1082 return sqlite3_finalize(pStmt
);
1085 /* Invoke this routine to run a single test case */
1086 int runCombinedDbSqlInput(
1087 const uint8_t *aData
, /* Combined DB+SQL content */
1088 size_t nByte
, /* Size of aData in bytes */
1089 int iTimeout
, /* Use this timeout */
1090 int bScript
, /* If true, just render CLI output */
1091 int iSqlId
/* SQL identifier */
1093 int rc
; /* SQLite API return value */
1094 int iSql
; /* Index in aData[] of start of SQL */
1095 unsigned char *aDb
= 0; /* Decoded database content */
1096 int nDb
= 0; /* Size of the decoded database */
1097 int i
; /* Loop counter */
1098 int j
; /* Start of current SQL statement */
1099 char *zSql
= 0; /* SQL text to run */
1100 int nSql
; /* Bytes of SQL text */
1101 FuzzCtx cx
; /* Fuzzing context */
1102 unsigned int btsFlags
= 0; /* Parsing flags */
1104 if( nByte
<10 ) return 0;
1105 if( sqlite3_initialize() ) return 0;
1106 if( sqlite3_memory_used()!=0 ){
1109 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1110 fprintf(stderr
,"memory leak prior to test start:"
1111 " %lld bytes in %d allocations\n",
1112 sqlite3_memory_used(), nAlloc
);
1115 memset(&cx
, 0, sizeof(cx
));
1116 iSql
= decodeDatabase((unsigned char*)aData
, (int)nByte
, &aDb
, &nDb
);
1117 if( iSql
<0 ) return 0;
1118 nSql
= (int)(nByte
- iSql
);
1121 sqlite3_snprintf(sizeof(zName
),zName
,"dbsql%06d.db",iSqlId
);
1122 renderDbSqlForCLI(stdout
, zName
, aDb
, nDb
,
1123 (unsigned char*)(aData
+iSql
), nSql
);
1127 if( eVerbosity
>=3 ){
1129 "****** %d-byte input, %d-byte database, %d-byte script "
1130 "******\n", (int)nByte
, nDb
, nSql
);
1133 rc
= sqlite3_open(0, &cx
.db
);
1139 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
1142 /* Invoke the progress handler frequently to check to see if we
1143 ** are taking too long. The progress handler will return true
1144 ** (which will block further processing) if more than giTimeout seconds have
1145 ** elapsed since the start of the test.
1147 cx
.iLastCb
= timeOfDay();
1148 cx
.iCutoffTime
= cx
.iLastCb
+ (iTimeout
<giTimeout
? iTimeout
: giTimeout
);
1149 cx
.mxCb
= mxProgressCb
;
1150 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
1151 sqlite3_progress_handler(cx
.db
, 10, progress_handler
, (void*)&cx
);
1154 /* Set a limit on the maximum size of a prepared statement, and the
1155 ** maximum length of a string or blob */
1156 if( vdbeOpLimit
>0 ){
1157 sqlite3_limit(cx
.db
, SQLITE_LIMIT_VDBE_OP
, vdbeOpLimit
);
1159 if( lengthLimit
>0 ){
1160 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LENGTH
, lengthLimit
);
1163 sqlite3_limit(cx
.db
, SQLITE_LIMIT_EXPR_DEPTH
, depthLimit
);
1165 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 100);
1166 sqlite3_hard_heap_limit64(heapLimit
);
1168 if( nDb
>=20 && aDb
[18]==2 && aDb
[19]==2 ){
1169 aDb
[18] = aDb
[19] = 1;
1171 rc
= sqlite3_deserialize(cx
.db
, "main", aDb
, nDb
, nDb
,
1172 SQLITE_DESERIALIZE_RESIZEABLE
|
1173 SQLITE_DESERIALIZE_FREEONCLOSE
);
1175 fprintf(stderr
, "sqlite3_deserialize() failed with %d\n", rc
);
1176 goto testrun_finished
;
1179 sqlite3_int64 x
= maxDbSize
;
1180 sqlite3_file_control(cx
.db
, "main", SQLITE_FCNTL_SIZE_LIMIT
, &x
);
1183 /* For high debugging levels, turn on debug mode */
1184 if( eVerbosity
>=5 ){
1185 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON;", 0, 0, 0);
1188 /* Block debug pragmas and ATTACH/DETACH. But wait until after
1189 ** deserialize to do this because deserialize depends on ATTACH */
1190 sqlite3_set_authorizer(cx
.db
, block_troublesome_sql
, &btsFlags
);
1193 sqlite3_vt02_init(cx
.db
, 0, 0);
1196 /* Consistent PRNG seed */
1197 #ifdef SQLITE_TESTCTRL_PRNG_SEED
1198 sqlite3_table_column_metadata(cx
.db
, 0, "x", 0, 0, 0, 0, 0, 0);
1199 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, cx
.db
);
1201 sqlite3_randomness(0,0);
1204 zSql
= sqlite3_malloc( nSql
+ 1 );
1206 fprintf(stderr
, "Out of memory!\n");
1208 memcpy(zSql
, aData
+iSql
, nSql
);
1210 for(i
=j
=0; zSql
[i
]; i
++){
1212 char cSaved
= zSql
[i
+1];
1214 if( sqlite3_complete(zSql
+j
) ){
1215 rc
= runDbSql(cx
.db
, zSql
+j
, &btsFlags
);
1219 if( rc
==SQLITE_INTERRUPT
|| progress_handler(&cx
) ){
1220 goto testrun_finished
;
1225 runDbSql(cx
.db
, zSql
+j
, &btsFlags
);
1230 rc
= sqlite3_close(cx
.db
);
1231 if( rc
!=SQLITE_OK
){
1232 fprintf(stdout
, "sqlite3_close() returns %d\n", rc
);
1234 if( eVerbosity
>=2 && !bScript
){
1235 fprintf(stdout
, "Peak memory usages: %f MB\n",
1236 sqlite3_memory_highwater(1) / 1000000.0);
1238 if( sqlite3_memory_used()!=0 ){
1241 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1242 fprintf(stderr
,"Memory leak: %lld bytes in %d allocations\n",
1243 sqlite3_memory_used(), nAlloc
);
1246 sqlite3_hard_heap_limit64(0);
1247 sqlite3_soft_heap_limit64(0);
1252 ** END of the dbsqlfuzz code
1253 ***************************************************************************/
1255 /* Look at a SQL text and try to determine if it begins with a database
1256 ** description, such as would be found in a dbsqlfuzz test case. Return
1257 ** true if this does appear to be a dbsqlfuzz test case and false otherwise.
1259 static int isDbSql(unsigned char *a
, int n
){
1260 unsigned char buf
[12];
1262 if( n
>4 && memcmp(a
,"\n--\n",4)==0 ) return 1;
1263 while( n
>0 && isspace(a
[0]) ){ a
++; n
--; }
1264 for(i
=0; n
>0 && i
<8; n
--, a
++){
1265 if( isxdigit(a
[0]) ) buf
[i
++] = a
[0];
1267 if( i
==8 && memcmp(buf
,"53514c69",8)==0 ) return 1;
1271 /* Implementation of the isdbsql(TEXT) SQL function.
1273 static void isDbSqlFunc(
1274 sqlite3_context
*context
,
1276 sqlite3_value
**argv
1278 int n
= sqlite3_value_bytes(argv
[0]);
1279 unsigned char *a
= (unsigned char*)sqlite3_value_blob(argv
[0]);
1280 sqlite3_result_int(context
, a
!=0 && n
>0 && isDbSql(a
,n
));
1283 /* Methods for the VHandle object
1285 static int inmemClose(sqlite3_file
*pFile
){
1286 VHandle
*p
= (VHandle
*)pFile
;
1287 VFile
*pVFile
= p
->pVFile
;
1289 if( pVFile
->nRef
==0 && pVFile
->zFilename
==0 ){
1296 static int inmemRead(
1297 sqlite3_file
*pFile
, /* Read from this open file */
1298 void *pData
, /* Store content in this buffer */
1299 int iAmt
, /* Bytes of content */
1300 sqlite3_int64 iOfst
/* Start reading here */
1302 VHandle
*pHandle
= (VHandle
*)pFile
;
1303 VFile
*pVFile
= pHandle
->pVFile
;
1304 if( iOfst
<0 || iOfst
>=pVFile
->sz
){
1305 memset(pData
, 0, iAmt
);
1306 return SQLITE_IOERR_SHORT_READ
;
1308 if( iOfst
+iAmt
>pVFile
->sz
){
1309 memset(pData
, 0, iAmt
);
1310 iAmt
= (int)(pVFile
->sz
- iOfst
);
1311 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1312 return SQLITE_IOERR_SHORT_READ
;
1314 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1317 static int inmemWrite(
1318 sqlite3_file
*pFile
, /* Write to this file */
1319 const void *pData
, /* Content to write */
1320 int iAmt
, /* bytes to write */
1321 sqlite3_int64 iOfst
/* Start writing here */
1323 VHandle
*pHandle
= (VHandle
*)pFile
;
1324 VFile
*pVFile
= pHandle
->pVFile
;
1325 if( iOfst
+iAmt
> pVFile
->sz
){
1326 if( iOfst
+iAmt
>= MX_FILE_SZ
){
1329 pVFile
->a
= safe_realloc(pVFile
->a
, (int)(iOfst
+iAmt
));
1330 if( iOfst
> pVFile
->sz
){
1331 memset(pVFile
->a
+ pVFile
->sz
, 0, (int)(iOfst
- pVFile
->sz
));
1333 pVFile
->sz
= (int)(iOfst
+ iAmt
);
1335 memcpy(pVFile
->a
+ iOfst
, pData
, iAmt
);
1338 static int inmemTruncate(sqlite3_file
*pFile
, sqlite3_int64 iSize
){
1339 VHandle
*pHandle
= (VHandle
*)pFile
;
1340 VFile
*pVFile
= pHandle
->pVFile
;
1341 if( pVFile
->sz
>iSize
&& iSize
>=0 ) pVFile
->sz
= (int)iSize
;
1344 static int inmemSync(sqlite3_file
*pFile
, int flags
){
1347 static int inmemFileSize(sqlite3_file
*pFile
, sqlite3_int64
*pSize
){
1348 *pSize
= ((VHandle
*)pFile
)->pVFile
->sz
;
1351 static int inmemLock(sqlite3_file
*pFile
, int type
){
1354 static int inmemUnlock(sqlite3_file
*pFile
, int type
){
1357 static int inmemCheckReservedLock(sqlite3_file
*pFile
, int *pOut
){
1361 static int inmemFileControl(sqlite3_file
*pFile
, int op
, void *pArg
){
1362 return SQLITE_NOTFOUND
;
1364 static int inmemSectorSize(sqlite3_file
*pFile
){
1367 static int inmemDeviceCharacteristics(sqlite3_file
*pFile
){
1369 SQLITE_IOCAP_SAFE_APPEND
|
1370 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN
|
1371 SQLITE_IOCAP_POWERSAFE_OVERWRITE
;
1375 /* Method table for VHandle
1377 static sqlite3_io_methods VHandleMethods
= {
1379 /* xClose */ inmemClose
,
1380 /* xRead */ inmemRead
,
1381 /* xWrite */ inmemWrite
,
1382 /* xTruncate */ inmemTruncate
,
1383 /* xSync */ inmemSync
,
1384 /* xFileSize */ inmemFileSize
,
1385 /* xLock */ inmemLock
,
1386 /* xUnlock */ inmemUnlock
,
1387 /* xCheck... */ inmemCheckReservedLock
,
1388 /* xFileCtrl */ inmemFileControl
,
1389 /* xSectorSz */ inmemSectorSize
,
1390 /* xDevchar */ inmemDeviceCharacteristics
,
1393 /* xShmBarrier */ 0,
1400 ** Open a new file in the inmem VFS. All files are anonymous and are
1403 static int inmemOpen(
1405 const char *zFilename
,
1406 sqlite3_file
*pFile
,
1410 VFile
*pVFile
= createVFile(zFilename
, 0, (unsigned char*)"");
1411 VHandle
*pHandle
= (VHandle
*)pFile
;
1415 pHandle
->pVFile
= pVFile
;
1417 pFile
->pMethods
= &VHandleMethods
;
1418 if( pOutFlags
) *pOutFlags
= openFlags
;
1423 ** Delete a file by name
1425 static int inmemDelete(
1427 const char *zFilename
,
1430 VFile
*pVFile
= findVFile(zFilename
);
1431 if( pVFile
==0 ) return SQLITE_OK
;
1432 if( pVFile
->nRef
==0 ){
1433 free(pVFile
->zFilename
);
1434 pVFile
->zFilename
= 0;
1440 return SQLITE_IOERR_DELETE
;
1443 /* Check for the existance of a file
1445 static int inmemAccess(
1447 const char *zFilename
,
1451 VFile
*pVFile
= findVFile(zFilename
);
1452 *pResOut
= pVFile
!=0;
1456 /* Get the canonical pathname for a file
1458 static int inmemFullPathname(
1460 const char *zFilename
,
1464 sqlite3_snprintf(nOut
, zOut
, "%s", zFilename
);
1468 /* Always use the same random see, for repeatability.
1470 static int inmemRandomness(sqlite3_vfs
*NotUsed
, int nBuf
, char *zBuf
){
1471 memset(zBuf
, 0, nBuf
);
1472 memcpy(zBuf
, &g
.uRandom
, nBuf
<sizeof(g
.uRandom
) ? nBuf
: sizeof(g
.uRandom
));
1477 ** Register the VFS that reads from the g.aFile[] set of files.
1479 static void inmemVfsRegister(int makeDefault
){
1480 static sqlite3_vfs inmemVfs
;
1481 sqlite3_vfs
*pDefault
= sqlite3_vfs_find(0);
1482 inmemVfs
.iVersion
= 3;
1483 inmemVfs
.szOsFile
= sizeof(VHandle
);
1484 inmemVfs
.mxPathname
= 200;
1485 inmemVfs
.zName
= "inmem";
1486 inmemVfs
.xOpen
= inmemOpen
;
1487 inmemVfs
.xDelete
= inmemDelete
;
1488 inmemVfs
.xAccess
= inmemAccess
;
1489 inmemVfs
.xFullPathname
= inmemFullPathname
;
1490 inmemVfs
.xRandomness
= inmemRandomness
;
1491 inmemVfs
.xSleep
= pDefault
->xSleep
;
1492 inmemVfs
.xCurrentTimeInt64
= pDefault
->xCurrentTimeInt64
;
1493 sqlite3_vfs_register(&inmemVfs
, makeDefault
);
1497 ** Allowed values for the runFlags parameter to runSql()
1499 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */
1500 #define SQL_OUTPUT 0x0002 /* Show the SQL output */
1503 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not
1504 ** stop if an error is encountered.
1506 static void runSql(sqlite3
*db
, const char *zSql
, unsigned runFlags
){
1508 sqlite3_stmt
*pStmt
;
1510 while( zSql
&& zSql
[0] ){
1513 sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, &zMore
);
1514 if( zMore
==zSql
) break;
1515 if( runFlags
& SQL_TRACE
){
1516 const char *z
= zSql
;
1518 while( z
<zMore
&& ISSPACE(z
[0]) ) z
++;
1519 n
= (int)(zMore
- z
);
1520 while( n
>0 && ISSPACE(z
[n
-1]) ) n
--;
1523 printf("TRACE: %.*s (error: %s)\n", n
, z
, sqlite3_errmsg(db
));
1525 printf("TRACE: %.*s\n", n
, z
);
1530 if( (runFlags
& SQL_OUTPUT
)==0 ){
1531 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){}
1534 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
1537 nCol
= sqlite3_column_count(pStmt
);
1539 printf("--------------------------------------------\n");
1541 for(i
=0; i
<nCol
; i
++){
1542 int eType
= sqlite3_column_type(pStmt
,i
);
1543 printf("%s = ", sqlite3_column_name(pStmt
,i
));
1549 case SQLITE_INTEGER
: {
1550 printf("INT %s\n", sqlite3_column_text(pStmt
,i
));
1553 case SQLITE_FLOAT
: {
1554 printf("FLOAT %s\n", sqlite3_column_text(pStmt
,i
));
1558 printf("TEXT [%s]\n", sqlite3_column_text(pStmt
,i
));
1562 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt
,i
));
1569 sqlite3_finalize(pStmt
);
1575 ** Rebuild the database file.
1577 ** (1) Remove duplicate entries
1578 ** (2) Put all entries in order
1581 static void rebuild_database(sqlite3
*db
, int dbSqlOnly
){
1584 zSql
= sqlite3_mprintf(
1586 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n"
1588 "INSERT INTO db(dbid, dbcontent) "
1589 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n"
1591 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n"
1592 "DELETE FROM xsql;\n"
1593 "INSERT INTO xsql(sqlid,sqltext) "
1594 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n"
1597 "PRAGMA page_size=1024;\n"
1599 dbSqlOnly
? " WHERE isdbsql(sqltext)" : ""
1601 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
1603 if( rc
) fatalError("cannot rebuild: %s", sqlite3_errmsg(db
));
1607 ** Return the value of a hexadecimal digit. Return -1 if the input
1608 ** is not a hex digit.
1610 static int hexDigitValue(char c
){
1611 if( c
>='0' && c
<='9' ) return c
- '0';
1612 if( c
>='a' && c
<='f' ) return c
- 'a' + 10;
1613 if( c
>='A' && c
<='F' ) return c
- 'A' + 10;
1618 ** Interpret zArg as an integer value, possibly with suffixes.
1620 static int integerValue(const char *zArg
){
1621 sqlite3_int64 v
= 0;
1622 static const struct { char *zSuffix
; int iMult
; } aMult
[] = {
1624 { "MiB", 1024*1024 },
1625 { "GiB", 1024*1024*1024 },
1628 { "GB", 1000000000 },
1631 { "G", 1000000000 },
1638 }else if( zArg
[0]=='+' ){
1641 if( zArg
[0]=='0' && zArg
[1]=='x' ){
1644 while( (x
= hexDigitValue(zArg
[0]))>=0 ){
1649 while( ISDIGIT(zArg
[0]) ){
1650 v
= v
*10 + zArg
[0] - '0';
1654 for(i
=0; i
<sizeof(aMult
)/sizeof(aMult
[0]); i
++){
1655 if( sqlite3_stricmp(aMult
[i
].zSuffix
, zArg
)==0 ){
1656 v
*= aMult
[i
].iMult
;
1660 if( v
>0x7fffffff ) fatalError("parameter too large - max 2147483648");
1661 return (int)(isNeg
? -v
: v
);
1665 ** Return the number of "v" characters in a string. Return 0 if there
1666 ** are any characters in the string other than "v".
1668 static int numberOfVChar(const char *z
){
1670 while( z
[0] && z
[0]=='v' ){
1674 return z
[0]==0 ? N
: 0;
1678 ** Print sketchy documentation for this utility program
1680 static void showHelp(void){
1681 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g
.zArgv0
);
1683 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n"
1684 "each database, checking for crashes and memory leaks.\n"
1686 " --cell-size-check Set the PRAGMA cell_size_check=ON\n"
1687 " --dbid N Use only the database where dbid=N\n"
1688 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n"
1689 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n"
1690 " --help Show this help text\n"
1691 " --info Show information about SOURCE-DB w/o running tests\n"
1692 " --limit-depth N Limit expression depth to N. Default: 500\n"
1693 " --limit-heap N Limit heap memory to N. Default: 100M\n"
1694 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n"
1695 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n"
1696 " --load-sql FILE.. Load SQL scripts fron files into SOURCE-DB\n"
1697 " --load-db FILE.. Load template databases from files into SOURCE_DB\n"
1698 " --load-dbsql FILE.. Load dbsqlfuzz outputs into the xsql table\n"
1699 " ^^^^------ Use \"-\" for FILE to read filenames from stdin\n"
1700 " -m TEXT Add a description to the database\n"
1701 " --native-vfs Use the native VFS for initially empty database files\n"
1702 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n"
1703 " --oss-fuzz Enable OSS-FUZZ testing\n"
1704 " --prng-seed N Seed value for the PRGN inside of SQLite\n"
1705 " -q|--quiet Reduced output\n"
1706 " --rebuild Rebuild and vacuum the database file\n"
1707 " --result-trace Show the results of each SQL command\n"
1708 " --script Output CLI script instead of running tests\n"
1709 " --skip N Skip the first N test cases\n"
1710 " --spinner Use a spinner to show progress\n"
1711 " --sqlid N Use only SQL where sqlid=N\n"
1712 " --timeout N Maximum time for any one test in N millseconds\n"
1713 " -v|--verbose Increased output. Repeat for more output.\n"
1714 " --vdbe-debug Activate VDBE debugging.\n"
1718 int main(int argc
, char **argv
){
1719 sqlite3_int64 iBegin
; /* Start time of this program */
1720 int quietFlag
= 0; /* True if --quiet or -q */
1721 int verboseFlag
= 0; /* True if --verbose or -v */
1722 char *zInsSql
= 0; /* SQL statement for --load-db or --load-sql */
1723 int iFirstInsArg
= 0; /* First argv[] for --load-db or --load-sql */
1724 sqlite3
*db
= 0; /* The open database connection */
1725 sqlite3_stmt
*pStmt
; /* A prepared statement */
1726 int rc
; /* Result code from SQLite interface calls */
1727 Blob
*pSql
; /* For looping over SQL scripts */
1728 Blob
*pDb
; /* For looping over template databases */
1729 int i
; /* Loop index for the argv[] loop */
1730 int dbSqlOnly
= 0; /* Only use scripts that are dbsqlfuzz */
1731 int onlySqlid
= -1; /* --sqlid */
1732 int onlyDbid
= -1; /* --dbid */
1733 int nativeFlag
= 0; /* --native-vfs */
1734 int rebuildFlag
= 0; /* --rebuild */
1735 int vdbeLimitFlag
= 0; /* --limit-vdbe */
1736 int infoFlag
= 0; /* --info */
1737 int nSkip
= 0; /* --skip */
1738 int bScript
= 0; /* --script */
1739 int bSpinner
= 0; /* True for --spinner */
1740 int timeoutTest
= 0; /* undocumented --timeout-test flag */
1741 int runFlags
= 0; /* Flags sent to runSql() */
1742 char *zMsg
= 0; /* Add this message */
1743 int nSrcDb
= 0; /* Number of source databases */
1744 char **azSrcDb
= 0; /* Array of source database names */
1745 int iSrcDb
; /* Loop over all source databases */
1746 int nTest
= 0; /* Total number of tests performed */
1747 char *zDbName
= ""; /* Appreviated name of a source database */
1748 const char *zFailCode
= 0; /* Value of the TEST_FAILURE env variable */
1749 int cellSzCkFlag
= 0; /* --cell-size-check */
1750 int sqlFuzz
= 0; /* True for SQL fuzz. False for DB fuzz */
1751 int iTimeout
= 120000; /* Default 120-second timeout */
1752 int nMem
= 0; /* Memory limit override */
1753 int nMemThisDb
= 0; /* Memory limit set by the CONFIG table */
1754 char *zExpDb
= 0; /* Write Databases to files in this directory */
1755 char *zExpSql
= 0; /* Write SQL to files in this directory */
1756 void *pHeap
= 0; /* Heap for use by SQLite */
1757 int ossFuzz
= 0; /* enable OSS-FUZZ testing */
1758 int ossFuzzThisDb
= 0; /* ossFuzz value for this particular database */
1759 int nativeMalloc
= 0; /* Turn off MEMSYS3/5 and lookaside if true */
1760 sqlite3_vfs
*pDfltVfs
; /* The default VFS */
1761 int openFlags4Data
; /* Flags for sqlite3_open_v2() */
1762 int bTimer
= 0; /* Show elapse time for each test */
1763 int nV
; /* How much to increase verbosity with -vvvv */
1764 sqlite3_int64 tmStart
; /* Start of each test */
1766 sqlite3_config(SQLITE_CONFIG_URI
,1);
1767 registerOomSimulator();
1768 sqlite3_initialize();
1769 iBegin
= timeOfDay();
1771 signal(SIGALRM
, signalHandler
);
1772 signal(SIGSEGV
, signalHandler
);
1773 signal(SIGABRT
, signalHandler
);
1776 openFlags4Data
= SQLITE_OPEN_READONLY
;
1777 zFailCode
= getenv("TEST_FAILURE");
1778 pDfltVfs
= sqlite3_vfs_find(0);
1779 inmemVfsRegister(1);
1780 for(i
=1; i
<argc
; i
++){
1781 const char *z
= argv
[i
];
1784 if( z
[0]=='-' ) z
++;
1785 if( strcmp(z
,"cell-size-check")==0 ){
1788 if( strcmp(z
,"dbid")==0 ){
1789 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1790 onlyDbid
= integerValue(argv
[++i
]);
1792 if( strcmp(z
,"export-db")==0 ){
1793 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1796 if( strcmp(z
,"export-sql")==0 || strcmp(z
,"export-dbsql")==0 ){
1797 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1798 zExpSql
= argv
[++i
];
1800 if( strcmp(z
,"help")==0 ){
1804 if( strcmp(z
,"info")==0 ){
1807 if( strcmp(z
,"limit-depth")==0 ){
1808 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1809 depthLimit
= integerValue(argv
[++i
]);
1811 if( strcmp(z
,"limit-heap")==0 ){
1812 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1813 heapLimit
= integerValue(argv
[++i
]);
1815 if( strcmp(z
,"limit-mem")==0 ){
1816 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1817 nMem
= integerValue(argv
[++i
]);
1819 if( strcmp(z
,"limit-vdbe")==0 ){
1822 if( strcmp(z
,"load-sql")==0 ){
1823 zInsSql
= "INSERT INTO xsql(sqltext)"
1824 "VALUES(CAST(readtextfile(?1) AS text))";
1826 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1829 if( strcmp(z
,"load-db")==0 ){
1830 zInsSql
= "INSERT INTO db(dbcontent) VALUES(readfile(?1))";
1832 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1835 if( strcmp(z
,"load-dbsql")==0 ){
1836 zInsSql
= "INSERT INTO xsql(sqltext)"
1837 "VALUES(readfile(?1))";
1839 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1843 if( strcmp(z
,"m")==0 ){
1844 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1846 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1848 if( strcmp(z
,"native-malloc")==0 ){
1851 if( strcmp(z
,"native-vfs")==0 ){
1854 if( strcmp(z
,"oss-fuzz")==0 ){
1857 if( strcmp(z
,"prng-seed")==0 ){
1858 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1859 g
.uRandom
= atoi(argv
[++i
]);
1861 if( strcmp(z
,"quiet")==0 || strcmp(z
,"q")==0 ){
1866 if( strcmp(z
,"rebuild")==0 ){
1868 openFlags4Data
= SQLITE_OPEN_READWRITE
;
1870 if( strcmp(z
,"result-trace")==0 ){
1871 runFlags
|= SQL_OUTPUT
;
1873 if( strcmp(z
,"script")==0 ){
1876 if( strcmp(z
,"skip")==0 ){
1877 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1878 nSkip
= atoi(argv
[++i
]);
1880 if( strcmp(z
,"spinner")==0 ){
1883 if( strcmp(z
,"timer")==0 ){
1886 if( strcmp(z
,"sqlid")==0 ){
1887 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1888 onlySqlid
= integerValue(argv
[++i
]);
1890 if( strcmp(z
,"timeout")==0 ){
1891 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1892 iTimeout
= integerValue(argv
[++i
]);
1894 if( strcmp(z
,"timeout-test")==0 ){
1897 fatalError("timeout is not available on non-unix systems");
1900 if( strcmp(z
,"vdbe-debug")==0 ){
1903 if( strcmp(z
,"verbose")==0 ){
1907 if( verboseFlag
>1 ) runFlags
|= SQL_TRACE
;
1909 if( (nV
= numberOfVChar(z
))>=1 ){
1913 if( verboseFlag
>1 ) runFlags
|= SQL_TRACE
;
1915 if( strcmp(z
,"version")==0 ){
1918 printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid());
1919 for(ii
=0; (zz
= sqlite3_compileoption_get(ii
))!=0; ii
++){
1924 if( strcmp(z
,"is-dbsql")==0 ){
1926 for(i
++; i
<argc
; i
++){
1928 char *aData
= readFile(argv
[i
], &nData
);
1929 printf("%d %s\n", isDbSql((unsigned char*)aData
,nData
), argv
[i
]);
1930 sqlite3_free(aData
);
1935 fatalError("unknown option: %s", argv
[i
]);
1939 azSrcDb
= safe_realloc(azSrcDb
, nSrcDb
*sizeof(azSrcDb
[0]));
1940 azSrcDb
[nSrcDb
-1] = argv
[i
];
1943 if( nSrcDb
==0 ) fatalError("no source database specified");
1946 fatalError("cannot change the description of more than one database");
1949 fatalError("cannot import into more than one database");
1953 /* Process each source database separately */
1954 for(iSrcDb
=0; iSrcDb
<nSrcDb
; iSrcDb
++){
1957 g
.zDbFile
= azSrcDb
[iSrcDb
];
1958 rc
= sqlite3_open_v2(azSrcDb
[iSrcDb
], &db
,
1959 openFlags4Data
, pDfltVfs
->zName
);
1960 if( rc
==SQLITE_OK
){
1961 rc
= sqlite3_exec(db
, "SELECT count(*) FROM sqlite_schema", 0, 0, 0);
1965 zRawData
= readFile(azSrcDb
[iSrcDb
], &nRawData
);
1967 fatalError("input file \"%s\" is not recognized\n", azSrcDb
[iSrcDb
]);
1969 sqlite3_open(":memory:", &db
);
1972 /* Print the description, if there is one */
1975 zDbName
= azSrcDb
[iSrcDb
];
1976 i
= (int)strlen(zDbName
) - 1;
1977 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
1979 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
1980 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
1981 printf("%s: %s", zDbName
, sqlite3_column_text(pStmt
,0));
1983 printf("%s: (empty \"readme\")", zDbName
);
1985 sqlite3_finalize(pStmt
);
1986 sqlite3_prepare_v2(db
, "SELECT count(*) FROM db", -1, &pStmt
, 0);
1988 && sqlite3_step(pStmt
)==SQLITE_ROW
1989 && (n
= sqlite3_column_int(pStmt
,0))>0
1991 printf(" - %d DBs", n
);
1993 sqlite3_finalize(pStmt
);
1994 sqlite3_prepare_v2(db
, "SELECT count(*) FROM xsql", -1, &pStmt
, 0);
1996 && sqlite3_step(pStmt
)==SQLITE_ROW
1997 && (n
= sqlite3_column_int(pStmt
,0))>0
1999 printf(" - %d scripts", n
);
2001 sqlite3_finalize(pStmt
);
2004 sqlite3_free(zRawData
);
2008 rc
= sqlite3_exec(db
,
2009 "CREATE TABLE IF NOT EXISTS db(\n"
2010 " dbid INTEGER PRIMARY KEY, -- database id\n"
2011 " dbcontent BLOB -- database disk file image\n"
2013 "CREATE TABLE IF NOT EXISTS xsql(\n"
2014 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n"
2015 " sqltext TEXT -- Text of SQL statements to run\n"
2017 "CREATE TABLE IF NOT EXISTS readme(\n"
2018 " msg TEXT -- Human-readable description of this file\n"
2020 if( rc
) fatalError("cannot create schema: %s", sqlite3_errmsg(db
));
2023 zSql
= sqlite3_mprintf(
2024 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg
);
2025 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
2027 if( rc
) fatalError("cannot change description: %s", sqlite3_errmsg(db
));
2030 zInsSql
= "INSERT INTO xsql(sqltext) VALUES(?1)";
2031 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2032 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2033 zInsSql
, sqlite3_errmsg(db
));
2034 sqlite3_bind_text(pStmt
, 1, zRawData
, nRawData
, SQLITE_STATIC
);
2035 sqlite3_step(pStmt
);
2036 rc
= sqlite3_reset(pStmt
);
2037 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2038 sqlite3_finalize(pStmt
);
2039 rebuild_database(db
, dbSqlOnly
);
2041 sqlite3_free(zRawData
);
2044 ossFuzzThisDb
= ossFuzz
;
2046 /* If the CONFIG(name,value) table exists, read db-specific settings
2047 ** from that table */
2048 if( sqlite3_table_column_metadata(db
,0,"config",0,0,0,0,0,0)==SQLITE_OK
){
2049 rc
= sqlite3_prepare_v2(db
, "SELECT name, value FROM config",
2051 if( rc
) fatalError("cannot prepare query of CONFIG table: %s",
2052 sqlite3_errmsg(db
));
2053 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
2054 const char *zName
= (const char *)sqlite3_column_text(pStmt
,0);
2055 if( zName
==0 ) continue;
2056 if( strcmp(zName
, "oss-fuzz")==0 ){
2057 ossFuzzThisDb
= sqlite3_column_int(pStmt
,1);
2058 if( verboseFlag
) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb
);
2060 if( strcmp(zName
, "limit-mem")==0 ){
2061 nMemThisDb
= sqlite3_column_int(pStmt
,1);
2062 if( verboseFlag
) printf("Config: limit-mem=%d\n", nMemThisDb
);
2065 sqlite3_finalize(pStmt
);
2069 sqlite3_create_function(db
, "readfile", 1, SQLITE_UTF8
, 0,
2070 readfileFunc
, 0, 0);
2071 sqlite3_create_function(db
, "readtextfile", 1, SQLITE_UTF8
, 0,
2072 readtextfileFunc
, 0, 0);
2073 sqlite3_create_function(db
, "isdbsql", 1, SQLITE_UTF8
, 0,
2075 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2076 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2077 zInsSql
, sqlite3_errmsg(db
));
2078 rc
= sqlite3_exec(db
, "BEGIN", 0, 0, 0);
2079 if( rc
) fatalError("cannot start a transaction");
2080 for(i
=iFirstInsArg
; i
<argc
; i
++){
2081 if( strcmp(argv
[i
],"-")==0 ){
2082 /* A filename of "-" means read multiple filenames from stdin */
2084 while( rc
==0 && fgets(zLine
,sizeof(zLine
),stdin
)!=0 ){
2085 size_t kk
= strlen(zLine
);
2086 while( kk
>0 && zLine
[kk
-1]<=' ' ) kk
--;
2087 sqlite3_bind_text(pStmt
, 1, zLine
, (int)kk
, SQLITE_STATIC
);
2088 if( verboseFlag
) printf("loading %.*s\n", (int)kk
, zLine
);
2089 sqlite3_step(pStmt
);
2090 rc
= sqlite3_reset(pStmt
);
2091 if( rc
) fatalError("insert failed for %s", zLine
);
2094 sqlite3_bind_text(pStmt
, 1, argv
[i
], -1, SQLITE_STATIC
);
2095 if( verboseFlag
) printf("loading %s\n", argv
[i
]);
2096 sqlite3_step(pStmt
);
2097 rc
= sqlite3_reset(pStmt
);
2098 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2101 sqlite3_finalize(pStmt
);
2102 rc
= sqlite3_exec(db
, "COMMIT", 0, 0, 0);
2103 if( rc
) fatalError("cannot commit the transaction: %s",
2104 sqlite3_errmsg(db
));
2105 rebuild_database(db
, dbSqlOnly
);
2109 rc
= sqlite3_exec(db
, "PRAGMA query_only=1;", 0, 0, 0);
2110 if( rc
) fatalError("cannot set database to query-only");
2111 if( zExpDb
!=0 || zExpSql
!=0 ){
2112 sqlite3_create_function(db
, "writefile", 2, SQLITE_UTF8
, 0,
2113 writefileFunc
, 0, 0);
2116 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent),"
2117 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)"
2118 " FROM db WHERE ?2<0 OR dbid=?2;";
2119 rc
= sqlite3_prepare_v2(db
, zExDb
, -1, &pStmt
, 0);
2120 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2121 zExDb
, sqlite3_errmsg(db
));
2122 sqlite3_bind_text64(pStmt
, 1, zExpDb
, strlen(zExpDb
),
2123 SQLITE_STATIC
, SQLITE_UTF8
);
2124 sqlite3_bind_int(pStmt
, 2, onlyDbid
);
2125 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2126 printf("write db-%d (%d bytes) into %s\n",
2127 sqlite3_column_int(pStmt
,1),
2128 sqlite3_column_int(pStmt
,3),
2129 sqlite3_column_text(pStmt
,2));
2131 sqlite3_finalize(pStmt
);
2134 const char *zExSql
=
2135 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext),"
2136 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)"
2137 " FROM xsql WHERE ?2<0 OR sqlid=?2;";
2138 rc
= sqlite3_prepare_v2(db
, zExSql
, -1, &pStmt
, 0);
2139 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2140 zExSql
, sqlite3_errmsg(db
));
2141 sqlite3_bind_text64(pStmt
, 1, zExpSql
, strlen(zExpSql
),
2142 SQLITE_STATIC
, SQLITE_UTF8
);
2143 sqlite3_bind_int(pStmt
, 2, onlySqlid
);
2144 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2145 printf("write sql-%d (%d bytes) into %s\n",
2146 sqlite3_column_int(pStmt
,1),
2147 sqlite3_column_int(pStmt
,3),
2148 sqlite3_column_text(pStmt
,2));
2150 sqlite3_finalize(pStmt
);
2156 /* Load all SQL script content and all initial database images from the
2159 blobListLoadFromDb(db
, "SELECT sqlid, sqltext FROM xsql", onlySqlid
,
2160 &g
.nSql
, &g
.pFirstSql
);
2161 if( g
.nSql
==0 ) fatalError("need at least one SQL script");
2162 blobListLoadFromDb(db
, "SELECT dbid, dbcontent FROM db", onlyDbid
,
2163 &g
.nDb
, &g
.pFirstDb
);
2165 g
.pFirstDb
= safe_realloc(0, sizeof(Blob
));
2166 memset(g
.pFirstDb
, 0, sizeof(Blob
));
2168 g
.pFirstDb
->seq
= 0;
2173 /* Print the description, if there is one */
2174 if( !quietFlag
&& !bScript
){
2175 zDbName
= azSrcDb
[iSrcDb
];
2176 i
= (int)strlen(zDbName
) - 1;
2177 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
2179 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
2180 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
2181 printf("%s: %s\n", zDbName
, sqlite3_column_text(pStmt
,0));
2183 sqlite3_finalize(pStmt
);
2186 /* Rebuild the database, if requested */
2189 printf("%s: rebuilding... ", zDbName
);
2192 rebuild_database(db
, 0);
2193 if( !quietFlag
) printf("done\n");
2196 /* Close the source database. Verify that no SQLite memory allocations are
2200 if( sqlite3_memory_used()>0 ){
2201 fatalError("SQLite has memory in use before the start of testing");
2204 /* Limit available memory, if requested */
2207 if( nMemThisDb
>0 && nMem
==0 ){
2208 if( !nativeMalloc
){
2209 pHeap
= realloc(pHeap
, nMemThisDb
);
2211 fatalError("failed to allocate %d bytes of heap memory", nMem
);
2213 sqlite3_config(SQLITE_CONFIG_HEAP
, pHeap
, nMemThisDb
, 128);
2215 sqlite3_hard_heap_limit64((sqlite3_int64
)nMemThisDb
);
2218 sqlite3_hard_heap_limit64(0);
2221 /* Disable lookaside with the --native-malloc option */
2223 sqlite3_config(SQLITE_CONFIG_LOOKASIDE
, 0, 0);
2226 /* Reset the in-memory virtual filesystem */
2229 /* Run a test using each SQL script against each database.
2231 if( !verboseFlag
&& !quietFlag
&& !bSpinner
&& !bScript
){
2232 printf("%s:", zDbName
);
2234 for(pSql
=g
.pFirstSql
; pSql
; pSql
=pSql
->pNext
){
2235 tmStart
= timeOfDay();
2236 if( isDbSql(pSql
->a
, pSql
->sz
) ){
2237 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d",pSql
->id
);
2239 /* No progress output */
2240 }else if( bSpinner
){
2242 int idx
= pSql
->seq
;
2243 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2245 }else if( verboseFlag
){
2246 printf("%s\n", g
.zTestName
);
2248 }else if( !quietFlag
){
2249 static int prevAmt
= -1;
2250 int idx
= pSql
->seq
;
2251 int amt
= idx
*10/(g
.nSql
);
2253 printf(" %d%%", amt
*10);
2261 runCombinedDbSqlInput(pSql
->a
, pSql
->sz
, iTimeout
, bScript
, pSql
->id
);
2264 if( bTimer
&& !bScript
){
2265 sqlite3_int64 tmEnd
= timeOfDay();
2266 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2272 for(pDb
=g
.pFirstDb
; pDb
; pDb
=pDb
->pNext
){
2274 const char *zVfs
= "inmem";
2275 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d,dbid=%d",
2278 /* No progress output */
2279 }else if( bSpinner
){
2280 int nTotal
= g
.nDb
*g
.nSql
;
2281 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2282 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2284 }else if( verboseFlag
){
2285 printf("%s\n", g
.zTestName
);
2287 }else if( !quietFlag
){
2288 static int prevAmt
= -1;
2289 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2290 int amt
= idx
*10/(g
.nDb
*g
.nSql
);
2292 printf(" %d%%", amt
*10);
2303 sqlite3_snprintf(sizeof(zName
), zName
, "db%06d.db",
2304 pDb
->id
>1 ? pDb
->id
: pSql
->id
);
2305 renderDbSqlForCLI(stdout
, zName
,
2306 pDb
->a
, pDb
->sz
, pSql
->a
, pSql
->sz
);
2309 createVFile("main.db", pDb
->sz
, pDb
->a
);
2310 sqlite3_randomness(0,0);
2311 if( ossFuzzThisDb
){
2312 #ifndef SQLITE_OSS_FUZZ
2313 fatalError("--oss-fuzz not supported: recompile"
2314 " with -DSQLITE_OSS_FUZZ");
2316 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t);
2317 LLVMFuzzerTestOneInput((const uint8_t*)pSql
->a
, (size_t)pSql
->sz
);
2320 openFlags
= SQLITE_OPEN_CREATE
| SQLITE_OPEN_READWRITE
;
2321 if( nativeFlag
&& pDb
->sz
==0 ){
2322 openFlags
|= SQLITE_OPEN_MEMORY
;
2325 rc
= sqlite3_open_v2("main.db", &db
, openFlags
, zVfs
);
2326 if( rc
) fatalError("cannot open inmem database");
2327 sqlite3_limit(db
, SQLITE_LIMIT_LENGTH
, 100000000);
2328 sqlite3_limit(db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 50);
2329 if( cellSzCkFlag
) runSql(db
, "PRAGMA cell_size_check=ON", runFlags
);
2330 setAlarm((iTimeout
+999)/1000);
2331 /* Enable test functions */
2332 sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS
, db
);
2333 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
2334 if( sqlFuzz
|| vdbeLimitFlag
){
2335 sqlite3_progress_handler(db
, 100000, progressHandler
,
2339 #ifdef SQLITE_TESTCTRL_PRNG_SEED
2340 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, db
);
2343 sqlite3_exec(db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
2346 runSql(db
, (char*)pSql
->a
, runFlags
);
2347 }while( timeoutTest
);
2349 sqlite3_exec(db
, "PRAGMA temp_store_directory=''", 0, 0, 0);
2352 if( sqlite3_memory_used()>0 ){
2353 fatalError("memory leak: %lld bytes outstanding",
2354 sqlite3_memory_used());
2359 sqlite3_int64 tmEnd
= timeOfDay();
2360 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2364 /* Simulate an error if the TEST_FAILURE environment variable is "5".
2365 ** This is used to verify that automated test script really do spot
2366 ** errors that occur in this test program.
2369 if( zFailCode
[0]=='5' && zFailCode
[1]==0 ){
2370 fatalError("simulated failure");
2371 }else if( zFailCode
[0]!=0 ){
2372 /* If TEST_FAILURE is something other than 5, just exit the test
2374 printf("\nExit early due to TEST_FAILURE being set\n");
2376 goto sourcedb_cleanup
;
2382 /* No progress output */
2383 }else if( bSpinner
){
2384 int nTotal
= g
.nDb
*g
.nSql
;
2385 printf("\r%s: %d/%d \n", zDbName
, nTotal
, nTotal
);
2386 }else if( !quietFlag
&& !verboseFlag
){
2387 printf(" 100%% - %d tests\n", g
.nDb
*g
.nSql
);
2390 /* Clean up at the end of processing a single source database
2393 blobListFree(g
.pFirstSql
);
2394 blobListFree(g
.pFirstDb
);
2397 } /* End loop over all source databases */
2399 if( !quietFlag
&& !bScript
){
2400 sqlite3_int64 iElapse
= timeOfDay() - iBegin
;
2402 printf("fuzzcheck: %u query invariants checked\n", g
.nInvariant
);
2404 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n"
2406 nTest
, (int)(iElapse
/1000), (int)(iElapse
%1000),
2407 sqlite3_libversion(), sqlite3_sourceid());