2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service.
3 ** (https://github.com/google/oss-fuzz)
11 /* Global debugging settings. OSS-Fuzz will have all debugging turned
12 ** off. But if LLVMFuzzerTestOneInput() is called interactively from
13 ** the ossshell utility program, then these flags might be set.
15 static unsigned mDebug
= 0;
16 #define FUZZ_SQL_TRACE 0x0001 /* Set an sqlite3_trace() callback */
17 #define FUZZ_SHOW_MAX_DELAY 0x0002 /* Show maximum progress callback delay */
18 #define FUZZ_SHOW_ERRORS 0x0004 /* Print error messages from SQLite */
20 /* The ossshell utility program invokes this interface to see the
21 ** debugging flags. Unused by OSS-Fuzz.
23 void ossfuzz_set_debug_flags(unsigned x
){
27 /* Return the current real-world time in milliseconds since the
28 ** Julian epoch (-4714-11-24).
30 static sqlite3_int64
timeOfDay(void){
31 static sqlite3_vfs
*clockVfs
= 0;
33 if( clockVfs
==0 ) clockVfs
= sqlite3_vfs_find(0);
34 if( clockVfs
->iVersion
>=2 && clockVfs
->xCurrentTimeInt64
!=0 ){
35 clockVfs
->xCurrentTimeInt64(clockVfs
, &t
);
38 clockVfs
->xCurrentTime(clockVfs
, &r
);
39 t
= (sqlite3_int64
)(r
*86400000.0);
44 /* An instance of the following object is passed by pointer as the
45 ** client data to various callbacks.
47 typedef struct FuzzCtx
{
48 sqlite3
*db
; /* The database connection */
49 sqlite3_int64 iCutoffTime
; /* Stop processing at this time. */
50 sqlite3_int64 iLastCb
; /* Time recorded for previous progress callback */
51 sqlite3_int64 mxInterval
; /* Longest interval between two progress calls */
52 unsigned nCb
; /* Number of progress callbacks */
55 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
57 ** Progress handler callback.
59 ** The argument is the cutoff-time after which all processing should
60 ** stop. So return non-zero if the cut-off time is exceeded.
62 static int progress_handler(void *pClientData
) {
63 FuzzCtx
*p
= (FuzzCtx
*)pClientData
;
64 sqlite3_int64 iNow
= timeOfDay();
65 int rc
= iNow
>=p
->iCutoffTime
;
66 sqlite3_int64 iDiff
= iNow
- p
->iLastCb
;
67 if( iDiff
> p
->mxInterval
) p
->mxInterval
= iDiff
;
74 ** Callback for sqlite3_exec().
76 static int exec_handler(void *pCnt
, int argc
, char **argv
, char **namev
){
79 for(i
=0; i
<argc
; i
++) sqlite3_free(sqlite3_mprintf("%s", argv
[i
]));
81 return ((*(int*)pCnt
)--)<=0;
85 ** Main entry point. The fuzzer invokes this function with each
88 int LLVMFuzzerTestOneInput(const uint8_t* data
, size_t size
) {
89 int execCnt
= 0; /* Abort row callback when count reaches zero */
90 char *zErrMsg
= 0; /* Error message returned by sqlite_exec() */
91 uint8_t uSelector
; /* First byte of input data[] */
92 int rc
; /* Return code from various interfaces */
93 char *zSql
; /* Zero-terminated copy of data[] */
94 FuzzCtx cx
; /* Fuzzing context */
96 memset(&cx
, 0, sizeof(cx
));
97 if( size
<3 ) return 0; /* Early out if unsufficient data */
99 /* Extract the selector byte from the beginning of the input. But only
100 ** do this if the second byte is a \n. If the second byte is not \n,
101 ** then use a default selector */
103 uSelector
= data
[0]; data
+= 2; size
-= 2;
108 /* Open the database connection. Only use an in-memory database. */
109 rc
= sqlite3_open_v2("fuzz.db", &cx
.db
,
110 SQLITE_OPEN_READWRITE
| SQLITE_OPEN_CREATE
| SQLITE_OPEN_MEMORY
, 0);
113 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
114 /* Invoke the progress handler frequently to check to see if we
115 ** are taking too long. The progress handler will return true
116 ** (which will block further processing) if more than 10 seconds have
117 ** elapsed since the start of the test.
119 cx
.iLastCb
= timeOfDay();
120 cx
.iCutoffTime
= cx
.iLastCb
+ 10000; /* Now + 10 seconds */
121 sqlite3_progress_handler(cx
.db
, 10, progress_handler
, (void*)&cx
);
124 /* Set a limit on the maximum size of a prepared statement */
125 sqlite3_limit(cx
.db
, SQLITE_LIMIT_VDBE_OP
, 25000);
127 /* Bit 1 of the selector enables foreign key constraints */
128 sqlite3_db_config(cx
.db
, SQLITE_DBCONFIG_ENABLE_FKEY
, uSelector
&1, &rc
);
131 /* Remaining bits of the selector determine a limit on the number of
133 execCnt
= uSelector
+ 1;
135 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated
136 ** string, so make a copy. */
137 zSql
= sqlite3_mprintf("%.*s", (int)size
, data
);
138 sqlite3_exec(cx
.db
, zSql
, exec_handler
, (void*)&execCnt
, &zErrMsg
);
140 /* Show any errors */
141 if( (mDebug
& FUZZ_SHOW_ERRORS
)!=0 && zErrMsg
){
142 printf("Error: %s\n", zErrMsg
);
145 /* Cleanup and return */
146 sqlite3_free(zErrMsg
);
148 sqlite3_exec(cx
.db
, "PRAGMA temp_store_directory=''", 0, 0, 0);
149 sqlite3_close(cx
.db
);
151 if( mDebug
& FUZZ_SHOW_MAX_DELAY
){
152 printf("Progress callback count....... %d\n", cx
.nCb
);
153 printf("Max time between callbacks.... %d ms\n", (int)cx
.mxInterval
);