test/ossfuzz.c

   1 /*
   2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service.
   3 ** (https://github.com/google/oss-fuzz)
   4 */
   5 #include <stddef.h>
   6 #include <stdint.h>
   7 #include <stdio.h>
   8 #include <string.h>
   9 #include "sqlite3.h"
  10
  11 /* Global debugging settings.  OSS-Fuzz will have all debugging turned
  12 ** off.  But if LLVMFuzzerTestOneInput() is called interactively from
  13 ** the ossshell utility program, then these flags might be set.
  14 */
  15 static unsigned mDebug = 0;
  16 #define FUZZ_SQL_TRACE       0x0001   /* Set an sqlite3_trace() callback */
  17 #define FUZZ_SHOW_MAX_DELAY  0x0002   /* Show maximum progress callback delay */
  18 #define FUZZ_SHOW_ERRORS     0x0004   /* Print error messages from SQLite */
  19
  20 /* The ossshell utility program invokes this interface to see the
  21 ** debugging flags.  Unused by OSS-Fuzz.
  22 */
  23 void ossfuzz_set_debug_flags(unsigned x){
  24   mDebug = x;
  25 }
  26
  27 /* Return the current real-world time in milliseconds since the
  28 ** Julian epoch (-4714-11-24).
  29 */
  30 static sqlite3_int64 timeOfDay(void){
  31   static sqlite3_vfs *clockVfs = 0;
  32   sqlite3_int64 t;
  33   if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0);
  34   if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){
  35     clockVfs->xCurrentTimeInt64(clockVfs, &t);
  36   }else{
  37     double r;
  38     clockVfs->xCurrentTime(clockVfs, &r);
  39     t = (sqlite3_int64)(r*86400000.0);
  40   }
  41   return t;
  42 }
  43
  44 /* An instance of the following object is passed by pointer as the
  45 ** client data to various callbacks.
  46 */
  47 typedef struct FuzzCtx {
  48   sqlite3 *db;               /* The database connection */
  49   sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
  50   sqlite3_int64 iLastCb;     /* Time recorded for previous progress callback */
  51   sqlite3_int64 mxInterval;  /* Longest interval between two progress calls */
  52   unsigned nCb;              /* Number of progress callbacks */
  53 } FuzzCtx;
  54
  55 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
  56 /*
  57 ** Progress handler callback.
  58 **
  59 ** The argument is the cutoff-time after which all processing should
  60 ** stop.  So return non-zero if the cut-off time is exceeded.
  61 */
  62 static int progress_handler(void *pClientData) {
  63   FuzzCtx *p = (FuzzCtx*)pClientData;
  64   sqlite3_int64 iNow = timeOfDay();
  65   int rc = iNow>=p->iCutoffTime;
  66   sqlite3_int64 iDiff = iNow - p->iLastCb;
  67   if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
  68   p->nCb++;
  69   return rc;
  70 }
  71 #endif
  72
  73 /*
  74 ** Callback for sqlite3_exec().
  75 */
  76 static int exec_handler(void *pCnt, int argc, char **argv, char **namev){
  77   int i;
  78   if( argv ){
  79     for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i]));
  80   }
  81   return ((*(int*)pCnt)--)<=0;
  82 }
  83
  84 /*
  85 ** Main entry point.  The fuzzer invokes this function with each
  86 ** fuzzed input.
  87 */
  88 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  89   int execCnt = 0;         /* Abort row callback when count reaches zero */
  90   char *zErrMsg = 0;       /* Error message returned by sqlite_exec() */
  91   uint8_t uSelector;       /* First byte of input data[] */
  92   int rc;                  /* Return code from various interfaces */
  93   char *zSql;              /* Zero-terminated copy of data[] */
  94   FuzzCtx cx;              /* Fuzzing context */
  95
  96   memset(&cx, 0, sizeof(cx));
  97   if( size<3 ) return 0;   /* Early out if unsufficient data */
  98
  99   /* Extract the selector byte from the beginning of the input.  But only
 100   ** do this if the second byte is a \n.  If the second byte is not \n,
 101   ** then use a default selector */
 102   if( data[1]=='\n' ){
 103     uSelector = data[0];  data += 2; size -= 2;
 104   }else{
 105     uSelector = 0xfd;
 106   }
 107
 108   /* Open the database connection.  Only use an in-memory database. */
 109   rc = sqlite3_open_v2("fuzz.db", &cx.db,
 110            SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0);
 111   if( rc ) return 0;
 112
 113 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
 114   /* Invoke the progress handler frequently to check to see if we
 115   ** are taking too long.  The progress handler will return true
 116   ** (which will block further processing) if more than 10 seconds have
 117   ** elapsed since the start of the test.
 118   */
 119   cx.iLastCb = timeOfDay();
 120   cx.iCutoffTime = cx.iLastCb + 10000;  /* Now + 10 seconds */
 121   sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
 122 #endif
 123
 124   /* Set a limit on the maximum size of a prepared statement */
 125   sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000);
 126
 127   /* Bit 1 of the selector enables foreign key constraints */
 128   sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc);
 129   uSelector >>= 1;
 130
 131   /* Remaining bits of the selector determine a limit on the number of
 132   ** output rows */
 133   execCnt = uSelector + 1;
 134
 135   /* Run the SQL.  The sqlite_exec() interface expects a zero-terminated
 136   ** string, so make a copy. */
 137   zSql = sqlite3_mprintf("%.*s", (int)size, data);
 138   sqlite3_exec(cx.db, zSql, exec_handler, (void*)&execCnt, &zErrMsg);
 139
 140   /* Show any errors */
 141   if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){
 142     printf("Error: %s\n", zErrMsg);
 143   }
 144
 145   /* Cleanup and return */
 146   sqlite3_free(zErrMsg);
 147   sqlite3_free(zSql);
 148   sqlite3_exec(cx.db, "PRAGMA temp_store_directory=''", 0, 0, 0);
 149   sqlite3_close(cx.db);
 150
 151   if( mDebug & FUZZ_SHOW_MAX_DELAY ){
 152     printf("Progress callback count....... %d\n", cx.nCb);
 153     printf("Max time between callbacks.... %d ms\n", (int)cx.mxInterval);
 154   }
 155   return 0;
 156 }