4 ** The author disclaims copyright to this source code. In place of
5 ** a legal notice, here is a blessing:
7 ** May you do good and not evil.
8 ** May you find forgiveness for yourself and forgive others.
9 ** May you share freely, never taking more than you give.
11 *************************************************************************
13 ** This is a utility program designed to aid running regressions tests on
14 ** the SQLite library using data from external fuzzers.
16 ** This program reads content from an SQLite database file with the following
20 ** dbid INTEGER PRIMARY KEY, -- database id
21 ** dbcontent BLOB -- database disk file image
24 ** sqlid INTEGER PRIMARY KEY, -- SQL script id
25 ** sqltext TEXT -- Text of SQL statements to run
27 ** CREATE TABLE IF NOT EXISTS readme(
28 ** msg TEXT -- Human-readable description of this test collection
31 ** For each database file in the DB table, the SQL text in the XSQL table
32 ** is run against that database. All README.MSG values are printed prior
33 ** to the start of the test (unless the --quiet option is used). If the
34 ** DB table is empty, then all entries in XSQL are run against an empty
35 ** in-memory database.
37 ** This program is looking for crashes, assertion faults, and/or memory leaks.
38 ** No attempt is made to verify the output. The assumption is that either all
39 ** of the database files or all of the SQL statements are malformed inputs,
40 ** generated by a fuzzer, that need to be checked to make sure they do not
41 ** present a security risk.
43 ** This program also includes some command-line options to help with
44 ** creation and maintenance of the source content database. The command
46 ** ./fuzzcheck database.db --load-sql FILE...
48 ** Loads all FILE... arguments into the XSQL table. The --load-db option
49 ** works the same but loads the files into the DB table. The -m option can
50 ** be used to initialize the README table. The "database.db" file is created
51 ** if it does not previously exist. Example:
53 ** ./fuzzcheck new.db --load-sql *.sql
54 ** ./fuzzcheck new.db --load-db *.db
55 ** ./fuzzcheck new.db -m 'New test cases'
57 ** The three commands above will create the "new.db" file and initialize all
58 ** tables. Then do "./fuzzcheck new.db" to run the tests.
62 ** If fuzzcheck does crash, it can be run in the debugger and the content
63 ** of the global variable g.zTextName[] will identify the specific XSQL and
64 ** DB values that were running when the crash occurred.
66 ** DBSQLFUZZ: (Added 2020-02-25)
68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against
69 ** that database in its input. This utility can now process dbsqlfuzz
70 ** input files. Load such files using the "--load-dbsql FILE ..." command-line
73 ** Dbsqlfuzz inputs are ordinary text. The first part of the file is text
74 ** that describes the content of the database (using a lot of hexadecimal),
75 ** then there is a divider line followed by the SQL to run against the
76 ** database. Because they are ordinary text, dbsqlfuzz inputs are stored
77 ** in the XSQL table, as if they were ordinary SQL inputs. The isDbSql()
78 ** function can look at a text string and determine whether or not it is
79 ** a valid dbsqlfuzz input.
88 #include "sqlite3recover.h"
89 #define ISSPACE(X) isspace((unsigned char)(X))
90 #define ISDIGIT(X) isdigit((unsigned char)(X))
99 #if !defined(_MSC_VER)
103 #if defined(_MSC_VER)
104 typedef unsigned char uint8_t;
108 ** Files in the virtual file system.
110 typedef struct VFile VFile
;
112 char *zFilename
; /* Filename. NULL for delete-on-close. From malloc() */
113 int sz
; /* Size of the file in bytes */
114 int nRef
; /* Number of references to this file */
115 unsigned char *a
; /* Content of the file. From malloc() */
117 typedef struct VHandle VHandle
;
119 sqlite3_file base
; /* Base class. Must be first */
120 VFile
*pVFile
; /* The underlying file */
124 ** The value of a database file template, or of an SQL script
126 typedef struct Blob Blob
;
128 Blob
*pNext
; /* Next in a list */
129 int id
; /* Id of this Blob */
130 int seq
; /* Sequence number */
131 int sz
; /* Size of this Blob in bytes */
132 unsigned char a
[1]; /* Blob content. Extra space allocated as needed. */
136 ** Maximum number of files in the in-memory virtual filesystem.
141 ** Maximum allowed file size
143 #define MX_FILE_SZ 10000000
146 ** All global variables are gathered into the "g" singleton.
148 static struct GlobalVars
{
149 const char *zArgv0
; /* Name of program */
150 const char *zDbFile
; /* Name of database file */
151 VFile aFile
[MX_FILE
]; /* The virtual filesystem */
152 int nDb
; /* Number of template databases */
153 Blob
*pFirstDb
; /* Content of first template database */
154 int nSql
; /* Number of SQL scripts */
155 Blob
*pFirstSql
; /* First SQL script */
156 unsigned int uRandom
; /* Seed for the SQLite PRNG */
157 unsigned int nInvariant
; /* Number of invariant checks run */
158 char zTestName
[100]; /* Name of current test */
162 ** Include the external vt02.c and randomjson.c modules.
164 extern int sqlite3_vt02_init(sqlite3
*,char***,void*);
165 extern int sqlite3_randomjson_init(sqlite3
*,char***,void*);
169 ** Print an error message and quit.
171 static void fatalError(const char *zFormat
, ...){
173 fprintf(stderr
, "%s", g
.zArgv0
);
174 if( g
.zDbFile
) fprintf(stderr
, " %s", g
.zDbFile
);
175 if( g
.zTestName
[0] ) fprintf(stderr
, " (%s)", g
.zTestName
);
176 fprintf(stderr
, ": ");
177 va_start(ap
, zFormat
);
178 vfprintf(stderr
, zFormat
, ap
);
180 fprintf(stderr
, "\n");
188 static void signalHandler(int signum
){
190 if( signum
==SIGABRT
){
192 }else if( signum
==SIGALRM
){
194 }else if( signum
==SIGSEGV
){
204 ** Set the an alarm to go off after N seconds. Disable the alarm
207 static void setAlarm(int N
){
215 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
217 ** This an SQL progress handler. After an SQL statement has run for
218 ** many steps, we want to interrupt it. This guards against infinite
219 ** loops from recursive common table expressions.
221 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used.
222 ** In that case, hitting the progress handler is a fatal error.
224 static int progressHandler(void *pVdbeLimitFlag
){
225 if( *(int*)pVdbeLimitFlag
) fatalError("too many VDBE cycles");
231 ** Reallocate memory. Show an error and quit if unable.
233 static void *safe_realloc(void *pOld
, int szNew
){
234 void *pNew
= realloc(pOld
, szNew
<=0 ? 1 : szNew
);
235 if( pNew
==0 ) fatalError("unable to realloc for %d bytes", szNew
);
240 ** Initialize the virtual file system.
242 static void formatVfs(void){
244 for(i
=0; i
<MX_FILE
; i
++){
246 g
.aFile
[i
].zFilename
= 0;
254 ** Erase all information in the virtual file system.
256 static void reformatVfs(void){
258 for(i
=0; i
<MX_FILE
; i
++){
259 if( g
.aFile
[i
].sz
<0 ) continue;
260 if( g
.aFile
[i
].zFilename
){
261 free(g
.aFile
[i
].zFilename
);
262 g
.aFile
[i
].zFilename
= 0;
264 if( g
.aFile
[i
].nRef
>0 ){
265 fatalError("file %d still open. nRef=%d", i
, g
.aFile
[i
].nRef
);
275 ** Find a VFile by name
277 static VFile
*findVFile(const char *zName
){
279 if( zName
==0 ) return 0;
280 for(i
=0; i
<MX_FILE
; i
++){
281 if( g
.aFile
[i
].zFilename
==0 ) continue;
282 if( strcmp(g
.aFile
[i
].zFilename
, zName
)==0 ) return &g
.aFile
[i
];
288 ** Find a VFile by name. Create it if it does not already exist and
289 ** initialize it to the size and content given.
291 ** Return NULL only if the filesystem is full.
293 static VFile
*createVFile(const char *zName
, int sz
, unsigned char *pData
){
294 VFile
*pNew
= findVFile(zName
);
296 if( pNew
) return pNew
;
297 for(i
=0; i
<MX_FILE
&& g
.aFile
[i
].sz
>=0; i
++){}
298 if( i
>=MX_FILE
) return 0;
301 int nName
= (int)strlen(zName
)+1;
302 pNew
->zFilename
= safe_realloc(0, nName
);
303 memcpy(pNew
->zFilename
, zName
, nName
);
309 pNew
->a
= safe_realloc(0, sz
);
310 if( sz
>0 ) memcpy(pNew
->a
, pData
, sz
);
314 /* Return true if the line is all zeros */
315 static int allZero(unsigned char *aLine
){
317 for(i
=0; i
<16 && aLine
[i
]==0; i
++){}
322 ** Render a database and query as text that can be input into
325 static void renderDbSqlForCLI(
326 FILE *out
, /* Write to this file */
327 const char *zFile
, /* Name of the database file */
328 unsigned char *aDb
, /* Database content */
329 int nDb
, /* Number of bytes in aDb[] */
330 unsigned char *zSql
, /* SQL content */
331 int nSql
/* Bytes of SQL */
333 fprintf(out
, ".print ******* %s *******\n", zFile
);
335 int i
, j
; /* Loop counters */
336 int pgsz
; /* Size of each page */
337 int lastPage
= 0; /* Last page number shown */
338 int iPage
; /* Current page number */
339 unsigned char *aLine
; /* Single line to display */
340 unsigned char buf
[16]; /* Fake line */
341 unsigned char bShow
[256]; /* Characters ok to display */
343 memset(bShow
, '.', sizeof(bShow
));
344 for(i
=' '; i
<='~'; i
++){
345 if( i
!='{' && i
!='}' && i
!='"' && i
!='\\' ) bShow
[i
] = i
;
347 pgsz
= (aDb
[16]<<8) | aDb
[17];
348 if( pgsz
==0 ) pgsz
= 65536;
349 if( pgsz
<512 || (pgsz
&(pgsz
-1))!=0 ) pgsz
= 4096;
350 fprintf(out
,".open --hexdb\n");
351 fprintf(out
,"| size %d pagesize %d filename %s\n",nDb
,pgsz
,zFile
);
352 for(i
=0; i
<nDb
; i
+= 16){
354 memset(buf
, 0, sizeof(buf
));
355 memcpy(buf
, aDb
+i
, nDb
-i
);
360 if( allZero(aLine
) ) continue;
362 if( lastPage
!=iPage
){
363 fprintf(out
,"| page %d offset %d\n", iPage
, (iPage
-1)*pgsz
);
366 fprintf(out
,"| %5d:", i
-(iPage
-1)*pgsz
);
367 for(j
=0; j
<16; j
++) fprintf(out
," %02x", aLine
[j
]);
370 unsigned char c
= (unsigned char)aLine
[j
];
371 fputc( bShow
[c
], stdout
);
375 fprintf(out
,"| end %s\n", zFile
);
377 fprintf(out
,".open :memory:\n");
379 fprintf(out
,".testctrl prng_seed 1 db\n");
380 fprintf(out
,".testctrl internal_functions\n");
381 fprintf(out
,"%.*s", nSql
, zSql
);
382 if( nSql
>0 && zSql
[nSql
-1]!='\n' ) fprintf(out
, "\n");
386 ** Read the complete content of a file into memory. Add a 0x00 terminator
387 ** and return a pointer to the result.
389 ** The file content is held in memory obtained from sqlite_malloc64() which
390 ** should be freed by the caller.
392 static char *readFile(const char *zFilename
, long *sz
){
398 if( zFilename
==0 ) return 0;
399 in
= fopen(zFilename
, "rb");
400 if( in
==0 ) return 0;
401 fseek(in
, 0, SEEK_END
);
402 *sz
= nIn
= ftell(in
);
404 pBuf
= sqlite3_malloc64( nIn
+1 );
405 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
418 ** Implementation of the "readfile(X)" SQL function. The entire content
419 ** of the file named X is read and returned as a BLOB. NULL is returned
420 ** if the file does not exist or is unreadable.
422 static void readfileFunc(
423 sqlite3_context
*context
,
429 const char *zName
= (const char*)sqlite3_value_text(argv
[0]);
431 if( zName
==0 ) return;
432 pBuf
= readFile(zName
, &nIn
);
434 sqlite3_result_blob(context
, pBuf
, nIn
, sqlite3_free
);
439 ** Implementation of the "readtextfile(X)" SQL function. The text content
440 ** of the file named X through the end of the file or to the first \000
441 ** character, whichever comes first, is read and returned as TEXT. NULL
442 ** is returned if the file does not exist or is unreadable.
444 static void readtextfileFunc(
445 sqlite3_context
*context
,
454 zName
= (const char*)sqlite3_value_text(argv
[0]);
455 if( zName
==0 ) return;
456 in
= fopen(zName
, "rb");
458 fseek(in
, 0, SEEK_END
);
461 pBuf
= sqlite3_malloc64( nIn
+1 );
462 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
464 sqlite3_result_text(context
, pBuf
, -1, sqlite3_free
);
472 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y
473 ** is written into file X. The number of bytes written is returned. Or
474 ** NULL is returned if something goes wrong, such as being unable to open
475 ** file X for writing.
477 static void writefileFunc(
478 sqlite3_context
*context
,
488 zFile
= (const char*)sqlite3_value_text(argv
[0]);
489 if( zFile
==0 ) return;
490 out
= fopen(zFile
, "wb");
492 z
= (const char*)sqlite3_value_blob(argv
[1]);
496 rc
= fwrite(z
, 1, sqlite3_value_bytes(argv
[1]), out
);
499 sqlite3_result_int64(context
, rc
);
504 ** Load a list of Blob objects from the database
506 static void blobListLoadFromDb(
507 sqlite3
*db
, /* Read from this database */
508 const char *zSql
, /* Query used to extract the blobs */
509 int onlyId
, /* Only load where id is this value */
510 int *pN
, /* OUT: Write number of blobs loaded here */
511 Blob
**ppList
/* OUT: Write the head of the blob list here */
521 z2
= sqlite3_mprintf("%s WHERE rowid=%d", zSql
, onlyId
);
523 z2
= sqlite3_mprintf("%s", zSql
);
525 rc
= sqlite3_prepare_v2(db
, z2
, -1, &pStmt
, 0);
527 if( rc
) fatalError("%s", sqlite3_errmsg(db
));
530 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
531 int sz
= sqlite3_column_bytes(pStmt
, 1);
532 Blob
*pNew
= safe_realloc(0, sizeof(*pNew
)+sz
);
533 pNew
->id
= sqlite3_column_int(pStmt
, 0);
537 memcpy(pNew
->a
, sqlite3_column_blob(pStmt
,1), sz
);
542 sqlite3_finalize(pStmt
);
544 *ppList
= head
.pNext
;
548 ** Free a list of Blob objects
550 static void blobListFree(Blob
*p
){
559 /* Return the current wall-clock time
561 ** The number of milliseconds since the julian epoch.
562 ** 1907-01-01 00:00:00 -> 210866716800000
563 ** 2021-01-01 00:00:00 -> 212476176000000
565 static sqlite3_int64
timeOfDay(void){
566 static sqlite3_vfs
*clockVfs
= 0;
569 clockVfs
= sqlite3_vfs_find(0);
570 if( clockVfs
==0 ) return 0;
572 if( clockVfs
->iVersion
>=1 && clockVfs
->xCurrentTimeInt64
!=0 ){
573 clockVfs
->xCurrentTimeInt64(clockVfs
, &t
);
576 clockVfs
->xCurrentTime(clockVfs
, &r
);
577 t
= (sqlite3_int64
)(r
*86400000.0);
582 /***************************************************************************
583 ** Code to process combined database+SQL scripts generated by the
587 /* An instance of the following object is passed by pointer as the
588 ** client data to various callbacks.
590 typedef struct FuzzCtx
{
591 sqlite3
*db
; /* The database connection */
592 sqlite3_int64 iCutoffTime
; /* Stop processing at this time. */
593 sqlite3_int64 iLastCb
; /* Time recorded for previous progress callback */
594 sqlite3_int64 mxInterval
; /* Longest interval between two progress calls */
595 unsigned nCb
; /* Number of progress callbacks */
596 unsigned mxCb
; /* Maximum number of progress callbacks allowed */
597 unsigned execCnt
; /* Number of calls to the sqlite3_exec callback */
598 int timeoutHit
; /* True when reaching a timeout */
601 /* Verbosity level for the dbsqlfuzz test runner */
602 static int eVerbosity
= 0;
604 /* True to activate PRAGMA vdbe_debug=on */
605 static int bVdbeDebug
= 0;
607 /* Timeout for each fuzzing attempt, in milliseconds */
608 static int giTimeout
= 10000; /* Defaults to 10 seconds */
610 /* Maximum number of progress handler callbacks */
611 static unsigned int mxProgressCb
= 2000;
613 /* Maximum string length in SQLite */
614 static int lengthLimit
= 1000000;
616 /* Maximum expression depth */
617 static int depthLimit
= 500;
619 /* Limit on the amount of heap memory that can be used */
620 static sqlite3_int64 heapLimit
= 100000000;
622 /* Maximum byte-code program length in SQLite */
623 static int vdbeOpLimit
= 25000;
625 /* Maximum size of the in-memory database */
626 static sqlite3_int64 maxDbSize
= 104857600;
627 /* OOM simulation parameters */
628 static unsigned int oomCounter
= 0; /* Simulate OOM when equals 1 */
629 static unsigned int oomRepeat
= 0; /* Number of OOMs in a row */
630 static void*(*defaultMalloc
)(int) = 0; /* The low-level malloc routine */
632 /* Enable recovery */
633 static int bNoRecover
= 0;
635 /* This routine is called when a simulated OOM occurs. It is broken
636 ** out as a separate routine to make it easy to set a breakpoint on
641 printf("Simulated OOM fault\n");
650 /* This routine is a replacement malloc() that is used to simulate
651 ** Out-Of-Memory (OOM) errors for testing purposes.
653 static void *oomMalloc(int nByte
){
662 return defaultMalloc(nByte
);
665 /* Register the OOM simulator. This must occur before any memory
667 static void registerOomSimulator(void){
668 sqlite3_mem_methods mem
;
670 sqlite3_config(SQLITE_CONFIG_GETMALLOC
, &mem
);
671 defaultMalloc
= mem
.xMalloc
;
672 mem
.xMalloc
= oomMalloc
;
673 sqlite3_config(SQLITE_CONFIG_MALLOC
, &mem
);
676 /* Turn off any pending OOM simulation */
677 static void disableOom(void){
683 ** Translate a single byte of Hex into an integer.
684 ** This routine only works if h really is a valid hexadecimal
685 ** character: 0..9a..fA..F
687 static unsigned char hexToInt(unsigned int h
){
689 h
+= 9*(1&~(h
>>4)); /* EBCDIC */
691 h
+= 9*(1&(h
>>6)); /* ASCII */
697 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine
698 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it
699 ** does it makes corresponding changes to the *pK value and *pI value
700 ** and returns true. If the input buffer does not match the patterns,
701 ** no changes are made to either *pK or *pI and this routine returns false.
704 const unsigned char *zIn
, /* Text input */
705 int nIn
, /* Bytes of input */
706 unsigned int *pK
, /* half-byte cursor to adjust */
707 unsigned int *pI
/* Input index to adjust */
712 for(i
=1; i
<nIn
&& (c
= zIn
[i
])!=']'; i
++){
713 if( !isxdigit(c
) ) return 0;
714 k
= k
*16 + hexToInt(c
);
716 if( i
==nIn
) return 0;
723 ** Decode the text starting at zIn into a binary database file.
724 ** The maximum length of zIn is nIn bytes. Store the binary database
725 ** file in space obtained from sqlite3_malloc().
727 ** Return the number of bytes of zIn consumed. Or return -1 if there
728 ** is an error. One potential error is that the recipe specifies a
729 ** database file larger than MX_FILE_SZ bytes.
733 static int decodeDatabase(
734 const unsigned char *zIn
, /* Input text to be decoded */
735 int nIn
, /* Bytes of input text */
736 unsigned char **paDecode
, /* OUT: decoded database file */
737 int *pnDecode
/* OUT: Size of decoded database */
739 unsigned char *a
, *aNew
; /* Database under construction */
740 int mx
= 0; /* Current size of the database */
741 sqlite3_uint64 nAlloc
= 4096; /* Space allocated in a[] */
742 unsigned int i
; /* Next byte of zIn[] to read */
743 unsigned int j
; /* Temporary integer */
744 unsigned int k
; /* half-byte cursor index for output */
745 unsigned int n
; /* Number of bytes of input */
747 if( nIn
<4 ) return -1;
748 n
= (unsigned int)nIn
;
749 a
= sqlite3_malloc64( nAlloc
);
751 fprintf(stderr
, "Out of memory!\n");
754 memset(a
, 0, (size_t)nAlloc
);
755 for(i
=k
=0; i
<n
; i
++){
756 unsigned char c
= (unsigned char)zIn
[i
];
765 sqlite3_uint64 newSize
;
766 if( nAlloc
==MX_FILE_SZ
|| j
>=MX_FILE_SZ
){
768 fprintf(stderr
, "Input database too big: max %d bytes\n",
776 newSize
= (j
+4096)&~4095;
778 if( newSize
>MX_FILE_SZ
){
783 newSize
= MX_FILE_SZ
;
785 aNew
= sqlite3_realloc64( a
, newSize
);
791 assert( newSize
> nAlloc
);
792 memset(a
+nAlloc
, 0, (size_t)(newSize
- nAlloc
));
795 if( j
>=(unsigned)mx
){
796 mx
= (j
+ 4095)&~4095;
797 if( mx
>MX_FILE_SZ
) mx
= MX_FILE_SZ
;
802 }else if( zIn
[i
]=='[' && i
<n
-3 && isOffset(zIn
+i
, nIn
-i
, &k
, &i
) ){
804 }else if( zIn
[i
]=='\n' && i
<n
-4 && memcmp(zIn
+i
,"\n--\n",4)==0 ){
815 ** Progress handler callback.
817 ** The argument is the cutoff-time after which all processing should
818 ** stop. So return non-zero if the cut-off time is exceeded.
820 static int progress_handler(void *pClientData
) {
821 FuzzCtx
*p
= (FuzzCtx
*)pClientData
;
822 sqlite3_int64 iNow
= timeOfDay();
823 int rc
= iNow
>=p
->iCutoffTime
;
824 sqlite3_int64 iDiff
= iNow
- p
->iLastCb
;
825 /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */
826 if( iDiff
> p
->mxInterval
) p
->mxInterval
= iDiff
;
828 if( rc
==0 && p
->mxCb
>0 && p
->mxCb
<=p
->nCb
) rc
= 1;
829 if( rc
&& !p
->timeoutHit
&& eVerbosity
>=2 ){
830 printf("Timeout on progress callback %d\n", p
->nCb
);
838 ** Flag bits set by block_troublesome_sql()
840 #define BTS_SELECT 0x000001
841 #define BTS_NONSELECT 0x000002
842 #define BTS_BADFUNC 0x000004
843 #define BTS_BADPRAGMA 0x000008 /* Sticky for rest of the script */
846 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
847 ** "PRAGMA parser_trace" since they can dramatically increase the
848 ** amount of output without actually testing anything useful.
850 ** Also block ATTACH if attaching a file from the filesystem.
852 static int block_troublesome_sql(
860 unsigned int *pBtsFlags
= (unsigned int*)pClientData
;
865 case SQLITE_PRAGMA
: {
866 if( sqlite3_stricmp("busy_timeout",zArg1
)==0
867 && (zArg2
==0 || strtoll(zArg2
,0,0)>100 || strtoll(zArg2
,0,10)>100)
870 }else if( sqlite3_stricmp("hard_heap_limit", zArg1
)==0
871 || sqlite3_stricmp("reverse_unordered_selects", zArg1
)==0
873 /* BTS_BADPRAGMA is sticky. A hard_heap_limit or
874 ** revert_unordered_selects should inhibit all future attempts
875 ** at verifying query invariants */
876 *pBtsFlags
|= BTS_BADPRAGMA
;
877 }else if( eVerbosity
==0 ){
878 if( sqlite3_strnicmp("vdbe_", zArg1
, 5)==0
879 || sqlite3_stricmp("parser_trace", zArg1
)==0
880 || sqlite3_stricmp("temp_store_directory", zArg1
)==0
884 }else if( sqlite3_stricmp("oom",zArg1
)==0
885 && zArg2
!=0 && zArg2
[0]!=0 ){
886 oomCounter
= atoi(zArg2
);
888 *pBtsFlags
|= BTS_NONSELECT
;
891 case SQLITE_ATTACH
: {
892 /* Deny the ATTACH if it is attaching anything other than an in-memory
894 *pBtsFlags
|= BTS_NONSELECT
;
895 if( zArg1
==0 ) return SQLITE_DENY
;
896 if( strcmp(zArg1
,":memory:")==0 ) return SQLITE_OK
;
897 if( sqlite3_strglob("file:*[?]vfs=memdb", zArg1
)==0
898 && sqlite3_strglob("file:*[^/a-zA-Z0-9_.]*[?]vfs=memdb", zArg1
)!=0
904 case SQLITE_SELECT
: {
905 *pBtsFlags
|= BTS_SELECT
;
908 case SQLITE_FUNCTION
: {
909 static const char *azBadFuncs
[] = {
921 "geopoly_group_bbox",
923 "implies_nonnull_row",
948 last
= sizeof(azBadFuncs
)/sizeof(azBadFuncs
[0]) - 1;
950 int mid
= (first
+last
)/2;
951 int c
= sqlite3_stricmp(azBadFuncs
[mid
], zArg2
);
957 *pBtsFlags
|= BTS_BADFUNC
;
960 }while( first
<=last
);
968 *pBtsFlags
|= BTS_NONSELECT
;
974 /* Implementation found in fuzzinvariant.c */
975 extern int fuzz_invariant(
976 sqlite3
*db
, /* The database connection */
977 sqlite3_stmt
*pStmt
, /* Test statement stopped on an SQLITE_ROW */
978 int iCnt
, /* Invariant sequence number, starting at 0 */
979 int iRow
, /* The row number for pStmt */
980 int nRow
, /* Total number of output rows */
981 int *pbCorrupt
, /* IN/OUT: Flag indicating a corrupt database file */
982 int eVerbosity
/* How much debugging output */
985 /* Implementation of sqlite_dbdata and sqlite_dbptr */
986 extern int sqlite3_dbdata_init(sqlite3
*,const char**,void*);
990 ** This function is used as a callback by the recover extension. Simply
991 ** print the supplied SQL statement to stdout.
993 static int recoverSqlCb(void *pCtx
, const char *zSql
){
995 printf("%s\n", zSql
);
1001 ** This function is called to recover data from the database.
1003 static int recoverDatabase(sqlite3
*db
){
1004 int rc
; /* Return code from this routine */
1005 const char *zRecoveryDb
= ""; /* Name of "recovery" database */
1006 const char *zLAF
= "lost_and_found"; /* Name of "lost_and_found" table */
1007 int bFreelist
= 1; /* True to scan the freelist */
1008 int bRowids
= 1; /* True to restore ROWID values */
1009 sqlite3_recover
*p
= 0; /* The recovery object */
1011 p
= sqlite3_recover_init_sql(db
, "main", recoverSqlCb
, 0);
1012 sqlite3_recover_config(p
, 789, (void*)zRecoveryDb
);
1013 sqlite3_recover_config(p
, SQLITE_RECOVER_LOST_AND_FOUND
, (void*)zLAF
);
1014 sqlite3_recover_config(p
, SQLITE_RECOVER_ROWIDS
, (void*)&bRowids
);
1015 sqlite3_recover_config(p
, SQLITE_RECOVER_FREELIST_CORRUPT
,(void*)&bFreelist
);
1016 sqlite3_recover_run(p
);
1017 if( sqlite3_recover_errcode(p
)!=SQLITE_OK
){
1018 const char *zErr
= sqlite3_recover_errmsg(p
);
1019 int errCode
= sqlite3_recover_errcode(p
);
1021 printf("recovery error: %s (%d)\n", zErr
, errCode
);
1024 rc
= sqlite3_recover_finish(p
);
1025 if( eVerbosity
>0 && rc
){
1026 printf("recovery returns error code %d\n", rc
);
1034 static int runDbSql(sqlite3
*db
, const char *zSql
, unsigned int *pBtsFlags
){
1036 sqlite3_stmt
*pStmt
;
1038 while( isspace(zSql
[0]&0x7f) ) zSql
++;
1039 if( zSql
[0]==0 ) return SQLITE_OK
;
1040 if( eVerbosity
>=4 ){
1041 printf("RUNNING-SQL: [%s]\n", zSql
);
1044 (*pBtsFlags
) &= BTS_BADPRAGMA
;
1045 rc
= sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, 0);
1046 if( rc
==SQLITE_OK
){
1048 while( (rc
= sqlite3_step(pStmt
))==SQLITE_ROW
){
1050 if( eVerbosity
>=4 ){
1052 for(j
=0; j
<sqlite3_column_count(pStmt
); j
++){
1053 if( j
) printf(",");
1054 switch( sqlite3_column_type(pStmt
, j
) ){
1059 case SQLITE_INTEGER
:
1060 case SQLITE_FLOAT
: {
1061 printf("%s", sqlite3_column_text(pStmt
, j
));
1065 int n
= sqlite3_column_bytes(pStmt
, j
);
1067 const unsigned char *a
;
1068 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1071 printf("%02x", a
[i
]);
1077 int n
= sqlite3_column_bytes(pStmt
, j
);
1079 const unsigned char *a
;
1080 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1092 } /* End switch() */
1096 } /* End if( eVerbosity>=5 ) */
1097 } /* End while( SQLITE_ROW */
1098 if( rc
==SQLITE_DONE
){
1099 if( (*pBtsFlags
)==BTS_SELECT
1100 && !sqlite3_stmt_isexplain(pStmt
)
1104 sqlite3_reset(pStmt
);
1105 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
1108 for(iCnt
=0; iCnt
<99999; iCnt
++){
1109 rc
= fuzz_invariant(db
, pStmt
, iCnt
, iRow
, nRow
,
1110 &bCorrupt
, eVerbosity
);
1111 if( rc
==SQLITE_DONE
) break;
1112 if( rc
!=SQLITE_ERROR
) g
.nInvariant
++;
1114 if( rc
==SQLITE_OK
){
1115 printf("invariant-check: ok\n");
1116 }else if( rc
==SQLITE_CORRUPT
){
1117 printf("invariant-check: failed due to database corruption\n");
1123 }else if( eVerbosity
>=4 ){
1124 printf("SQL-ERROR: (%d) %s\n", rc
, sqlite3_errmsg(db
));
1127 }else if( eVerbosity
>=4 ){
1128 printf("SQL-ERROR (%d): %s\n", rc
, sqlite3_errmsg(db
));
1130 } /* End if( SQLITE_OK ) */
1131 return sqlite3_finalize(pStmt
);
1134 /* Mappings into dbconfig settings for bits taken from bytes 72..75 of
1135 ** the input database.
1137 ** This should be the same as in dbsqlfuzz.c. Make sure those codes stay
1140 static const struct {
1144 } aDbConfigSettings
[] = {
1145 { 0x0001, SQLITE_DBCONFIG_ENABLE_FKEY
, "enable_fkey" },
1146 { 0x0002, SQLITE_DBCONFIG_ENABLE_TRIGGER
, "enable_trigger" },
1147 { 0x0004, SQLITE_DBCONFIG_ENABLE_VIEW
, "enable_view" },
1148 { 0x0008, SQLITE_DBCONFIG_ENABLE_QPSG
, "enable_qpsg" },
1149 { 0x0010, SQLITE_DBCONFIG_TRIGGER_EQP
, "trigger_eqp" },
1150 { 0x0020, SQLITE_DBCONFIG_DEFENSIVE
, "defensive" },
1151 { 0x0040, SQLITE_DBCONFIG_WRITABLE_SCHEMA
, "writable_schema" },
1152 { 0x0080, SQLITE_DBCONFIG_LEGACY_ALTER_TABLE
, "legacy_alter_table" },
1153 { 0x0100, SQLITE_DBCONFIG_STMT_SCANSTATUS
, "stmt_scanstatus" },
1154 { 0x0200, SQLITE_DBCONFIG_REVERSE_SCANORDER
, "reverse_scanorder" },
1155 #ifdef SQLITE_DBCONFIG_STRICT_AGGREGATE
1156 { 0x0400, SQLITE_DBCONFIG_STRICT_AGGREGATE
, "strict_aggregate" },
1158 { 0x0800, SQLITE_DBCONFIG_DQS_DML
, "dqs_dml" },
1159 { 0x1000, SQLITE_DBCONFIG_DQS_DDL
, "dqs_ddl" },
1160 { 0x2000, SQLITE_DBCONFIG_TRUSTED_SCHEMA
, "trusted_schema" },
1163 /* Toggle a dbconfig setting
1165 static void toggleDbConfig(sqlite3
*db
, int iSetting
){
1167 sqlite3_db_config(db
, iSetting
, -1, &v
);
1169 sqlite3_db_config(db
, iSetting
, v
, 0);
1172 /* Invoke this routine to run a single test case */
1173 int runCombinedDbSqlInput(
1174 const uint8_t *aData
, /* Combined DB+SQL content */
1175 size_t nByte
, /* Size of aData in bytes */
1176 int iTimeout
, /* Use this timeout */
1177 int bScript
, /* If true, just render CLI output */
1178 int iSqlId
/* SQL identifier */
1180 int rc
; /* SQLite API return value */
1181 int iSql
; /* Index in aData[] of start of SQL */
1182 unsigned char *aDb
= 0; /* Decoded database content */
1183 int nDb
= 0; /* Size of the decoded database */
1184 int i
; /* Loop counter */
1185 int j
; /* Start of current SQL statement */
1186 char *zSql
= 0; /* SQL text to run */
1187 int nSql
; /* Bytes of SQL text */
1188 FuzzCtx cx
; /* Fuzzing context */
1189 unsigned int btsFlags
= 0; /* Parsing flags */
1190 unsigned int dbFlags
= 0; /* Flag values from db offset 72..75 */
1191 unsigned int dbOpt
= 0; /* Flag values from db offset 76..79 */
1194 if( nByte
<10 ) return 0;
1195 if( sqlite3_initialize() ) return 0;
1196 if( sqlite3_memory_used()!=0 ){
1199 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1200 fprintf(stderr
,"memory leak prior to test start:"
1201 " %lld bytes in %d allocations\n",
1202 sqlite3_memory_used(), nAlloc
);
1205 memset(&cx
, 0, sizeof(cx
));
1206 iSql
= decodeDatabase((unsigned char*)aData
, (int)nByte
, &aDb
, &nDb
);
1207 if( iSql
<0 ) return 0;
1209 dbFlags
= ((unsigned int)aDb
[72]<<24) + ((unsigned int)aDb
[73]<<16) +
1210 ((unsigned int)aDb
[74]<<8) + (unsigned int)aDb
[75];
1213 dbOpt
= ((unsigned int)aDb
[76]<<24) + ((unsigned int)aDb
[77]<<16) +
1214 ((unsigned int)aDb
[78]<<8) + (unsigned int)aDb
[79];
1216 nSql
= (int)(nByte
- iSql
);
1219 sqlite3_snprintf(sizeof(zName
),zName
,"dbsql%06d.db",iSqlId
);
1220 renderDbSqlForCLI(stdout
, zName
, aDb
, nDb
,
1221 (unsigned char*)(aData
+iSql
), nSql
);
1225 if( eVerbosity
>=3 ){
1227 "****** %d-byte input, %d-byte database, %d-byte script "
1228 "******\n", (int)nByte
, nDb
, nSql
);
1231 rc
= sqlite3_open(0, &cx
.db
);
1236 sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS
, cx
.db
, dbOpt
);
1237 for(i
=0; i
<sizeof(aDbConfigSettings
)/sizeof(aDbConfigSettings
[0]); i
++){
1238 if( dbFlags
& aDbConfigSettings
[i
].mask
){
1239 toggleDbConfig(cx
.db
, aDbConfigSettings
[i
].iSetting
);
1243 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
1246 /* Invoke the progress handler frequently to check to see if we
1247 ** are taking too long. The progress handler will return true
1248 ** (which will block further processing) if more than giTimeout seconds have
1249 ** elapsed since the start of the test.
1251 cx
.iLastCb
= timeOfDay();
1252 cx
.iCutoffTime
= cx
.iLastCb
+ (iTimeout
<giTimeout
? iTimeout
: giTimeout
);
1253 cx
.mxCb
= mxProgressCb
;
1254 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
1255 sqlite3_progress_handler(cx
.db
, 10, progress_handler
, (void*)&cx
);
1258 /* Set a limit on the maximum size of a prepared statement, and the
1259 ** maximum length of a string or blob */
1260 if( vdbeOpLimit
>0 ){
1261 sqlite3_limit(cx
.db
, SQLITE_LIMIT_VDBE_OP
, vdbeOpLimit
);
1263 if( lengthLimit
>0 ){
1264 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LENGTH
, lengthLimit
);
1267 sqlite3_limit(cx
.db
, SQLITE_LIMIT_EXPR_DEPTH
, depthLimit
);
1269 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 100);
1270 sqlite3_hard_heap_limit64(heapLimit
);
1272 sqlite3_test_control(SQLITE_TESTCTRL_JSON_SELFCHECK
, &rc
);
1274 if( nDb
>=20 && aDb
[18]==2 && aDb
[19]==2 ){
1275 aDb
[18] = aDb
[19] = 1;
1277 rc
= sqlite3_deserialize(cx
.db
, "main", aDb
, nDb
, nDb
,
1278 SQLITE_DESERIALIZE_RESIZEABLE
|
1279 SQLITE_DESERIALIZE_FREEONCLOSE
);
1281 fprintf(stderr
, "sqlite3_deserialize() failed with %d\n", rc
);
1282 goto testrun_finished
;
1285 sqlite3_int64 x
= maxDbSize
;
1286 sqlite3_file_control(cx
.db
, "main", SQLITE_FCNTL_SIZE_LIMIT
, &x
);
1289 /* For high debugging levels, turn on debug mode */
1290 if( eVerbosity
>=5 ){
1291 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON;", 0, 0, 0);
1294 /* Block debug pragmas and ATTACH/DETACH. But wait until after
1295 ** deserialize to do this because deserialize depends on ATTACH */
1296 sqlite3_set_authorizer(cx
.db
, block_troublesome_sql
, &btsFlags
);
1298 /* Add the vt02 virtual table */
1299 sqlite3_vt02_init(cx
.db
, 0, 0);
1301 /* Add the random_json() and random_json5() functions */
1302 sqlite3_randomjson_init(cx
.db
, 0, 0);
1304 /* Add support for sqlite_dbdata and sqlite_dbptr virtual tables used
1305 ** by the recovery API */
1306 sqlite3_dbdata_init(cx
.db
, 0, 0);
1308 /* Consistent PRNG seed */
1309 #ifdef SQLITE_TESTCTRL_PRNG_SEED
1310 sqlite3_table_column_metadata(cx
.db
, 0, "x", 0, 0, 0, 0, 0, 0);
1311 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, cx
.db
);
1313 sqlite3_randomness(0,0);
1316 /* Run recovery on the initial database, just to make sure recovery
1319 recoverDatabase(cx
.db
);
1322 zSql
= sqlite3_malloc( nSql
+ 1 );
1324 fprintf(stderr
, "Out of memory!\n");
1326 memcpy(zSql
, aData
+iSql
, nSql
);
1328 for(i
=j
=0; zSql
[i
]; i
++){
1330 char cSaved
= zSql
[i
+1];
1332 if( sqlite3_complete(zSql
+j
) ){
1333 rc
= runDbSql(cx
.db
, zSql
+j
, &btsFlags
);
1337 if( rc
==SQLITE_INTERRUPT
|| progress_handler(&cx
) ){
1338 goto testrun_finished
;
1343 runDbSql(cx
.db
, zSql
+j
, &btsFlags
);
1348 rc
= sqlite3_close(cx
.db
);
1349 if( rc
!=SQLITE_OK
){
1350 fprintf(stdout
, "sqlite3_close() returns %d\n", rc
);
1352 if( eVerbosity
>=2 && !bScript
){
1353 fprintf(stdout
, "Peak memory usages: %f MB\n",
1354 sqlite3_memory_highwater(1) / 1000000.0);
1356 if( sqlite3_memory_used()!=0 ){
1359 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1360 fprintf(stderr
,"Memory leak: %lld bytes in %d allocations\n",
1361 sqlite3_memory_used(), nAlloc
);
1364 sqlite3_hard_heap_limit64(0);
1365 sqlite3_soft_heap_limit64(0);
1370 ** END of the dbsqlfuzz code
1371 ***************************************************************************/
1373 /* Look at a SQL text and try to determine if it begins with a database
1374 ** description, such as would be found in a dbsqlfuzz test case. Return
1375 ** true if this does appear to be a dbsqlfuzz test case and false otherwise.
1377 static int isDbSql(unsigned char *a
, int n
){
1378 unsigned char buf
[12];
1380 if( n
>4 && memcmp(a
,"\n--\n",4)==0 ) return 1;
1381 while( n
>0 && isspace(a
[0]) ){ a
++; n
--; }
1382 for(i
=0; n
>0 && i
<8; n
--, a
++){
1383 if( isxdigit(a
[0]) ) buf
[i
++] = a
[0];
1385 if( i
==8 && memcmp(buf
,"53514c69",8)==0 ) return 1;
1389 /* Implementation of the isdbsql(TEXT) SQL function.
1391 static void isDbSqlFunc(
1392 sqlite3_context
*context
,
1394 sqlite3_value
**argv
1396 int n
= sqlite3_value_bytes(argv
[0]);
1397 unsigned char *a
= (unsigned char*)sqlite3_value_blob(argv
[0]);
1398 sqlite3_result_int(context
, a
!=0 && n
>0 && isDbSql(a
,n
));
1401 /* Methods for the VHandle object
1403 static int inmemClose(sqlite3_file
*pFile
){
1404 VHandle
*p
= (VHandle
*)pFile
;
1405 VFile
*pVFile
= p
->pVFile
;
1407 if( pVFile
->nRef
==0 && pVFile
->zFilename
==0 ){
1414 static int inmemRead(
1415 sqlite3_file
*pFile
, /* Read from this open file */
1416 void *pData
, /* Store content in this buffer */
1417 int iAmt
, /* Bytes of content */
1418 sqlite3_int64 iOfst
/* Start reading here */
1420 VHandle
*pHandle
= (VHandle
*)pFile
;
1421 VFile
*pVFile
= pHandle
->pVFile
;
1422 if( iOfst
<0 || iOfst
>=pVFile
->sz
){
1423 memset(pData
, 0, iAmt
);
1424 return SQLITE_IOERR_SHORT_READ
;
1426 if( iOfst
+iAmt
>pVFile
->sz
){
1427 memset(pData
, 0, iAmt
);
1428 iAmt
= (int)(pVFile
->sz
- iOfst
);
1429 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1430 return SQLITE_IOERR_SHORT_READ
;
1432 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1435 static int inmemWrite(
1436 sqlite3_file
*pFile
, /* Write to this file */
1437 const void *pData
, /* Content to write */
1438 int iAmt
, /* bytes to write */
1439 sqlite3_int64 iOfst
/* Start writing here */
1441 VHandle
*pHandle
= (VHandle
*)pFile
;
1442 VFile
*pVFile
= pHandle
->pVFile
;
1443 if( iOfst
+iAmt
> pVFile
->sz
){
1444 if( iOfst
+iAmt
>= MX_FILE_SZ
){
1447 pVFile
->a
= safe_realloc(pVFile
->a
, (int)(iOfst
+iAmt
));
1448 if( iOfst
> pVFile
->sz
){
1449 memset(pVFile
->a
+ pVFile
->sz
, 0, (int)(iOfst
- pVFile
->sz
));
1451 pVFile
->sz
= (int)(iOfst
+ iAmt
);
1453 memcpy(pVFile
->a
+ iOfst
, pData
, iAmt
);
1456 static int inmemTruncate(sqlite3_file
*pFile
, sqlite3_int64 iSize
){
1457 VHandle
*pHandle
= (VHandle
*)pFile
;
1458 VFile
*pVFile
= pHandle
->pVFile
;
1459 if( pVFile
->sz
>iSize
&& iSize
>=0 ) pVFile
->sz
= (int)iSize
;
1462 static int inmemSync(sqlite3_file
*pFile
, int flags
){
1465 static int inmemFileSize(sqlite3_file
*pFile
, sqlite3_int64
*pSize
){
1466 *pSize
= ((VHandle
*)pFile
)->pVFile
->sz
;
1469 static int inmemLock(sqlite3_file
*pFile
, int type
){
1472 static int inmemUnlock(sqlite3_file
*pFile
, int type
){
1475 static int inmemCheckReservedLock(sqlite3_file
*pFile
, int *pOut
){
1479 static int inmemFileControl(sqlite3_file
*pFile
, int op
, void *pArg
){
1480 return SQLITE_NOTFOUND
;
1482 static int inmemSectorSize(sqlite3_file
*pFile
){
1485 static int inmemDeviceCharacteristics(sqlite3_file
*pFile
){
1487 SQLITE_IOCAP_SAFE_APPEND
|
1488 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN
|
1489 SQLITE_IOCAP_POWERSAFE_OVERWRITE
;
1493 /* Method table for VHandle
1495 static sqlite3_io_methods VHandleMethods
= {
1497 /* xClose */ inmemClose
,
1498 /* xRead */ inmemRead
,
1499 /* xWrite */ inmemWrite
,
1500 /* xTruncate */ inmemTruncate
,
1501 /* xSync */ inmemSync
,
1502 /* xFileSize */ inmemFileSize
,
1503 /* xLock */ inmemLock
,
1504 /* xUnlock */ inmemUnlock
,
1505 /* xCheck... */ inmemCheckReservedLock
,
1506 /* xFileCtrl */ inmemFileControl
,
1507 /* xSectorSz */ inmemSectorSize
,
1508 /* xDevchar */ inmemDeviceCharacteristics
,
1511 /* xShmBarrier */ 0,
1518 ** Open a new file in the inmem VFS. All files are anonymous and are
1521 static int inmemOpen(
1523 const char *zFilename
,
1524 sqlite3_file
*pFile
,
1528 VFile
*pVFile
= createVFile(zFilename
, 0, (unsigned char*)"");
1529 VHandle
*pHandle
= (VHandle
*)pFile
;
1533 pHandle
->pVFile
= pVFile
;
1535 pFile
->pMethods
= &VHandleMethods
;
1536 if( pOutFlags
) *pOutFlags
= openFlags
;
1541 ** Delete a file by name
1543 static int inmemDelete(
1545 const char *zFilename
,
1548 VFile
*pVFile
= findVFile(zFilename
);
1549 if( pVFile
==0 ) return SQLITE_OK
;
1550 if( pVFile
->nRef
==0 ){
1551 free(pVFile
->zFilename
);
1552 pVFile
->zFilename
= 0;
1558 return SQLITE_IOERR_DELETE
;
1561 /* Check for the existance of a file
1563 static int inmemAccess(
1565 const char *zFilename
,
1569 VFile
*pVFile
= findVFile(zFilename
);
1570 *pResOut
= pVFile
!=0;
1574 /* Get the canonical pathname for a file
1576 static int inmemFullPathname(
1578 const char *zFilename
,
1582 sqlite3_snprintf(nOut
, zOut
, "%s", zFilename
);
1586 /* Always use the same random see, for repeatability.
1588 static int inmemRandomness(sqlite3_vfs
*NotUsed
, int nBuf
, char *zBuf
){
1589 memset(zBuf
, 0, nBuf
);
1590 memcpy(zBuf
, &g
.uRandom
, nBuf
<sizeof(g
.uRandom
) ? nBuf
: sizeof(g
.uRandom
));
1595 ** Register the VFS that reads from the g.aFile[] set of files.
1597 static void inmemVfsRegister(int makeDefault
){
1598 static sqlite3_vfs inmemVfs
;
1599 sqlite3_vfs
*pDefault
= sqlite3_vfs_find(0);
1600 inmemVfs
.iVersion
= 3;
1601 inmemVfs
.szOsFile
= sizeof(VHandle
);
1602 inmemVfs
.mxPathname
= 200;
1603 inmemVfs
.zName
= "inmem";
1604 inmemVfs
.xOpen
= inmemOpen
;
1605 inmemVfs
.xDelete
= inmemDelete
;
1606 inmemVfs
.xAccess
= inmemAccess
;
1607 inmemVfs
.xFullPathname
= inmemFullPathname
;
1608 inmemVfs
.xRandomness
= inmemRandomness
;
1609 inmemVfs
.xSleep
= pDefault
->xSleep
;
1610 inmemVfs
.xCurrentTimeInt64
= pDefault
->xCurrentTimeInt64
;
1611 sqlite3_vfs_register(&inmemVfs
, makeDefault
);
1615 ** Allowed values for the runFlags parameter to runSql()
1617 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */
1618 #define SQL_OUTPUT 0x0002 /* Show the SQL output */
1621 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not
1622 ** stop if an error is encountered.
1624 static void runSql(sqlite3
*db
, const char *zSql
, unsigned runFlags
){
1626 sqlite3_stmt
*pStmt
;
1628 while( zSql
&& zSql
[0] ){
1631 sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, &zMore
);
1632 if( zMore
==zSql
) break;
1633 if( runFlags
& SQL_TRACE
){
1634 const char *z
= zSql
;
1636 while( z
<zMore
&& ISSPACE(z
[0]) ) z
++;
1637 n
= (int)(zMore
- z
);
1638 while( n
>0 && ISSPACE(z
[n
-1]) ) n
--;
1641 printf("TRACE: %.*s (error: %s)\n", n
, z
, sqlite3_errmsg(db
));
1643 printf("TRACE: %.*s\n", n
, z
);
1648 if( (runFlags
& SQL_OUTPUT
)==0 ){
1649 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){}
1652 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
1655 nCol
= sqlite3_column_count(pStmt
);
1657 printf("--------------------------------------------\n");
1659 for(i
=0; i
<nCol
; i
++){
1660 int eType
= sqlite3_column_type(pStmt
,i
);
1661 printf("%s = ", sqlite3_column_name(pStmt
,i
));
1667 case SQLITE_INTEGER
: {
1668 printf("INT %s\n", sqlite3_column_text(pStmt
,i
));
1671 case SQLITE_FLOAT
: {
1672 printf("FLOAT %s\n", sqlite3_column_text(pStmt
,i
));
1676 printf("TEXT [%s]\n", sqlite3_column_text(pStmt
,i
));
1680 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt
,i
));
1687 sqlite3_finalize(pStmt
);
1693 ** Rebuild the database file.
1695 ** (1) Remove duplicate entries
1696 ** (2) Put all entries in order
1699 static void rebuild_database(sqlite3
*db
, int dbSqlOnly
){
1702 zSql
= sqlite3_mprintf(
1704 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n"
1706 "INSERT INTO db(dbid, dbcontent) "
1707 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n"
1709 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n"
1710 "DELETE FROM xsql;\n"
1711 "INSERT INTO xsql(sqlid,sqltext) "
1712 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n"
1715 "PRAGMA page_size=1024;\n"
1717 dbSqlOnly
? " WHERE isdbsql(sqltext)" : ""
1719 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
1721 if( rc
) fatalError("cannot rebuild: %s", sqlite3_errmsg(db
));
1725 ** Return the value of a hexadecimal digit. Return -1 if the input
1726 ** is not a hex digit.
1728 static int hexDigitValue(char c
){
1729 if( c
>='0' && c
<='9' ) return c
- '0';
1730 if( c
>='a' && c
<='f' ) return c
- 'a' + 10;
1731 if( c
>='A' && c
<='F' ) return c
- 'A' + 10;
1736 ** Interpret zArg as an integer value, possibly with suffixes.
1738 static int integerValue(const char *zArg
){
1739 sqlite3_int64 v
= 0;
1740 static const struct { char *zSuffix
; int iMult
; } aMult
[] = {
1742 { "MiB", 1024*1024 },
1743 { "GiB", 1024*1024*1024 },
1746 { "GB", 1000000000 },
1749 { "G", 1000000000 },
1756 }else if( zArg
[0]=='+' ){
1759 if( zArg
[0]=='0' && zArg
[1]=='x' ){
1762 while( (x
= hexDigitValue(zArg
[0]))>=0 ){
1767 while( ISDIGIT(zArg
[0]) ){
1768 v
= v
*10 + zArg
[0] - '0';
1772 for(i
=0; i
<sizeof(aMult
)/sizeof(aMult
[0]); i
++){
1773 if( sqlite3_stricmp(aMult
[i
].zSuffix
, zArg
)==0 ){
1774 v
*= aMult
[i
].iMult
;
1778 if( v
>0x7fffffff ) fatalError("parameter too large - max 2147483648");
1779 return (int)(isNeg
? -v
: v
);
1783 ** Return the number of "v" characters in a string. Return 0 if there
1784 ** are any characters in the string other than "v".
1786 static int numberOfVChar(const char *z
){
1788 while( z
[0] && z
[0]=='v' ){
1792 return z
[0]==0 ? N
: 0;
1796 ** Print sketchy documentation for this utility program
1798 static void showHelp(void){
1799 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g
.zArgv0
);
1801 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n"
1802 "each database, checking for crashes and memory leaks.\n"
1804 " --cell-size-check Set the PRAGMA cell_size_check=ON\n"
1805 " --dbid N Use only the database where dbid=N\n"
1806 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n"
1807 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n"
1808 " --help Show this help text\n"
1809 " --info Show information about SOURCE-DB w/o running tests\n"
1810 " --limit-depth N Limit expression depth to N. Default: 500\n"
1811 " --limit-heap N Limit heap memory to N. Default: 100M\n"
1812 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n"
1813 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n"
1814 " --load-sql FILE.. Load SQL scripts fron files into SOURCE-DB\n"
1815 " --load-db FILE.. Load template databases from files into SOURCE_DB\n"
1816 " --load-dbsql FILE.. Load dbsqlfuzz outputs into the xsql table\n"
1817 " ^^^^------ Use \"-\" for FILE to read filenames from stdin\n"
1818 " -m TEXT Add a description to the database\n"
1819 " --native-vfs Use the native VFS for initially empty database files\n"
1820 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n"
1821 " --no-recover Do not run recovery on dbsqlfuzz databases\n"
1822 " --oss-fuzz Enable OSS-FUZZ testing\n"
1823 " --prng-seed N Seed value for the PRGN inside of SQLite\n"
1824 " -q|--quiet Reduced output\n"
1825 " --rebuild Rebuild and vacuum the database file\n"
1826 " --result-trace Show the results of each SQL command\n"
1827 " --script Output CLI script instead of running tests\n"
1828 " --skip N Skip the first N test cases\n"
1829 " --spinner Use a spinner to show progress\n"
1830 " --sqlid N Use only SQL where sqlid=N\n"
1831 " --timeout N Maximum time for any one test in N millseconds\n"
1832 " -v|--verbose Increased output. Repeat for more output.\n"
1833 " --vdbe-debug Activate VDBE debugging.\n"
1834 " --wait N Wait N seconds before continuing - useful for\n"
1835 " attaching an MSVC debugging.\n"
1839 int main(int argc
, char **argv
){
1840 sqlite3_int64 iBegin
; /* Start time of this program */
1841 int quietFlag
= 0; /* True if --quiet or -q */
1842 int verboseFlag
= 0; /* True if --verbose or -v */
1843 char *zInsSql
= 0; /* SQL statement for --load-db or --load-sql */
1844 int iFirstInsArg
= 0; /* First argv[] for --load-db or --load-sql */
1845 sqlite3
*db
= 0; /* The open database connection */
1846 sqlite3_stmt
*pStmt
; /* A prepared statement */
1847 int rc
; /* Result code from SQLite interface calls */
1848 Blob
*pSql
; /* For looping over SQL scripts */
1849 Blob
*pDb
; /* For looping over template databases */
1850 int i
; /* Loop index for the argv[] loop */
1851 int dbSqlOnly
= 0; /* Only use scripts that are dbsqlfuzz */
1852 int onlySqlid
= -1; /* --sqlid */
1853 int onlyDbid
= -1; /* --dbid */
1854 int nativeFlag
= 0; /* --native-vfs */
1855 int rebuildFlag
= 0; /* --rebuild */
1856 int vdbeLimitFlag
= 0; /* --limit-vdbe */
1857 int infoFlag
= 0; /* --info */
1858 int nSkip
= 0; /* --skip */
1859 int bScript
= 0; /* --script */
1860 int bSpinner
= 0; /* True for --spinner */
1861 int timeoutTest
= 0; /* undocumented --timeout-test flag */
1862 int runFlags
= 0; /* Flags sent to runSql() */
1863 char *zMsg
= 0; /* Add this message */
1864 int nSrcDb
= 0; /* Number of source databases */
1865 char **azSrcDb
= 0; /* Array of source database names */
1866 int iSrcDb
; /* Loop over all source databases */
1867 int nTest
= 0; /* Total number of tests performed */
1868 char *zDbName
= ""; /* Appreviated name of a source database */
1869 const char *zFailCode
= 0; /* Value of the TEST_FAILURE env variable */
1870 int cellSzCkFlag
= 0; /* --cell-size-check */
1871 int sqlFuzz
= 0; /* True for SQL fuzz. False for DB fuzz */
1872 int iTimeout
= 120000; /* Default 120-second timeout */
1873 int nMem
= 0; /* Memory limit override */
1874 int nMemThisDb
= 0; /* Memory limit set by the CONFIG table */
1875 char *zExpDb
= 0; /* Write Databases to files in this directory */
1876 char *zExpSql
= 0; /* Write SQL to files in this directory */
1877 void *pHeap
= 0; /* Heap for use by SQLite */
1878 int ossFuzz
= 0; /* enable OSS-FUZZ testing */
1879 int ossFuzzThisDb
= 0; /* ossFuzz value for this particular database */
1880 int nativeMalloc
= 0; /* Turn off MEMSYS3/5 and lookaside if true */
1881 sqlite3_vfs
*pDfltVfs
; /* The default VFS */
1882 int openFlags4Data
; /* Flags for sqlite3_open_v2() */
1883 int bTimer
= 0; /* Show elapse time for each test */
1884 int nV
; /* How much to increase verbosity with -vvvv */
1885 sqlite3_int64 tmStart
; /* Start of each test */
1887 sqlite3_config(SQLITE_CONFIG_URI
,1);
1888 registerOomSimulator();
1889 sqlite3_initialize();
1890 iBegin
= timeOfDay();
1892 signal(SIGALRM
, signalHandler
);
1893 signal(SIGSEGV
, signalHandler
);
1894 signal(SIGABRT
, signalHandler
);
1897 openFlags4Data
= SQLITE_OPEN_READONLY
;
1898 zFailCode
= getenv("TEST_FAILURE");
1899 pDfltVfs
= sqlite3_vfs_find(0);
1900 inmemVfsRegister(1);
1901 for(i
=1; i
<argc
; i
++){
1902 const char *z
= argv
[i
];
1905 if( z
[0]=='-' ) z
++;
1906 if( strcmp(z
,"cell-size-check")==0 ){
1909 if( strcmp(z
,"dbid")==0 ){
1910 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1911 onlyDbid
= integerValue(argv
[++i
]);
1913 if( strcmp(z
,"export-db")==0 ){
1914 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1917 if( strcmp(z
,"export-sql")==0 || strcmp(z
,"export-dbsql")==0 ){
1918 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1919 zExpSql
= argv
[++i
];
1921 if( strcmp(z
,"help")==0 ){
1925 if( strcmp(z
,"info")==0 ){
1928 if( strcmp(z
,"limit-depth")==0 ){
1929 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1930 depthLimit
= integerValue(argv
[++i
]);
1932 if( strcmp(z
,"limit-heap")==0 ){
1933 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1934 heapLimit
= integerValue(argv
[++i
]);
1936 if( strcmp(z
,"limit-mem")==0 ){
1937 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1938 nMem
= integerValue(argv
[++i
]);
1940 if( strcmp(z
,"limit-vdbe")==0 ){
1943 if( strcmp(z
,"load-sql")==0 ){
1944 zInsSql
= "INSERT INTO xsql(sqltext)"
1945 "VALUES(CAST(readtextfile(?1) AS text))";
1947 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1950 if( strcmp(z
,"load-db")==0 ){
1951 zInsSql
= "INSERT INTO db(dbcontent) VALUES(readfile(?1))";
1953 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1956 if( strcmp(z
,"load-dbsql")==0 ){
1957 zInsSql
= "INSERT INTO xsql(sqltext)"
1958 "VALUES(readfile(?1))";
1960 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1964 if( strcmp(z
,"m")==0 ){
1965 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1967 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1969 if( strcmp(z
,"native-malloc")==0 ){
1972 if( strcmp(z
,"native-vfs")==0 ){
1975 if( strcmp(z
,"no-recover")==0 ){
1978 if( strcmp(z
,"oss-fuzz")==0 ){
1981 if( strcmp(z
,"prng-seed")==0 ){
1982 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1983 g
.uRandom
= atoi(argv
[++i
]);
1985 if( strcmp(z
,"quiet")==0 || strcmp(z
,"q")==0 ){
1990 if( strcmp(z
,"rebuild")==0 ){
1992 openFlags4Data
= SQLITE_OPEN_READWRITE
;
1994 if( strcmp(z
,"result-trace")==0 ){
1995 runFlags
|= SQL_OUTPUT
;
1997 if( strcmp(z
,"script")==0 ){
2000 if( strcmp(z
,"skip")==0 ){
2001 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2002 nSkip
= atoi(argv
[++i
]);
2004 if( strcmp(z
,"spinner")==0 ){
2007 if( strcmp(z
,"timer")==0 ){
2010 if( strcmp(z
,"sqlid")==0 ){
2011 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2012 onlySqlid
= integerValue(argv
[++i
]);
2014 if( strcmp(z
,"timeout")==0 ){
2015 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2016 iTimeout
= integerValue(argv
[++i
]);
2018 if( strcmp(z
,"timeout-test")==0 ){
2021 fatalError("timeout is not available on non-unix systems");
2024 if( strcmp(z
,"vdbe-debug")==0 ){
2027 if( strcmp(z
,"verbose")==0 ){
2031 if( verboseFlag
>2 ) runFlags
|= SQL_TRACE
;
2033 if( (nV
= numberOfVChar(z
))>=1 ){
2037 if( verboseFlag
>2 ) runFlags
|= SQL_TRACE
;
2039 if( strcmp(z
,"version")==0 ){
2042 printf("SQLite %s %s (%d-bit)\n",
2043 sqlite3_libversion(), sqlite3_sourceid(),
2044 8*(int)sizeof(char*));
2045 for(ii
=0; (zz
= sqlite3_compileoption_get(ii
))!=0; ii
++){
2050 if( strcmp(z
,"wait")==0 ){
2052 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2053 iDelay
= integerValue(argv
[++i
]);
2054 printf("Waiting %d seconds:", iDelay
);
2056 while( 1 /*exit-by-break*/ ){
2057 sqlite3_sleep(1000);
2059 if( iDelay
<=0 ) break;
2060 printf(" %d", iDelay
);
2066 if( strcmp(z
,"is-dbsql")==0 ){
2068 for(i
++; i
<argc
; i
++){
2070 char *aData
= readFile(argv
[i
], &nData
);
2071 printf("%d %s\n", isDbSql((unsigned char*)aData
,nData
), argv
[i
]);
2072 sqlite3_free(aData
);
2077 fatalError("unknown option: %s", argv
[i
]);
2081 azSrcDb
= safe_realloc(azSrcDb
, nSrcDb
*sizeof(azSrcDb
[0]));
2082 azSrcDb
[nSrcDb
-1] = argv
[i
];
2085 if( nSrcDb
==0 ) fatalError("no source database specified");
2088 fatalError("cannot change the description of more than one database");
2091 fatalError("cannot import into more than one database");
2095 /* Process each source database separately */
2096 for(iSrcDb
=0; iSrcDb
<nSrcDb
; iSrcDb
++){
2099 g
.zDbFile
= azSrcDb
[iSrcDb
];
2100 rc
= sqlite3_open_v2(azSrcDb
[iSrcDb
], &db
,
2101 openFlags4Data
, pDfltVfs
->zName
);
2102 if( rc
==SQLITE_OK
){
2103 rc
= sqlite3_exec(db
, "SELECT count(*) FROM sqlite_schema", 0, 0, 0);
2107 zRawData
= readFile(azSrcDb
[iSrcDb
], &nRawData
);
2109 fatalError("input file \"%s\" is not recognized\n", azSrcDb
[iSrcDb
]);
2111 sqlite3_open(":memory:", &db
);
2114 /* Print the description, if there is one */
2117 zDbName
= azSrcDb
[iSrcDb
];
2118 i
= (int)strlen(zDbName
) - 1;
2119 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
2121 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
2122 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
2123 printf("%s: %s", zDbName
, sqlite3_column_text(pStmt
,0));
2125 printf("%s: (empty \"readme\")", zDbName
);
2127 sqlite3_finalize(pStmt
);
2128 sqlite3_prepare_v2(db
, "SELECT count(*) FROM db", -1, &pStmt
, 0);
2130 && sqlite3_step(pStmt
)==SQLITE_ROW
2131 && (n
= sqlite3_column_int(pStmt
,0))>0
2133 printf(" - %d DBs", n
);
2135 sqlite3_finalize(pStmt
);
2136 sqlite3_prepare_v2(db
, "SELECT count(*) FROM xsql", -1, &pStmt
, 0);
2138 && sqlite3_step(pStmt
)==SQLITE_ROW
2139 && (n
= sqlite3_column_int(pStmt
,0))>0
2141 printf(" - %d scripts", n
);
2143 sqlite3_finalize(pStmt
);
2146 sqlite3_free(zRawData
);
2150 rc
= sqlite3_exec(db
,
2151 "CREATE TABLE IF NOT EXISTS db(\n"
2152 " dbid INTEGER PRIMARY KEY, -- database id\n"
2153 " dbcontent BLOB -- database disk file image\n"
2155 "CREATE TABLE IF NOT EXISTS xsql(\n"
2156 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n"
2157 " sqltext TEXT -- Text of SQL statements to run\n"
2159 "CREATE TABLE IF NOT EXISTS readme(\n"
2160 " msg TEXT -- Human-readable description of this file\n"
2162 if( rc
) fatalError("cannot create schema: %s", sqlite3_errmsg(db
));
2165 zSql
= sqlite3_mprintf(
2166 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg
);
2167 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
2169 if( rc
) fatalError("cannot change description: %s", sqlite3_errmsg(db
));
2172 zInsSql
= "INSERT INTO xsql(sqltext) VALUES(?1)";
2173 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2174 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2175 zInsSql
, sqlite3_errmsg(db
));
2176 sqlite3_bind_text(pStmt
, 1, zRawData
, nRawData
, SQLITE_STATIC
);
2177 sqlite3_step(pStmt
);
2178 rc
= sqlite3_reset(pStmt
);
2179 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2180 sqlite3_finalize(pStmt
);
2181 rebuild_database(db
, dbSqlOnly
);
2183 sqlite3_free(zRawData
);
2186 ossFuzzThisDb
= ossFuzz
;
2188 /* If the CONFIG(name,value) table exists, read db-specific settings
2189 ** from that table */
2190 if( sqlite3_table_column_metadata(db
,0,"config",0,0,0,0,0,0)==SQLITE_OK
){
2191 rc
= sqlite3_prepare_v2(db
, "SELECT name, value FROM config",
2193 if( rc
) fatalError("cannot prepare query of CONFIG table: %s",
2194 sqlite3_errmsg(db
));
2195 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
2196 const char *zName
= (const char *)sqlite3_column_text(pStmt
,0);
2197 if( zName
==0 ) continue;
2198 if( strcmp(zName
, "oss-fuzz")==0 ){
2199 ossFuzzThisDb
= sqlite3_column_int(pStmt
,1);
2200 if( verboseFlag
>1 ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb
);
2202 if( strcmp(zName
, "limit-mem")==0 ){
2203 nMemThisDb
= sqlite3_column_int(pStmt
,1);
2204 if( verboseFlag
>1 ) printf("Config: limit-mem=%d\n", nMemThisDb
);
2207 sqlite3_finalize(pStmt
);
2211 sqlite3_create_function(db
, "readfile", 1, SQLITE_UTF8
, 0,
2212 readfileFunc
, 0, 0);
2213 sqlite3_create_function(db
, "readtextfile", 1, SQLITE_UTF8
, 0,
2214 readtextfileFunc
, 0, 0);
2215 sqlite3_create_function(db
, "isdbsql", 1, SQLITE_UTF8
, 0,
2217 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2218 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2219 zInsSql
, sqlite3_errmsg(db
));
2220 rc
= sqlite3_exec(db
, "BEGIN", 0, 0, 0);
2221 if( rc
) fatalError("cannot start a transaction");
2222 for(i
=iFirstInsArg
; i
<argc
; i
++){
2223 if( strcmp(argv
[i
],"-")==0 ){
2224 /* A filename of "-" means read multiple filenames from stdin */
2226 while( rc
==0 && fgets(zLine
,sizeof(zLine
),stdin
)!=0 ){
2227 size_t kk
= strlen(zLine
);
2228 while( kk
>0 && zLine
[kk
-1]<=' ' ) kk
--;
2229 sqlite3_bind_text(pStmt
, 1, zLine
, (int)kk
, SQLITE_STATIC
);
2230 if( verboseFlag
>1 ) printf("loading %.*s\n", (int)kk
, zLine
);
2231 sqlite3_step(pStmt
);
2232 rc
= sqlite3_reset(pStmt
);
2233 if( rc
) fatalError("insert failed for %s", zLine
);
2236 sqlite3_bind_text(pStmt
, 1, argv
[i
], -1, SQLITE_STATIC
);
2237 if( verboseFlag
>1 ) printf("loading %s\n", argv
[i
]);
2238 sqlite3_step(pStmt
);
2239 rc
= sqlite3_reset(pStmt
);
2240 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2243 sqlite3_finalize(pStmt
);
2244 rc
= sqlite3_exec(db
, "COMMIT", 0, 0, 0);
2245 if( rc
) fatalError("cannot commit the transaction: %s",
2246 sqlite3_errmsg(db
));
2247 rebuild_database(db
, dbSqlOnly
);
2251 rc
= sqlite3_exec(db
, "PRAGMA query_only=1;", 0, 0, 0);
2252 if( rc
) fatalError("cannot set database to query-only");
2253 if( zExpDb
!=0 || zExpSql
!=0 ){
2254 sqlite3_create_function(db
, "writefile", 2, SQLITE_UTF8
, 0,
2255 writefileFunc
, 0, 0);
2258 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent),"
2259 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)"
2260 " FROM db WHERE ?2<0 OR dbid=?2;";
2261 rc
= sqlite3_prepare_v2(db
, zExDb
, -1, &pStmt
, 0);
2262 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2263 zExDb
, sqlite3_errmsg(db
));
2264 sqlite3_bind_text64(pStmt
, 1, zExpDb
, strlen(zExpDb
),
2265 SQLITE_STATIC
, SQLITE_UTF8
);
2266 sqlite3_bind_int(pStmt
, 2, onlyDbid
);
2267 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2268 printf("write db-%d (%d bytes) into %s\n",
2269 sqlite3_column_int(pStmt
,1),
2270 sqlite3_column_int(pStmt
,3),
2271 sqlite3_column_text(pStmt
,2));
2273 sqlite3_finalize(pStmt
);
2276 const char *zExSql
=
2277 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext),"
2278 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)"
2279 " FROM xsql WHERE ?2<0 OR sqlid=?2;";
2280 rc
= sqlite3_prepare_v2(db
, zExSql
, -1, &pStmt
, 0);
2281 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2282 zExSql
, sqlite3_errmsg(db
));
2283 sqlite3_bind_text64(pStmt
, 1, zExpSql
, strlen(zExpSql
),
2284 SQLITE_STATIC
, SQLITE_UTF8
);
2285 sqlite3_bind_int(pStmt
, 2, onlySqlid
);
2286 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2287 printf("write sql-%d (%d bytes) into %s\n",
2288 sqlite3_column_int(pStmt
,1),
2289 sqlite3_column_int(pStmt
,3),
2290 sqlite3_column_text(pStmt
,2));
2292 sqlite3_finalize(pStmt
);
2298 /* Load all SQL script content and all initial database images from the
2301 blobListLoadFromDb(db
, "SELECT sqlid, sqltext FROM xsql", onlySqlid
,
2302 &g
.nSql
, &g
.pFirstSql
);
2303 if( g
.nSql
==0 ) fatalError("need at least one SQL script");
2304 blobListLoadFromDb(db
, "SELECT dbid, dbcontent FROM db", onlyDbid
,
2305 &g
.nDb
, &g
.pFirstDb
);
2307 g
.pFirstDb
= safe_realloc(0, sizeof(Blob
));
2308 memset(g
.pFirstDb
, 0, sizeof(Blob
));
2310 g
.pFirstDb
->seq
= 0;
2315 /* Print the description, if there is one */
2316 if( !quietFlag
&& !bScript
){
2317 zDbName
= azSrcDb
[iSrcDb
];
2318 i
= (int)strlen(zDbName
) - 1;
2319 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
2322 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
2323 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
2324 printf("%s: %s\n", zDbName
, sqlite3_column_text(pStmt
,0));
2326 sqlite3_finalize(pStmt
);
2330 /* Rebuild the database, if requested */
2333 printf("%s: rebuilding... ", zDbName
);
2336 rebuild_database(db
, 0);
2337 if( !quietFlag
) printf("done\n");
2340 /* Close the source database. Verify that no SQLite memory allocations are
2344 if( sqlite3_memory_used()>0 ){
2345 fatalError("SQLite has memory in use before the start of testing");
2348 /* Limit available memory, if requested */
2351 if( nMemThisDb
>0 && nMem
==0 ){
2352 if( !nativeMalloc
){
2353 pHeap
= realloc(pHeap
, nMemThisDb
);
2355 fatalError("failed to allocate %d bytes of heap memory", nMem
);
2357 sqlite3_config(SQLITE_CONFIG_HEAP
, pHeap
, nMemThisDb
, 128);
2359 sqlite3_hard_heap_limit64((sqlite3_int64
)nMemThisDb
);
2362 sqlite3_hard_heap_limit64(0);
2365 /* Disable lookaside with the --native-malloc option */
2367 sqlite3_config(SQLITE_CONFIG_LOOKASIDE
, 0, 0);
2370 /* Reset the in-memory virtual filesystem */
2373 /* Run a test using each SQL script against each database.
2375 if( verboseFlag
<2 && !quietFlag
&& !bSpinner
&& !bScript
){
2376 printf("%s:", zDbName
);
2378 for(pSql
=g
.pFirstSql
; pSql
; pSql
=pSql
->pNext
){
2379 tmStart
= timeOfDay();
2380 if( isDbSql(pSql
->a
, pSql
->sz
) ){
2381 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d",pSql
->id
);
2383 /* No progress output */
2384 }else if( bSpinner
){
2386 int idx
= pSql
->seq
;
2387 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2389 }else if( verboseFlag
>1 ){
2390 printf("%s\n", g
.zTestName
);
2392 }else if( !quietFlag
){
2393 static int prevAmt
= -1;
2394 int idx
= pSql
->seq
;
2395 int amt
= idx
*10/(g
.nSql
);
2397 printf(" %d%%", amt
*10);
2405 runCombinedDbSqlInput(pSql
->a
, pSql
->sz
, iTimeout
, bScript
, pSql
->id
);
2408 if( bTimer
&& !bScript
){
2409 sqlite3_int64 tmEnd
= timeOfDay();
2410 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2416 for(pDb
=g
.pFirstDb
; pDb
; pDb
=pDb
->pNext
){
2418 const char *zVfs
= "inmem";
2419 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d,dbid=%d",
2422 /* No progress output */
2423 }else if( bSpinner
){
2424 int nTotal
= g
.nDb
*g
.nSql
;
2425 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2426 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2428 }else if( verboseFlag
>1 ){
2429 printf("%s\n", g
.zTestName
);
2431 }else if( !quietFlag
){
2432 static int prevAmt
= -1;
2433 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2434 int amt
= idx
*10/(g
.nDb
*g
.nSql
);
2436 printf(" %d%%", amt
*10);
2447 sqlite3_snprintf(sizeof(zName
), zName
, "db%06d.db",
2448 pDb
->id
>1 ? pDb
->id
: pSql
->id
);
2449 renderDbSqlForCLI(stdout
, zName
,
2450 pDb
->a
, pDb
->sz
, pSql
->a
, pSql
->sz
);
2453 createVFile("main.db", pDb
->sz
, pDb
->a
);
2454 sqlite3_randomness(0,0);
2455 if( ossFuzzThisDb
){
2456 #ifndef SQLITE_OSS_FUZZ
2457 fatalError("--oss-fuzz not supported: recompile"
2458 " with -DSQLITE_OSS_FUZZ");
2460 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t);
2461 LLVMFuzzerTestOneInput((const uint8_t*)pSql
->a
, (size_t)pSql
->sz
);
2464 openFlags
= SQLITE_OPEN_CREATE
| SQLITE_OPEN_READWRITE
;
2465 if( nativeFlag
&& pDb
->sz
==0 ){
2466 openFlags
|= SQLITE_OPEN_MEMORY
;
2469 rc
= sqlite3_open_v2("main.db", &db
, openFlags
, zVfs
);
2470 if( rc
) fatalError("cannot open inmem database");
2471 sqlite3_limit(db
, SQLITE_LIMIT_LENGTH
, 100000000);
2472 sqlite3_limit(db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 50);
2473 if( cellSzCkFlag
) runSql(db
, "PRAGMA cell_size_check=ON", runFlags
);
2474 setAlarm((iTimeout
+999)/1000);
2475 /* Enable test functions */
2476 sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS
, db
);
2477 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
2478 if( sqlFuzz
|| vdbeLimitFlag
){
2479 sqlite3_progress_handler(db
, 100000, progressHandler
,
2483 #ifdef SQLITE_TESTCTRL_PRNG_SEED
2484 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, db
);
2487 sqlite3_exec(db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
2490 runSql(db
, (char*)pSql
->a
, runFlags
);
2491 }while( timeoutTest
);
2493 sqlite3_exec(db
, "PRAGMA temp_store_directory=''", 0, 0, 0);
2496 if( sqlite3_memory_used()>0 ){
2497 fatalError("memory leak: %lld bytes outstanding",
2498 sqlite3_memory_used());
2503 sqlite3_int64 tmEnd
= timeOfDay();
2504 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2508 /* Simulate an error if the TEST_FAILURE environment variable is "5".
2509 ** This is used to verify that automated test script really do spot
2510 ** errors that occur in this test program.
2513 if( zFailCode
[0]=='5' && zFailCode
[1]==0 ){
2514 fatalError("simulated failure");
2515 }else if( zFailCode
[0]!=0 ){
2516 /* If TEST_FAILURE is something other than 5, just exit the test
2518 printf("\nExit early due to TEST_FAILURE being set\n");
2520 goto sourcedb_cleanup
;
2526 /* No progress output */
2527 }else if( bSpinner
){
2528 int nTotal
= g
.nDb
*g
.nSql
;
2529 printf("\r%s: %d/%d \n", zDbName
, nTotal
, nTotal
);
2530 }else if( !quietFlag
&& verboseFlag
<2 ){
2531 printf(" 100%% - %d tests\n", g
.nDb
*g
.nSql
);
2534 /* Clean up at the end of processing a single source database
2537 blobListFree(g
.pFirstSql
);
2538 blobListFree(g
.pFirstDb
);
2541 } /* End loop over all source databases */
2543 if( !quietFlag
&& !bScript
){
2544 sqlite3_int64 iElapse
= timeOfDay() - iBegin
;
2546 printf("fuzzcheck: %u query invariants checked\n", g
.nInvariant
);
2548 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n"
2549 "SQLite %s %s (%d-bit)\n",
2550 nTest
, (int)(iElapse
/1000), (int)(iElapse
%1000),
2551 sqlite3_libversion(), sqlite3_sourceid(),
2552 8*(int)sizeof(char*));