test/ossfuzz.c

   1 /*
   2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service.
   3 ** (https://github.com/google/oss-fuzz)
   4 */
   5 #include <stddef.h>
   6 #if !defined(_MSC_VER)
   7 # include <stdint.h>
   8 #endif
   9 #include <stdio.h>
  10 #include <string.h>
  11 #include "sqlite3.h"
  12
  13 #if defined(_MSC_VER)
  14 typedef unsigned char uint8_t;
  15 #endif
  16
  17 /* Global debugging settings.  OSS-Fuzz will have all debugging turned
  18 ** off.  But if LLVMFuzzerTestOneInput() is called interactively from
  19 ** the ossshell utility program, then these flags might be set.
  20 */
  21 static unsigned mDebug = 0;
  22 #define FUZZ_SQL_TRACE       0x0001   /* Set an sqlite3_trace() callback */
  23 #define FUZZ_SHOW_MAX_DELAY  0x0002   /* Show maximum progress callback delay */
  24 #define FUZZ_SHOW_ERRORS     0x0004   /* Print error messages from SQLite */
  25
  26 /* The ossshell utility program invokes this interface to see the
  27 ** debugging flags.  Unused by OSS-Fuzz.
  28 */
  29 void ossfuzz_set_debug_flags(unsigned x){
  30   mDebug = x;
  31 }
  32
  33 /* Return the current real-world time in milliseconds since the
  34 ** Julian epoch (-4714-11-24).
  35 */
  36 static sqlite3_int64 timeOfDay(void){
  37   static sqlite3_vfs *clockVfs = 0;
  38   sqlite3_int64 t;
  39   if( clockVfs==0 ){
  40     clockVfs = sqlite3_vfs_find(0);
  41     if( clockVfs==0 ) return 0;
  42   }
  43   if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){
  44     clockVfs->xCurrentTimeInt64(clockVfs, &t);
  45   }else{
  46     double r;
  47     clockVfs->xCurrentTime(clockVfs, &r);
  48     t = (sqlite3_int64)(r*86400000.0);
  49   }
  50   return t;
  51 }
  52
  53 /* An instance of the following object is passed by pointer as the
  54 ** client data to various callbacks.
  55 */
  56 typedef struct FuzzCtx {
  57   sqlite3 *db;               /* The database connection */
  58   sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
  59   sqlite3_int64 iLastCb;     /* Time recorded for previous progress callback */
  60   sqlite3_int64 mxInterval;  /* Longest interval between two progress calls */
  61   unsigned nCb;              /* Number of progress callbacks */
  62   unsigned execCnt;          /* Number of calls to the sqlite3_exec callback */
  63 } FuzzCtx;
  64
  65 /*
  66 ** Progress handler callback.
  67 **
  68 ** The argument is the cutoff-time after which all processing should
  69 ** stop.  So return non-zero if the cut-off time is exceeded.
  70 */
  71 static int progress_handler(void *pClientData) {
  72   FuzzCtx *p = (FuzzCtx*)pClientData;
  73   sqlite3_int64 iNow = timeOfDay();
  74   int rc = iNow>=p->iCutoffTime;
  75   sqlite3_int64 iDiff = iNow - p->iLastCb;
  76   if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
  77   p->nCb++;
  78   return rc;
  79 }
  80
  81 /*
  82 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
  83 ** "PRAGMA parser_trace" since they can dramatically increase the
  84 ** amount of output without actually testing anything useful.
  85 */
  86 static int block_debug_pragmas(
  87   void *Notused,
  88   int eCode,
  89   const char *zArg1,
  90   const char *zArg2,
  91   const char *zArg3,
  92   const char *zArg4
  93 ){
  94   if( eCode==SQLITE_PRAGMA
  95    && (sqlite3_strnicmp("vdbe_", zArg1, 5)==0
  96         || sqlite3_stricmp("parser_trace", zArg1)==0)
  97   ){
  98     return SQLITE_DENY;
  99   }
 100   return SQLITE_OK;
 101 }
 102
 103 /*
 104 ** Callback for sqlite3_exec().
 105 */
 106 static int exec_handler(void *pClientData, int argc, char **argv, char **namev){
 107   FuzzCtx *p = (FuzzCtx*)pClientData;
 108   int i;
 109   if( argv ){
 110     for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i]));
 111   }
 112   return (p->execCnt--)<=0 || progress_handler(pClientData);
 113 }
 114
 115 /*
 116 ** Main entry point.  The fuzzer invokes this function with each
 117 ** fuzzed input.
 118 */
 119 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 120   char *zErrMsg = 0;       /* Error message returned by sqlite_exec() */
 121   uint8_t uSelector;       /* First byte of input data[] */
 122   int rc;                  /* Return code from various interfaces */
 123   char *zSql;              /* Zero-terminated copy of data[] */
 124   FuzzCtx cx;              /* Fuzzing context */
 125
 126   memset(&cx, 0, sizeof(cx));
 127   if( size<3 ) return 0;   /* Early out if unsufficient data */
 128
 129   /* Extract the selector byte from the beginning of the input.  But only
 130   ** do this if the second byte is a \n.  If the second byte is not \n,
 131   ** then use a default selector */
 132   if( data[1]=='\n' ){
 133     uSelector = data[0];  data += 2; size -= 2;
 134   }else{
 135     uSelector = 0xfd;
 136   }
 137
 138   /* Open the database connection.  Only use an in-memory database. */
 139   if( sqlite3_initialize() ) return 0;
 140   rc = sqlite3_open_v2("fuzz.db", &cx.db,
 141            SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0);
 142   if( rc ) return 0;
 143
 144   /* Invoke the progress handler frequently to check to see if we
 145   ** are taking too long.  The progress handler will return true
 146   ** (which will block further processing) if more than 10 seconds have
 147   ** elapsed since the start of the test.
 148   */
 149   cx.iLastCb = timeOfDay();
 150   cx.iCutoffTime = cx.iLastCb + 10000;  /* Now + 10 seconds */
 151 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
 152   sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
 153 #endif
 154
 155   /* Set a limit on the maximum size of a prepared statement */
 156   sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000);
 157
 158   /* Limit total memory available to SQLite to 20MB */
 159   sqlite3_hard_heap_limit64(20000000);
 160
 161   /* Set a limit on the maximum length of a string or BLOB.  Without this
 162   ** limit, fuzzers will invoke randomblob(N) for a large N, and the process
 163   ** will timeout trying to generate the huge blob */
 164   sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, 50000);
 165
 166   /* Bit 1 of the selector enables foreign key constraints */
 167   sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc);
 168   uSelector >>= 1;
 169
 170   /* Do not allow debugging pragma statements that might cause excess output */
 171   sqlite3_set_authorizer(cx.db, block_debug_pragmas, 0);
 172
 173   /* Remaining bits of the selector determine a limit on the number of
 174   ** output rows */
 175   cx.execCnt = uSelector + 1;
 176
 177   /* Run the SQL.  The sqlite_exec() interface expects a zero-terminated
 178   ** string, so make a copy. */
 179   zSql = sqlite3_mprintf("%.*s", (int)size, data);
 180 #ifndef SQLITE_OMIT_COMPLETE
 181   sqlite3_complete(zSql);
 182 #endif
 183   sqlite3_exec(cx.db, zSql, exec_handler, (void*)&cx, &zErrMsg);
 184
 185   /* Show any errors */
 186   if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){
 187     printf("Error: %s\n", zErrMsg);
 188   }
 189
 190   /* Cleanup and return */
 191   sqlite3_free(zErrMsg);
 192   sqlite3_free(zSql);
 193   sqlite3_exec(cx.db, "PRAGMA temp_store_directory=''", 0, 0, 0);
 194   sqlite3_close(cx.db);
 195
 196   if( mDebug & FUZZ_SHOW_MAX_DELAY ){
 197     printf("Progress callback count....... %d\n", cx.nCb);
 198     printf("Max time between callbacks.... %d ms\n", (int)cx.mxInterval);
 199   }
 200   return 0;
 201 }