4 ** The author disclaims copyright to this source code. In place of
5 ** a legal notice, here is a blessing:
7 ** May you do good and not evil.
8 ** May you find forgiveness for yourself and forgive others.
9 ** May you share freely, never taking more than you give.
11 *************************************************************************
13 ** This is a utility program designed to aid running regressions tests on
14 ** the SQLite library using data from external fuzzers.
16 ** This program reads content from an SQLite database file with the following
20 ** dbid INTEGER PRIMARY KEY, -- database id
21 ** dbcontent BLOB -- database disk file image
24 ** sqlid INTEGER PRIMARY KEY, -- SQL script id
25 ** sqltext TEXT -- Text of SQL statements to run
27 ** CREATE TABLE IF NOT EXISTS readme(
28 ** msg TEXT -- Human-readable description of this test collection
31 ** For each database file in the DB table, the SQL text in the XSQL table
32 ** is run against that database. All README.MSG values are printed prior
33 ** to the start of the test (unless the --quiet option is used). If the
34 ** DB table is empty, then all entries in XSQL are run against an empty
35 ** in-memory database.
37 ** This program is looking for crashes, assertion faults, and/or memory leaks.
38 ** No attempt is made to verify the output. The assumption is that either all
39 ** of the database files or all of the SQL statements are malformed inputs,
40 ** generated by a fuzzer, that need to be checked to make sure they do not
41 ** present a security risk.
43 ** This program also includes some command-line options to help with
44 ** creation and maintenance of the source content database. The command
46 ** ./fuzzcheck database.db --load-sql FILE...
48 ** Loads all FILE... arguments into the XSQL table. The --load-db option
49 ** works the same but loads the files into the DB table. The -m option can
50 ** be used to initialize the README table. The "database.db" file is created
51 ** if it does not previously exist. Example:
53 ** ./fuzzcheck new.db --load-sql *.sql
54 ** ./fuzzcheck new.db --load-db *.db
55 ** ./fuzzcheck new.db -m 'New test cases'
57 ** The three commands above will create the "new.db" file and initialize all
58 ** tables. Then do "./fuzzcheck new.db" to run the tests.
62 ** If fuzzcheck does crash, it can be run in the debugger and the content
63 ** of the global variable g.zTextName[] will identify the specific XSQL and
64 ** DB values that were running when the crash occurred.
66 ** DBSQLFUZZ: (Added 2020-02-25)
68 ** The dbsqlfuzz fuzzer includes both a database file and SQL to run against
69 ** that database in its input. This utility can now process dbsqlfuzz
70 ** input files. Load such files using the "--load-dbsql FILE ..." command-line
73 ** Dbsqlfuzz inputs are ordinary text. The first part of the file is text
74 ** that describes the content of the database (using a lot of hexadecimal),
75 ** then there is a divider line followed by the SQL to run against the
76 ** database. Because they are ordinary text, dbsqlfuzz inputs are stored
77 ** in the XSQL table, as if they were ordinary SQL inputs. The isDbSql()
78 ** function can look at a text string and determine whether or not it is
79 ** a valid dbsqlfuzz input.
88 #include "sqlite3recover.h"
89 #define ISSPACE(X) isspace((unsigned char)(X))
90 #define ISDIGIT(X) isdigit((unsigned char)(X))
99 #if !defined(_MSC_VER)
103 #if defined(_MSC_VER)
104 typedef unsigned char uint8_t;
108 ** Files in the virtual file system.
110 typedef struct VFile VFile
;
112 char *zFilename
; /* Filename. NULL for delete-on-close. From malloc() */
113 int sz
; /* Size of the file in bytes */
114 int nRef
; /* Number of references to this file */
115 unsigned char *a
; /* Content of the file. From malloc() */
117 typedef struct VHandle VHandle
;
119 sqlite3_file base
; /* Base class. Must be first */
120 VFile
*pVFile
; /* The underlying file */
124 ** The value of a database file template, or of an SQL script
126 typedef struct Blob Blob
;
128 Blob
*pNext
; /* Next in a list */
129 int id
; /* Id of this Blob */
130 int seq
; /* Sequence number */
131 int sz
; /* Size of this Blob in bytes */
132 unsigned char a
[1]; /* Blob content. Extra space allocated as needed. */
136 ** Maximum number of files in the in-memory virtual filesystem.
141 ** Maximum allowed file size
143 #define MX_FILE_SZ 10000000
146 ** All global variables are gathered into the "g" singleton.
148 static struct GlobalVars
{
149 const char *zArgv0
; /* Name of program */
150 const char *zDbFile
; /* Name of database file */
151 VFile aFile
[MX_FILE
]; /* The virtual filesystem */
152 int nDb
; /* Number of template databases */
153 Blob
*pFirstDb
; /* Content of first template database */
154 int nSql
; /* Number of SQL scripts */
155 Blob
*pFirstSql
; /* First SQL script */
156 unsigned int uRandom
; /* Seed for the SQLite PRNG */
157 unsigned int nInvariant
; /* Number of invariant checks run */
158 char zTestName
[100]; /* Name of current test */
162 ** Include various extensions.
164 extern int sqlite3_vt02_init(sqlite3
*,char**,const sqlite3_api_routines
*);
165 extern int sqlite3_randomjson_init(sqlite3
*,char**,const sqlite3_api_routines
*);
166 extern int sqlite3_percentile_init(sqlite3
*,char**,const sqlite3_api_routines
*);
170 ** Print an error message and quit.
172 static void fatalError(const char *zFormat
, ...){
174 fprintf(stderr
, "%s", g
.zArgv0
);
175 if( g
.zDbFile
) fprintf(stderr
, " %s", g
.zDbFile
);
176 if( g
.zTestName
[0] ) fprintf(stderr
, " (%s)", g
.zTestName
);
177 fprintf(stderr
, ": ");
178 va_start(ap
, zFormat
);
179 vfprintf(stderr
, zFormat
, ap
);
181 fprintf(stderr
, "\n");
189 static void signalHandler(int signum
){
191 if( signum
==SIGABRT
){
193 }else if( signum
==SIGALRM
){
195 }else if( signum
==SIGSEGV
){
205 ** Set the an alarm to go off after N seconds. Disable the alarm
208 static void setAlarm(int N
){
216 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
218 ** This an SQL progress handler. After an SQL statement has run for
219 ** many steps, we want to interrupt it. This guards against infinite
220 ** loops from recursive common table expressions.
222 ** *pVdbeLimitFlag is true if the --limit-vdbe command-line option is used.
223 ** In that case, hitting the progress handler is a fatal error.
225 static int progressHandler(void *pVdbeLimitFlag
){
226 if( *(int*)pVdbeLimitFlag
) fatalError("too many VDBE cycles");
232 ** Reallocate memory. Show an error and quit if unable.
234 static void *safe_realloc(void *pOld
, int szNew
){
235 void *pNew
= realloc(pOld
, szNew
<=0 ? 1 : szNew
);
236 if( pNew
==0 ) fatalError("unable to realloc for %d bytes", szNew
);
241 ** Initialize the virtual file system.
243 static void formatVfs(void){
245 for(i
=0; i
<MX_FILE
; i
++){
247 g
.aFile
[i
].zFilename
= 0;
255 ** Erase all information in the virtual file system.
257 static void reformatVfs(void){
259 for(i
=0; i
<MX_FILE
; i
++){
260 if( g
.aFile
[i
].sz
<0 ) continue;
261 if( g
.aFile
[i
].zFilename
){
262 free(g
.aFile
[i
].zFilename
);
263 g
.aFile
[i
].zFilename
= 0;
265 if( g
.aFile
[i
].nRef
>0 ){
266 fatalError("file %d still open. nRef=%d", i
, g
.aFile
[i
].nRef
);
276 ** Find a VFile by name
278 static VFile
*findVFile(const char *zName
){
280 if( zName
==0 ) return 0;
281 for(i
=0; i
<MX_FILE
; i
++){
282 if( g
.aFile
[i
].zFilename
==0 ) continue;
283 if( strcmp(g
.aFile
[i
].zFilename
, zName
)==0 ) return &g
.aFile
[i
];
289 ** Find a VFile by name. Create it if it does not already exist and
290 ** initialize it to the size and content given.
292 ** Return NULL only if the filesystem is full.
294 static VFile
*createVFile(const char *zName
, int sz
, unsigned char *pData
){
295 VFile
*pNew
= findVFile(zName
);
297 if( pNew
) return pNew
;
298 for(i
=0; i
<MX_FILE
&& g
.aFile
[i
].sz
>=0; i
++){}
299 if( i
>=MX_FILE
) return 0;
302 int nName
= (int)strlen(zName
)+1;
303 pNew
->zFilename
= safe_realloc(0, nName
);
304 memcpy(pNew
->zFilename
, zName
, nName
);
310 pNew
->a
= safe_realloc(0, sz
);
311 if( sz
>0 ) memcpy(pNew
->a
, pData
, sz
);
315 /* Return true if the line is all zeros */
316 static int allZero(unsigned char *aLine
){
318 for(i
=0; i
<16 && aLine
[i
]==0; i
++){}
323 ** Render a database and query as text that can be input into
326 static void renderDbSqlForCLI(
327 FILE *out
, /* Write to this file */
328 const char *zFile
, /* Name of the database file */
329 unsigned char *aDb
, /* Database content */
330 int nDb
, /* Number of bytes in aDb[] */
331 unsigned char *zSql
, /* SQL content */
332 int nSql
/* Bytes of SQL */
334 fprintf(out
, ".print ******* %s *******\n", zFile
);
336 int i
, j
; /* Loop counters */
337 int pgsz
; /* Size of each page */
338 int lastPage
= 0; /* Last page number shown */
339 int iPage
; /* Current page number */
340 unsigned char *aLine
; /* Single line to display */
341 unsigned char buf
[16]; /* Fake line */
342 unsigned char bShow
[256]; /* Characters ok to display */
344 memset(bShow
, '.', sizeof(bShow
));
345 for(i
=' '; i
<='~'; i
++){
346 if( i
!='{' && i
!='}' && i
!='"' && i
!='\\' ) bShow
[i
] = i
;
348 pgsz
= (aDb
[16]<<8) | aDb
[17];
349 if( pgsz
==0 ) pgsz
= 65536;
350 if( pgsz
<512 || (pgsz
&(pgsz
-1))!=0 ) pgsz
= 4096;
351 fprintf(out
,".open --hexdb\n");
352 fprintf(out
,"| size %d pagesize %d filename %s\n",nDb
,pgsz
,zFile
);
353 for(i
=0; i
<nDb
; i
+= 16){
355 memset(buf
, 0, sizeof(buf
));
356 memcpy(buf
, aDb
+i
, nDb
-i
);
361 if( allZero(aLine
) ) continue;
363 if( lastPage
!=iPage
){
364 fprintf(out
,"| page %d offset %d\n", iPage
, (iPage
-1)*pgsz
);
367 fprintf(out
,"| %5d:", i
-(iPage
-1)*pgsz
);
368 for(j
=0; j
<16; j
++) fprintf(out
," %02x", aLine
[j
]);
371 unsigned char c
= (unsigned char)aLine
[j
];
372 fputc( bShow
[c
], stdout
);
376 fprintf(out
,"| end %s\n", zFile
);
378 fprintf(out
,".open :memory:\n");
380 fprintf(out
,".testctrl prng_seed 1 db\n");
381 fprintf(out
,".testctrl internal_functions\n");
382 fprintf(out
,"%.*s", nSql
, zSql
);
383 if( nSql
>0 && zSql
[nSql
-1]!='\n' ) fprintf(out
, "\n");
387 ** Read the complete content of a file into memory. Add a 0x00 terminator
388 ** and return a pointer to the result.
390 ** The file content is held in memory obtained from sqlite_malloc64() which
391 ** should be freed by the caller.
393 static char *readFile(const char *zFilename
, long *sz
){
399 if( zFilename
==0 ) return 0;
400 in
= fopen(zFilename
, "rb");
401 if( in
==0 ) return 0;
402 fseek(in
, 0, SEEK_END
);
403 *sz
= nIn
= ftell(in
);
405 pBuf
= sqlite3_malloc64( nIn
+1 );
406 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
419 ** Implementation of the "readfile(X)" SQL function. The entire content
420 ** of the file named X is read and returned as a BLOB. NULL is returned
421 ** if the file does not exist or is unreadable.
423 static void readfileFunc(
424 sqlite3_context
*context
,
430 const char *zName
= (const char*)sqlite3_value_text(argv
[0]);
432 if( zName
==0 ) return;
433 pBuf
= readFile(zName
, &nIn
);
435 sqlite3_result_blob(context
, pBuf
, nIn
, sqlite3_free
);
440 ** Implementation of the "readtextfile(X)" SQL function. The text content
441 ** of the file named X through the end of the file or to the first \000
442 ** character, whichever comes first, is read and returned as TEXT. NULL
443 ** is returned if the file does not exist or is unreadable.
445 static void readtextfileFunc(
446 sqlite3_context
*context
,
455 zName
= (const char*)sqlite3_value_text(argv
[0]);
456 if( zName
==0 ) return;
457 in
= fopen(zName
, "rb");
459 fseek(in
, 0, SEEK_END
);
462 pBuf
= sqlite3_malloc64( nIn
+1 );
463 if( pBuf
&& 1==fread(pBuf
, nIn
, 1, in
) ){
465 sqlite3_result_text(context
, pBuf
, -1, sqlite3_free
);
473 ** Implementation of the "writefile(X,Y)" SQL function. The argument Y
474 ** is written into file X. The number of bytes written is returned. Or
475 ** NULL is returned if something goes wrong, such as being unable to open
476 ** file X for writing.
478 static void writefileFunc(
479 sqlite3_context
*context
,
489 zFile
= (const char*)sqlite3_value_text(argv
[0]);
490 if( zFile
==0 ) return;
491 out
= fopen(zFile
, "wb");
493 z
= (const char*)sqlite3_value_blob(argv
[1]);
497 rc
= fwrite(z
, 1, sqlite3_value_bytes(argv
[1]), out
);
500 sqlite3_result_int64(context
, rc
);
505 ** Load a list of Blob objects from the database
507 static void blobListLoadFromDb(
508 sqlite3
*db
, /* Read from this database */
509 const char *zSql
, /* Query used to extract the blobs */
510 int onlyId
, /* Only load where id is this value */
511 int *pN
, /* OUT: Write number of blobs loaded here */
512 Blob
**ppList
/* OUT: Write the head of the blob list here */
522 z2
= sqlite3_mprintf("%s WHERE rowid=%d", zSql
, onlyId
);
524 z2
= sqlite3_mprintf("%s", zSql
);
526 rc
= sqlite3_prepare_v2(db
, z2
, -1, &pStmt
, 0);
528 if( rc
) fatalError("%s", sqlite3_errmsg(db
));
531 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
532 int sz
= sqlite3_column_bytes(pStmt
, 1);
533 Blob
*pNew
= safe_realloc(0, sizeof(*pNew
)+sz
);
534 pNew
->id
= sqlite3_column_int(pStmt
, 0);
538 memcpy(pNew
->a
, sqlite3_column_blob(pStmt
,1), sz
);
543 sqlite3_finalize(pStmt
);
545 *ppList
= head
.pNext
;
549 ** Free a list of Blob objects
551 static void blobListFree(Blob
*p
){
560 /* Return the current wall-clock time
562 ** The number of milliseconds since the julian epoch.
563 ** 1907-01-01 00:00:00 -> 210866716800000
564 ** 2021-01-01 00:00:00 -> 212476176000000
566 static sqlite3_int64
timeOfDay(void){
567 static sqlite3_vfs
*clockVfs
= 0;
570 clockVfs
= sqlite3_vfs_find(0);
571 if( clockVfs
==0 ) return 0;
573 if( clockVfs
->iVersion
>=1 && clockVfs
->xCurrentTimeInt64
!=0 ){
574 clockVfs
->xCurrentTimeInt64(clockVfs
, &t
);
577 clockVfs
->xCurrentTime(clockVfs
, &r
);
578 t
= (sqlite3_int64
)(r
*86400000.0);
583 /***************************************************************************
584 ** Code to process combined database+SQL scripts generated by the
588 /* An instance of the following object is passed by pointer as the
589 ** client data to various callbacks.
591 typedef struct FuzzCtx
{
592 sqlite3
*db
; /* The database connection */
593 sqlite3_int64 iCutoffTime
; /* Stop processing at this time. */
594 sqlite3_int64 iLastCb
; /* Time recorded for previous progress callback */
595 sqlite3_int64 mxInterval
; /* Longest interval between two progress calls */
596 unsigned nCb
; /* Number of progress callbacks */
597 unsigned mxCb
; /* Maximum number of progress callbacks allowed */
598 unsigned execCnt
; /* Number of calls to the sqlite3_exec callback */
599 int timeoutHit
; /* True when reaching a timeout */
602 /* Verbosity level for the dbsqlfuzz test runner */
603 static int eVerbosity
= 0;
605 /* True to activate PRAGMA vdbe_debug=on */
606 static int bVdbeDebug
= 0;
608 /* Timeout for each fuzzing attempt, in milliseconds */
609 static int giTimeout
= 10000; /* Defaults to 10 seconds */
611 /* Maximum number of progress handler callbacks */
612 static unsigned int mxProgressCb
= 2000;
614 /* Maximum string length in SQLite */
615 static int lengthLimit
= 1000000;
617 /* Maximum expression depth */
618 static int depthLimit
= 500;
620 /* Limit on the amount of heap memory that can be used */
621 static sqlite3_int64 heapLimit
= 100000000;
623 /* Maximum byte-code program length in SQLite */
624 static int vdbeOpLimit
= 25000;
626 /* Maximum size of the in-memory database */
627 static sqlite3_int64 maxDbSize
= 104857600;
628 /* OOM simulation parameters */
629 static unsigned int oomCounter
= 0; /* Simulate OOM when equals 1 */
630 static unsigned int oomRepeat
= 0; /* Number of OOMs in a row */
631 static void*(*defaultMalloc
)(int) = 0; /* The low-level malloc routine */
633 /* Enable recovery */
634 static int bNoRecover
= 0;
636 /* This routine is called when a simulated OOM occurs. It is broken
637 ** out as a separate routine to make it easy to set a breakpoint on
642 printf("Simulated OOM fault\n");
651 /* This routine is a replacement malloc() that is used to simulate
652 ** Out-Of-Memory (OOM) errors for testing purposes.
654 static void *oomMalloc(int nByte
){
663 return defaultMalloc(nByte
);
666 /* Register the OOM simulator. This must occur before any memory
668 static void registerOomSimulator(void){
669 sqlite3_mem_methods mem
;
671 sqlite3_config(SQLITE_CONFIG_GETMALLOC
, &mem
);
672 defaultMalloc
= mem
.xMalloc
;
673 mem
.xMalloc
= oomMalloc
;
674 sqlite3_config(SQLITE_CONFIG_MALLOC
, &mem
);
677 /* Turn off any pending OOM simulation */
678 static void disableOom(void){
684 ** Translate a single byte of Hex into an integer.
685 ** This routine only works if h really is a valid hexadecimal
686 ** character: 0..9a..fA..F
688 static unsigned char hexToInt(unsigned int h
){
690 h
+= 9*(1&~(h
>>4)); /* EBCDIC */
692 h
+= 9*(1&(h
>>6)); /* ASCII */
698 ** The first character of buffer zIn[0..nIn-1] is a '['. This routine
699 ** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it
700 ** does it makes corresponding changes to the *pK value and *pI value
701 ** and returns true. If the input buffer does not match the patterns,
702 ** no changes are made to either *pK or *pI and this routine returns false.
705 const unsigned char *zIn
, /* Text input */
706 int nIn
, /* Bytes of input */
707 unsigned int *pK
, /* half-byte cursor to adjust */
708 unsigned int *pI
/* Input index to adjust */
713 for(i
=1; i
<nIn
&& (c
= zIn
[i
])!=']'; i
++){
714 if( !isxdigit(c
) ) return 0;
715 k
= k
*16 + hexToInt(c
);
717 if( i
==nIn
) return 0;
724 ** Decode the text starting at zIn into a binary database file.
725 ** The maximum length of zIn is nIn bytes. Store the binary database
726 ** file in space obtained from sqlite3_malloc().
728 ** Return the number of bytes of zIn consumed. Or return -1 if there
729 ** is an error. One potential error is that the recipe specifies a
730 ** database file larger than MX_FILE_SZ bytes.
734 static int decodeDatabase(
735 const unsigned char *zIn
, /* Input text to be decoded */
736 int nIn
, /* Bytes of input text */
737 unsigned char **paDecode
, /* OUT: decoded database file */
738 int *pnDecode
/* OUT: Size of decoded database */
740 unsigned char *a
, *aNew
; /* Database under construction */
741 int mx
= 0; /* Current size of the database */
742 sqlite3_uint64 nAlloc
= 4096; /* Space allocated in a[] */
743 unsigned int i
; /* Next byte of zIn[] to read */
744 unsigned int j
; /* Temporary integer */
745 unsigned int k
; /* half-byte cursor index for output */
746 unsigned int n
; /* Number of bytes of input */
748 if( nIn
<4 ) return -1;
749 n
= (unsigned int)nIn
;
750 a
= sqlite3_malloc64( nAlloc
);
752 fprintf(stderr
, "Out of memory!\n");
755 memset(a
, 0, (size_t)nAlloc
);
756 for(i
=k
=0; i
<n
; i
++){
757 unsigned char c
= (unsigned char)zIn
[i
];
766 sqlite3_uint64 newSize
;
767 if( nAlloc
==MX_FILE_SZ
|| j
>=MX_FILE_SZ
){
769 fprintf(stderr
, "Input database too big: max %d bytes\n",
777 newSize
= (j
+4096)&~4095;
779 if( newSize
>MX_FILE_SZ
){
784 newSize
= MX_FILE_SZ
;
786 aNew
= sqlite3_realloc64( a
, newSize
);
792 assert( newSize
> nAlloc
);
793 memset(a
+nAlloc
, 0, (size_t)(newSize
- nAlloc
));
796 if( j
>=(unsigned)mx
){
797 mx
= (j
+ 4095)&~4095;
798 if( mx
>MX_FILE_SZ
) mx
= MX_FILE_SZ
;
803 }else if( zIn
[i
]=='[' && i
<n
-3 && isOffset(zIn
+i
, nIn
-i
, &k
, &i
) ){
805 }else if( zIn
[i
]=='\n' && i
<n
-4 && memcmp(zIn
+i
,"\n--\n",4)==0 ){
816 ** Progress handler callback.
818 ** The argument is the cutoff-time after which all processing should
819 ** stop. So return non-zero if the cut-off time is exceeded.
821 static int progress_handler(void *pClientData
) {
822 FuzzCtx
*p
= (FuzzCtx
*)pClientData
;
823 sqlite3_int64 iNow
= timeOfDay();
824 int rc
= iNow
>=p
->iCutoffTime
;
825 sqlite3_int64 iDiff
= iNow
- p
->iLastCb
;
826 /* printf("time-remaining: %lld\n", p->iCutoffTime - iNow); */
827 if( iDiff
> p
->mxInterval
) p
->mxInterval
= iDiff
;
829 if( rc
==0 && p
->mxCb
>0 && p
->mxCb
<=p
->nCb
) rc
= 1;
830 if( rc
&& !p
->timeoutHit
&& eVerbosity
>=2 ){
831 printf("Timeout on progress callback %d\n", p
->nCb
);
839 ** Flag bits set by block_troublesome_sql()
841 #define BTS_SELECT 0x000001
842 #define BTS_NONSELECT 0x000002
843 #define BTS_BADFUNC 0x000004
844 #define BTS_BADPRAGMA 0x000008 /* Sticky for rest of the script */
847 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
848 ** "PRAGMA parser_trace" since they can dramatically increase the
849 ** amount of output without actually testing anything useful.
851 ** Also block ATTACH if attaching a file from the filesystem.
853 static int block_troublesome_sql(
861 unsigned int *pBtsFlags
= (unsigned int*)pClientData
;
866 case SQLITE_PRAGMA
: {
867 if( sqlite3_stricmp("busy_timeout",zArg1
)==0
868 && (zArg2
==0 || strtoll(zArg2
,0,0)>100 || strtoll(zArg2
,0,10)>100)
871 }else if( sqlite3_stricmp("hard_heap_limit", zArg1
)==0
872 || sqlite3_stricmp("reverse_unordered_selects", zArg1
)==0
874 /* BTS_BADPRAGMA is sticky. A hard_heap_limit or
875 ** revert_unordered_selects should inhibit all future attempts
876 ** at verifying query invariants */
877 *pBtsFlags
|= BTS_BADPRAGMA
;
878 }else if( eVerbosity
==0 ){
879 if( sqlite3_strnicmp("vdbe_", zArg1
, 5)==0
880 || sqlite3_stricmp("parser_trace", zArg1
)==0
881 || sqlite3_stricmp("temp_store_directory", zArg1
)==0
885 }else if( sqlite3_stricmp("oom",zArg1
)==0
886 && zArg2
!=0 && zArg2
[0]!=0 ){
887 oomCounter
= atoi(zArg2
);
889 *pBtsFlags
|= BTS_NONSELECT
;
892 case SQLITE_ATTACH
: {
893 /* Deny the ATTACH if it is attaching anything other than an in-memory
895 *pBtsFlags
|= BTS_NONSELECT
;
896 if( zArg1
==0 ) return SQLITE_DENY
;
897 if( strcmp(zArg1
,":memory:")==0 ) return SQLITE_OK
;
898 if( sqlite3_strglob("file:*[?]vfs=memdb", zArg1
)==0
899 && sqlite3_strglob("file:*[^/a-zA-Z0-9_.]*[?]vfs=memdb", zArg1
)!=0
905 case SQLITE_SELECT
: {
906 *pBtsFlags
|= BTS_SELECT
;
909 case SQLITE_FUNCTION
: {
910 static const char *azBadFuncs
[] = {
922 "geopoly_group_bbox",
924 "implies_nonnull_row",
949 last
= sizeof(azBadFuncs
)/sizeof(azBadFuncs
[0]) - 1;
951 int mid
= (first
+last
)/2;
952 int c
= sqlite3_stricmp(azBadFuncs
[mid
], zArg2
);
958 *pBtsFlags
|= BTS_BADFUNC
;
961 }while( first
<=last
);
969 *pBtsFlags
|= BTS_NONSELECT
;
975 /* Implementation found in fuzzinvariant.c */
976 extern int fuzz_invariant(
977 sqlite3
*db
, /* The database connection */
978 sqlite3_stmt
*pStmt
, /* Test statement stopped on an SQLITE_ROW */
979 int iCnt
, /* Invariant sequence number, starting at 0 */
980 int iRow
, /* The row number for pStmt */
981 int nRow
, /* Total number of output rows */
982 int *pbCorrupt
, /* IN/OUT: Flag indicating a corrupt database file */
983 int eVerbosity
, /* How much debugging output */
984 unsigned int dbOpt
/* Default optimization flags */
987 /* Implementation of sqlite_dbdata and sqlite_dbptr */
988 extern int sqlite3_dbdata_init(sqlite3
*,const char**,void*);
992 ** This function is used as a callback by the recover extension. Simply
993 ** print the supplied SQL statement to stdout.
995 static int recoverSqlCb(void *pCtx
, const char *zSql
){
997 printf("%s\n", zSql
);
1003 ** This function is called to recover data from the database.
1005 static int recoverDatabase(sqlite3
*db
){
1006 int rc
; /* Return code from this routine */
1007 const char *zRecoveryDb
= ""; /* Name of "recovery" database */
1008 const char *zLAF
= "lost_and_found"; /* Name of "lost_and_found" table */
1009 int bFreelist
= 1; /* True to scan the freelist */
1010 int bRowids
= 1; /* True to restore ROWID values */
1011 sqlite3_recover
*p
= 0; /* The recovery object */
1013 p
= sqlite3_recover_init_sql(db
, "main", recoverSqlCb
, 0);
1014 sqlite3_recover_config(p
, 789, (void*)zRecoveryDb
);
1015 sqlite3_recover_config(p
, SQLITE_RECOVER_LOST_AND_FOUND
, (void*)zLAF
);
1016 sqlite3_recover_config(p
, SQLITE_RECOVER_ROWIDS
, (void*)&bRowids
);
1017 sqlite3_recover_config(p
, SQLITE_RECOVER_FREELIST_CORRUPT
,(void*)&bFreelist
);
1018 sqlite3_recover_run(p
);
1019 if( sqlite3_recover_errcode(p
)!=SQLITE_OK
){
1020 const char *zErr
= sqlite3_recover_errmsg(p
);
1021 int errCode
= sqlite3_recover_errcode(p
);
1023 printf("recovery error: %s (%d)\n", zErr
, errCode
);
1026 rc
= sqlite3_recover_finish(p
);
1027 if( eVerbosity
>0 && rc
){
1028 printf("recovery returns error code %d\n", rc
);
1033 ** Special parameter binding, for testing and debugging purposes.
1035 ** $int_NNN -> integer value NNN
1036 ** $text_TTTT -> floating point value TTT with destructor
1038 static void bindDebugParameters(sqlite3_stmt
*pStmt
){
1039 int nVar
= sqlite3_bind_parameter_count(pStmt
);
1041 for(i
=1; i
<=nVar
; i
++){
1042 const char *zVar
= sqlite3_bind_parameter_name(pStmt
, i
);
1043 if( zVar
==0 ) continue;
1044 if( strncmp(zVar
, "$int_", 5)==0 ){
1045 sqlite3_bind_int(pStmt
, i
, atoi(&zVar
[5]));
1047 if( strncmp(zVar
, "$text_", 6)==0 ){
1048 size_t szVar
= strlen(zVar
);
1049 char *zBuf
= sqlite3_malloc64( szVar
-5 );
1051 memcpy(zBuf
, &zVar
[6], szVar
-5);
1052 sqlite3_bind_text64(pStmt
, i
, zBuf
, szVar
-6, sqlite3_free
, SQLITE_UTF8
);
1061 static int runDbSql(
1062 sqlite3
*db
, /* Run SQL on this database connection */
1063 const char *zSql
, /* The SQL to be run */
1064 unsigned int *pBtsFlags
,
1065 unsigned int dbOpt
/* Default optimization flags */
1068 sqlite3_stmt
*pStmt
;
1070 while( isspace(zSql
[0]&0x7f) ) zSql
++;
1071 if( zSql
[0]==0 ) return SQLITE_OK
;
1072 if( eVerbosity
>=4 ){
1073 printf("RUNNING-SQL: [%s]\n", zSql
);
1076 (*pBtsFlags
) &= BTS_BADPRAGMA
;
1077 rc
= sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, 0);
1078 if( rc
==SQLITE_OK
){
1080 bindDebugParameters(pStmt
);
1081 while( (rc
= sqlite3_step(pStmt
))==SQLITE_ROW
){
1083 if( eVerbosity
>=4 ){
1085 for(j
=0; j
<sqlite3_column_count(pStmt
); j
++){
1086 if( j
) printf(",");
1087 switch( sqlite3_column_type(pStmt
, j
) ){
1092 case SQLITE_INTEGER
:
1093 case SQLITE_FLOAT
: {
1094 printf("%s", sqlite3_column_text(pStmt
, j
));
1098 int n
= sqlite3_column_bytes(pStmt
, j
);
1100 const unsigned char *a
;
1101 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1104 printf("%02x", a
[i
]);
1110 int n
= sqlite3_column_bytes(pStmt
, j
);
1112 const unsigned char *a
;
1113 a
= (const unsigned char*)sqlite3_column_blob(pStmt
, j
);
1125 } /* End switch() */
1129 } /* End if( eVerbosity>=5 ) */
1130 } /* End while( SQLITE_ROW */
1131 if( rc
==SQLITE_DONE
){
1132 if( (*pBtsFlags
)==BTS_SELECT
1133 && !sqlite3_stmt_isexplain(pStmt
)
1137 sqlite3_reset(pStmt
);
1138 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
1141 for(iCnt
=0; iCnt
<99999; iCnt
++){
1142 rc
= fuzz_invariant(db
, pStmt
, iCnt
, iRow
, nRow
,
1143 &bCorrupt
, eVerbosity
, dbOpt
);
1144 if( rc
==SQLITE_DONE
) break;
1145 if( rc
!=SQLITE_ERROR
) g
.nInvariant
++;
1147 if( rc
==SQLITE_OK
){
1148 printf("invariant-check: ok\n");
1149 }else if( rc
==SQLITE_CORRUPT
){
1150 printf("invariant-check: failed due to database corruption\n");
1156 }else if( eVerbosity
>=4 ){
1157 printf("SQL-ERROR: (%d) %s\n", rc
, sqlite3_errmsg(db
));
1160 }else if( eVerbosity
>=4 ){
1161 printf("SQL-ERROR (%d): %s\n", rc
, sqlite3_errmsg(db
));
1163 } /* End if( SQLITE_OK ) */
1164 return sqlite3_finalize(pStmt
);
1167 /* Mappings into dbconfig settings for bits taken from bytes 72..75 of
1168 ** the input database.
1170 ** This should be the same as in dbsqlfuzz.c. Make sure those codes stay
1173 static const struct {
1177 } aDbConfigSettings
[] = {
1178 { 0x0001, SQLITE_DBCONFIG_ENABLE_FKEY
, "enable_fkey" },
1179 { 0x0002, SQLITE_DBCONFIG_ENABLE_TRIGGER
, "enable_trigger" },
1180 { 0x0004, SQLITE_DBCONFIG_ENABLE_VIEW
, "enable_view" },
1181 { 0x0008, SQLITE_DBCONFIG_ENABLE_QPSG
, "enable_qpsg" },
1182 { 0x0010, SQLITE_DBCONFIG_TRIGGER_EQP
, "trigger_eqp" },
1183 { 0x0020, SQLITE_DBCONFIG_DEFENSIVE
, "defensive" },
1184 { 0x0040, SQLITE_DBCONFIG_WRITABLE_SCHEMA
, "writable_schema" },
1185 { 0x0080, SQLITE_DBCONFIG_LEGACY_ALTER_TABLE
, "legacy_alter_table" },
1186 { 0x0100, SQLITE_DBCONFIG_STMT_SCANSTATUS
, "stmt_scanstatus" },
1187 { 0x0200, SQLITE_DBCONFIG_REVERSE_SCANORDER
, "reverse_scanorder" },
1188 #ifdef SQLITE_DBCONFIG_STRICT_AGGREGATE
1189 { 0x0400, SQLITE_DBCONFIG_STRICT_AGGREGATE
, "strict_aggregate" },
1191 { 0x0800, SQLITE_DBCONFIG_DQS_DML
, "dqs_dml" },
1192 { 0x1000, SQLITE_DBCONFIG_DQS_DDL
, "dqs_ddl" },
1193 { 0x2000, SQLITE_DBCONFIG_TRUSTED_SCHEMA
, "trusted_schema" },
1196 /* Toggle a dbconfig setting
1198 static void toggleDbConfig(sqlite3
*db
, int iSetting
){
1200 sqlite3_db_config(db
, iSetting
, -1, &v
);
1202 sqlite3_db_config(db
, iSetting
, v
, 0);
1205 /* Invoke this routine to run a single test case */
1206 int runCombinedDbSqlInput(
1207 const uint8_t *aData
, /* Combined DB+SQL content */
1208 size_t nByte
, /* Size of aData in bytes */
1209 int iTimeout
, /* Use this timeout */
1210 int bScript
, /* If true, just render CLI output */
1211 int iSqlId
/* SQL identifier */
1213 int rc
; /* SQLite API return value */
1214 int iSql
; /* Index in aData[] of start of SQL */
1215 unsigned char *aDb
= 0; /* Decoded database content */
1216 int nDb
= 0; /* Size of the decoded database */
1217 int i
; /* Loop counter */
1218 int j
; /* Start of current SQL statement */
1219 char *zSql
= 0; /* SQL text to run */
1220 int nSql
; /* Bytes of SQL text */
1221 FuzzCtx cx
; /* Fuzzing context */
1222 unsigned int btsFlags
= 0; /* Parsing flags */
1223 unsigned int dbFlags
= 0; /* Flag values from db offset 72..75 */
1224 unsigned int dbOpt
= 0; /* Flag values from db offset 76..79 */
1227 if( nByte
<10 ) return 0;
1228 if( sqlite3_initialize() ) return 0;
1229 if( sqlite3_memory_used()!=0 ){
1232 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1233 fprintf(stderr
,"memory leak prior to test start:"
1234 " %lld bytes in %d allocations\n",
1235 sqlite3_memory_used(), nAlloc
);
1238 memset(&cx
, 0, sizeof(cx
));
1239 iSql
= decodeDatabase((unsigned char*)aData
, (int)nByte
, &aDb
, &nDb
);
1240 if( iSql
<0 ) return 0;
1242 dbFlags
= ((unsigned int)aDb
[72]<<24) + ((unsigned int)aDb
[73]<<16) +
1243 ((unsigned int)aDb
[74]<<8) + (unsigned int)aDb
[75];
1246 dbOpt
= ((unsigned int)aDb
[76]<<24) + ((unsigned int)aDb
[77]<<16) +
1247 ((unsigned int)aDb
[78]<<8) + (unsigned int)aDb
[79];
1249 nSql
= (int)(nByte
- iSql
);
1252 sqlite3_snprintf(sizeof(zName
),zName
,"dbsql%06d.db",iSqlId
);
1253 renderDbSqlForCLI(stdout
, zName
, aDb
, nDb
,
1254 (unsigned char*)(aData
+iSql
), nSql
);
1258 if( eVerbosity
>=3 ){
1260 "****** %d-byte input, %d-byte database, %d-byte script "
1261 "******\n", (int)nByte
, nDb
, nSql
);
1264 rc
= sqlite3_open(0, &cx
.db
);
1269 sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS
, cx
.db
, dbOpt
);
1270 for(i
=0; i
<sizeof(aDbConfigSettings
)/sizeof(aDbConfigSettings
[0]); i
++){
1271 if( dbFlags
& aDbConfigSettings
[i
].mask
){
1272 toggleDbConfig(cx
.db
, aDbConfigSettings
[i
].iSetting
);
1276 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
1279 /* Invoke the progress handler frequently to check to see if we
1280 ** are taking too long. The progress handler will return true
1281 ** (which will block further processing) if more than giTimeout seconds have
1282 ** elapsed since the start of the test.
1284 cx
.iLastCb
= timeOfDay();
1285 cx
.iCutoffTime
= cx
.iLastCb
+ (iTimeout
<giTimeout
? iTimeout
: giTimeout
);
1286 cx
.mxCb
= mxProgressCb
;
1287 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
1288 sqlite3_progress_handler(cx
.db
, 10, progress_handler
, (void*)&cx
);
1291 /* Set a limit on the maximum size of a prepared statement, and the
1292 ** maximum length of a string or blob */
1293 if( vdbeOpLimit
>0 ){
1294 sqlite3_limit(cx
.db
, SQLITE_LIMIT_VDBE_OP
, vdbeOpLimit
);
1296 if( lengthLimit
>0 ){
1297 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LENGTH
, lengthLimit
);
1300 sqlite3_limit(cx
.db
, SQLITE_LIMIT_EXPR_DEPTH
, depthLimit
);
1302 sqlite3_limit(cx
.db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 100);
1303 sqlite3_hard_heap_limit64(heapLimit
);
1305 sqlite3_test_control(SQLITE_TESTCTRL_JSON_SELFCHECK
, &rc
);
1307 if( nDb
>=20 && aDb
[18]==2 && aDb
[19]==2 ){
1308 aDb
[18] = aDb
[19] = 1;
1310 rc
= sqlite3_deserialize(cx
.db
, "main", aDb
, nDb
, nDb
,
1311 SQLITE_DESERIALIZE_RESIZEABLE
|
1312 SQLITE_DESERIALIZE_FREEONCLOSE
);
1314 fprintf(stderr
, "sqlite3_deserialize() failed with %d\n", rc
);
1315 goto testrun_finished
;
1318 sqlite3_int64 x
= maxDbSize
;
1319 sqlite3_file_control(cx
.db
, "main", SQLITE_FCNTL_SIZE_LIMIT
, &x
);
1322 /* For high debugging levels, turn on debug mode */
1323 if( eVerbosity
>=5 ){
1324 sqlite3_exec(cx
.db
, "PRAGMA vdbe_debug=ON;", 0, 0, 0);
1327 /* Block debug pragmas and ATTACH/DETACH. But wait until after
1328 ** deserialize to do this because deserialize depends on ATTACH */
1329 sqlite3_set_authorizer(cx
.db
, block_troublesome_sql
, &btsFlags
);
1331 /* Add the vt02 virtual table */
1332 sqlite3_vt02_init(cx
.db
, 0, 0);
1334 /* Activate extensions */
1335 sqlite3_percentile_init(cx
.db
, 0, 0);
1336 sqlite3_randomjson_init(cx
.db
, 0, 0);
1338 /* Add support for sqlite_dbdata and sqlite_dbptr virtual tables used
1339 ** by the recovery API */
1340 sqlite3_dbdata_init(cx
.db
, 0, 0);
1342 /* Consistent PRNG seed */
1343 #ifdef SQLITE_TESTCTRL_PRNG_SEED
1344 sqlite3_table_column_metadata(cx
.db
, 0, "x", 0, 0, 0, 0, 0, 0);
1345 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, cx
.db
);
1347 sqlite3_randomness(0,0);
1350 /* Run recovery on the initial database, just to make sure recovery
1353 recoverDatabase(cx
.db
);
1356 zSql
= sqlite3_malloc( nSql
+ 1 );
1358 fprintf(stderr
, "Out of memory!\n");
1360 memcpy(zSql
, aData
+iSql
, nSql
);
1362 for(i
=j
=0; zSql
[i
]; i
++){
1364 char cSaved
= zSql
[i
+1];
1366 if( sqlite3_complete(zSql
+j
) ){
1367 rc
= runDbSql(cx
.db
, zSql
+j
, &btsFlags
, dbOpt
);
1371 if( rc
==SQLITE_INTERRUPT
|| progress_handler(&cx
) ){
1372 goto testrun_finished
;
1377 runDbSql(cx
.db
, zSql
+j
, &btsFlags
, dbOpt
);
1382 rc
= sqlite3_close(cx
.db
);
1383 if( rc
!=SQLITE_OK
){
1384 fprintf(stdout
, "sqlite3_close() returns %d\n", rc
);
1386 if( eVerbosity
>=2 && !bScript
){
1387 fprintf(stdout
, "Peak memory usages: %f MB\n",
1388 sqlite3_memory_highwater(1) / 1000000.0);
1390 if( sqlite3_memory_used()!=0 ){
1393 sqlite3_status(SQLITE_STATUS_MALLOC_COUNT
, &nAlloc
, &nNotUsed
, 0);
1394 fprintf(stderr
,"Memory leak: %lld bytes in %d allocations\n",
1395 sqlite3_memory_used(), nAlloc
);
1398 sqlite3_hard_heap_limit64(0);
1399 sqlite3_soft_heap_limit64(0);
1404 ** END of the dbsqlfuzz code
1405 ***************************************************************************/
1407 /* Look at a SQL text and try to determine if it begins with a database
1408 ** description, such as would be found in a dbsqlfuzz test case. Return
1409 ** true if this does appear to be a dbsqlfuzz test case and false otherwise.
1411 static int isDbSql(unsigned char *a
, int n
){
1412 unsigned char buf
[12];
1414 if( n
>4 && memcmp(a
,"\n--\n",4)==0 ) return 1;
1415 while( n
>0 && isspace(a
[0]) ){ a
++; n
--; }
1416 for(i
=0; n
>0 && i
<8; n
--, a
++){
1417 if( isxdigit(a
[0]) ) buf
[i
++] = a
[0];
1419 if( i
==8 && memcmp(buf
,"53514c69",8)==0 ) return 1;
1423 /* Implementation of the isdbsql(TEXT) SQL function.
1425 static void isDbSqlFunc(
1426 sqlite3_context
*context
,
1428 sqlite3_value
**argv
1430 int n
= sqlite3_value_bytes(argv
[0]);
1431 unsigned char *a
= (unsigned char*)sqlite3_value_blob(argv
[0]);
1432 sqlite3_result_int(context
, a
!=0 && n
>0 && isDbSql(a
,n
));
1435 /* Methods for the VHandle object
1437 static int inmemClose(sqlite3_file
*pFile
){
1438 VHandle
*p
= (VHandle
*)pFile
;
1439 VFile
*pVFile
= p
->pVFile
;
1441 if( pVFile
->nRef
==0 && pVFile
->zFilename
==0 ){
1448 static int inmemRead(
1449 sqlite3_file
*pFile
, /* Read from this open file */
1450 void *pData
, /* Store content in this buffer */
1451 int iAmt
, /* Bytes of content */
1452 sqlite3_int64 iOfst
/* Start reading here */
1454 VHandle
*pHandle
= (VHandle
*)pFile
;
1455 VFile
*pVFile
= pHandle
->pVFile
;
1456 if( iOfst
<0 || iOfst
>=pVFile
->sz
){
1457 memset(pData
, 0, iAmt
);
1458 return SQLITE_IOERR_SHORT_READ
;
1460 if( iOfst
+iAmt
>pVFile
->sz
){
1461 memset(pData
, 0, iAmt
);
1462 iAmt
= (int)(pVFile
->sz
- iOfst
);
1463 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1464 return SQLITE_IOERR_SHORT_READ
;
1466 memcpy(pData
, pVFile
->a
+ iOfst
, iAmt
);
1469 static int inmemWrite(
1470 sqlite3_file
*pFile
, /* Write to this file */
1471 const void *pData
, /* Content to write */
1472 int iAmt
, /* bytes to write */
1473 sqlite3_int64 iOfst
/* Start writing here */
1475 VHandle
*pHandle
= (VHandle
*)pFile
;
1476 VFile
*pVFile
= pHandle
->pVFile
;
1477 if( iOfst
+iAmt
> pVFile
->sz
){
1478 if( iOfst
+iAmt
>= MX_FILE_SZ
){
1481 pVFile
->a
= safe_realloc(pVFile
->a
, (int)(iOfst
+iAmt
));
1482 if( iOfst
> pVFile
->sz
){
1483 memset(pVFile
->a
+ pVFile
->sz
, 0, (int)(iOfst
- pVFile
->sz
));
1485 pVFile
->sz
= (int)(iOfst
+ iAmt
);
1487 memcpy(pVFile
->a
+ iOfst
, pData
, iAmt
);
1490 static int inmemTruncate(sqlite3_file
*pFile
, sqlite3_int64 iSize
){
1491 VHandle
*pHandle
= (VHandle
*)pFile
;
1492 VFile
*pVFile
= pHandle
->pVFile
;
1493 if( pVFile
->sz
>iSize
&& iSize
>=0 ) pVFile
->sz
= (int)iSize
;
1496 static int inmemSync(sqlite3_file
*pFile
, int flags
){
1499 static int inmemFileSize(sqlite3_file
*pFile
, sqlite3_int64
*pSize
){
1500 *pSize
= ((VHandle
*)pFile
)->pVFile
->sz
;
1503 static int inmemLock(sqlite3_file
*pFile
, int type
){
1506 static int inmemUnlock(sqlite3_file
*pFile
, int type
){
1509 static int inmemCheckReservedLock(sqlite3_file
*pFile
, int *pOut
){
1513 static int inmemFileControl(sqlite3_file
*pFile
, int op
, void *pArg
){
1514 return SQLITE_NOTFOUND
;
1516 static int inmemSectorSize(sqlite3_file
*pFile
){
1519 static int inmemDeviceCharacteristics(sqlite3_file
*pFile
){
1521 SQLITE_IOCAP_SAFE_APPEND
|
1522 SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN
|
1523 SQLITE_IOCAP_POWERSAFE_OVERWRITE
;
1527 /* Method table for VHandle
1529 static sqlite3_io_methods VHandleMethods
= {
1531 /* xClose */ inmemClose
,
1532 /* xRead */ inmemRead
,
1533 /* xWrite */ inmemWrite
,
1534 /* xTruncate */ inmemTruncate
,
1535 /* xSync */ inmemSync
,
1536 /* xFileSize */ inmemFileSize
,
1537 /* xLock */ inmemLock
,
1538 /* xUnlock */ inmemUnlock
,
1539 /* xCheck... */ inmemCheckReservedLock
,
1540 /* xFileCtrl */ inmemFileControl
,
1541 /* xSectorSz */ inmemSectorSize
,
1542 /* xDevchar */ inmemDeviceCharacteristics
,
1545 /* xShmBarrier */ 0,
1552 ** Open a new file in the inmem VFS. All files are anonymous and are
1555 static int inmemOpen(
1557 const char *zFilename
,
1558 sqlite3_file
*pFile
,
1562 VFile
*pVFile
= createVFile(zFilename
, 0, (unsigned char*)"");
1563 VHandle
*pHandle
= (VHandle
*)pFile
;
1567 pHandle
->pVFile
= pVFile
;
1569 pFile
->pMethods
= &VHandleMethods
;
1570 if( pOutFlags
) *pOutFlags
= openFlags
;
1575 ** Delete a file by name
1577 static int inmemDelete(
1579 const char *zFilename
,
1582 VFile
*pVFile
= findVFile(zFilename
);
1583 if( pVFile
==0 ) return SQLITE_OK
;
1584 if( pVFile
->nRef
==0 ){
1585 free(pVFile
->zFilename
);
1586 pVFile
->zFilename
= 0;
1592 return SQLITE_IOERR_DELETE
;
1595 /* Check for the existance of a file
1597 static int inmemAccess(
1599 const char *zFilename
,
1603 VFile
*pVFile
= findVFile(zFilename
);
1604 *pResOut
= pVFile
!=0;
1608 /* Get the canonical pathname for a file
1610 static int inmemFullPathname(
1612 const char *zFilename
,
1616 sqlite3_snprintf(nOut
, zOut
, "%s", zFilename
);
1620 /* Always use the same random see, for repeatability.
1622 static int inmemRandomness(sqlite3_vfs
*NotUsed
, int nBuf
, char *zBuf
){
1623 memset(zBuf
, 0, nBuf
);
1624 memcpy(zBuf
, &g
.uRandom
, nBuf
<sizeof(g
.uRandom
) ? nBuf
: sizeof(g
.uRandom
));
1629 ** Register the VFS that reads from the g.aFile[] set of files.
1631 static void inmemVfsRegister(int makeDefault
){
1632 static sqlite3_vfs inmemVfs
;
1633 sqlite3_vfs
*pDefault
= sqlite3_vfs_find(0);
1634 inmemVfs
.iVersion
= 3;
1635 inmemVfs
.szOsFile
= sizeof(VHandle
);
1636 inmemVfs
.mxPathname
= 200;
1637 inmemVfs
.zName
= "inmem";
1638 inmemVfs
.xOpen
= inmemOpen
;
1639 inmemVfs
.xDelete
= inmemDelete
;
1640 inmemVfs
.xAccess
= inmemAccess
;
1641 inmemVfs
.xFullPathname
= inmemFullPathname
;
1642 inmemVfs
.xRandomness
= inmemRandomness
;
1643 inmemVfs
.xSleep
= pDefault
->xSleep
;
1644 inmemVfs
.xCurrentTimeInt64
= pDefault
->xCurrentTimeInt64
;
1645 sqlite3_vfs_register(&inmemVfs
, makeDefault
);
1649 ** Allowed values for the runFlags parameter to runSql()
1651 #define SQL_TRACE 0x0001 /* Print each SQL statement as it is prepared */
1652 #define SQL_OUTPUT 0x0002 /* Show the SQL output */
1655 ** Run multiple commands of SQL. Similar to sqlite3_exec(), but does not
1656 ** stop if an error is encountered.
1658 static void runSql(sqlite3
*db
, const char *zSql
, unsigned runFlags
){
1660 sqlite3_stmt
*pStmt
;
1662 while( zSql
&& zSql
[0] ){
1665 sqlite3_prepare_v2(db
, zSql
, -1, &pStmt
, &zMore
);
1666 if( zMore
==zSql
) break;
1667 if( runFlags
& SQL_TRACE
){
1668 const char *z
= zSql
;
1670 while( z
<zMore
&& ISSPACE(z
[0]) ) z
++;
1671 n
= (int)(zMore
- z
);
1672 while( n
>0 && ISSPACE(z
[n
-1]) ) n
--;
1675 printf("TRACE: %.*s (error: %s)\n", n
, z
, sqlite3_errmsg(db
));
1677 printf("TRACE: %.*s\n", n
, z
);
1682 if( (runFlags
& SQL_OUTPUT
)==0 ){
1683 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){}
1686 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
1689 nCol
= sqlite3_column_count(pStmt
);
1691 printf("--------------------------------------------\n");
1693 for(i
=0; i
<nCol
; i
++){
1694 int eType
= sqlite3_column_type(pStmt
,i
);
1695 printf("%s = ", sqlite3_column_name(pStmt
,i
));
1701 case SQLITE_INTEGER
: {
1702 printf("INT %s\n", sqlite3_column_text(pStmt
,i
));
1705 case SQLITE_FLOAT
: {
1706 printf("FLOAT %s\n", sqlite3_column_text(pStmt
,i
));
1710 printf("TEXT [%s]\n", sqlite3_column_text(pStmt
,i
));
1714 printf("BLOB (%d bytes)\n", sqlite3_column_bytes(pStmt
,i
));
1721 sqlite3_finalize(pStmt
);
1727 ** Rebuild the database file.
1729 ** (1) Remove duplicate entries
1730 ** (2) Put all entries in order
1733 static void rebuild_database(sqlite3
*db
, int dbSqlOnly
){
1736 zSql
= sqlite3_mprintf(
1738 "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n"
1740 "INSERT INTO db(dbid, dbcontent) "
1741 " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n"
1743 "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n"
1744 "DELETE FROM xsql;\n"
1745 "INSERT INTO xsql(sqlid,sqltext) "
1746 " SELECT NULL, sqltext FROM sx ORDER BY 2;\n"
1749 "PRAGMA page_size=1024;\n"
1751 dbSqlOnly
? " WHERE isdbsql(sqltext)" : ""
1753 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
1755 if( rc
) fatalError("cannot rebuild: %s", sqlite3_errmsg(db
));
1759 ** Return the value of a hexadecimal digit. Return -1 if the input
1760 ** is not a hex digit.
1762 static int hexDigitValue(char c
){
1763 if( c
>='0' && c
<='9' ) return c
- '0';
1764 if( c
>='a' && c
<='f' ) return c
- 'a' + 10;
1765 if( c
>='A' && c
<='F' ) return c
- 'A' + 10;
1770 ** Interpret zArg as an integer value, possibly with suffixes.
1772 static int integerValue(const char *zArg
){
1773 sqlite3_int64 v
= 0;
1774 static const struct { char *zSuffix
; int iMult
; } aMult
[] = {
1776 { "MiB", 1024*1024 },
1777 { "GiB", 1024*1024*1024 },
1780 { "GB", 1000000000 },
1783 { "G", 1000000000 },
1790 }else if( zArg
[0]=='+' ){
1793 if( zArg
[0]=='0' && zArg
[1]=='x' ){
1796 while( (x
= hexDigitValue(zArg
[0]))>=0 ){
1801 while( ISDIGIT(zArg
[0]) ){
1802 v
= v
*10 + zArg
[0] - '0';
1806 for(i
=0; i
<sizeof(aMult
)/sizeof(aMult
[0]); i
++){
1807 if( sqlite3_stricmp(aMult
[i
].zSuffix
, zArg
)==0 ){
1808 v
*= aMult
[i
].iMult
;
1812 if( v
>0x7fffffff ) fatalError("parameter too large - max 2147483648");
1813 return (int)(isNeg
? -v
: v
);
1817 ** Return the number of "v" characters in a string. Return 0 if there
1818 ** are any characters in the string other than "v".
1820 static int numberOfVChar(const char *z
){
1822 while( z
[0] && z
[0]=='v' ){
1826 return z
[0]==0 ? N
: 0;
1830 ** Print sketchy documentation for this utility program
1832 static void showHelp(void){
1833 printf("Usage: %s [options] SOURCE-DB ?ARGS...?\n", g
.zArgv0
);
1835 "Read databases and SQL scripts from SOURCE-DB and execute each script against\n"
1836 "each database, checking for crashes and memory leaks.\n"
1838 " --cell-size-check Set the PRAGMA cell_size_check=ON\n"
1839 " --dbid N Use only the database where dbid=N\n"
1840 " --export-db DIR Write databases to files(s) in DIR. Works with --dbid\n"
1841 " --export-sql DIR Write SQL to file(s) in DIR. Also works with --sqlid\n"
1842 " --help Show this help text\n"
1843 " --info Show information about SOURCE-DB w/o running tests\n"
1844 " --limit-depth N Limit expression depth to N. Default: 500\n"
1845 " --limit-heap N Limit heap memory to N. Default: 100M\n"
1846 " --limit-mem N Limit memory used by test SQLite instance to N bytes\n"
1847 " --limit-vdbe Panic if any test runs for more than 100,000 cycles\n"
1848 " --load-sql FILE.. Load SQL scripts fron files into SOURCE-DB\n"
1849 " --load-db FILE.. Load template databases from files into SOURCE_DB\n"
1850 " --load-dbsql FILE.. Load dbsqlfuzz outputs into the xsql table\n"
1851 " ^^^^------ Use \"-\" for FILE to read filenames from stdin\n"
1852 " -m TEXT Add a description to the database\n"
1853 " --native-vfs Use the native VFS for initially empty database files\n"
1854 " --native-malloc Turn off MEMSYS3/5 and Lookaside\n"
1855 " --no-recover Do not run recovery on dbsqlfuzz databases\n"
1856 " --oss-fuzz Enable OSS-FUZZ testing\n"
1857 " --prng-seed N Seed value for the PRGN inside of SQLite\n"
1858 " -q|--quiet Reduced output\n"
1859 " --rebuild Rebuild and vacuum the database file\n"
1860 " --result-trace Show the results of each SQL command\n"
1861 " --script Output CLI script instead of running tests\n"
1862 " --skip N Skip the first N test cases\n"
1863 " --spinner Use a spinner to show progress\n"
1864 " --sqlid N Use only SQL where sqlid=N\n"
1865 " --timeout N Maximum time for any one test in N millseconds\n"
1866 " -v|--verbose Increased output. Repeat for more output.\n"
1867 " --vdbe-debug Activate VDBE debugging.\n"
1868 " --wait N Wait N seconds before continuing - useful for\n"
1869 " attaching an MSVC debugging.\n"
1873 int main(int argc
, char **argv
){
1874 sqlite3_int64 iBegin
; /* Start time of this program */
1875 int quietFlag
= 0; /* True if --quiet or -q */
1876 int verboseFlag
= 0; /* True if --verbose or -v */
1877 char *zInsSql
= 0; /* SQL statement for --load-db or --load-sql */
1878 int iFirstInsArg
= 0; /* First argv[] for --load-db or --load-sql */
1879 sqlite3
*db
= 0; /* The open database connection */
1880 sqlite3_stmt
*pStmt
; /* A prepared statement */
1881 int rc
; /* Result code from SQLite interface calls */
1882 Blob
*pSql
; /* For looping over SQL scripts */
1883 Blob
*pDb
; /* For looping over template databases */
1884 int i
; /* Loop index for the argv[] loop */
1885 int dbSqlOnly
= 0; /* Only use scripts that are dbsqlfuzz */
1886 int onlySqlid
= -1; /* --sqlid */
1887 int onlyDbid
= -1; /* --dbid */
1888 int nativeFlag
= 0; /* --native-vfs */
1889 int rebuildFlag
= 0; /* --rebuild */
1890 int vdbeLimitFlag
= 0; /* --limit-vdbe */
1891 int infoFlag
= 0; /* --info */
1892 int nSkip
= 0; /* --skip */
1893 int bScript
= 0; /* --script */
1894 int bSpinner
= 0; /* True for --spinner */
1895 int timeoutTest
= 0; /* undocumented --timeout-test flag */
1896 int runFlags
= 0; /* Flags sent to runSql() */
1897 char *zMsg
= 0; /* Add this message */
1898 int nSrcDb
= 0; /* Number of source databases */
1899 char **azSrcDb
= 0; /* Array of source database names */
1900 int iSrcDb
; /* Loop over all source databases */
1901 int nTest
= 0; /* Total number of tests performed */
1902 char *zDbName
= ""; /* Appreviated name of a source database */
1903 const char *zFailCode
= 0; /* Value of the TEST_FAILURE env variable */
1904 int cellSzCkFlag
= 0; /* --cell-size-check */
1905 int sqlFuzz
= 0; /* True for SQL fuzz. False for DB fuzz */
1906 int iTimeout
= 120000; /* Default 120-second timeout */
1907 int nMem
= 0; /* Memory limit override */
1908 int nMemThisDb
= 0; /* Memory limit set by the CONFIG table */
1909 char *zExpDb
= 0; /* Write Databases to files in this directory */
1910 char *zExpSql
= 0; /* Write SQL to files in this directory */
1911 void *pHeap
= 0; /* Heap for use by SQLite */
1912 int ossFuzz
= 0; /* enable OSS-FUZZ testing */
1913 int ossFuzzThisDb
= 0; /* ossFuzz value for this particular database */
1914 int nativeMalloc
= 0; /* Turn off MEMSYS3/5 and lookaside if true */
1915 sqlite3_vfs
*pDfltVfs
; /* The default VFS */
1916 int openFlags4Data
; /* Flags for sqlite3_open_v2() */
1917 int bTimer
= 0; /* Show elapse time for each test */
1918 int nV
; /* How much to increase verbosity with -vvvv */
1919 sqlite3_int64 tmStart
; /* Start of each test */
1921 sqlite3_config(SQLITE_CONFIG_URI
,1);
1922 registerOomSimulator();
1923 sqlite3_initialize();
1924 iBegin
= timeOfDay();
1926 signal(SIGALRM
, signalHandler
);
1927 signal(SIGSEGV
, signalHandler
);
1928 signal(SIGABRT
, signalHandler
);
1931 openFlags4Data
= SQLITE_OPEN_READONLY
;
1932 zFailCode
= getenv("TEST_FAILURE");
1933 pDfltVfs
= sqlite3_vfs_find(0);
1934 inmemVfsRegister(1);
1935 for(i
=1; i
<argc
; i
++){
1936 const char *z
= argv
[i
];
1939 if( z
[0]=='-' ) z
++;
1940 if( strcmp(z
,"cell-size-check")==0 ){
1943 if( strcmp(z
,"dbid")==0 ){
1944 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1945 onlyDbid
= integerValue(argv
[++i
]);
1947 if( strcmp(z
,"export-db")==0 ){
1948 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1951 if( strcmp(z
,"export-sql")==0 || strcmp(z
,"export-dbsql")==0 ){
1952 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1953 zExpSql
= argv
[++i
];
1955 if( strcmp(z
,"help")==0 ){
1959 if( strcmp(z
,"info")==0 ){
1962 if( strcmp(z
,"limit-depth")==0 ){
1963 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1964 depthLimit
= integerValue(argv
[++i
]);
1966 if( strcmp(z
,"limit-heap")==0 ){
1967 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1968 heapLimit
= integerValue(argv
[++i
]);
1970 if( strcmp(z
,"limit-mem")==0 ){
1971 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
1972 nMem
= integerValue(argv
[++i
]);
1974 if( strcmp(z
,"limit-vdbe")==0 ){
1977 if( strcmp(z
,"load-sql")==0 ){
1978 zInsSql
= "INSERT INTO xsql(sqltext)"
1979 "VALUES(CAST(readtextfile(?1) AS text))";
1981 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1984 if( strcmp(z
,"load-db")==0 ){
1985 zInsSql
= "INSERT INTO db(dbcontent) VALUES(readfile(?1))";
1987 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1990 if( strcmp(z
,"load-dbsql")==0 ){
1991 zInsSql
= "INSERT INTO xsql(sqltext)"
1992 "VALUES(readfile(?1))";
1994 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
1998 if( strcmp(z
,"m")==0 ){
1999 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2001 openFlags4Data
= SQLITE_OPEN_READWRITE
|SQLITE_OPEN_CREATE
;
2003 if( strcmp(z
,"native-malloc")==0 ){
2006 if( strcmp(z
,"native-vfs")==0 ){
2009 if( strcmp(z
,"no-recover")==0 ){
2012 if( strcmp(z
,"oss-fuzz")==0 ){
2015 if( strcmp(z
,"prng-seed")==0 ){
2016 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2017 g
.uRandom
= atoi(argv
[++i
]);
2019 if( strcmp(z
,"quiet")==0 || strcmp(z
,"q")==0 ){
2024 if( strcmp(z
,"rebuild")==0 ){
2026 openFlags4Data
= SQLITE_OPEN_READWRITE
;
2028 if( strcmp(z
,"result-trace")==0 ){
2029 runFlags
|= SQL_OUTPUT
;
2031 if( strcmp(z
,"script")==0 ){
2034 if( strcmp(z
,"skip")==0 ){
2035 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2036 nSkip
= atoi(argv
[++i
]);
2038 if( strcmp(z
,"spinner")==0 ){
2041 if( strcmp(z
,"timer")==0 ){
2044 if( strcmp(z
,"sqlid")==0 ){
2045 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2046 onlySqlid
= integerValue(argv
[++i
]);
2048 if( strcmp(z
,"timeout")==0 ){
2049 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2050 iTimeout
= integerValue(argv
[++i
]);
2052 if( strcmp(z
,"timeout-test")==0 ){
2055 fatalError("timeout is not available on non-unix systems");
2058 if( strcmp(z
,"vdbe-debug")==0 ){
2061 if( strcmp(z
,"verbose")==0 ){
2065 if( verboseFlag
>2 ) runFlags
|= SQL_TRACE
;
2067 if( (nV
= numberOfVChar(z
))>=1 ){
2071 if( verboseFlag
>2 ) runFlags
|= SQL_TRACE
;
2073 if( strcmp(z
,"version")==0 ){
2076 printf("SQLite %s %s (%d-bit)\n",
2077 sqlite3_libversion(), sqlite3_sourceid(),
2078 8*(int)sizeof(char*));
2079 for(ii
=0; (zz
= sqlite3_compileoption_get(ii
))!=0; ii
++){
2084 if( strcmp(z
,"wait")==0 ){
2086 if( i
>=argc
-1 ) fatalError("missing arguments on %s", argv
[i
]);
2087 iDelay
= integerValue(argv
[++i
]);
2088 printf("Waiting %d seconds:", iDelay
);
2090 while( 1 /*exit-by-break*/ ){
2091 sqlite3_sleep(1000);
2093 if( iDelay
<=0 ) break;
2094 printf(" %d", iDelay
);
2100 if( strcmp(z
,"is-dbsql")==0 ){
2102 for(i
++; i
<argc
; i
++){
2104 char *aData
= readFile(argv
[i
], &nData
);
2105 printf("%d %s\n", isDbSql((unsigned char*)aData
,nData
), argv
[i
]);
2106 sqlite3_free(aData
);
2111 fatalError("unknown option: %s", argv
[i
]);
2115 azSrcDb
= safe_realloc(azSrcDb
, nSrcDb
*sizeof(azSrcDb
[0]));
2116 azSrcDb
[nSrcDb
-1] = argv
[i
];
2119 if( nSrcDb
==0 ) fatalError("no source database specified");
2122 fatalError("cannot change the description of more than one database");
2125 fatalError("cannot import into more than one database");
2129 /* Process each source database separately */
2130 for(iSrcDb
=0; iSrcDb
<nSrcDb
; iSrcDb
++){
2133 g
.zDbFile
= azSrcDb
[iSrcDb
];
2134 rc
= sqlite3_open_v2(azSrcDb
[iSrcDb
], &db
,
2135 openFlags4Data
, pDfltVfs
->zName
);
2136 if( rc
==SQLITE_OK
){
2137 rc
= sqlite3_exec(db
, "SELECT count(*) FROM sqlite_schema", 0, 0, 0);
2141 zRawData
= readFile(azSrcDb
[iSrcDb
], &nRawData
);
2143 fatalError("input file \"%s\" is not recognized\n", azSrcDb
[iSrcDb
]);
2145 sqlite3_open(":memory:", &db
);
2148 /* Print the description, if there is one */
2151 zDbName
= azSrcDb
[iSrcDb
];
2152 i
= (int)strlen(zDbName
) - 1;
2153 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
2155 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
2156 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
2157 printf("%s: %s", zDbName
, sqlite3_column_text(pStmt
,0));
2159 printf("%s: (empty \"readme\")", zDbName
);
2161 sqlite3_finalize(pStmt
);
2162 sqlite3_prepare_v2(db
, "SELECT count(*) FROM db", -1, &pStmt
, 0);
2164 && sqlite3_step(pStmt
)==SQLITE_ROW
2165 && (n
= sqlite3_column_int(pStmt
,0))>0
2167 printf(" - %d DBs", n
);
2169 sqlite3_finalize(pStmt
);
2170 sqlite3_prepare_v2(db
, "SELECT count(*) FROM xsql", -1, &pStmt
, 0);
2172 && sqlite3_step(pStmt
)==SQLITE_ROW
2173 && (n
= sqlite3_column_int(pStmt
,0))>0
2175 printf(" - %d scripts", n
);
2177 sqlite3_finalize(pStmt
);
2180 sqlite3_free(zRawData
);
2184 rc
= sqlite3_exec(db
,
2185 "CREATE TABLE IF NOT EXISTS db(\n"
2186 " dbid INTEGER PRIMARY KEY, -- database id\n"
2187 " dbcontent BLOB -- database disk file image\n"
2189 "CREATE TABLE IF NOT EXISTS xsql(\n"
2190 " sqlid INTEGER PRIMARY KEY, -- SQL script id\n"
2191 " sqltext TEXT -- Text of SQL statements to run\n"
2193 "CREATE TABLE IF NOT EXISTS readme(\n"
2194 " msg TEXT -- Human-readable description of this file\n"
2196 if( rc
) fatalError("cannot create schema: %s", sqlite3_errmsg(db
));
2199 zSql
= sqlite3_mprintf(
2200 "DELETE FROM readme; INSERT INTO readme(msg) VALUES(%Q)", zMsg
);
2201 rc
= sqlite3_exec(db
, zSql
, 0, 0, 0);
2203 if( rc
) fatalError("cannot change description: %s", sqlite3_errmsg(db
));
2206 zInsSql
= "INSERT INTO xsql(sqltext) VALUES(?1)";
2207 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2208 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2209 zInsSql
, sqlite3_errmsg(db
));
2210 sqlite3_bind_text(pStmt
, 1, zRawData
, nRawData
, SQLITE_STATIC
);
2211 sqlite3_step(pStmt
);
2212 rc
= sqlite3_reset(pStmt
);
2213 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2214 sqlite3_finalize(pStmt
);
2215 rebuild_database(db
, dbSqlOnly
);
2217 sqlite3_free(zRawData
);
2220 ossFuzzThisDb
= ossFuzz
;
2222 /* If the CONFIG(name,value) table exists, read db-specific settings
2223 ** from that table */
2224 if( sqlite3_table_column_metadata(db
,0,"config",0,0,0,0,0,0)==SQLITE_OK
){
2225 rc
= sqlite3_prepare_v2(db
, "SELECT name, value FROM config",
2227 if( rc
) fatalError("cannot prepare query of CONFIG table: %s",
2228 sqlite3_errmsg(db
));
2229 while( SQLITE_ROW
==sqlite3_step(pStmt
) ){
2230 const char *zName
= (const char *)sqlite3_column_text(pStmt
,0);
2231 if( zName
==0 ) continue;
2232 if( strcmp(zName
, "oss-fuzz")==0 ){
2233 ossFuzzThisDb
= sqlite3_column_int(pStmt
,1);
2234 if( verboseFlag
>1 ) printf("Config: oss-fuzz=%d\n", ossFuzzThisDb
);
2236 if( strcmp(zName
, "limit-mem")==0 ){
2237 nMemThisDb
= sqlite3_column_int(pStmt
,1);
2238 if( verboseFlag
>1 ) printf("Config: limit-mem=%d\n", nMemThisDb
);
2241 sqlite3_finalize(pStmt
);
2245 sqlite3_create_function(db
, "readfile", 1, SQLITE_UTF8
, 0,
2246 readfileFunc
, 0, 0);
2247 sqlite3_create_function(db
, "readtextfile", 1, SQLITE_UTF8
, 0,
2248 readtextfileFunc
, 0, 0);
2249 sqlite3_create_function(db
, "isdbsql", 1, SQLITE_UTF8
, 0,
2251 rc
= sqlite3_prepare_v2(db
, zInsSql
, -1, &pStmt
, 0);
2252 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2253 zInsSql
, sqlite3_errmsg(db
));
2254 rc
= sqlite3_exec(db
, "BEGIN", 0, 0, 0);
2255 if( rc
) fatalError("cannot start a transaction");
2256 for(i
=iFirstInsArg
; i
<argc
; i
++){
2257 if( strcmp(argv
[i
],"-")==0 ){
2258 /* A filename of "-" means read multiple filenames from stdin */
2260 while( rc
==0 && fgets(zLine
,sizeof(zLine
),stdin
)!=0 ){
2261 size_t kk
= strlen(zLine
);
2262 while( kk
>0 && zLine
[kk
-1]<=' ' ) kk
--;
2263 sqlite3_bind_text(pStmt
, 1, zLine
, (int)kk
, SQLITE_STATIC
);
2264 if( verboseFlag
>1 ) printf("loading %.*s\n", (int)kk
, zLine
);
2265 sqlite3_step(pStmt
);
2266 rc
= sqlite3_reset(pStmt
);
2267 if( rc
) fatalError("insert failed for %s", zLine
);
2270 sqlite3_bind_text(pStmt
, 1, argv
[i
], -1, SQLITE_STATIC
);
2271 if( verboseFlag
>1 ) printf("loading %s\n", argv
[i
]);
2272 sqlite3_step(pStmt
);
2273 rc
= sqlite3_reset(pStmt
);
2274 if( rc
) fatalError("insert failed for %s", argv
[i
]);
2277 sqlite3_finalize(pStmt
);
2278 rc
= sqlite3_exec(db
, "COMMIT", 0, 0, 0);
2279 if( rc
) fatalError("cannot commit the transaction: %s",
2280 sqlite3_errmsg(db
));
2281 rebuild_database(db
, dbSqlOnly
);
2285 rc
= sqlite3_exec(db
, "PRAGMA query_only=1;", 0, 0, 0);
2286 if( rc
) fatalError("cannot set database to query-only");
2287 if( zExpDb
!=0 || zExpSql
!=0 ){
2288 sqlite3_create_function(db
, "writefile", 2, SQLITE_UTF8
, 0,
2289 writefileFunc
, 0, 0);
2292 "SELECT writefile(printf('%s/db%06d.db',?1,dbid),dbcontent),"
2293 " dbid, printf('%s/db%06d.db',?1,dbid), length(dbcontent)"
2294 " FROM db WHERE ?2<0 OR dbid=?2;";
2295 rc
= sqlite3_prepare_v2(db
, zExDb
, -1, &pStmt
, 0);
2296 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2297 zExDb
, sqlite3_errmsg(db
));
2298 sqlite3_bind_text64(pStmt
, 1, zExpDb
, strlen(zExpDb
),
2299 SQLITE_STATIC
, SQLITE_UTF8
);
2300 sqlite3_bind_int(pStmt
, 2, onlyDbid
);
2301 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2302 printf("write db-%d (%d bytes) into %s\n",
2303 sqlite3_column_int(pStmt
,1),
2304 sqlite3_column_int(pStmt
,3),
2305 sqlite3_column_text(pStmt
,2));
2307 sqlite3_finalize(pStmt
);
2310 const char *zExSql
=
2311 "SELECT writefile(printf('%s/sql%06d.txt',?1,sqlid),sqltext),"
2312 " sqlid, printf('%s/sql%06d.txt',?1,sqlid), length(sqltext)"
2313 " FROM xsql WHERE ?2<0 OR sqlid=?2;";
2314 rc
= sqlite3_prepare_v2(db
, zExSql
, -1, &pStmt
, 0);
2315 if( rc
) fatalError("cannot prepare statement [%s]: %s",
2316 zExSql
, sqlite3_errmsg(db
));
2317 sqlite3_bind_text64(pStmt
, 1, zExpSql
, strlen(zExpSql
),
2318 SQLITE_STATIC
, SQLITE_UTF8
);
2319 sqlite3_bind_int(pStmt
, 2, onlySqlid
);
2320 while( sqlite3_step(pStmt
)==SQLITE_ROW
){
2321 printf("write sql-%d (%d bytes) into %s\n",
2322 sqlite3_column_int(pStmt
,1),
2323 sqlite3_column_int(pStmt
,3),
2324 sqlite3_column_text(pStmt
,2));
2326 sqlite3_finalize(pStmt
);
2332 /* Load all SQL script content and all initial database images from the
2335 blobListLoadFromDb(db
, "SELECT sqlid, sqltext FROM xsql", onlySqlid
,
2336 &g
.nSql
, &g
.pFirstSql
);
2337 if( g
.nSql
==0 ) fatalError("need at least one SQL script");
2338 blobListLoadFromDb(db
, "SELECT dbid, dbcontent FROM db", onlyDbid
,
2339 &g
.nDb
, &g
.pFirstDb
);
2341 g
.pFirstDb
= safe_realloc(0, sizeof(Blob
));
2342 memset(g
.pFirstDb
, 0, sizeof(Blob
));
2344 g
.pFirstDb
->seq
= 0;
2349 /* Print the description, if there is one */
2350 if( !quietFlag
&& !bScript
){
2351 zDbName
= azSrcDb
[iSrcDb
];
2352 i
= (int)strlen(zDbName
) - 1;
2353 while( i
>0 && zDbName
[i
-1]!='/' && zDbName
[i
-1]!='\\' ){ i
--; }
2356 sqlite3_prepare_v2(db
, "SELECT msg FROM readme", -1, &pStmt
, 0);
2357 if( pStmt
&& sqlite3_step(pStmt
)==SQLITE_ROW
){
2358 printf("%s: %s\n", zDbName
, sqlite3_column_text(pStmt
,0));
2360 sqlite3_finalize(pStmt
);
2364 /* Rebuild the database, if requested */
2367 printf("%s: rebuilding... ", zDbName
);
2370 rebuild_database(db
, 0);
2371 if( !quietFlag
) printf("done\n");
2374 /* Close the source database. Verify that no SQLite memory allocations are
2378 if( sqlite3_memory_used()>0 ){
2379 fatalError("SQLite has memory in use before the start of testing");
2382 /* Limit available memory, if requested */
2385 if( nMemThisDb
>0 && nMem
==0 ){
2386 if( !nativeMalloc
){
2387 pHeap
= realloc(pHeap
, nMemThisDb
);
2389 fatalError("failed to allocate %d bytes of heap memory", nMem
);
2391 sqlite3_config(SQLITE_CONFIG_HEAP
, pHeap
, nMemThisDb
, 128);
2393 sqlite3_hard_heap_limit64((sqlite3_int64
)nMemThisDb
);
2396 sqlite3_hard_heap_limit64(0);
2399 /* Disable lookaside with the --native-malloc option */
2401 sqlite3_config(SQLITE_CONFIG_LOOKASIDE
, 0, 0);
2404 /* Reset the in-memory virtual filesystem */
2407 /* Run a test using each SQL script against each database.
2409 if( verboseFlag
<2 && !quietFlag
&& !bSpinner
&& !bScript
){
2410 printf("%s:", zDbName
);
2412 for(pSql
=g
.pFirstSql
; pSql
; pSql
=pSql
->pNext
){
2413 tmStart
= timeOfDay();
2414 if( isDbSql(pSql
->a
, pSql
->sz
) ){
2415 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d",pSql
->id
);
2417 /* No progress output */
2418 }else if( bSpinner
){
2420 int idx
= pSql
->seq
;
2421 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2423 }else if( verboseFlag
>1 ){
2424 printf("%s\n", g
.zTestName
);
2426 }else if( !quietFlag
){
2427 static int prevAmt
= -1;
2428 int idx
= pSql
->seq
;
2429 int amt
= idx
*10/(g
.nSql
);
2431 printf(" %d%%", amt
*10);
2439 runCombinedDbSqlInput(pSql
->a
, pSql
->sz
, iTimeout
, bScript
, pSql
->id
);
2442 if( bTimer
&& !bScript
){
2443 sqlite3_int64 tmEnd
= timeOfDay();
2444 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2450 for(pDb
=g
.pFirstDb
; pDb
; pDb
=pDb
->pNext
){
2452 const char *zVfs
= "inmem";
2453 sqlite3_snprintf(sizeof(g
.zTestName
), g
.zTestName
, "sqlid=%d,dbid=%d",
2456 /* No progress output */
2457 }else if( bSpinner
){
2458 int nTotal
= g
.nDb
*g
.nSql
;
2459 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2460 printf("\r%s: %d/%d ", zDbName
, idx
, nTotal
);
2462 }else if( verboseFlag
>1 ){
2463 printf("%s\n", g
.zTestName
);
2465 }else if( !quietFlag
){
2466 static int prevAmt
= -1;
2467 int idx
= pSql
->seq
*g
.nDb
+ pDb
->id
- 1;
2468 int amt
= idx
*10/(g
.nDb
*g
.nSql
);
2470 printf(" %d%%", amt
*10);
2481 sqlite3_snprintf(sizeof(zName
), zName
, "db%06d.db",
2482 pDb
->id
>1 ? pDb
->id
: pSql
->id
);
2483 renderDbSqlForCLI(stdout
, zName
,
2484 pDb
->a
, pDb
->sz
, pSql
->a
, pSql
->sz
);
2487 createVFile("main.db", pDb
->sz
, pDb
->a
);
2488 sqlite3_randomness(0,0);
2489 if( ossFuzzThisDb
){
2490 #ifndef SQLITE_OSS_FUZZ
2491 fatalError("--oss-fuzz not supported: recompile"
2492 " with -DSQLITE_OSS_FUZZ");
2494 extern int LLVMFuzzerTestOneInput(const uint8_t*, size_t);
2495 LLVMFuzzerTestOneInput((const uint8_t*)pSql
->a
, (size_t)pSql
->sz
);
2498 openFlags
= SQLITE_OPEN_CREATE
| SQLITE_OPEN_READWRITE
;
2499 if( nativeFlag
&& pDb
->sz
==0 ){
2500 openFlags
|= SQLITE_OPEN_MEMORY
;
2503 rc
= sqlite3_open_v2("main.db", &db
, openFlags
, zVfs
);
2504 if( rc
) fatalError("cannot open inmem database");
2505 sqlite3_limit(db
, SQLITE_LIMIT_LENGTH
, 100000000);
2506 sqlite3_limit(db
, SQLITE_LIMIT_LIKE_PATTERN_LENGTH
, 50);
2507 if( cellSzCkFlag
) runSql(db
, "PRAGMA cell_size_check=ON", runFlags
);
2508 setAlarm((iTimeout
+999)/1000);
2509 /* Enable test functions */
2510 sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCTIONS
, db
);
2511 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
2512 if( sqlFuzz
|| vdbeLimitFlag
){
2513 sqlite3_progress_handler(db
, 100000, progressHandler
,
2517 #ifdef SQLITE_TESTCTRL_PRNG_SEED
2518 sqlite3_test_control(SQLITE_TESTCTRL_PRNG_SEED
, 1, db
);
2521 sqlite3_exec(db
, "PRAGMA vdbe_debug=ON", 0, 0, 0);
2524 runSql(db
, (char*)pSql
->a
, runFlags
);
2525 }while( timeoutTest
);
2527 sqlite3_exec(db
, "PRAGMA temp_store_directory=''", 0, 0, 0);
2530 if( sqlite3_memory_used()>0 ){
2531 fatalError("memory leak: %lld bytes outstanding",
2532 sqlite3_memory_used());
2537 sqlite3_int64 tmEnd
= timeOfDay();
2538 printf("%lld %s\n", tmEnd
- tmStart
, g
.zTestName
);
2542 /* Simulate an error if the TEST_FAILURE environment variable is "5".
2543 ** This is used to verify that automated test script really do spot
2544 ** errors that occur in this test program.
2547 if( zFailCode
[0]=='5' && zFailCode
[1]==0 ){
2548 fatalError("simulated failure");
2549 }else if( zFailCode
[0]!=0 ){
2550 /* If TEST_FAILURE is something other than 5, just exit the test
2552 printf("\nExit early due to TEST_FAILURE being set\n");
2554 goto sourcedb_cleanup
;
2560 /* No progress output */
2561 }else if( bSpinner
){
2562 int nTotal
= g
.nDb
*g
.nSql
;
2563 printf("\r%s: %d/%d \n", zDbName
, nTotal
, nTotal
);
2564 }else if( !quietFlag
&& verboseFlag
<2 ){
2565 printf(" 100%% - %d tests\n", g
.nDb
*g
.nSql
);
2568 /* Clean up at the end of processing a single source database
2571 blobListFree(g
.pFirstSql
);
2572 blobListFree(g
.pFirstDb
);
2575 } /* End loop over all source databases */
2577 if( !quietFlag
&& !bScript
){
2578 sqlite3_int64 iElapse
= timeOfDay() - iBegin
;
2580 printf("fuzzcheck: %u query invariants checked\n", g
.nInvariant
);
2582 printf("fuzzcheck: 0 errors out of %d tests in %d.%03d seconds\n"
2583 "SQLite %s %s (%d-bit)\n",
2584 nTest
, (int)(iElapse
/1000), (int)(iElapse
%1000),
2585 sqlite3_libversion(), sqlite3_sourceid(),
2586 8*(int)sizeof(char*));