1 /*
2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service.
3 ** (https://github.com/google/oss-fuzz)
4 */
5 #include <stddef.h>
6 #if !defined(_MSC_VER)
7 # include <stdint.h>
8 #endif
9 #include <stdio.h>
10 #include <string.h>
11 #include "sqlite3.h"
12
13 #if defined(_MSC_VER)
14 typedef unsigned char uint8_t;
15 #endif
16
17 /* Global debugging settings. OSS-Fuzz will have all debugging turned
18 ** off. But if LLVMFuzzerTestOneInput() is called interactively from
19 ** the ossshell utility program, then these flags might be set.
20 */
21 static unsigned mDebug = 0;
22 #define FUZZ_SQL_TRACE 0x0001 /* Set an sqlite3_trace() callback */
23 #define FUZZ_SHOW_MAX_DELAY 0x0002 /* Show maximum progress callback delay */
24 #define FUZZ_SHOW_ERRORS 0x0004 /* Print error messages from SQLite */
25
26 /* The ossshell utility program invokes this interface to see the
27 ** debugging flags. Unused by OSS-Fuzz.
28 */
ossfuzz_set_debug_flags(unsigned x)29 void ossfuzz_set_debug_flags(unsigned x){
30 mDebug = x;
31 }
32
33 /* Return the current real-world time in milliseconds since the
34 ** Julian epoch (-4714-11-24).
35 */
timeOfDay(void)36 static sqlite3_int64 timeOfDay(void){
37 static sqlite3_vfs *clockVfs = 0;
38 sqlite3_int64 t;
39 if( clockVfs==0 ){
40 clockVfs = sqlite3_vfs_find(0);
41 if( clockVfs==0 ) return 0;
42 }
43 if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){
44 clockVfs->xCurrentTimeInt64(clockVfs, &t);
45 }else{
46 double r;
47 clockVfs->xCurrentTime(clockVfs, &r);
48 t = (sqlite3_int64)(r*86400000.0);
49 }
50 return t;
51 }
52
53 /* An instance of the following object is passed by pointer as the
54 ** client data to various callbacks.
55 */
56 typedef struct FuzzCtx {
57 sqlite3 *db; /* The database connection */
58 sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
59 sqlite3_int64 iLastCb; /* Time recorded for previous progress callback */
60 sqlite3_int64 mxInterval; /* Longest interval between two progress calls */
61 unsigned nCb; /* Number of progress callbacks */
62 unsigned execCnt; /* Number of calls to the sqlite3_exec callback */
63 } FuzzCtx;
64
65 /*
66 ** Progress handler callback.
67 **
68 ** The argument is the cutoff-time after which all processing should
69 ** stop. So return non-zero if the cut-off time is exceeded.
70 */
progress_handler(void * pClientData)71 static int progress_handler(void *pClientData) {
72 FuzzCtx *p = (FuzzCtx*)pClientData;
73 sqlite3_int64 iNow = timeOfDay();
74 int rc = iNow>=p->iCutoffTime;
75 sqlite3_int64 iDiff = iNow - p->iLastCb;
76 if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
77 p->nCb++;
78 return rc;
79 }
80
81 /*
82 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
83 ** "PRAGMA parser_trace" since they can dramatically increase the
84 ** amount of output without actually testing anything useful.
85 */
block_debug_pragmas(void * Notused,int eCode,const char * zArg1,const char * zArg2,const char * zArg3,const char * zArg4)86 static int block_debug_pragmas(
87 void *Notused,
88 int eCode,
89 const char *zArg1,
90 const char *zArg2,
91 const char *zArg3,
92 const char *zArg4
93 ){
94 if( eCode==SQLITE_PRAGMA
95 && (sqlite3_strnicmp("vdbe_", zArg1, 5)==0
96 || sqlite3_stricmp("parser_trace", zArg1)==0)
97 ){
98 return SQLITE_DENY;
99 }
100 return SQLITE_OK;
101 }
102
103 /*
104 ** Callback for sqlite3_exec().
105 */
exec_handler(void * pClientData,int argc,char ** argv,char ** namev)106 static int exec_handler(void *pClientData, int argc, char **argv, char **namev){
107 FuzzCtx *p = (FuzzCtx*)pClientData;
108 int i;
109 if( argv ){
110 for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i]));
111 }
112 return (p->execCnt--)<=0 || progress_handler(pClientData);
113 }
114
115 /*
116 ** Main entry point. The fuzzer invokes this function with each
117 ** fuzzed input.
118 */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)119 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
120 char *zErrMsg = 0; /* Error message returned by sqlite_exec() */
121 uint8_t uSelector; /* First byte of input data[] */
122 int rc; /* Return code from various interfaces */
123 char *zSql; /* Zero-terminated copy of data[] */
124 FuzzCtx cx; /* Fuzzing context */
125
126 memset(&cx, 0, sizeof(cx));
127 if( size<3 ) return 0; /* Early out if unsufficient data */
128
129 /* Extract the selector byte from the beginning of the input. But only
130 ** do this if the second byte is a \n. If the second byte is not \n,
131 ** then use a default selector */
132 if( data[1]=='\n' ){
133 uSelector = data[0]; data += 2; size -= 2;
134 }else{
135 uSelector = 0xfd;
136 }
137
138 /* Open the database connection. Only use an in-memory database. */
139 if( sqlite3_initialize() ) return 0;
140 rc = sqlite3_open_v2("fuzz.db", &cx.db,
141 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0);
142 if( rc ) return 0;
143
144 /* Invoke the progress handler frequently to check to see if we
145 ** are taking too long. The progress handler will return true
146 ** (which will block further processing) if more than 10 seconds have
147 ** elapsed since the start of the test.
148 */
149 cx.iLastCb = timeOfDay();
150 cx.iCutoffTime = cx.iLastCb + 10000; /* Now + 10 seconds */
151 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
152 sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
153 #endif
154
155 /* Set a limit on the maximum size of a prepared statement */
156 sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000);
157
158 /* Limit total memory available to SQLite to 20MB */
159 sqlite3_hard_heap_limit64(20000000);
160
161 /* Set a limit on the maximum length of a string or BLOB. Without this
162 ** limit, fuzzers will invoke randomblob(N) for a large N, and the process
163 ** will timeout trying to generate the huge blob */
164 sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, 50000);
165
166 /* Bit 1 of the selector enables foreign key constraints */
167 sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc);
168 uSelector >>= 1;
169
170 /* Do not allow debugging pragma statements that might cause excess output */
171 sqlite3_set_authorizer(cx.db, block_debug_pragmas, 0);
172
173 /* Remaining bits of the selector determine a limit on the number of
174 ** output rows */
175 cx.execCnt = uSelector + 1;
176
177 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated
178 ** string, so make a copy. */
179 zSql = sqlite3_mprintf("%.*s", (int)size, data);
180 #ifndef SQLITE_OMIT_COMPLETE
181 sqlite3_complete(zSql);
182 #endif
183 sqlite3_exec(cx.db, zSql, exec_handler, (void*)&cx, &zErrMsg);
184
185 /* Show any errors */
186 if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){
187 printf("Error: %s\n", zErrMsg);
188 }
189
190 /* Cleanup and return */
191 sqlite3_free(zErrMsg);
192 sqlite3_free(zSql);
193 sqlite3_exec(cx.db, "PRAGMA temp_store_directory=''", 0, 0, 0);
194 sqlite3_close(cx.db);
195
196 if( mDebug & FUZZ_SHOW_MAX_DELAY ){
197 printf("Progress callback count....... %d\n", cx.nCb);
198 printf("Max time between callbacks.... %d ms\n", (int)cx.mxInterval);
199 }
200 return 0;
201 }
202