| /* Copyright 2019 Google Inc. All Rights Reserved. |
| ** Licensed under the Apache License, Version 2.0 (the "License"); |
| ** |
| ** Derived from the public domain SQLite (https://sqlite.org) sources. |
| */ |
| |
| #include <fuzzer/FuzzedDataProvider.h> |
| #include <stddef.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <cstdlib> |
| #include <iomanip> |
| #include <ios> |
| #include <iostream> |
| #include <sstream> |
| #include <string> |
| |
| #include "third_party/sqlite/sqlite3.h" |
| |
| sqlite3 *g_database = 0; /* The database connection */ |
| |
| enum class ColumnType { |
| kMin = 0, |
| kShortNumber = 0, |
| kBlob = 1, |
| kString = 2, |
| kAny = 3, |
| kMax = 3, |
| }; |
| |
| enum class TableOperator : unsigned long { |
| kMin = 0, |
| kShadowTableMin = 0, |
| kSegdir = 0, |
| kContent = 1, |
| kDocsize = 2, |
| kSegments = 3, |
| kStat = 4, |
| kShadowTableMax = 4, |
| // 5-7: reserved for further use |
| kFuzzTable = 8, |
| kMax = 8, |
| }; |
| |
| typedef struct { |
| uint8_t op_type : 4; |
| uint8_t column_op : 4; |
| uint8_t op_sql_operation : 4; |
| uint8_t select_operator_1 : 1; |
| uint8_t select_operator_2 : 3; |
| } opdata_16; |
| |
| /* |
| ** Callback for sqlite3_exec(). |
| */ |
| static int ExecHandler(void *pCnt, int argc, char **argv, char **namev) { |
| return ((*static_cast<int *>(pCnt))--) <= 0; |
| } |
| |
| size_t GetOperator16(FuzzedDataProvider *data_provider, opdata_16 *op16) { |
| if (data_provider->remaining_bytes() < sizeof(uint16_t)) |
| return 0; |
| |
| uint16_t operator_data = data_provider->ConsumeIntegral<uint16_t>(); |
| memcpy(op16, &operator_data, sizeof(uint16_t)); |
| return sizeof(uint16_t); |
| } |
| |
| std::string GetValueByType(FuzzedDataProvider *data_provider, ColumnType type) { |
| std::string out; |
| std::ostringstream ss; |
| switch (type) { |
| case ColumnType::kShortNumber: { |
| uint8_t number = data_provider->ConsumeIntegral<uint8_t>(); |
| ss << static_cast<uint16_t>(number); |
| } break; |
| case ColumnType::kBlob: { |
| uint16_t length = data_provider->ConsumeIntegral<uint16_t>(); |
| uint16_t value = 0; |
| if (length) { |
| ss << "x'" << std::hex; |
| for (uint16_t i = 0; i < length; i++) { |
| value = data_provider->ConsumeIntegral<uint8_t>(); |
| |
| if (data_provider->remaining_bytes() == 0) |
| break; |
| |
| ss << std::setfill('0') << std::setw(2) << value; |
| } |
| ss << "'"; |
| } else |
| return "x'00'"; |
| } break; |
| default: |
| return "'NOT SUPPORTED'"; |
| } |
| out = ss.str(); |
| return out; |
| } |
| |
| void RunSqlQuery(std::string &query, int *exec_count) { |
| static bool should_print = ::getenv("DUMP_NATIVE_INPUT"); |
| if (should_print) |
| std::cout << query << std::endl; |
| char *zErrMsg = 0; /* Error message returned by sqlite_exec() */ |
| sqlite3_exec(g_database, query.c_str(), ExecHandler, |
| static_cast<void *>(exec_count), &zErrMsg); |
| sqlite3_free(zErrMsg); |
| } |
| |
| int InitializeDB(FuzzedDataProvider *data_provider, int *exec_count) { |
| int rc; /* Return code from various interfaces */ |
| const char *icu_list[219] = { |
| "af_NA", "af_ZA", "ar_AE", "ar_BH", "ar_DZ", |
| "ar_EG", "ar_IQ", "ar_JO", "ar_KW", "ar_LB", |
| "ar_LY", "ar_MA", "ar_OM", "ar_QA", "ar_SA", |
| "ar_SD", "ar_SY", "ar_TN", "ar_YE", "as_IN", |
| "az_Latn", "az_Latn_AZ", "be_BY", "bg_BG", "bn_BD", |
| "bn_IN", "bs_BA", "ca_ES", "chr", "chr_US", |
| "cs_CZ", "cy_GB", "da_DK", "de_AT", "de_BE", |
| "de_CH", "de_DE", "de_LI", "de_LU", "el_CY", |
| "el_GR", "en", "en_AS", "en_AU", "en_BE", |
| "en_BW", "en_BZ", "en_CA", "en_GB", "en_GU", |
| "en_HK", "en_IE", "en_IN", "en_JM", "en_MH", |
| "en_MP", "en_MT", "en_MU", "en_NA", "en_NZ", |
| "en_PH", "en_PK", "en_SG", "en_TT", "en_UM", |
| "en_US", "en_US_POSIX", "en_VI", "en_ZA", "en_ZW", |
| "es_419", "es_AR", "es_BO", "es_CL", "es_CO", |
| "es_CR", "es_DO", "es_EC", "es_ES", "es_GQ", |
| "es_GT", "es_HN", "es_MX", "es_NI", "es_PA", |
| "es_PE", "es_PR", "es_PY", "es_SV", "es_US", |
| "es_UY", "es_VE", "et_EE", "fa_IR", "fi_FI", |
| "fil_PH", "fo_FO", "fr_BE", "fr_BF", "fr_BI", |
| "fr_BJ", "fr_BL", "fr_CA", "fr_CD", "fr_CF", |
| "fr_CG", "fr_CH", "fr_CI", "fr_CM", "fr_DJ", |
| "fr_FR", "fr_GA", "fr_GN", "fr_GP", "fr_GQ", |
| "fr_KM", "fr_LU", "fr_MC", "fr_MF", "fr_MG", |
| "fr_ML", "fr_MQ", "fr_NE", "fr_RE", "fr_RW", |
| "fr_SN", "fr_TD", "fr_TG", "ga", "ga_IE", |
| "gu_IN", "ha_Latn", "ha_Latn_GH", "ha_Latn_NE", "ha_Latn_NG", |
| "he_IL", "hi_IN", "hr_HR", "hu_HU", "hy_AM", |
| "id", "id_ID", "ig_NG", "is_IS", "it", |
| "it_CH", "it_IT", "ja_JP", "ka", "ka_GE", |
| "kk_KZ", "kl_GL", "kn_IN", "ko_KR", "kok_IN", |
| "lt_LT", "lv_LV", "mk_MK", "ml_IN", "mr_IN", |
| "ms", "ms_BN", "ms_MY", "mt_MT", "nb_NO", |
| "nlnl_BE", "nl_NL", "nn_NO", "om_ET", "om_KE", |
| "or_IN", "pa_Arab", "pa_Arab_PK", "pa_Guru", "pa_Guru_IN", |
| "pl_PL", "ps_AF", "pt", "pt_BR", "pt_PT", |
| "ro_MD", "ro_RO", "ru_MD", "ru_RU", "ru_UA", |
| "si_LK", "sk_SK", "sl_SI", "sq_AL", "sr_Cyrl", |
| "sr_Cyrl_BA", "sr_Cyrl_ME", "sr_Cyrl_RS", "sr_Latn_BA", "sr_Latn_ME", |
| "sr_Latn_RS", "sv_FI", "sv_SE", "sw", "sw_KE", |
| "sw_TZ", "ta_IN", "ta_LK", "te_IN", "th_TH", |
| "tr_TR", "uk_UA", "ur_IN", "ur_PK", "vi_VN", |
| "yo_NG", "zh_Hans", "zh_Hans_CN", "zh_Hans_SG", "zh_Hant_HK", |
| "zh_Hant_MO", "zh_Hant_TW", "zu", "zu_ZA"}; |
| |
| rc = sqlite3_initialize(); |
| if (rc) |
| return rc; |
| |
| /* Open the database connection. Only use an in-memory database. */ |
| rc = sqlite3_open_v2( |
| "fuzz.db", &g_database, |
| SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0); |
| if (rc) |
| return rc; |
| |
| /* enables foreign key constraints */ |
| sqlite3_db_config(g_database, SQLITE_DBCONFIG_ENABLE_FKEY, 1, &rc); |
| |
| /* disable defence-in-depth to simplify the fuzzing on shadow tables */ |
| sqlite3_db_config(g_database, SQLITE_DBCONFIG_DEFENSIVE, 0, &rc); |
| if (rc) |
| return rc; |
| |
| /* determine a limit on the number of output rows */ |
| *exec_count = 0x3f; |
| |
| /* Some initial queries */ |
| std::string init_drop_db("DROP TABLE IF EXISTS f;"); |
| std::string init_drop_docsize("DROP TABLE IF EXISTS 'f_docsize';"); |
| std::string init_drop_stat("DROP TABLE IF EXISTS 'f_stat';"); |
| std::string init_create_fts3 = "CREATE VIRTUAL TABLE f USING fts3(a,b"; |
| switch (data_provider->ConsumeIntegralInRange<uint8_t>(0, 3)) { |
| case 1: |
| init_create_fts3 += ",tokenize=porter"; |
| break; |
| case 2: |
| init_create_fts3 += ",tokenize=icu "; |
| init_create_fts3 += |
| icu_list[(data_provider->ConsumeIntegralInRange<uint8_t>( |
| 0, ((sizeof(icu_list) / sizeof(const char *) % 0x100) - 1)))]; |
| break; |
| case 3: |
| init_create_fts3 += ",tokenize=icu"; |
| break; |
| default: |
| case 0: |
| /*if we don't set tokenizer to anything, it will goes default simple |
| * tokenizer*/ |
| break; |
| } |
| init_create_fts3 += ");"; |
| std::string create_fake_docsize( |
| "CREATE TABLE 'f_docsize'(docid INTEGER PRIMARY KEY, size BLOB);"); |
| std::string create_fake_stat( |
| "CREATE TABLE 'f_stat'(id INTEGER PRIMARY KEY, value BLOB);"); |
| std::string init_set_initial_data("INSERT INTO f VALUES (1, '1234');"); |
| |
| RunSqlQuery(init_drop_db, exec_count); |
| RunSqlQuery(init_drop_docsize, exec_count); |
| RunSqlQuery(init_drop_stat, exec_count); |
| RunSqlQuery(init_create_fts3, exec_count); |
| RunSqlQuery(create_fake_docsize, exec_count); |
| RunSqlQuery(create_fake_stat, exec_count); |
| RunSqlQuery(init_set_initial_data, exec_count); |
| |
| return rc; |
| } |
| /* |
| ** Main entry point. The fuzzer invokes this function with each |
| ** fuzzed input. |
| */ |
| |
| extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
| if (size < 3 || size > 0x1000000) |
| return 0; /* Early out if unsufficient or too much data */ |
| |
| FuzzedDataProvider data_provider(data, size); |
| int exec_count = 0; /* Abort row callback when count reaches zero */ |
| |
| if (InitializeDB(&data_provider, &exec_count)) |
| return 0; |
| |
| while (1) { |
| std::string op, target, target_column; |
| ColumnType target_column_type = ColumnType::kMin; |
| |
| opdata_16 op_16; |
| size_t ret = GetOperator16(&data_provider, &op_16); |
| |
| if (ret == 0) |
| break; |
| unsigned long table_operator_border = |
| static_cast<unsigned long>(TableOperator::kMax) + 1; |
| TableOperator op_type = |
| static_cast<TableOperator>(op_16.op_type % table_operator_border); |
| |
| /* |
| 1. choose a table and a column to fuzz. |
| */ |
| bool op_on_shadow = (op_type <= TableOperator::kShadowTableMax); |
| if (op_on_shadow) { |
| switch (op_type) { |
| case TableOperator::kSegdir: |
| target = "f_segdir"; |
| switch (op_16.column_op % 5) { |
| case 0x00: |
| target_column = " level "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " start_block "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x02: |
| target_column = " end_block "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x03: |
| target_column = " leaves_end_block "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x04: |
| target_column = " root "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| break; |
| |
| case TableOperator::kContent: |
| target = "f_content"; |
| switch (op_16.column_op % 3) { |
| case 0x00: |
| target_column = " docid "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " 'c0a' "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x02: |
| target_column = " 'c1b' "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| break; |
| |
| case TableOperator::kDocsize: |
| target = "f_docsize"; |
| switch (op_16.column_op % 2) { |
| case 0x00: |
| target_column = " docid "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " size "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| break; |
| |
| case TableOperator::kSegments: |
| target = "f_segments"; |
| switch (op_16.column_op % 2) { |
| case 0x00: |
| target_column = " blockid "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " block "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| break; |
| |
| case TableOperator::kStat: |
| default: |
| target = "f_stat"; |
| switch (op_16.column_op % 2) { |
| case 0x00: |
| target_column = " id "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " value "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| break; |
| } |
| } else { |
| target = "f"; |
| switch (op_16.column_op % 2) { |
| case 0x00: |
| target_column = " a "; |
| target_column_type = ColumnType::kShortNumber; |
| break; |
| case 0x01: |
| target_column = " b "; |
| target_column_type = ColumnType::kBlob; |
| break; |
| } |
| op_type = TableOperator::kFuzzTable; |
| } |
| |
| /* |
| 2. choose a verb and generate some data if needed |
| */ |
| switch (op_16.op_sql_operation % 6) { |
| case 0x01: |
| op = "UPDATE " + target + " SET " + target_column + " = "; |
| op += GetValueByType(&data_provider, target_column_type); |
| op += " WHERE " + target_column + " IN (SELECT " + target_column; |
| op += " FROM " + target + " LIMIT 1 OFFSET "; |
| op += GetValueByType(&data_provider, ColumnType::kShortNumber); |
| op += ");"; |
| break; |
| |
| case 0x00: |
| case 0x02: { |
| std::ostringstream ss; |
| switch (op_type) { |
| case TableOperator::kSegdir: |
| ss << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << ",'" |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << " " |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << "'," |
| << GetValueByType(&data_provider, ColumnType::kBlob); |
| break; |
| case TableOperator::kContent: |
| ss << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kBlob); |
| break; |
| default: |
| /* |
| All other tables have the same type, so to simplify, use this |
| default instead. |
| BLOB is almost the same as STRING and it avoids the annoying |
| encoding problem, so choose BLOB instead when some columns |
| need STRING |
| */ |
| ss << GetValueByType(&data_provider, ColumnType::kShortNumber) << "," |
| << GetValueByType(&data_provider, ColumnType::kBlob); |
| break; |
| } |
| op = "INSERT INTO " + target + " VALUES (" + ss.str() + ");"; |
| } break; |
| |
| case 0x03: |
| op = "DELETE FROM f WHERE "; |
| op += (op_16.select_operator_1 ? "a" : "b"); |
| op += "="; |
| op += GetValueByType(&data_provider, op_16.select_operator_1 |
| ? ColumnType::kShortNumber |
| : ColumnType::kBlob); |
| op += ";"; |
| break; |
| |
| case 0x04: { |
| uint8_t selector_indicator = |
| data_provider.ConsumeIntegralInRange<uint8_t>(0, 4); |
| std::string selector_string; |
| switch (selector_indicator) { |
| case 0x00: { |
| selector_string = " matchinfo( f , '"; |
| uint8_t matchinfo_argdata = data_provider.ConsumeIntegral<uint8_t>(); |
| if (matchinfo_argdata == 0) { |
| selector_string += "pcx"; // default value |
| } |
| /* to simplify I removed y, because it is almost the same as 'x' |
| * =>https://www.sqlite.org/fts3.html#matchinfo */ |
| const char matchinfo_args[8] = {'p', 'c', 'n', 'a', 'l', 's', 'x', 'b'}; |
| size_t matchinfo_counter = 0; |
| while (matchinfo_argdata > 0 && |
| matchinfo_counter < sizeof(matchinfo_args)) { |
| if (matchinfo_argdata % 2) { |
| selector_string += matchinfo_args[matchinfo_counter]; |
| } |
| matchinfo_argdata >>= 1; |
| matchinfo_counter++; |
| } |
| |
| selector_string += "') "; |
| break; |
| } |
| case 0x01: |
| selector_string += " snippet(f) "; |
| break; |
| case 0x02: |
| selector_string += " snippet(f, x'"; |
| selector_string += GetValueByType(&data_provider, ColumnType::kBlob); |
| selector_string += "', x'"; |
| selector_string += GetValueByType(&data_provider, ColumnType::kBlob); |
| selector_string += "', x'"; |
| selector_string += GetValueByType(&data_provider, ColumnType::kBlob); |
| selector_string += "') "; |
| break; |
| case 0x03: |
| selector_string += " offsets(f) "; |
| break; |
| case 0x04: |
| selector_string += " * "; |
| break; |
| } |
| |
| op = "SELECT " + selector_string + " FROM f WHERE "; |
| op += (op_16.select_operator_1 ? "a" : "b"); |
| uint16_t processor_byte = |
| 0; /* don't read a byte when it compares with = (eq)*/ |
| uint8_t current_bits = 0; /* 4 bits of data, maximum = 15*/ |
| switch (op_16.select_operator_2 % 4) { |
| case 0: { |
| bool need_string = true; |
| uint8_t match_length = data_provider.ConsumeIntegralInRange<uint8_t>( |
| 1, 10); /* parts involved in match */ |
| op += " MATCH "; |
| while (match_length && data_provider.remaining_bytes()) { |
| if (need_string) { |
| /* asterisk cases like MATCH 'a*' will be automatically covered in |
| * this BLOB */ |
| op += GetValueByType(&data_provider, ColumnType::kBlob); |
| need_string = false; |
| } else { |
| /* |
| ignoring brackets to simplify the logic since they can be |
| converted into the equal forms. |
| eg: a AND (b OR c) == b OR c AND a |
| */ |
| switch (data_provider.ConsumeIntegralInRange<uint8_t>(0, 3)) { |
| case 0: |
| op += " AND "; |
| break; |
| case 1: |
| op += " OR "; |
| break; |
| case 2: |
| op += " NEAR "; |
| break; |
| default: |
| case 3: |
| op += " NEAR/"; |
| op += GetValueByType(&data_provider, ColumnType::kShortNumber); |
| op += " "; |
| break; |
| } |
| need_string = true; |
| } |
| match_length--; |
| } |
| if (need_string) { |
| /* asterisk cases like MATCH 'a*' will be automatically covered in |
| * this BLOB */ |
| op += GetValueByType(&data_provider, ColumnType::kBlob); |
| need_string = false; |
| } |
| op += ";"; |
| } break; |
| case 1: |
| processor_byte = data_provider.ConsumeIntegral<uint16_t>(); |
| op += " LIKE "; |
| while (processor_byte) { |
| current_bits = processor_byte % (1 << 4); |
| processor_byte >>= 4; |
| switch (current_bits) { |
| case 0: |
| op += "%"; |
| break; |
| case 1: |
| op += "_"; |
| break; |
| case 2: |
| op += " "; |
| break; |
| default: |
| op += ('a' + current_bits); |
| break; |
| } |
| } |
| op += "';"; |
| break; |
| case 2: |
| op += " = 'a b';"; |
| break; |
| case 3: |
| processor_byte = data_provider.ConsumeIntegral<uint16_t>(); |
| op += " GLOB '"; |
| while (processor_byte) { |
| current_bits = processor_byte % (1 << 4); |
| processor_byte >>= 4; |
| switch (current_bits) { |
| case 0: |
| op += "*"; |
| break; |
| case 1: |
| op += "?"; |
| break; |
| case 2: |
| op += "[AB]"; |
| break; |
| case 3: |
| op += "[0-9]"; |
| break; |
| case 4: |
| op += "[!A]"; |
| break; |
| case 5: |
| op += "[!3-5]"; |
| break; |
| case 6: |
| op += "\\"; |
| break; |
| case 7: |
| op += "/"; |
| break; |
| default: // alphabets |
| op += ('a' + current_bits); |
| break; |
| } |
| } |
| op += "';"; |
| break; |
| } /* end of switch (op_16.select_operator_2 % 4) */ |
| break; |
| } |
| case 0x05: { |
| std::string command; |
| std::ostringstream ss; |
| uint8_t command_operator = |
| (op_16.select_operator_2 << 1) + op_16.select_operator_1; |
| switch (command_operator % 5) { |
| case 0x00: |
| command = "optimize"; |
| break; |
| case 0x01: |
| command = "rebuild"; |
| break; |
| case 0x02: |
| command = "integrity-check"; |
| break; |
| case 0x03: |
| ss << GetValueByType(&data_provider, ColumnType::kShortNumber) << ',' |
| << GetValueByType(&data_provider, ColumnType::kShortNumber); |
| command = "merge="; |
| command += ss.str(); |
| break; |
| case 0x04: |
| ss << GetValueByType(&data_provider, ColumnType::kShortNumber); |
| command = "automerge="; |
| command += ss.str(); |
| break; |
| } |
| op = "INSERT INTO f(f) VALUES ('" + command + "');"; |
| } break; |
| } |
| |
| RunSqlQuery(op, &exec_count); |
| } |
| /* Cleanup and return */ |
| |
| sqlite3_close(g_database); |
| |
| return 0; |
| } |
| |
