| /* |
| ** 2018-03-21 |
| ** |
| ** The author disclaims copyright to this source code. In place of |
| ** a legal notice, here is a blessing: |
| ** |
| ** May you do good and not evil. |
| ** May you find forgiveness for yourself and forgive others. |
| ** May you share freely, never taking more than you give. |
| ** |
| ************************************************************************* |
| ** |
| ** This program attempts to verify the correctness of the SQLite query |
| ** optimizer by fuzzing. |
| ** |
| ** The input is an SQL script, presumably generated by a fuzzer. The |
| ** argument is the name of the input. If no files are named, standard |
| ** input is read. |
| ** |
| ** The SQL script is run twice, once with optimization enabled, and again |
| ** with optimization disabled. If the output is not equivalent, an error |
| ** is printed and the program returns non-zero. |
| */ |
| |
| /* Include the SQLite amalgamation, after making appropriate #defines. |
| */ |
| #define SQLITE_THREADSAFE 0 |
| #define SQLITE_OMIT_LOAD_EXTENSION 1 |
| #define SQLITE_ENABLE_DESERIALIZE 1 |
| #include "sqlite3.c" |
| |
| /* Content of the read-only test database */ |
| #include "optfuzz-db01.c" |
| |
| /* |
| ** Prepare a single SQL statement. Panic if anything goes wrong |
| */ |
| static sqlite3_stmt *prepare_sql(sqlite3 *db, const char *zFormat, ...){ |
| char *zSql; |
| int rc; |
| sqlite3_stmt *pStmt = 0; |
| va_list ap; |
| |
| va_start(ap, zFormat); |
| zSql = sqlite3_vmprintf(zFormat, ap); |
| va_end(ap); |
| rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0); |
| if( rc ){ |
| printf("Error: %s\nSQL: %s\n", |
| sqlite3_errmsg(db), zSql); |
| exit(1); |
| } |
| sqlite3_free(zSql); |
| return pStmt; |
| } |
| |
| /* |
| ** Run SQL. Panic if anything goes wrong |
| */ |
| static void run_sql(sqlite3 *db, const char *zFormat, ...){ |
| char *zSql; |
| int rc; |
| char *zErr = 0; |
| va_list ap; |
| |
| va_start(ap, zFormat); |
| zSql = sqlite3_vmprintf(zFormat, ap); |
| va_end(ap); |
| rc = sqlite3_exec(db, zSql, 0, 0, &zErr); |
| if( rc || zErr ){ |
| printf("Error: %s\nsqlite3_errmsg: %s\nSQL: %s\n", |
| zErr, sqlite3_errmsg(db), zSql); |
| exit(1); |
| } |
| sqlite3_free(zSql); |
| } |
| |
| /* |
| ** Run one or more SQL statements contained in zSql against database dbRun. |
| ** Store the input in database dbOut. |
| */ |
| static int optfuzz_exec( |
| sqlite3 *dbRun, /* The database on which the SQL executes */ |
| const char *zSql, /* The SQL to be executed */ |
| sqlite3 *dbOut, /* Store results in this database */ |
| const char *zOutTab, /* Store results in this table of dbOut */ |
| int *pnStmt, /* Write the number of statements here */ |
| int *pnRow, /* Write the number of rows here */ |
| int bTrace /* Print query results if true */ |
| ){ |
| int rc = SQLITE_OK; /* Return code */ |
| const char *zLeftover; /* Tail of unprocessed SQL */ |
| sqlite3_stmt *pStmt = 0; /* The current SQL statement */ |
| sqlite3_stmt *pIns = 0; /* Statement to insert into dbOut */ |
| const char *zCol; /* Single column value */ |
| int nCol; /* Number of output columns */ |
| char zLine[4000]; /* Complete row value */ |
| |
| run_sql(dbOut, "BEGIN"); |
| run_sql(dbOut, "CREATE TABLE IF NOT EXISTS staging(x TEXT)"); |
| run_sql(dbOut, "CREATE TABLE IF NOT EXISTS \"%w\"(x TEXT)", zOutTab); |
| pIns = prepare_sql(dbOut, "INSERT INTO staging(x) VALUES(?1)"); |
| *pnRow = *pnStmt = 0; |
| while( rc==SQLITE_OK && zSql && zSql[0] ){ |
| zLeftover = 0; |
| rc = sqlite3_prepare_v2(dbRun, zSql, -1, &pStmt, &zLeftover); |
| zSql = zLeftover; |
| assert( rc==SQLITE_OK || pStmt==0 ); |
| if( rc!=SQLITE_OK ){ |
| printf("Error with [%s]\n%s\n", zSql, sqlite3_errmsg(dbRun)); |
| break; |
| } |
| if( !pStmt ) continue; |
| (*pnStmt)++; |
| nCol = sqlite3_column_count(pStmt); |
| run_sql(dbOut, "DELETE FROM staging;"); |
| while( sqlite3_step(pStmt)==SQLITE_ROW ){ |
| int i, j; |
| for(i=j=0; i<nCol && j<sizeof(zLine)-50; i++){ |
| int eType = sqlite3_column_type(pStmt, i); |
| if( eType==SQLITE_NULL ){ |
| zCol = "NULL"; |
| }else{ |
| zCol = (const char*)sqlite3_column_text(pStmt, i); |
| } |
| if( i ) zLine[j++] = ','; |
| if( eType==SQLITE_TEXT ){ |
| sqlite3_snprintf(sizeof(zLine)-j, zLine+j, "'%q'", zCol); |
| }else{ |
| sqlite3_snprintf(sizeof(zLine)-j, zLine+j, "%s", zCol); |
| } |
| j += (int)strlen(zLine+j); |
| } |
| /* Detect if any row is too large and throw an error, because we will |
| ** want to go back and look more closely at that case */ |
| if( j>=sizeof(zLine)-100 ){ |
| printf("Excessively long output line: %d bytes\n" ,j); |
| exit(1); |
| } |
| if( bTrace ){ |
| printf("%s\n", zLine); |
| } |
| (*pnRow)++; |
| sqlite3_bind_text(pIns, 1, zLine, j, SQLITE_TRANSIENT); |
| rc = sqlite3_step(pIns); |
| assert( rc==SQLITE_DONE ); |
| rc = sqlite3_reset(pIns); |
| } |
| run_sql(dbOut, |
| "INSERT INTO \"%w\"(x) VALUES('### %q ###')", |
| zOutTab, sqlite3_sql(pStmt) |
| ); |
| run_sql(dbOut, |
| "INSERT INTO \"%w\"(x) SELECT group_concat(x,char(10))" |
| " FROM (SELECT x FROM staging ORDER BY x)", |
| zOutTab |
| ); |
| run_sql(dbOut, "COMMIT"); |
| sqlite3_finalize(pStmt); |
| pStmt = 0; |
| } |
| sqlite3_finalize(pStmt); |
| sqlite3_finalize(pIns); |
| return rc; |
| } |
| |
| /* |
| ** Read the content of file zName into memory obtained from sqlite3_malloc64() |
| ** and return a pointer to the buffer. The caller is responsible for freeing |
| ** the memory. |
| ** |
| ** If parameter pnByte is not NULL, (*pnByte) is set to the number of bytes |
| ** read. |
| ** |
| ** For convenience, a nul-terminator byte is always appended to the data read |
| ** from the file before the buffer is returned. This byte is not included in |
| ** the final value of (*pnByte), if applicable. |
| ** |
| ** NULL is returned if any error is encountered. The final value of *pnByte |
| ** is undefined in this case. |
| */ |
| static char *readFile(const char *zName, int *pnByte){ |
| FILE *in = fopen(zName, "rb"); |
| long nIn; |
| size_t nRead; |
| char *pBuf; |
| if( in==0 ) return 0; |
| fseek(in, 0, SEEK_END); |
| nIn = ftell(in); |
| rewind(in); |
| pBuf = sqlite3_malloc64( nIn+1 ); |
| if( pBuf==0 ) return 0; |
| nRead = fread(pBuf, nIn, 1, in); |
| fclose(in); |
| if( nRead!=1 ){ |
| sqlite3_free(pBuf); |
| return 0; |
| } |
| pBuf[nIn] = 0; |
| if( pnByte ) *pnByte = nIn; |
| return pBuf; |
| } |
| |
| int main(int argc, char **argv){ |
| int nIn = 0; /* Number of input files */ |
| char **azIn = 0; /* Names of input files */ |
| sqlite3 *dbOut = 0; /* Database to hold results */ |
| sqlite3 *dbRun = 0; /* Database used for tests */ |
| int bTrace = 0; /* Show query results */ |
| int bShowValid = 0; /* Just list inputs that are valid SQL */ |
| int nRow, nStmt; /* Number of rows and statements */ |
| int i, rc; |
| |
| for(i=1; i<argc; i++){ |
| const char *z = argv[i]; |
| if( z[0]=='-' && z[1]=='-' ) z++; |
| if( strcmp(z,"-help")==0 ){ |
| printf("Usage: %s [OPTIONS] FILENAME ...\n", argv[0]); |
| printf("Options:\n"); |
| printf(" --help Show his message\n"); |
| printf(" --output-trace Show each line of SQL output\n"); |
| printf(" --valid-sql List FILEs that are valid SQL\n"); |
| return 0; |
| } |
| else if( strcmp(z,"-output-trace")==0 ){ |
| bTrace = 1; |
| } |
| else if( strcmp(z,"-valid-sql")==0 ){ |
| bShowValid = 1; |
| } |
| else if( z[0]=='-' ){ |
| printf("unknown option \"%s\". Use --help for details\n", argv[i]); |
| return 1; |
| } |
| else { |
| nIn++; |
| azIn = realloc(azIn, sizeof(azIn[0])*nIn); |
| if( azIn==0 ){ |
| printf("out of memory\n"); |
| exit(1); |
| } |
| azIn[nIn-1] = argv[i]; |
| } |
| } |
| |
| sqlite3_open(":memory:", &dbOut); |
| sqlite3_open(":memory:", &dbRun); |
| sqlite3_deserialize(dbRun, "main", data001, sizeof(data001), |
| sizeof(data001), SQLITE_DESERIALIZE_READONLY); |
| for(i=0; i<nIn; i++){ |
| char *zSql = readFile(azIn[i], 0); |
| sqlite3_stmt *pCk; |
| sqlite3_exec(dbRun, "ROLLBACK", 0, 0, 0); |
| if( bShowValid ){ |
| rc = sqlite3_exec(dbRun, zSql, 0, 0, 0); |
| if( rc==SQLITE_OK ) printf("%s\n", azIn[i]); |
| sqlite3_free(zSql); |
| continue; |
| } |
| sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS, dbRun, 0); |
| if( bTrace ) printf("%s: Optimized\n", azIn[i]); |
| rc = optfuzz_exec(dbRun, zSql, dbOut, "opt", &nStmt, &nRow, bTrace); |
| if( rc ){ |
| printf("%s: optimized run failed: %s\n", |
| azIn[i], sqlite3_errmsg(dbRun)); |
| }else{ |
| sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS, dbRun, 0xffff); |
| if( bTrace ) printf("%s: Non-optimized\n", azIn[i]); |
| rc = optfuzz_exec(dbRun, zSql, dbOut, "noopt", &nStmt, &nRow, bTrace); |
| if( rc ){ |
| printf("%s: non-optimized run failed: %s\n", |
| azIn[i], sqlite3_errmsg(dbRun)); |
| exit(1); |
| } |
| pCk = prepare_sql(dbOut, |
| "SELECT (SELECT group_concat(x,char(10)) FROM opt)==" |
| " (SELECT group_concat(x,char(10)) FROM noopt)"); |
| rc = sqlite3_step(pCk); |
| if( rc!=SQLITE_ROW ){ |
| printf("%s: comparison failed\n", sqlite3_errmsg(dbOut)); |
| exit(1); |
| } |
| if( !sqlite3_column_int(pCk, 0) ){ |
| printf("%s: opt/no-opt outputs differ\n", azIn[i]); |
| pCk = prepare_sql(dbOut, |
| "SELECT group_concat(x,char(10)) FROM opt " |
| "UNION ALL " |
| "SELECT group_concat(x,char(10)) FROM noopt"); |
| sqlite3_step(pCk); |
| printf("opt:\n%s\n", sqlite3_column_text(pCk,0)); |
| sqlite3_step(pCk); |
| printf("noopt:\n%s\n", sqlite3_column_text(pCk,0)); |
| exit(1); |
| }else{ |
| printf("%s: %d stmts %d rows ok\n", azIn[i], nStmt, nRow); |
| } |
| sqlite3_finalize(pCk); |
| } |
| sqlite3_free(zSql); |
| } |
| sqlite3_close(dbRun); |
| sqlite3_close(dbOut); |
| free(azIn); |
| if( sqlite3_memory_used() ){ |
| printf("Memory leak of %lld bytes\n", sqlite3_memory_used()); |
| exit(1); |
| } |
| return 0; |
| } |
