Add the tool/fuzzershell.c utility program.
FossilOrigin-Name: db8d9af4d04ee862995ffa13ae6dcd9a1fc72855
This commit is contained in:
drh
parent
50be9c4b28
commit
268e72f936
@ -539,6 +539,9 @@ sqlite3$(TEXE): $(TOP)/src/shell.c libsqlite3.la sqlite3.h
|
||||
sqldiff$(EXE): $(TOP)/tool/sqldiff.c sqlite3.c sqlite3.h
|
||||
$(LTLINK) -o $@ $(TOP)/tool/sqldiff.c sqlite3.c $(TLIBS)
|
||||
|
||||
fuzzershell$(EXE): $(TOP)/tool/fuzzershell.c sqlite3.c sqlite3.h
|
||||
$(LTLINK) -o $@ $(TOP)/tool/fuzzershell.c sqlite3.c $(TLIBS)
|
||||
|
||||
mptester$(EXE): sqlite3.c $(TOP)/mptest/mptest.c
|
||||
$(LTLINK) -o $@ -I. $(TOP)/mptest/mptest.c sqlite3.c \
|
||||
$(TLIBS) -rpath "$(libdir)"
|
||||
|
||||
@ -1159,6 +1159,9 @@ sqlite3.exe: $(TOP)\src\shell.c $(SHELL_CORE_DEP) $(LIBRESOBJS) sqlite3.h
|
||||
sqldiff.exe: $(TOP)\tool\sqldiff.c sqlite3.c sqlite3.h
|
||||
$(LTLINK) $(TOP)\tool\sqldiff.c sqlite3.c
|
||||
|
||||
fuzzershell.exe: $(TOP)\tool\fuzzershell.c sqlite3.c sqlite3.h
|
||||
$(LTLINK) $(TOP)\tool\fuzzershell.c sqlite3.c
|
||||
|
||||
mptester.exe: $(TOP)\mptest\mptest.c $(SHELL_CORE_DEP) $(LIBRESOBJS) sqlite3.h
|
||||
$(LTLINK) $(SHELL_COMPILE_OPTS) $(TOP)\mptest\mptest.c \
|
||||
/link $(LTLINKOPTS) $(LTLIBPATHS) $(SHELL_LINK_OPTS) $(LIBRESOBJS) $(LIBREADLINE) $(LTLIBS) $(TLIBS)
|
||||
|
||||
4
main.mk
4
main.mk
@ -408,6 +408,10 @@ sqldiff$(EXE): $(TOP)/tool/sqldiff.c sqlite3.c sqlite3.h
|
||||
$(TCCX) -o sqldiff$(EXE) -DSQLITE_THREADSAFE=0 \
|
||||
$(TOP)/tool/sqldiff.c sqlite3.c $(TLIBS) $(THREADLIB)
|
||||
|
||||
fuzzershell$(EXE): $(TOP)/tool/fuzzershell.c sqlite3.c sqlite3.h
|
||||
$(TCCX) -o fuzzershell$(EXE) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION\
|
||||
$(TOP)/tool/fuzzershell.c sqlite3.c $(TLIBS) $(THREADLIB)
|
||||
|
||||
mptester$(EXE): sqlite3.c $(TOP)/mptest/mptest.c
|
||||
$(TCCX) -o $@ -I. $(TOP)/mptest/mptest.c sqlite3.c \
|
||||
$(TLIBS) $(THREADLIB)
|
||||
|
||||
17
manifest
17
manifest
@ -1,9 +1,9 @@
|
||||
C Fix\sthe\sheader\scomment\son\sthe\ssqldiff\sutility\sprogram.\s\sNo\scode\schanges.
|
||||
D 2015-04-17T12:16:09.669
|
||||
C Add\sthe\stool/fuzzershell.c\sutility\sprogram.
|
||||
D 2015-04-17T14:30:49.931
|
||||
F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
|
||||
F Makefile.in 5f78b1ab81b64e7c57a75d170832443e66c0880a
|
||||
F Makefile.in faaf75b89840659d74501bea269c7e33414761c1
|
||||
F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
|
||||
F Makefile.msc 11cb5361e34b80e9c5b417ed6a6deee099c5b5f3
|
||||
F Makefile.msc a19bceec468fa18bb54df52257b1a2211e69172d
|
||||
F Makefile.vxworks e1b65dea203f054e71653415bd8f96dcaed47858
|
||||
F README.md d58e3bebc0a4145e0f2a87994015fdb575a8e866
|
||||
F VERSION 2e244662b71e6e68a5c29b014ebc5b7564f4cc5a
|
||||
@ -152,7 +152,7 @@ F ext/userauth/userauth.c 5fa3bdb492f481bbc1709fc83c91ebd13460c69e
|
||||
F install-sh 9d4de14ab9fb0facae2f48780b874848cbf2f895 x
|
||||
F ltmain.sh 3ff0879076df340d2e23ae905484d8c15d5fdea8
|
||||
F magic.txt 8273bf49ba3b0c8559cb2774495390c31fd61c60
|
||||
F main.mk ddffac494a82d42772df9fe30d3a78acf4f7cb41
|
||||
F main.mk 60aba7d38b9bd73e249693344dd8405aa24ac02a
|
||||
F mkopcodec.awk c2ff431854d702cdd2d779c9c0d1f58fa16fa4ea
|
||||
F mkopcodeh.awk d5e22023b5238985bb54a72d33e0ac71fe4f8a32
|
||||
F mkso.sh fd21c06b063bb16a5d25deea1752c2da6ac3ed83
|
||||
@ -1203,6 +1203,7 @@ F tool/diffdb.c 7524b1b5df217c20cd0431f6789851a4e0cb191b
|
||||
F tool/extract.c 054069d81b095fbdc189a6f5d4466e40380505e2
|
||||
F tool/fast_vacuum.c 5ba0d6f5963a0a63bdc42840f678bad75b2ebce1
|
||||
F tool/fragck.tcl 5265a95126abcf6ab357f7efa544787e5963f439
|
||||
F tool/fuzzershell.c 9e7e273da203037154b433bb67f10b0d9772b370
|
||||
F tool/genfkey.README cf68fddd4643bbe3ff8e31b8b6d8b0a1b85e20f4
|
||||
F tool/genfkey.test 4196a8928b78f51d54ef58e99e99401ab2f0a7e5
|
||||
F tool/getlock.c f4c39b651370156cae979501a7b156bdba50e7ce
|
||||
@ -1250,7 +1251,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
|
||||
F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
|
||||
F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
|
||||
F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
|
||||
P cd6598f47480a6189df3e4283231833fd246d7fb
|
||||
R bfdce473d247dbaaedf4cb00e3a28380
|
||||
P b355ca3a3f617cd6d4c45c8e27ecd75d9e68b792
|
||||
R d4d32c82236775154903bd68de367067
|
||||
U drh
|
||||
Z c972653cce57a7491204b613b522cd75
|
||||
Z b7bf748b01ea8ab50dc7b538dea6204b
|
||||
|
||||
@ -1 +1 @@
|
||||
b355ca3a3f617cd6d4c45c8e27ecd75d9e68b792
|
||||
db8d9af4d04ee862995ffa13ae6dcd9a1fc72855
|
||||
294
tool/fuzzershell.c
Normal file
294
tool/fuzzershell.c
Normal file
@ -0,0 +1,294 @@
|
||||
/*
|
||||
** 2015-04-17
|
||||
**
|
||||
** The author disclaims copyright to this source code. In place of
|
||||
** a legal notice, here is a blessing:
|
||||
**
|
||||
** May you do good and not evil.
|
||||
** May you find forgiveness for yourself and forgive others.
|
||||
** May you share freely, never taking more than you give.
|
||||
**
|
||||
*************************************************************************
|
||||
**
|
||||
** This is a utility program designed to aid running the SQLite library
|
||||
** against an external fuzzer, such as American Fuzzy Lop (AFL)
|
||||
** (http://lcamtuf.coredump.cx/afl/). Basically, this program reads
|
||||
** SQL text from standard input and passes it through to SQLite for evaluation,
|
||||
** just like the "sqlite3" command-line shell. Differences from the
|
||||
** command-line shell:
|
||||
**
|
||||
** (1) The complex "dot-command" extensions are omitted. This
|
||||
** prevents the fuzzer from discovering that it can run things
|
||||
** like ".shell rm -rf ~"
|
||||
**
|
||||
** (2) The database is opened with the SQLITE_OPEN_MEMORY flag so that
|
||||
** no disk I/O from the database is permitted. The ATTACH command
|
||||
** with a filename still uses an in-memory database.
|
||||
**
|
||||
** (3) The main in-memory database can be initialized from a template
|
||||
** disk database so that the fuzzer starts with a database containing
|
||||
** content.
|
||||
**
|
||||
** (4) The eval() SQL function is added, allowing the fuzzer to do
|
||||
** interesting recursive operations.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdarg.h>
|
||||
#include "sqlite3.h"
|
||||
|
||||
/*
|
||||
** All global variables are gathered into the "g" singleton.
|
||||
*/
|
||||
struct GlobalVars {
|
||||
const char *zArgv0; /* Name of program */
|
||||
} g;
|
||||
|
||||
|
||||
|
||||
/*
|
||||
** Print an error message and abort in such a way to indicate to the
|
||||
** fuzzer that this counts as a crash.
|
||||
*/
|
||||
static void abendError(const char *zFormat, ...){
|
||||
va_list ap;
|
||||
fprintf(stderr, "%s: ", g.zArgv0);
|
||||
va_start(ap, zFormat);
|
||||
vfprintf(stderr, zFormat, ap);
|
||||
va_end(ap);
|
||||
fprintf(stderr, "\n");
|
||||
abort();
|
||||
}
|
||||
/*
|
||||
** Print an error message and quit, but not in a way that would look
|
||||
** like a crash.
|
||||
*/
|
||||
static void fatalError(const char *zFormat, ...){
|
||||
va_list ap;
|
||||
fprintf(stderr, "%s: ", g.zArgv0);
|
||||
va_start(ap, zFormat);
|
||||
vfprintf(stderr, zFormat, ap);
|
||||
va_end(ap);
|
||||
fprintf(stderr, "\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/*
|
||||
** This callback is invoked by sqlite3_log().
|
||||
*/
|
||||
static void shellLog(void *pNotUsed, int iErrCode, const char *zMsg){
|
||||
printf("LOG: (%d) %s\n", iErrCode, zMsg);
|
||||
}
|
||||
|
||||
/*
|
||||
** This callback is invoked by sqlite3_exec() to return query results.
|
||||
*/
|
||||
static int execCallback(void *NotUsed, int argc, char **argv, char **colv){
|
||||
int i;
|
||||
static unsigned cnt = 0;
|
||||
printf("ROW #%u:\n", ++cnt);
|
||||
for(i=0; i<argc; i++){
|
||||
printf(" %s=", colv[i]);
|
||||
if( argv[i] ){
|
||||
printf("[%s]\n", argv[i]);
|
||||
}else{
|
||||
printf("NULL\n");
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
** This callback is invoked by sqlite3_trace() as each SQL statement
|
||||
** starts.
|
||||
*/
|
||||
static void traceCallback(void *NotUsed, const char *zMsg){
|
||||
printf("TRACE: %s\n", zMsg);
|
||||
}
|
||||
|
||||
/***************************************************************************
|
||||
** eval() implementation copied from ../ext/misc/eval.c
|
||||
*/
|
||||
/*
|
||||
** Structure used to accumulate the output
|
||||
*/
|
||||
struct EvalResult {
|
||||
char *z; /* Accumulated output */
|
||||
const char *zSep; /* Separator */
|
||||
int szSep; /* Size of the separator string */
|
||||
sqlite3_int64 nAlloc; /* Number of bytes allocated for z[] */
|
||||
sqlite3_int64 nUsed; /* Number of bytes of z[] actually used */
|
||||
};
|
||||
|
||||
/*
|
||||
** Callback from sqlite_exec() for the eval() function.
|
||||
*/
|
||||
static int callback(void *pCtx, int argc, char **argv, char **colnames){
|
||||
struct EvalResult *p = (struct EvalResult*)pCtx;
|
||||
int i;
|
||||
for(i=0; i<argc; i++){
|
||||
const char *z = argv[i] ? argv[i] : "";
|
||||
size_t sz = strlen(z);
|
||||
if( (sqlite3_int64)sz+p->nUsed+p->szSep+1 > p->nAlloc ){
|
||||
char *zNew;
|
||||
p->nAlloc = p->nAlloc*2 + sz + p->szSep + 1;
|
||||
/* Using sqlite3_realloc64() would be better, but it is a recent
|
||||
** addition and will cause a segfault if loaded by an older version
|
||||
** of SQLite. */
|
||||
zNew = p->nAlloc<=0x7fffffff ? sqlite3_realloc(p->z, (int)p->nAlloc) : 0;
|
||||
if( zNew==0 ){
|
||||
sqlite3_free(p->z);
|
||||
memset(p, 0, sizeof(*p));
|
||||
return 1;
|
||||
}
|
||||
p->z = zNew;
|
||||
}
|
||||
if( p->nUsed>0 ){
|
||||
memcpy(&p->z[p->nUsed], p->zSep, p->szSep);
|
||||
p->nUsed += p->szSep;
|
||||
}
|
||||
memcpy(&p->z[p->nUsed], z, sz);
|
||||
p->nUsed += sz;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
** Implementation of the eval(X) and eval(X,Y) SQL functions.
|
||||
**
|
||||
** Evaluate the SQL text in X. Return the results, using string
|
||||
** Y as the separator. If Y is omitted, use a single space character.
|
||||
*/
|
||||
static void sqlEvalFunc(
|
||||
sqlite3_context *context,
|
||||
int argc,
|
||||
sqlite3_value **argv
|
||||
){
|
||||
const char *zSql;
|
||||
sqlite3 *db;
|
||||
char *zErr = 0;
|
||||
int rc;
|
||||
struct EvalResult x;
|
||||
|
||||
memset(&x, 0, sizeof(x));
|
||||
x.zSep = " ";
|
||||
zSql = (const char*)sqlite3_value_text(argv[0]);
|
||||
if( zSql==0 ) return;
|
||||
if( argc>1 ){
|
||||
x.zSep = (const char*)sqlite3_value_text(argv[1]);
|
||||
if( x.zSep==0 ) return;
|
||||
}
|
||||
x.szSep = (int)strlen(x.zSep);
|
||||
db = sqlite3_context_db_handle(context);
|
||||
rc = sqlite3_exec(db, zSql, callback, &x, &zErr);
|
||||
if( rc!=SQLITE_OK ){
|
||||
sqlite3_result_error(context, zErr, -1);
|
||||
sqlite3_free(zErr);
|
||||
}else if( x.zSep==0 ){
|
||||
sqlite3_result_error_nomem(context);
|
||||
sqlite3_free(x.z);
|
||||
}else{
|
||||
sqlite3_result_text(context, x.z, (int)x.nUsed, sqlite3_free);
|
||||
}
|
||||
}
|
||||
/* End of the eval() implementation
|
||||
******************************************************************************/
|
||||
|
||||
/*
|
||||
** Print sketchy documentation for this utility program
|
||||
*/
|
||||
static void showHelp(void){
|
||||
printf("Usage: %s [options]\n", g.zArgv0);
|
||||
printf(
|
||||
"Read SQL text from standard input and evaluate it.\n"
|
||||
"Options:\n"
|
||||
" -f FILE Read SQL text from FILE instead of standard input\n"
|
||||
" --help Show this help text\n"
|
||||
" --initdb DBFILE Initialize the in-memory database using template DBFILE\n"
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
int main(int argc, char **argv){
|
||||
char *zIn = 0; /* Input text */
|
||||
int nAlloc = 0; /* Number of bytes allocated for zIn[] */
|
||||
int nIn = 0; /* Number of bytes of zIn[] used */
|
||||
size_t got; /* Bytes read from input */
|
||||
FILE *in = stdin; /* Where to read SQL text from */
|
||||
int rc = SQLITE_OK; /* Result codes from API functions */
|
||||
int i; /* Loop counter */
|
||||
sqlite3 *db; /* Open database */
|
||||
sqlite3 *dbInit; /* On-disk database used to initialize the in-memory db */
|
||||
const char *zInitDb = 0;/* Name of the initialization database file */
|
||||
char *zErrMsg = 0; /* Error message returned from sqlite3_exec() */
|
||||
|
||||
g.zArgv0 = argv[0];
|
||||
for(i=1; i<argc; i++){
|
||||
const char *z = argv[i];
|
||||
if( z[0]=='-' ){
|
||||
z++;
|
||||
if( z[0]=='-' ) z++;
|
||||
if( strcmp(z,"help")==0 ){
|
||||
showHelp();
|
||||
return 0;
|
||||
}else
|
||||
if( strcmp(z, "f")==0 && i+1<argc ){
|
||||
if( in!=stdin ) abendError("only one -f allowed");
|
||||
in = fopen(argv[++i],"rb");
|
||||
if( in==0 ) abendError("cannot open input file \"%s\"", argv[i]);
|
||||
}else
|
||||
if( strcmp(z, "initdb")==0 && i+1<argc ){
|
||||
if( zInitDb!=0 ) abendError("only one --initdb allowed");
|
||||
zInitDb = argv[++i];
|
||||
}else
|
||||
{
|
||||
abendError("unknown option: %s", argv[i]);
|
||||
}
|
||||
}else{
|
||||
abendError("unknown argument: %s", argv[i]);
|
||||
}
|
||||
}
|
||||
sqlite3_config(SQLITE_CONFIG_LOG, shellLog, 0);
|
||||
rc = sqlite3_open_v2(
|
||||
"main.db", &db,
|
||||
SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY,
|
||||
0);
|
||||
if( rc!=SQLITE_OK ){
|
||||
abendError("Unable to open the in-memory database");
|
||||
}
|
||||
if( zInitDb ){
|
||||
sqlite3_backup *pBackup;
|
||||
rc = sqlite3_open_v2(zInitDb, &dbInit, SQLITE_OPEN_READONLY, 0);
|
||||
if( rc!=SQLITE_OK ){
|
||||
abendError("unable to open initialization database \"%s\"", zInitDb);
|
||||
}
|
||||
pBackup = sqlite3_backup_init(db, "main", dbInit, "main");
|
||||
rc = sqlite3_backup_step(pBackup, -1);
|
||||
if( rc!=SQLITE_DONE ){
|
||||
abendError("attempt to initialize the in-memory database failed (rc=%d)",rc);
|
||||
}
|
||||
sqlite3_backup_finish(pBackup);
|
||||
sqlite3_close(dbInit);
|
||||
}
|
||||
sqlite3_trace(db, traceCallback, 0);
|
||||
sqlite3_create_function(db, "eval", 1, SQLITE_UTF8, 0, sqlEvalFunc, 0, 0);
|
||||
sqlite3_create_function(db, "eval", 2, SQLITE_UTF8, 0, sqlEvalFunc, 0, 0);
|
||||
while( !feof(in) ){
|
||||
nAlloc += 1000;
|
||||
zIn = sqlite3_realloc(zIn, nAlloc);
|
||||
if( zIn==0 ) fatalError("out of memory");
|
||||
got = fread(zIn+nIn, 1, nAlloc-nIn-1, in);
|
||||
nIn += (int)got;
|
||||
zIn[nIn] = 0;
|
||||
if( got==0 ) break;
|
||||
}
|
||||
printf("INPUT (%d bytes): [%s]\n", nIn, zIn);
|
||||
rc = sqlite3_exec(db, zIn, execCallback, 0, &zErrMsg);
|
||||
printf("RESULT-CODE: %d\n", rc);
|
||||
if( zErrMsg ){
|
||||
printf("ERROR-MSG: [%s]\n", zErrMsg);
|
||||
sqlite3_free(zErrMsg);
|
||||
}
|
||||
return rc!=SQLITE_OK;
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user