OLD | NEW |
(Empty) | |
| 1 /* |
| 2 ** 2015-04-17 |
| 3 ** |
| 4 ** The author disclaims copyright to this source code. In place of |
| 5 ** a legal notice, here is a blessing: |
| 6 ** |
| 7 ** May you do good and not evil. |
| 8 ** May you find forgiveness for yourself and forgive others. |
| 9 ** May you share freely, never taking more than you give. |
| 10 ** |
| 11 ************************************************************************* |
| 12 ** |
| 13 ** This is a utility program designed to aid running the SQLite library |
| 14 ** against an external fuzzer, such as American Fuzzy Lop (AFL) |
| 15 ** (http://lcamtuf.coredump.cx/afl/). Basically, this program reads |
| 16 ** SQL text from standard input and passes it through to SQLite for evaluation, |
| 17 ** just like the "sqlite3" command-line shell. Differences from the |
| 18 ** command-line shell: |
| 19 ** |
| 20 ** (1) The complex "dot-command" extensions are omitted. This |
| 21 ** prevents the fuzzer from discovering that it can run things |
| 22 ** like ".shell rm -rf ~" |
| 23 ** |
| 24 ** (2) The database is opened with the SQLITE_OPEN_MEMORY flag so that |
| 25 ** no disk I/O from the database is permitted. The ATTACH command |
| 26 ** with a filename still uses an in-memory database. |
| 27 ** |
| 28 ** (3) The main in-memory database can be initialized from a template |
| 29 ** disk database so that the fuzzer starts with a database containing |
| 30 ** content. |
| 31 ** |
| 32 ** (4) The eval() SQL function is added, allowing the fuzzer to do |
| 33 ** interesting recursive operations. |
| 34 ** |
| 35 ** (5) An error is raised if there is a memory leak. |
| 36 ** |
| 37 ** The input text can be divided into separate test cases using comments |
| 38 ** of the form: |
| 39 ** |
| 40 ** |****<...>****| |
| 41 ** |
| 42 ** where the "..." is arbitrary text. (Except the "|" should really be "/". |
| 43 ** "|" is used here to avoid compiler errors about nested comments.) |
| 44 ** A separate in-memory SQLite database is created to run each test case. |
| 45 ** This feature allows the "queue" of AFL to be captured into a single big |
| 46 ** file using a command like this: |
| 47 ** |
| 48 ** (for i in id:*; do echo '|****<'$i'>****|'; cat $i; done) >~/all-queue.txt |
| 49 ** |
| 50 ** (Once again, change the "|" to "/") Then all elements of the AFL queue |
| 51 ** can be run in a single go (for regression testing, for example) by typing: |
| 52 ** |
| 53 ** fuzzershell -f ~/all-queue.txt |
| 54 ** |
| 55 ** After running each chunk of SQL, the database connection is closed. The |
| 56 ** program aborts if the close fails or if there is any unfreed memory after |
| 57 ** the close. |
| 58 ** |
| 59 ** New test cases can be appended to all-queue.txt at any time. If redundant |
| 60 ** test cases are added, they can be eliminated by running: |
| 61 ** |
| 62 ** fuzzershell -f ~/all-queue.txt --unique-cases ~/unique-cases.txt |
| 63 */ |
| 64 #include <stdio.h> |
| 65 #include <stdlib.h> |
| 66 #include <string.h> |
| 67 #include <stdarg.h> |
| 68 #include <ctype.h> |
| 69 #include "sqlite3.h" |
| 70 #define ISDIGIT(X) isdigit((unsigned char)(X)) |
| 71 |
| 72 /* |
| 73 ** All global variables are gathered into the "g" singleton. |
| 74 */ |
| 75 struct GlobalVars { |
| 76 const char *zArgv0; /* Name of program */ |
| 77 sqlite3_mem_methods sOrigMem; /* Original memory methods */ |
| 78 sqlite3_mem_methods sOomMem; /* Memory methods with OOM simulator */ |
| 79 int iOomCntdown; /* Memory fails on 1 to 0 transition */ |
| 80 int nOomFault; /* Increments for each OOM fault */ |
| 81 int bOomOnce; /* Fail just once if true */ |
| 82 int bOomEnable; /* True to enable OOM simulation */ |
| 83 int nOomBrkpt; /* Number of calls to oomFault() */ |
| 84 char zTestName[100]; /* Name of current test */ |
| 85 } g; |
| 86 |
| 87 /* |
| 88 ** Maximum number of iterations for an OOM test |
| 89 */ |
| 90 #ifndef OOM_MAX |
| 91 # define OOM_MAX 625 |
| 92 #endif |
| 93 |
| 94 /* |
| 95 ** This routine is called when a simulated OOM occurs. It exists as a |
| 96 ** convenient place to set a debugger breakpoint. |
| 97 */ |
| 98 static void oomFault(void){ |
| 99 g.nOomBrkpt++; /* Prevent oomFault() from being optimized out */ |
| 100 } |
| 101 |
| 102 |
| 103 /* Versions of malloc() and realloc() that simulate OOM conditions */ |
| 104 static void *oomMalloc(int nByte){ |
| 105 if( nByte>0 && g.bOomEnable && g.iOomCntdown>0 ){ |
| 106 g.iOomCntdown--; |
| 107 if( g.iOomCntdown==0 ){ |
| 108 if( g.nOomFault==0 ) oomFault(); |
| 109 g.nOomFault++; |
| 110 if( !g.bOomOnce ) g.iOomCntdown = 1; |
| 111 return 0; |
| 112 } |
| 113 } |
| 114 return g.sOrigMem.xMalloc(nByte); |
| 115 } |
| 116 static void *oomRealloc(void *pOld, int nByte){ |
| 117 if( nByte>0 && g.bOomEnable && g.iOomCntdown>0 ){ |
| 118 g.iOomCntdown--; |
| 119 if( g.iOomCntdown==0 ){ |
| 120 if( g.nOomFault==0 ) oomFault(); |
| 121 g.nOomFault++; |
| 122 if( !g.bOomOnce ) g.iOomCntdown = 1; |
| 123 return 0; |
| 124 } |
| 125 } |
| 126 return g.sOrigMem.xRealloc(pOld, nByte); |
| 127 } |
| 128 |
| 129 /* |
| 130 ** Print an error message and abort in such a way to indicate to the |
| 131 ** fuzzer that this counts as a crash. |
| 132 */ |
| 133 static void abendError(const char *zFormat, ...){ |
| 134 va_list ap; |
| 135 if( g.zTestName[0] ){ |
| 136 fprintf(stderr, "%s (%s): ", g.zArgv0, g.zTestName); |
| 137 }else{ |
| 138 fprintf(stderr, "%s: ", g.zArgv0); |
| 139 } |
| 140 va_start(ap, zFormat); |
| 141 vfprintf(stderr, zFormat, ap); |
| 142 va_end(ap); |
| 143 fprintf(stderr, "\n"); |
| 144 abort(); |
| 145 } |
| 146 /* |
| 147 ** Print an error message and quit, but not in a way that would look |
| 148 ** like a crash. |
| 149 */ |
| 150 static void fatalError(const char *zFormat, ...){ |
| 151 va_list ap; |
| 152 if( g.zTestName[0] ){ |
| 153 fprintf(stderr, "%s (%s): ", g.zArgv0, g.zTestName); |
| 154 }else{ |
| 155 fprintf(stderr, "%s: ", g.zArgv0); |
| 156 } |
| 157 va_start(ap, zFormat); |
| 158 vfprintf(stderr, zFormat, ap); |
| 159 va_end(ap); |
| 160 fprintf(stderr, "\n"); |
| 161 exit(1); |
| 162 } |
| 163 |
| 164 /* |
| 165 ** Evaluate some SQL. Abort if unable. |
| 166 */ |
| 167 static void sqlexec(sqlite3 *db, const char *zFormat, ...){ |
| 168 va_list ap; |
| 169 char *zSql; |
| 170 char *zErrMsg = 0; |
| 171 int rc; |
| 172 va_start(ap, zFormat); |
| 173 zSql = sqlite3_vmprintf(zFormat, ap); |
| 174 va_end(ap); |
| 175 rc = sqlite3_exec(db, zSql, 0, 0, &zErrMsg); |
| 176 if( rc ) abendError("failed sql [%s]: %s", zSql, zErrMsg); |
| 177 sqlite3_free(zSql); |
| 178 } |
| 179 |
| 180 /* |
| 181 ** This callback is invoked by sqlite3_log(). |
| 182 */ |
| 183 static void shellLog(void *pNotUsed, int iErrCode, const char *zMsg){ |
| 184 printf("LOG: (%d) %s\n", iErrCode, zMsg); |
| 185 fflush(stdout); |
| 186 } |
| 187 static void shellLogNoop(void *pNotUsed, int iErrCode, const char *zMsg){ |
| 188 return; |
| 189 } |
| 190 |
| 191 /* |
| 192 ** This callback is invoked by sqlite3_exec() to return query results. |
| 193 */ |
| 194 static int execCallback(void *NotUsed, int argc, char **argv, char **colv){ |
| 195 int i; |
| 196 static unsigned cnt = 0; |
| 197 printf("ROW #%u:\n", ++cnt); |
| 198 if( argv ){ |
| 199 for(i=0; i<argc; i++){ |
| 200 printf(" %s=", colv[i]); |
| 201 if( argv[i] ){ |
| 202 printf("[%s]\n", argv[i]); |
| 203 }else{ |
| 204 printf("NULL\n"); |
| 205 } |
| 206 } |
| 207 } |
| 208 fflush(stdout); |
| 209 return 0; |
| 210 } |
| 211 static int execNoop(void *NotUsed, int argc, char **argv, char **colv){ |
| 212 return 0; |
| 213 } |
| 214 |
| 215 #ifndef SQLITE_OMIT_TRACE |
| 216 /* |
| 217 ** This callback is invoked by sqlite3_trace() as each SQL statement |
| 218 ** starts. |
| 219 */ |
| 220 static void traceCallback(void *NotUsed, const char *zMsg){ |
| 221 printf("TRACE: %s\n", zMsg); |
| 222 fflush(stdout); |
| 223 } |
| 224 static void traceNoop(void *NotUsed, const char *zMsg){ |
| 225 return; |
| 226 } |
| 227 #endif |
| 228 |
| 229 /*************************************************************************** |
| 230 ** String accumulator object |
| 231 */ |
| 232 typedef struct Str Str; |
| 233 struct Str { |
| 234 char *z; /* The string. Memory from malloc() */ |
| 235 sqlite3_uint64 n; /* Bytes of input used */ |
| 236 sqlite3_uint64 nAlloc; /* Bytes allocated to z[] */ |
| 237 int oomErr; /* OOM error has been seen */ |
| 238 }; |
| 239 |
| 240 /* Initialize a Str object */ |
| 241 static void StrInit(Str *p){ |
| 242 memset(p, 0, sizeof(*p)); |
| 243 } |
| 244 |
| 245 /* Append text to the end of a Str object */ |
| 246 static void StrAppend(Str *p, const char *z){ |
| 247 sqlite3_uint64 n = strlen(z); |
| 248 if( p->n + n >= p->nAlloc ){ |
| 249 char *zNew; |
| 250 sqlite3_uint64 nNew; |
| 251 if( p->oomErr ) return; |
| 252 nNew = p->nAlloc*2 + 100 + n; |
| 253 zNew = sqlite3_realloc(p->z, nNew); |
| 254 if( zNew==0 ){ |
| 255 sqlite3_free(p->z); |
| 256 memset(p, 0, sizeof(*p)); |
| 257 p->oomErr = 1; |
| 258 return; |
| 259 } |
| 260 p->z = zNew; |
| 261 p->nAlloc = nNew; |
| 262 } |
| 263 memcpy(p->z + p->n, z, n); |
| 264 p->n += n; |
| 265 p->z[p->n] = 0; |
| 266 } |
| 267 |
| 268 /* Return the current string content */ |
| 269 static char *StrStr(Str *p){ |
| 270 return p->z; |
| 271 } |
| 272 |
| 273 /* Free the string */ |
| 274 static void StrFree(Str *p){ |
| 275 sqlite3_free(p->z); |
| 276 StrInit(p); |
| 277 } |
| 278 |
| 279 /*************************************************************************** |
| 280 ** eval() implementation copied from ../ext/misc/eval.c |
| 281 */ |
| 282 /* |
| 283 ** Structure used to accumulate the output |
| 284 */ |
| 285 struct EvalResult { |
| 286 char *z; /* Accumulated output */ |
| 287 const char *zSep; /* Separator */ |
| 288 int szSep; /* Size of the separator string */ |
| 289 sqlite3_int64 nAlloc; /* Number of bytes allocated for z[] */ |
| 290 sqlite3_int64 nUsed; /* Number of bytes of z[] actually used */ |
| 291 }; |
| 292 |
| 293 /* |
| 294 ** Callback from sqlite_exec() for the eval() function. |
| 295 */ |
| 296 static int callback(void *pCtx, int argc, char **argv, char **colnames){ |
| 297 struct EvalResult *p = (struct EvalResult*)pCtx; |
| 298 int i; |
| 299 for(i=0; i<argc; i++){ |
| 300 const char *z = argv[i] ? argv[i] : ""; |
| 301 size_t sz = strlen(z); |
| 302 if( (sqlite3_int64)sz+p->nUsed+p->szSep+1 > p->nAlloc ){ |
| 303 char *zNew; |
| 304 p->nAlloc = p->nAlloc*2 + sz + p->szSep + 1; |
| 305 /* Using sqlite3_realloc64() would be better, but it is a recent |
| 306 ** addition and will cause a segfault if loaded by an older version |
| 307 ** of SQLite. */ |
| 308 zNew = p->nAlloc<=0x7fffffff ? sqlite3_realloc(p->z, (int)p->nAlloc) : 0; |
| 309 if( zNew==0 ){ |
| 310 sqlite3_free(p->z); |
| 311 memset(p, 0, sizeof(*p)); |
| 312 return 1; |
| 313 } |
| 314 p->z = zNew; |
| 315 } |
| 316 if( p->nUsed>0 ){ |
| 317 memcpy(&p->z[p->nUsed], p->zSep, p->szSep); |
| 318 p->nUsed += p->szSep; |
| 319 } |
| 320 memcpy(&p->z[p->nUsed], z, sz); |
| 321 p->nUsed += sz; |
| 322 } |
| 323 return 0; |
| 324 } |
| 325 |
| 326 /* |
| 327 ** Implementation of the eval(X) and eval(X,Y) SQL functions. |
| 328 ** |
| 329 ** Evaluate the SQL text in X. Return the results, using string |
| 330 ** Y as the separator. If Y is omitted, use a single space character. |
| 331 */ |
| 332 static void sqlEvalFunc( |
| 333 sqlite3_context *context, |
| 334 int argc, |
| 335 sqlite3_value **argv |
| 336 ){ |
| 337 const char *zSql; |
| 338 sqlite3 *db; |
| 339 char *zErr = 0; |
| 340 int rc; |
| 341 struct EvalResult x; |
| 342 |
| 343 memset(&x, 0, sizeof(x)); |
| 344 x.zSep = " "; |
| 345 zSql = (const char*)sqlite3_value_text(argv[0]); |
| 346 if( zSql==0 ) return; |
| 347 if( argc>1 ){ |
| 348 x.zSep = (const char*)sqlite3_value_text(argv[1]); |
| 349 if( x.zSep==0 ) return; |
| 350 } |
| 351 x.szSep = (int)strlen(x.zSep); |
| 352 db = sqlite3_context_db_handle(context); |
| 353 rc = sqlite3_exec(db, zSql, callback, &x, &zErr); |
| 354 if( rc!=SQLITE_OK ){ |
| 355 sqlite3_result_error(context, zErr, -1); |
| 356 sqlite3_free(zErr); |
| 357 }else if( x.zSep==0 ){ |
| 358 sqlite3_result_error_nomem(context); |
| 359 sqlite3_free(x.z); |
| 360 }else{ |
| 361 sqlite3_result_text(context, x.z, (int)x.nUsed, sqlite3_free); |
| 362 } |
| 363 } |
| 364 /* End of the eval() implementation |
| 365 ******************************************************************************/ |
| 366 |
| 367 /****************************************************************************** |
| 368 ** The generate_series(START,END,STEP) eponymous table-valued function. |
| 369 ** |
| 370 ** This code is copy/pasted from ext/misc/series.c in the SQLite source tree. |
| 371 */ |
| 372 /* series_cursor is a subclass of sqlite3_vtab_cursor which will |
| 373 ** serve as the underlying representation of a cursor that scans |
| 374 ** over rows of the result |
| 375 */ |
| 376 typedef struct series_cursor series_cursor; |
| 377 struct series_cursor { |
| 378 sqlite3_vtab_cursor base; /* Base class - must be first */ |
| 379 int isDesc; /* True to count down rather than up */ |
| 380 sqlite3_int64 iRowid; /* The rowid */ |
| 381 sqlite3_int64 iValue; /* Current value ("value") */ |
| 382 sqlite3_int64 mnValue; /* Mimimum value ("start") */ |
| 383 sqlite3_int64 mxValue; /* Maximum value ("stop") */ |
| 384 sqlite3_int64 iStep; /* Increment ("step") */ |
| 385 }; |
| 386 |
| 387 /* |
| 388 ** The seriesConnect() method is invoked to create a new |
| 389 ** series_vtab that describes the generate_series virtual table. |
| 390 ** |
| 391 ** Think of this routine as the constructor for series_vtab objects. |
| 392 ** |
| 393 ** All this routine needs to do is: |
| 394 ** |
| 395 ** (1) Allocate the series_vtab object and initialize all fields. |
| 396 ** |
| 397 ** (2) Tell SQLite (via the sqlite3_declare_vtab() interface) what the |
| 398 ** result set of queries against generate_series will look like. |
| 399 */ |
| 400 static int seriesConnect( |
| 401 sqlite3 *db, |
| 402 void *pAux, |
| 403 int argc, const char *const*argv, |
| 404 sqlite3_vtab **ppVtab, |
| 405 char **pzErr |
| 406 ){ |
| 407 sqlite3_vtab *pNew; |
| 408 int rc; |
| 409 |
| 410 /* Column numbers */ |
| 411 #define SERIES_COLUMN_VALUE 0 |
| 412 #define SERIES_COLUMN_START 1 |
| 413 #define SERIES_COLUMN_STOP 2 |
| 414 #define SERIES_COLUMN_STEP 3 |
| 415 |
| 416 rc = sqlite3_declare_vtab(db, |
| 417 "CREATE TABLE x(value,start hidden,stop hidden,step hidden)"); |
| 418 if( rc==SQLITE_OK ){ |
| 419 pNew = *ppVtab = sqlite3_malloc( sizeof(*pNew) ); |
| 420 if( pNew==0 ) return SQLITE_NOMEM; |
| 421 memset(pNew, 0, sizeof(*pNew)); |
| 422 } |
| 423 return rc; |
| 424 } |
| 425 |
| 426 /* |
| 427 ** This method is the destructor for series_cursor objects. |
| 428 */ |
| 429 static int seriesDisconnect(sqlite3_vtab *pVtab){ |
| 430 sqlite3_free(pVtab); |
| 431 return SQLITE_OK; |
| 432 } |
| 433 |
| 434 /* |
| 435 ** Constructor for a new series_cursor object. |
| 436 */ |
| 437 static int seriesOpen(sqlite3_vtab *p, sqlite3_vtab_cursor **ppCursor){ |
| 438 series_cursor *pCur; |
| 439 pCur = sqlite3_malloc( sizeof(*pCur) ); |
| 440 if( pCur==0 ) return SQLITE_NOMEM; |
| 441 memset(pCur, 0, sizeof(*pCur)); |
| 442 *ppCursor = &pCur->base; |
| 443 return SQLITE_OK; |
| 444 } |
| 445 |
| 446 /* |
| 447 ** Destructor for a series_cursor. |
| 448 */ |
| 449 static int seriesClose(sqlite3_vtab_cursor *cur){ |
| 450 sqlite3_free(cur); |
| 451 return SQLITE_OK; |
| 452 } |
| 453 |
| 454 |
| 455 /* |
| 456 ** Advance a series_cursor to its next row of output. |
| 457 */ |
| 458 static int seriesNext(sqlite3_vtab_cursor *cur){ |
| 459 series_cursor *pCur = (series_cursor*)cur; |
| 460 if( pCur->isDesc ){ |
| 461 pCur->iValue -= pCur->iStep; |
| 462 }else{ |
| 463 pCur->iValue += pCur->iStep; |
| 464 } |
| 465 pCur->iRowid++; |
| 466 return SQLITE_OK; |
| 467 } |
| 468 |
| 469 /* |
| 470 ** Return values of columns for the row at which the series_cursor |
| 471 ** is currently pointing. |
| 472 */ |
| 473 static int seriesColumn( |
| 474 sqlite3_vtab_cursor *cur, /* The cursor */ |
| 475 sqlite3_context *ctx, /* First argument to sqlite3_result_...() */ |
| 476 int i /* Which column to return */ |
| 477 ){ |
| 478 series_cursor *pCur = (series_cursor*)cur; |
| 479 sqlite3_int64 x = 0; |
| 480 switch( i ){ |
| 481 case SERIES_COLUMN_START: x = pCur->mnValue; break; |
| 482 case SERIES_COLUMN_STOP: x = pCur->mxValue; break; |
| 483 case SERIES_COLUMN_STEP: x = pCur->iStep; break; |
| 484 default: x = pCur->iValue; break; |
| 485 } |
| 486 sqlite3_result_int64(ctx, x); |
| 487 return SQLITE_OK; |
| 488 } |
| 489 |
| 490 /* |
| 491 ** Return the rowid for the current row. In this implementation, the |
| 492 ** rowid is the same as the output value. |
| 493 */ |
| 494 static int seriesRowid(sqlite3_vtab_cursor *cur, sqlite_int64 *pRowid){ |
| 495 series_cursor *pCur = (series_cursor*)cur; |
| 496 *pRowid = pCur->iRowid; |
| 497 return SQLITE_OK; |
| 498 } |
| 499 |
| 500 /* |
| 501 ** Return TRUE if the cursor has been moved off of the last |
| 502 ** row of output. |
| 503 */ |
| 504 static int seriesEof(sqlite3_vtab_cursor *cur){ |
| 505 series_cursor *pCur = (series_cursor*)cur; |
| 506 if( pCur->isDesc ){ |
| 507 return pCur->iValue < pCur->mnValue; |
| 508 }else{ |
| 509 return pCur->iValue > pCur->mxValue; |
| 510 } |
| 511 } |
| 512 |
| 513 /* True to cause run-time checking of the start=, stop=, and/or step= |
| 514 ** parameters. The only reason to do this is for testing the |
| 515 ** constraint checking logic for virtual tables in the SQLite core. |
| 516 */ |
| 517 #ifndef SQLITE_SERIES_CONSTRAINT_VERIFY |
| 518 # define SQLITE_SERIES_CONSTRAINT_VERIFY 0 |
| 519 #endif |
| 520 |
| 521 /* |
| 522 ** This method is called to "rewind" the series_cursor object back |
| 523 ** to the first row of output. This method is always called at least |
| 524 ** once prior to any call to seriesColumn() or seriesRowid() or |
| 525 ** seriesEof(). |
| 526 ** |
| 527 ** The query plan selected by seriesBestIndex is passed in the idxNum |
| 528 ** parameter. (idxStr is not used in this implementation.) idxNum |
| 529 ** is a bitmask showing which constraints are available: |
| 530 ** |
| 531 ** 1: start=VALUE |
| 532 ** 2: stop=VALUE |
| 533 ** 4: step=VALUE |
| 534 ** |
| 535 ** Also, if bit 8 is set, that means that the series should be output |
| 536 ** in descending order rather than in ascending order. |
| 537 ** |
| 538 ** This routine should initialize the cursor and position it so that it |
| 539 ** is pointing at the first row, or pointing off the end of the table |
| 540 ** (so that seriesEof() will return true) if the table is empty. |
| 541 */ |
| 542 static int seriesFilter( |
| 543 sqlite3_vtab_cursor *pVtabCursor, |
| 544 int idxNum, const char *idxStr, |
| 545 int argc, sqlite3_value **argv |
| 546 ){ |
| 547 series_cursor *pCur = (series_cursor *)pVtabCursor; |
| 548 int i = 0; |
| 549 if( idxNum & 1 ){ |
| 550 pCur->mnValue = sqlite3_value_int64(argv[i++]); |
| 551 }else{ |
| 552 pCur->mnValue = 0; |
| 553 } |
| 554 if( idxNum & 2 ){ |
| 555 pCur->mxValue = sqlite3_value_int64(argv[i++]); |
| 556 }else{ |
| 557 pCur->mxValue = 0xffffffff; |
| 558 } |
| 559 if( idxNum & 4 ){ |
| 560 pCur->iStep = sqlite3_value_int64(argv[i++]); |
| 561 if( pCur->iStep<1 ) pCur->iStep = 1; |
| 562 }else{ |
| 563 pCur->iStep = 1; |
| 564 } |
| 565 if( idxNum & 8 ){ |
| 566 pCur->isDesc = 1; |
| 567 pCur->iValue = pCur->mxValue; |
| 568 if( pCur->iStep>0 ){ |
| 569 pCur->iValue -= (pCur->mxValue - pCur->mnValue)%pCur->iStep; |
| 570 } |
| 571 }else{ |
| 572 pCur->isDesc = 0; |
| 573 pCur->iValue = pCur->mnValue; |
| 574 } |
| 575 pCur->iRowid = 1; |
| 576 return SQLITE_OK; |
| 577 } |
| 578 |
| 579 /* |
| 580 ** SQLite will invoke this method one or more times while planning a query |
| 581 ** that uses the generate_series virtual table. This routine needs to create |
| 582 ** a query plan for each invocation and compute an estimated cost for that |
| 583 ** plan. |
| 584 ** |
| 585 ** In this implementation idxNum is used to represent the |
| 586 ** query plan. idxStr is unused. |
| 587 ** |
| 588 ** The query plan is represented by bits in idxNum: |
| 589 ** |
| 590 ** (1) start = $value -- constraint exists |
| 591 ** (2) stop = $value -- constraint exists |
| 592 ** (4) step = $value -- constraint exists |
| 593 ** (8) output in descending order |
| 594 */ |
| 595 static int seriesBestIndex( |
| 596 sqlite3_vtab *tab, |
| 597 sqlite3_index_info *pIdxInfo |
| 598 ){ |
| 599 int i; /* Loop over constraints */ |
| 600 int idxNum = 0; /* The query plan bitmask */ |
| 601 int startIdx = -1; /* Index of the start= constraint, or -1 if none */ |
| 602 int stopIdx = -1; /* Index of the stop= constraint, or -1 if none */ |
| 603 int stepIdx = -1; /* Index of the step= constraint, or -1 if none */ |
| 604 int nArg = 0; /* Number of arguments that seriesFilter() expects */ |
| 605 |
| 606 const struct sqlite3_index_constraint *pConstraint; |
| 607 pConstraint = pIdxInfo->aConstraint; |
| 608 for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){ |
| 609 if( pConstraint->usable==0 ) continue; |
| 610 if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue; |
| 611 switch( pConstraint->iColumn ){ |
| 612 case SERIES_COLUMN_START: |
| 613 startIdx = i; |
| 614 idxNum |= 1; |
| 615 break; |
| 616 case SERIES_COLUMN_STOP: |
| 617 stopIdx = i; |
| 618 idxNum |= 2; |
| 619 break; |
| 620 case SERIES_COLUMN_STEP: |
| 621 stepIdx = i; |
| 622 idxNum |= 4; |
| 623 break; |
| 624 } |
| 625 } |
| 626 if( startIdx>=0 ){ |
| 627 pIdxInfo->aConstraintUsage[startIdx].argvIndex = ++nArg; |
| 628 pIdxInfo->aConstraintUsage[startIdx].omit= !SQLITE_SERIES_CONSTRAINT_VERIFY; |
| 629 } |
| 630 if( stopIdx>=0 ){ |
| 631 pIdxInfo->aConstraintUsage[stopIdx].argvIndex = ++nArg; |
| 632 pIdxInfo->aConstraintUsage[stopIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY; |
| 633 } |
| 634 if( stepIdx>=0 ){ |
| 635 pIdxInfo->aConstraintUsage[stepIdx].argvIndex = ++nArg; |
| 636 pIdxInfo->aConstraintUsage[stepIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY; |
| 637 } |
| 638 if( (idxNum & 3)==3 ){ |
| 639 /* Both start= and stop= boundaries are available. This is the |
| 640 ** the preferred case */ |
| 641 pIdxInfo->estimatedCost = (double)(2 - ((idxNum&4)!=0)); |
| 642 pIdxInfo->estimatedRows = 1000; |
| 643 if( pIdxInfo->nOrderBy==1 ){ |
| 644 if( pIdxInfo->aOrderBy[0].desc ) idxNum |= 8; |
| 645 pIdxInfo->orderByConsumed = 1; |
| 646 } |
| 647 }else{ |
| 648 /* If either boundary is missing, we have to generate a huge span |
| 649 ** of numbers. Make this case very expensive so that the query |
| 650 ** planner will work hard to avoid it. */ |
| 651 pIdxInfo->estimatedCost = (double)2147483647; |
| 652 pIdxInfo->estimatedRows = 2147483647; |
| 653 } |
| 654 pIdxInfo->idxNum = idxNum; |
| 655 return SQLITE_OK; |
| 656 } |
| 657 |
| 658 /* |
| 659 ** This following structure defines all the methods for the |
| 660 ** generate_series virtual table. |
| 661 */ |
| 662 static sqlite3_module seriesModule = { |
| 663 0, /* iVersion */ |
| 664 0, /* xCreate */ |
| 665 seriesConnect, /* xConnect */ |
| 666 seriesBestIndex, /* xBestIndex */ |
| 667 seriesDisconnect, /* xDisconnect */ |
| 668 0, /* xDestroy */ |
| 669 seriesOpen, /* xOpen - open a cursor */ |
| 670 seriesClose, /* xClose - close a cursor */ |
| 671 seriesFilter, /* xFilter - configure scan constraints */ |
| 672 seriesNext, /* xNext - advance a cursor */ |
| 673 seriesEof, /* xEof - check for end of scan */ |
| 674 seriesColumn, /* xColumn - read data */ |
| 675 seriesRowid, /* xRowid - read data */ |
| 676 0, /* xUpdate */ |
| 677 0, /* xBegin */ |
| 678 0, /* xSync */ |
| 679 0, /* xCommit */ |
| 680 0, /* xRollback */ |
| 681 0, /* xFindMethod */ |
| 682 0, /* xRename */ |
| 683 }; |
| 684 /* END the generate_series(START,END,STEP) implementation |
| 685 ********************************************************************************
*/ |
| 686 |
| 687 /* |
| 688 ** Print sketchy documentation for this utility program |
| 689 */ |
| 690 static void showHelp(void){ |
| 691 printf("Usage: %s [options] ?FILE...?\n", g.zArgv0); |
| 692 printf( |
| 693 "Read SQL text from FILE... (or from standard input if FILE... is omitted)\n" |
| 694 "and then evaluate each block of SQL contained therein.\n" |
| 695 "Options:\n" |
| 696 " --autovacuum Enable AUTOVACUUM mode\n" |
| 697 " --database FILE Use database FILE instead of an in-memory database\n" |
| 698 " --disable-lookaside Turn off lookaside memory\n" |
| 699 " --heap SZ MIN Memory allocator uses SZ bytes & min allocation MIN\n" |
| 700 " --help Show this help text\n" |
| 701 " --lookaside N SZ Configure lookaside for N slots of SZ bytes each\n" |
| 702 " --oom Run each test multiple times in a simulated OOM loop\n" |
| 703 " --pagesize N Set the page size to N\n" |
| 704 " --pcache N SZ Configure N pages of pagecache each of size SZ bytes\n" |
| 705 " -q Reduced output\n" |
| 706 " --quiet Reduced output\n" |
| 707 " --scratch N SZ Configure scratch memory for N slots of SZ bytes each\n
" |
| 708 " --unique-cases FILE Write all unique test cases to FILE\n" |
| 709 " --utf16be Set text encoding to UTF-16BE\n" |
| 710 " --utf16le Set text encoding to UTF-16LE\n" |
| 711 " -v Increased output\n" |
| 712 " --verbose Increased output\n" |
| 713 ); |
| 714 } |
| 715 |
| 716 /* |
| 717 ** Return the value of a hexadecimal digit. Return -1 if the input |
| 718 ** is not a hex digit. |
| 719 */ |
| 720 static int hexDigitValue(char c){ |
| 721 if( c>='0' && c<='9' ) return c - '0'; |
| 722 if( c>='a' && c<='f' ) return c - 'a' + 10; |
| 723 if( c>='A' && c<='F' ) return c - 'A' + 10; |
| 724 return -1; |
| 725 } |
| 726 |
| 727 /* |
| 728 ** Interpret zArg as an integer value, possibly with suffixes. |
| 729 */ |
| 730 static int integerValue(const char *zArg){ |
| 731 sqlite3_int64 v = 0; |
| 732 static const struct { char *zSuffix; int iMult; } aMult[] = { |
| 733 { "KiB", 1024 }, |
| 734 { "MiB", 1024*1024 }, |
| 735 { "GiB", 1024*1024*1024 }, |
| 736 { "KB", 1000 }, |
| 737 { "MB", 1000000 }, |
| 738 { "GB", 1000000000 }, |
| 739 { "K", 1000 }, |
| 740 { "M", 1000000 }, |
| 741 { "G", 1000000000 }, |
| 742 }; |
| 743 int i; |
| 744 int isNeg = 0; |
| 745 if( zArg[0]=='-' ){ |
| 746 isNeg = 1; |
| 747 zArg++; |
| 748 }else if( zArg[0]=='+' ){ |
| 749 zArg++; |
| 750 } |
| 751 if( zArg[0]=='0' && zArg[1]=='x' ){ |
| 752 int x; |
| 753 zArg += 2; |
| 754 while( (x = hexDigitValue(zArg[0]))>=0 ){ |
| 755 v = (v<<4) + x; |
| 756 zArg++; |
| 757 } |
| 758 }else{ |
| 759 while( ISDIGIT(zArg[0]) ){ |
| 760 v = v*10 + zArg[0] - '0'; |
| 761 zArg++; |
| 762 } |
| 763 } |
| 764 for(i=0; i<sizeof(aMult)/sizeof(aMult[0]); i++){ |
| 765 if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){ |
| 766 v *= aMult[i].iMult; |
| 767 break; |
| 768 } |
| 769 } |
| 770 if( v>0x7fffffff ) abendError("parameter too large - max 2147483648"); |
| 771 return (int)(isNeg? -v : v); |
| 772 } |
| 773 |
| 774 /* Return the current wall-clock time */ |
| 775 static sqlite3_int64 timeOfDay(void){ |
| 776 static sqlite3_vfs *clockVfs = 0; |
| 777 sqlite3_int64 t; |
| 778 if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0); |
| 779 if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){ |
| 780 clockVfs->xCurrentTimeInt64(clockVfs, &t); |
| 781 }else{ |
| 782 double r; |
| 783 clockVfs->xCurrentTime(clockVfs, &r); |
| 784 t = (sqlite3_int64)(r*86400000.0); |
| 785 } |
| 786 return t; |
| 787 } |
| 788 |
| 789 int main(int argc, char **argv){ |
| 790 char *zIn = 0; /* Input text */ |
| 791 int nAlloc = 0; /* Number of bytes allocated for zIn[] */ |
| 792 int nIn = 0; /* Number of bytes of zIn[] used */ |
| 793 size_t got; /* Bytes read from input */ |
| 794 int rc = SQLITE_OK; /* Result codes from API functions */ |
| 795 int i; /* Loop counter */ |
| 796 int iNext; /* Next block of SQL */ |
| 797 sqlite3 *db; /* Open database */ |
| 798 char *zErrMsg = 0; /* Error message returned from sqlite3_exec() */ |
| 799 const char *zEncoding = 0; /* --utf16be or --utf16le */ |
| 800 int nHeap = 0, mnHeap = 0; /* Heap size from --heap */ |
| 801 int nLook = 0, szLook = 0; /* --lookaside configuration */ |
| 802 int nPCache = 0, szPCache = 0;/* --pcache configuration */ |
| 803 int nScratch = 0, szScratch=0;/* --scratch configuration */ |
| 804 int pageSize = 0; /* Desired page size. 0 means default */ |
| 805 void *pHeap = 0; /* Allocated heap space */ |
| 806 void *pLook = 0; /* Allocated lookaside space */ |
| 807 void *pPCache = 0; /* Allocated storage for pcache */ |
| 808 void *pScratch = 0; /* Allocated storage for scratch */ |
| 809 int doAutovac = 0; /* True for --autovacuum */ |
| 810 char *zSql; /* SQL to run */ |
| 811 char *zToFree = 0; /* Call sqlite3_free() on this afte running zSql
*/ |
| 812 int verboseFlag = 0; /* --verbose or -v flag */ |
| 813 int quietFlag = 0; /* --quiet or -q flag */ |
| 814 int nTest = 0; /* Number of test cases run */ |
| 815 int multiTest = 0; /* True if there will be multiple test cases */ |
| 816 int lastPct = -1; /* Previous percentage done output */ |
| 817 sqlite3 *dataDb = 0; /* Database holding compacted input data */ |
| 818 sqlite3_stmt *pStmt = 0; /* Statement to insert testcase into dataDb */ |
| 819 const char *zDataOut = 0; /* Write compacted data to this output file */ |
| 820 int nHeader = 0; /* Bytes of header comment text on input file */ |
| 821 int oomFlag = 0; /* --oom */ |
| 822 int oomCnt = 0; /* Counter for the OOM loop */ |
| 823 char zErrBuf[200]; /* Space for the error message */ |
| 824 const char *zFailCode; /* Value of the TEST_FAILURE environment var */ |
| 825 const char *zPrompt; /* Initial prompt when large-file fuzzing */ |
| 826 int nInFile = 0; /* Number of input files to read */ |
| 827 char **azInFile = 0; /* Array of input file names */ |
| 828 int jj; /* Loop counter for azInFile[] */ |
| 829 sqlite3_int64 iBegin; /* Start time for the whole program */ |
| 830 sqlite3_int64 iStart, iEnd; /* Start and end-times for a test case */ |
| 831 const char *zDbName = 0; /* Name of an on-disk database file to open */ |
| 832 |
| 833 iBegin = timeOfDay(); |
| 834 sqlite3_shutdown(); |
| 835 zFailCode = getenv("TEST_FAILURE"); |
| 836 g.zArgv0 = argv[0]; |
| 837 zPrompt = "<stdin>"; |
| 838 for(i=1; i<argc; i++){ |
| 839 const char *z = argv[i]; |
| 840 if( z[0]=='-' ){ |
| 841 z++; |
| 842 if( z[0]=='-' ) z++; |
| 843 if( strcmp(z,"autovacuum")==0 ){ |
| 844 doAutovac = 1; |
| 845 }else |
| 846 if( strcmp(z,"database")==0 ){ |
| 847 if( i>=argc-1 ) abendError("missing argument on %s\n", argv[i]); |
| 848 zDbName = argv[i+1]; |
| 849 i += 1; |
| 850 }else |
| 851 if( strcmp(z,"disable-lookaside")==0 ){ |
| 852 nLook = 1; |
| 853 szLook = 0; |
| 854 }else |
| 855 if( strcmp(z, "f")==0 && i+1<argc ){ |
| 856 i++; |
| 857 goto addNewInFile; |
| 858 }else |
| 859 if( strcmp(z,"heap")==0 ){ |
| 860 if( i>=argc-2 ) abendError("missing arguments on %s\n", argv[i]); |
| 861 nHeap = integerValue(argv[i+1]); |
| 862 mnHeap = integerValue(argv[i+2]); |
| 863 i += 2; |
| 864 }else |
| 865 if( strcmp(z,"help")==0 ){ |
| 866 showHelp(); |
| 867 return 0; |
| 868 }else |
| 869 if( strcmp(z,"lookaside")==0 ){ |
| 870 if( i>=argc-2 ) abendError("missing arguments on %s", argv[i]); |
| 871 nLook = integerValue(argv[i+1]); |
| 872 szLook = integerValue(argv[i+2]); |
| 873 i += 2; |
| 874 }else |
| 875 if( strcmp(z,"oom")==0 ){ |
| 876 oomFlag = 1; |
| 877 }else |
| 878 if( strcmp(z,"pagesize")==0 ){ |
| 879 if( i>=argc-1 ) abendError("missing argument on %s", argv[i]); |
| 880 pageSize = integerValue(argv[++i]); |
| 881 }else |
| 882 if( strcmp(z,"pcache")==0 ){ |
| 883 if( i>=argc-2 ) abendError("missing arguments on %s", argv[i]); |
| 884 nPCache = integerValue(argv[i+1]); |
| 885 szPCache = integerValue(argv[i+2]); |
| 886 i += 2; |
| 887 }else |
| 888 if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){ |
| 889 quietFlag = 1; |
| 890 verboseFlag = 0; |
| 891 }else |
| 892 if( strcmp(z,"scratch")==0 ){ |
| 893 if( i>=argc-2 ) abendError("missing arguments on %s", argv[i]); |
| 894 nScratch = integerValue(argv[i+1]); |
| 895 szScratch = integerValue(argv[i+2]); |
| 896 i += 2; |
| 897 }else |
| 898 if( strcmp(z, "unique-cases")==0 ){ |
| 899 if( i>=argc-1 ) abendError("missing arguments on %s", argv[i]); |
| 900 if( zDataOut ) abendError("only one --minimize allowed"); |
| 901 zDataOut = argv[++i]; |
| 902 }else |
| 903 if( strcmp(z,"utf16le")==0 ){ |
| 904 zEncoding = "utf16le"; |
| 905 }else |
| 906 if( strcmp(z,"utf16be")==0 ){ |
| 907 zEncoding = "utf16be"; |
| 908 }else |
| 909 if( strcmp(z,"verbose")==0 || strcmp(z,"v")==0 ){ |
| 910 quietFlag = 0; |
| 911 verboseFlag = 1; |
| 912 }else |
| 913 { |
| 914 abendError("unknown option: %s", argv[i]); |
| 915 } |
| 916 }else{ |
| 917 addNewInFile: |
| 918 nInFile++; |
| 919 azInFile = realloc(azInFile, sizeof(azInFile[0])*nInFile); |
| 920 if( azInFile==0 ) abendError("out of memory"); |
| 921 azInFile[nInFile-1] = argv[i]; |
| 922 } |
| 923 } |
| 924 |
| 925 /* Do global SQLite initialization */ |
| 926 sqlite3_config(SQLITE_CONFIG_LOG, verboseFlag ? shellLog : shellLogNoop, 0); |
| 927 if( nHeap>0 ){ |
| 928 pHeap = malloc( nHeap ); |
| 929 if( pHeap==0 ) fatalError("cannot allocate %d-byte heap\n", nHeap); |
| 930 rc = sqlite3_config(SQLITE_CONFIG_HEAP, pHeap, nHeap, mnHeap); |
| 931 if( rc ) abendError("heap configuration failed: %d\n", rc); |
| 932 } |
| 933 if( oomFlag ){ |
| 934 sqlite3_config(SQLITE_CONFIG_GETMALLOC, &g.sOrigMem); |
| 935 g.sOomMem = g.sOrigMem; |
| 936 g.sOomMem.xMalloc = oomMalloc; |
| 937 g.sOomMem.xRealloc = oomRealloc; |
| 938 sqlite3_config(SQLITE_CONFIG_MALLOC, &g.sOomMem); |
| 939 } |
| 940 if( nLook>0 ){ |
| 941 sqlite3_config(SQLITE_CONFIG_LOOKASIDE, 0, 0); |
| 942 if( szLook>0 ){ |
| 943 pLook = malloc( nLook*szLook ); |
| 944 if( pLook==0 ) fatalError("out of memory"); |
| 945 } |
| 946 } |
| 947 if( nScratch>0 && szScratch>0 ){ |
| 948 pScratch = malloc( nScratch*(sqlite3_int64)szScratch ); |
| 949 if( pScratch==0 ) fatalError("cannot allocate %lld-byte scratch", |
| 950 nScratch*(sqlite3_int64)szScratch); |
| 951 rc = sqlite3_config(SQLITE_CONFIG_SCRATCH, pScratch, szScratch, nScratch); |
| 952 if( rc ) abendError("scratch configuration failed: %d\n", rc); |
| 953 } |
| 954 if( nPCache>0 && szPCache>0 ){ |
| 955 pPCache = malloc( nPCache*(sqlite3_int64)szPCache ); |
| 956 if( pPCache==0 ) fatalError("cannot allocate %lld-byte pcache", |
| 957 nPCache*(sqlite3_int64)szPCache); |
| 958 rc = sqlite3_config(SQLITE_CONFIG_PAGECACHE, pPCache, szPCache, nPCache); |
| 959 if( rc ) abendError("pcache configuration failed: %d", rc); |
| 960 } |
| 961 |
| 962 /* If the --unique-cases option was supplied, open the database that will |
| 963 ** be used to gather unique test cases. |
| 964 */ |
| 965 if( zDataOut ){ |
| 966 rc = sqlite3_open(":memory:", &dataDb); |
| 967 if( rc ) abendError("cannot open :memory: database"); |
| 968 rc = sqlite3_exec(dataDb, |
| 969 "CREATE TABLE testcase(sql BLOB PRIMARY KEY, tm) WITHOUT ROWID;",0,0,0
); |
| 970 if( rc ) abendError("%s", sqlite3_errmsg(dataDb)); |
| 971 rc = sqlite3_prepare_v2(dataDb, |
| 972 "INSERT OR IGNORE INTO testcase(sql,tm)VALUES(?1,?2)", |
| 973 -1, &pStmt, 0); |
| 974 if( rc ) abendError("%s", sqlite3_errmsg(dataDb)); |
| 975 } |
| 976 |
| 977 /* Initialize the input buffer used to hold SQL text */ |
| 978 if( nInFile==0 ) nInFile = 1; |
| 979 nAlloc = 1000; |
| 980 zIn = malloc(nAlloc); |
| 981 if( zIn==0 ) fatalError("out of memory"); |
| 982 |
| 983 /* Loop over all input files */ |
| 984 for(jj=0; jj<nInFile; jj++){ |
| 985 |
| 986 /* Read the complete content of the next input file into zIn[] */ |
| 987 FILE *in; |
| 988 if( azInFile ){ |
| 989 int j, k; |
| 990 in = fopen(azInFile[jj],"rb"); |
| 991 if( in==0 ){ |
| 992 abendError("cannot open %s for reading", azInFile[jj]); |
| 993 } |
| 994 zPrompt = azInFile[jj]; |
| 995 for(j=k=0; zPrompt[j]; j++) if( zPrompt[j]=='/' ) k = j+1; |
| 996 zPrompt += k; |
| 997 }else{ |
| 998 in = stdin; |
| 999 zPrompt = "<stdin>"; |
| 1000 } |
| 1001 while( !feof(in) ){ |
| 1002 got = fread(zIn+nIn, 1, nAlloc-nIn-1, in); |
| 1003 nIn += (int)got; |
| 1004 zIn[nIn] = 0; |
| 1005 if( got==0 ) break; |
| 1006 if( nAlloc - nIn - 1 < 100 ){ |
| 1007 nAlloc += nAlloc+1000; |
| 1008 zIn = realloc(zIn, nAlloc); |
| 1009 if( zIn==0 ) fatalError("out of memory"); |
| 1010 } |
| 1011 } |
| 1012 if( in!=stdin ) fclose(in); |
| 1013 lastPct = -1; |
| 1014 |
| 1015 /* Skip initial lines of the input file that begin with "#" */ |
| 1016 for(i=0; i<nIn; i=iNext+1){ |
| 1017 if( zIn[i]!='#' ) break; |
| 1018 for(iNext=i+1; iNext<nIn && zIn[iNext]!='\n'; iNext++){} |
| 1019 } |
| 1020 nHeader = i; |
| 1021 |
| 1022 /* Process all test cases contained within the input file. |
| 1023 */ |
| 1024 for(; i<nIn; i=iNext, nTest++, g.zTestName[0]=0){ |
| 1025 char cSaved; |
| 1026 if( strncmp(&zIn[i], "/****<",6)==0 ){ |
| 1027 char *z = strstr(&zIn[i], ">****/"); |
| 1028 if( z ){ |
| 1029 z += 6; |
| 1030 sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "%.*s", |
| 1031 (int)(z-&zIn[i]) - 12, &zIn[i+6]); |
| 1032 if( verboseFlag ){ |
| 1033 printf("%.*s\n", (int)(z-&zIn[i]), &zIn[i]); |
| 1034 fflush(stdout); |
| 1035 } |
| 1036 i += (int)(z-&zIn[i]); |
| 1037 multiTest = 1; |
| 1038 } |
| 1039 } |
| 1040 for(iNext=i; iNext<nIn && strncmp(&zIn[iNext],"/****<",6)!=0; iNext++){} |
| 1041 cSaved = zIn[iNext]; |
| 1042 zIn[iNext] = 0; |
| 1043 |
| 1044 |
| 1045 /* Print out the SQL of the next test case is --verbose is enabled |
| 1046 */ |
| 1047 zSql = &zIn[i]; |
| 1048 if( verboseFlag ){ |
| 1049 printf("INPUT (offset: %d, size: %d): [%s]\n", |
| 1050 i, (int)strlen(&zIn[i]), &zIn[i]); |
| 1051 }else if( multiTest && !quietFlag ){ |
| 1052 if( oomFlag ){ |
| 1053 printf("%s\n", g.zTestName); |
| 1054 }else{ |
| 1055 int pct = (10*iNext)/nIn; |
| 1056 if( pct!=lastPct ){ |
| 1057 if( lastPct<0 ) printf("%s:", zPrompt); |
| 1058 printf(" %d%%", pct*10); |
| 1059 lastPct = pct; |
| 1060 } |
| 1061 } |
| 1062 }else if( nInFile>1 ){ |
| 1063 printf("%s\n", zPrompt); |
| 1064 } |
| 1065 fflush(stdout); |
| 1066 |
| 1067 /* Run the next test case. Run it multiple times in --oom mode |
| 1068 */ |
| 1069 if( oomFlag ){ |
| 1070 oomCnt = g.iOomCntdown = 1; |
| 1071 g.nOomFault = 0; |
| 1072 g.bOomOnce = 1; |
| 1073 if( verboseFlag ){ |
| 1074 printf("Once.%d\n", oomCnt); |
| 1075 fflush(stdout); |
| 1076 } |
| 1077 }else{ |
| 1078 oomCnt = 0; |
| 1079 } |
| 1080 do{ |
| 1081 Str sql; |
| 1082 StrInit(&sql); |
| 1083 if( zDbName ){ |
| 1084 rc = sqlite3_open_v2(zDbName, &db, SQLITE_OPEN_READWRITE, 0); |
| 1085 if( rc!=SQLITE_OK ){ |
| 1086 abendError("Cannot open database file %s", zDbName); |
| 1087 } |
| 1088 }else{ |
| 1089 rc = sqlite3_open_v2( |
| 1090 "main.db", &db, |
| 1091 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, |
| 1092 0); |
| 1093 if( rc!=SQLITE_OK ){ |
| 1094 abendError("Unable to open the in-memory database"); |
| 1095 } |
| 1096 } |
| 1097 if( pLook ){ |
| 1098 rc = sqlite3_db_config(db, SQLITE_DBCONFIG_LOOKASIDE,pLook,szLook,nLoo
k); |
| 1099 if( rc!=SQLITE_OK ) abendError("lookaside configuration filed: %d", rc
); |
| 1100 } |
| 1101 #ifndef SQLITE_OMIT_TRACE |
| 1102 sqlite3_trace(db, verboseFlag ? traceCallback : traceNoop, 0); |
| 1103 #endif |
| 1104 sqlite3_create_function(db, "eval", 1, SQLITE_UTF8, 0, sqlEvalFunc, 0, 0
); |
| 1105 sqlite3_create_function(db, "eval", 2, SQLITE_UTF8, 0, sqlEvalFunc, 0, 0
); |
| 1106 sqlite3_create_module(db, "generate_series", &seriesModule, 0); |
| 1107 sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 1000000); |
| 1108 if( zEncoding ) sqlexec(db, "PRAGMA encoding=%s", zEncoding); |
| 1109 if( pageSize ) sqlexec(db, "PRAGMA pagesize=%d", pageSize); |
| 1110 if( doAutovac ) sqlexec(db, "PRAGMA auto_vacuum=FULL"); |
| 1111 iStart = timeOfDay(); |
| 1112 |
| 1113 /* If using an input database file and that database contains a table |
| 1114 ** named "autoexec" with a column "sql", then replace the input SQL |
| 1115 ** with the concatenated text of the autoexec table. In this way, |
| 1116 ** if the database file is the input being fuzzed, the SQL text is |
| 1117 ** fuzzed at the same time. */ |
| 1118 if( sqlite3_table_column_metadata(db,0,"autoexec","sql",0,0,0,0,0)==0 ){ |
| 1119 sqlite3_stmt *pStmt; |
| 1120 rc = sqlite3_prepare_v2(db, "SELECT sql FROM autoexec", -1, &pStmt, 0)
; |
| 1121 if( rc==SQLITE_OK ){ |
| 1122 while( sqlite3_step(pStmt)==SQLITE_ROW ){ |
| 1123 StrAppend(&sql, (const char*)sqlite3_column_text(pStmt, 0)); |
| 1124 StrAppend(&sql, "\n"); |
| 1125 } |
| 1126 } |
| 1127 sqlite3_finalize(pStmt); |
| 1128 zSql = StrStr(&sql); |
| 1129 } |
| 1130 |
| 1131 g.bOomEnable = 1; |
| 1132 if( verboseFlag ){ |
| 1133 zErrMsg = 0; |
| 1134 rc = sqlite3_exec(db, zSql, execCallback, 0, &zErrMsg); |
| 1135 if( zErrMsg ){ |
| 1136 sqlite3_snprintf(sizeof(zErrBuf),zErrBuf,"%z", zErrMsg); |
| 1137 zErrMsg = 0; |
| 1138 } |
| 1139 }else { |
| 1140 rc = sqlite3_exec(db, zSql, execNoop, 0, 0); |
| 1141 } |
| 1142 g.bOomEnable = 0; |
| 1143 iEnd = timeOfDay(); |
| 1144 StrFree(&sql); |
| 1145 rc = sqlite3_close(db); |
| 1146 if( rc ){ |
| 1147 abendError("sqlite3_close() failed with rc=%d", rc); |
| 1148 } |
| 1149 if( !zDataOut && sqlite3_memory_used()>0 ){ |
| 1150 abendError("memory in use after close: %lld bytes",sqlite3_memory_used
()); |
| 1151 } |
| 1152 if( oomFlag ){ |
| 1153 /* Limit the number of iterations of the OOM loop to OOM_MAX. If the |
| 1154 ** first pass (single failure) exceeds 2/3rds of OOM_MAX this skip the |
| 1155 ** second pass (continuous failure after first) completely. */ |
| 1156 if( g.nOomFault==0 || oomCnt>OOM_MAX ){ |
| 1157 if( g.bOomOnce && oomCnt<=(OOM_MAX*2/3) ){ |
| 1158 oomCnt = g.iOomCntdown = 1; |
| 1159 g.bOomOnce = 0; |
| 1160 }else{ |
| 1161 oomCnt = 0; |
| 1162 } |
| 1163 }else{ |
| 1164 g.iOomCntdown = ++oomCnt; |
| 1165 g.nOomFault = 0; |
| 1166 } |
| 1167 if( oomCnt ){ |
| 1168 if( verboseFlag ){ |
| 1169 printf("%s.%d\n", g.bOomOnce ? "Once" : "Multi", oomCnt); |
| 1170 fflush(stdout); |
| 1171 } |
| 1172 nTest++; |
| 1173 } |
| 1174 } |
| 1175 }while( oomCnt>0 ); |
| 1176 |
| 1177 /* Store unique test cases in the in the dataDb database if the |
| 1178 ** --unique-cases flag is present |
| 1179 */ |
| 1180 if( zDataOut ){ |
| 1181 sqlite3_bind_blob(pStmt, 1, &zIn[i], iNext-i, SQLITE_STATIC); |
| 1182 sqlite3_bind_int64(pStmt, 2, iEnd - iStart); |
| 1183 rc = sqlite3_step(pStmt); |
| 1184 if( rc!=SQLITE_DONE ) abendError("%s", sqlite3_errmsg(dataDb)); |
| 1185 sqlite3_reset(pStmt); |
| 1186 } |
| 1187 |
| 1188 /* Free the SQL from the current test case |
| 1189 */ |
| 1190 if( zToFree ){ |
| 1191 sqlite3_free(zToFree); |
| 1192 zToFree = 0; |
| 1193 } |
| 1194 zIn[iNext] = cSaved; |
| 1195 |
| 1196 /* Show test-case results in --verbose mode |
| 1197 */ |
| 1198 if( verboseFlag ){ |
| 1199 printf("RESULT-CODE: %d\n", rc); |
| 1200 if( zErrMsg ){ |
| 1201 printf("ERROR-MSG: [%s]\n", zErrBuf); |
| 1202 } |
| 1203 fflush(stdout); |
| 1204 } |
| 1205 |
| 1206 /* Simulate an error if the TEST_FAILURE environment variable is "5". |
| 1207 ** This is used to verify that automated test script really do spot |
| 1208 ** errors that occur in this test program. |
| 1209 */ |
| 1210 if( zFailCode ){ |
| 1211 if( zFailCode[0]=='5' && zFailCode[1]==0 ){ |
| 1212 abendError("simulated failure"); |
| 1213 }else if( zFailCode[0]!=0 ){ |
| 1214 /* If TEST_FAILURE is something other than 5, just exit the test |
| 1215 ** early */ |
| 1216 printf("\nExit early due to TEST_FAILURE being set"); |
| 1217 break; |
| 1218 } |
| 1219 } |
| 1220 } |
| 1221 if( !verboseFlag && multiTest && !quietFlag && !oomFlag ) printf("\n"); |
| 1222 } |
| 1223 |
| 1224 /* Report total number of tests run |
| 1225 */ |
| 1226 if( nTest>1 && !quietFlag ){ |
| 1227 sqlite3_int64 iElapse = timeOfDay() - iBegin; |
| 1228 printf("%s: 0 errors out of %d tests in %d.%03d seconds\nSQLite %s %s\n", |
| 1229 g.zArgv0, nTest, (int)(iElapse/1000), (int)(iElapse%1000), |
| 1230 sqlite3_libversion(), sqlite3_sourceid()); |
| 1231 } |
| 1232 |
| 1233 /* Write the unique test cases if the --unique-cases flag was used |
| 1234 */ |
| 1235 if( zDataOut ){ |
| 1236 int n = 0; |
| 1237 FILE *out = fopen(zDataOut, "wb"); |
| 1238 if( out==0 ) abendError("cannot open %s for writing", zDataOut); |
| 1239 if( nHeader>0 ) fwrite(zIn, nHeader, 1, out); |
| 1240 sqlite3_finalize(pStmt); |
| 1241 rc = sqlite3_prepare_v2(dataDb, "SELECT sql, tm FROM testcase ORDER BY tm, s
ql", |
| 1242 -1, &pStmt, 0); |
| 1243 if( rc ) abendError("%s", sqlite3_errmsg(dataDb)); |
| 1244 while( sqlite3_step(pStmt)==SQLITE_ROW ){ |
| 1245 fprintf(out,"/****<%d:%dms>****/", ++n, sqlite3_column_int(pStmt,1)); |
| 1246 fwrite(sqlite3_column_blob(pStmt,0),sqlite3_column_bytes(pStmt,0),1,out); |
| 1247 } |
| 1248 fclose(out); |
| 1249 sqlite3_finalize(pStmt); |
| 1250 sqlite3_close(dataDb); |
| 1251 } |
| 1252 |
| 1253 /* Clean up and exit. |
| 1254 */ |
| 1255 free(azInFile); |
| 1256 free(zIn); |
| 1257 free(pHeap); |
| 1258 free(pLook); |
| 1259 free(pScratch); |
| 1260 free(pPCache); |
| 1261 return 0; |
| 1262 } |
OLD | NEW |