test/fuzz.test

# 2007 May 10
#
# The author disclaims copyright to this source code.  In place of
# a legal notice, here is a blessing:
#
#    May you do good and not evil.
#    May you find forgiveness for yourself and forgive others.
#    May you share freely, never taking more than you give.
#
#***********************************************************************
# This file implements regression tests for SQLite library.  The
# focus of this file is generating semi-random strings of SQL
# (a.k.a. "fuzz") and sending it into the parser to try to generate
# errors.
#
# $Id: fuzz.test,v 1.5 2007/05/11 07:08:29 danielk1977 Exp $

set testdir [file dirname $argv0]
source $testdir/tester.tcl

proc fuzz {TemplateList} {
  set n [llength $TemplateList]
  set i [expr {int(rand()*$n)}]
  return [subst -novar [lindex $TemplateList $i]]
}

# Returns a string representing an SQL literal.
#
proc Literal {} {
  set TemplateList {
    456 0 -456 1 -1 
    2147483648 2147483647 2147483649 -2147483647 -2147483648 -2147483649
    'The' 'first' 'experiments' 'in' 'hardware' 'fault' 'injection'
    zeroblob(1000)
    NULL
    56.1 -56.1
    123456789.1234567899
  }
  fuzz $TemplateList
}

proc UnaryOp {} {
  set TemplateList {+ - NOT}
  fuzz $TemplateList
}

proc BinaryOp {} {
  set TemplateList {+ - % * / AND OR LIKE GLOB}
  fuzz $TemplateList
}

set ::ExprDepth 0
proc Expr {} {
  incr ::ExprDepth

  set TemplateList {[Literal]}
  if {$::ExprDepth < 100} {
    lappend TemplateList \
      {[Expr] [BinaryOp] [Expr]}   \
      {[UnaryOp] [Expr]}
  }
  if {$::SelectDepth < 10} {
    lappend TemplateList {([Select 1])}
  } 
  set res [fuzz $TemplateList]
  incr ::ExprDepth -1
  return $res
}

set ::TableList [list]
proc Table {} {
  set TemplateList [concat sqlite_master $::TableList]
  fuzz $TemplateList
}

set ::SelectDepth 0
proc Select {{isExpr 0}} {
  incr ::SelectDepth
  set TemplateList {
      {SELECT [Expr]}
  }
  if {$::SelectDepth < 5} {
    lappend TemplateList \
        {SELECT [Expr] FROM ([Select])}                \
        {SELECT [Expr] FROM [Table]}                  

    if {0 == $isExpr} {
      lappend TemplateList                                         \
          {SELECT [Expr], [Expr] FROM ([Select]) ORDER BY [Expr]}  \
          {SELECT * FROM ([Select]) ORDER BY [Expr]}               \
    }
  } 
  set res [fuzz $TemplateList]
  incr ::SelectDepth -1
  set res
}

########################################################################

#----------------------------------------------------------------
# These tests caused errors that were first caught by the tests
# in this file. They are still here.
do_test fuzz-1.1 {
  execsql {
    SELECT 'abc' LIKE X'ABCD';
  }
} {0}
do_test fuzz-1.2 {
  execsql {
    SELECT 'abc' LIKE zeroblob(10);
  }
} {0}
do_test fuzz-1.3 {
  execsql {
    SELECT zeroblob(10) LIKE 'abc';
  }
} {0}
do_test fuzz-1.4 {
  execsql {
    SELECT (- -21) % NOT (456 LIKE zeroblob(10));
  }
} {0}
do_test fuzz-1.5 {
  execsql {
    SELECT (SELECT (
        SELECT (SELECT -2147483648) FROM (SELECT 1) ORDER BY 1
    ))
  }
} {-2147483648}
do_test fuzz-1.6 {
  execsql {
    SELECT 'abc', zeroblob(1) FROM (SELECT 1) ORDER BY 1
  }
} [execsql {SELECT 'abc', zeroblob(1)}]

do_test fuzz-1.7 {
  execsql {
    SELECT ( SELECT zeroblob(1000) FROM ( 
      SELECT * FROM (SELECT 'first') ORDER BY NOT 'in') 
    )
  }
} [execsql {SELECT zeroblob(1000)}]

#----------------------------------------------------------------
# Test some fuzzily generated expressions.
#
for {set ii 0} {$ii < 2000} {incr ii} {
  do_test fuzz-2.1.$ii {
    set ::expr [Expr]
    set rc [catch {execsql "SELECT $::expr"} msg]
    set e [expr {
      $rc == 0 || 
      $msg eq "parser stack overflow" ||
      0 == [string first "ORDER BY column number" $msg]
    }]
    if {$e == 0} {
      puts ""
      puts "SELECT $::expr"
      puts $msg
    }
    set e
  } {1}
} 

do_test fuzz-3.1 {
  execsql {
    CREATE TABLE abc(a, b, c);
    CREATE TABLE def(d, e, f);
    CREATE TABLE ghi(g, h, i);
  }
} {}
set ::TableList [list abc def ghi]

#----------------------------------------------------------------
# Test some fuzzily generated SELECT statements.
#
for {set ii 0} {$ii < 2000} {incr ii} {
  do_test fuzz-2.2.$ii {
    set ::select [Select]
    set rc [catch {execsql $::select} msg]
    set e [expr {$rc == 0 || $msg eq "parser stack overflow"}]
    set e [expr {
      $rc == 0 || 
      $msg eq "parser stack overflow" ||
      0 == [string first "ORDER BY column number" $msg]
    }]
    if {$e == 0} {
      puts ""
      puts $::select
      puts $msg
    }
    set e
  } {1}
} 

finish_test