sql/built_in_recovery_fuzzer.cc

   1 // Copyright 2023 The Chromium Authors
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <stdint.h>
   6
   7 #include <tuple>
   8
   9 #include "base/check.h"
  10 #include "base/containers/span.h"
  11 #include "base/files/file_path.h"
  12 #include "base/files/file_util.h"
  13 #include "base/test/bind.h"
  14 #include "sql/database.h"
  15 #include "sql/recovery.h"
  16 #include "sql/statement.h"
  17
  18 namespace {
  19
  20 // Does initialization and holds state that's shared across all runs.
  21 class Environment {
  22  public:
  23   Environment() {
  24     CHECK(base::CreateTemporaryFile(&data_file_path_));
  25     logging::SetMinLogLevel(logging::LOG_FATAL);
  26   }
  27
  28   ~Environment() { base::DeleteFile(data_file_path_); }
  29
  30   const base::FilePath& data_file_path() const { return data_file_path_; }
  31
  32  private:
  33   base::FilePath data_file_path_;
  34 };
  35
  36 }  // namespace
  37
  38 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  39   static Environment env;
  40
  41   // Prepare fuzzed data file.
  42   CHECK(base::WriteFile(env.data_file_path(), base::make_span(data, size)));
  43
  44   // Load database. Check there's no unrecoverable error.
  45   sql::DatabaseOptions options;
  46   sql::Database database(options);
  47   bool should_attempt_recovery = false;
  48   database.set_error_callback(
  49       base::BindLambdaForTesting([&](int extended_error, sql::Statement*) {
  50         should_attempt_recovery = sql::BuiltInRecovery::ShouldAttemptRecovery(
  51             &database, extended_error);
  52       }));
  53   std::ignore = database.Open(env.data_file_path());
  54
  55   // Select a recovery strategy pseudorandomly.
  56   auto strategy =
  57       size % 2 == 0
  58           ? sql::BuiltInRecovery::Strategy::kRecoverOrRaze
  59           : sql::BuiltInRecovery::Strategy::kRecoverWithMetaVersionOrRaze;
  60
  61   // Ensure that we remember to update the fuzzer if more strategies are added.
  62   switch (strategy) {
  63     case sql::BuiltInRecovery::Strategy::kRecoverOrRaze:
  64     case sql::BuiltInRecovery::Strategy::kRecoverWithMetaVersionOrRaze:
  65       break;
  66   }
  67
  68   // Attempt recovery.
  69   if (should_attempt_recovery) {
  70     database.reset_error_callback();
  71     std::ignore = sql::BuiltInRecovery::RecoverDatabase(&database, strategy);
  72   }
  73
  74   return 0;
  75 }