Detecting Logical Bugs of DBMS with Coverage-based Guidance

Database management systems (DBMSs) are critical components of modern data-intensive applications. Developers have adopted many testing techniques to detect DBMS bugs such as crashes and assertion failures. However, most previous efforts cannot detect logical bugs that make the DBMS return incorrect results. Recent work proposed several oracles to identify incorrect results, but they rely on rule-based expression generation to synthesize queries without any guidance. In this paper, we propose to combine coverage-based guidance, validity-oriented mutations and oracles to detect logical bugs in DBMS systems. Specifically, we first design a set of general APIs to decouple the logic of fuzzers and oracles, so that developers can easily port fuzzing tools to test DBMSs and write new oracles for existing fuzzers. Then, we provide validity-oriented mutations to generate high-quality query statements in order to find more logical bugs. Our prototype, SQLRight, outperforms existing tools that only rely on oracles or code coverage. In total, SQLRight detects 18 logical bugs from two well-tested DBMSs, SQLite and MySQL. All bugs have been confirmed and 14 of them have been fixed. 01 CREATE TABLE person (pid INT ); 02 INSERT INTO person VALUES (1) , (10) , (10); 03 CREATE UNIQUE INDEX idx ON person (pid) WHERE pid =1; 04 SELECT DISTINCT pid FROM person WHERE pid =10; 05 --output : 10 n10 06 --expect : 10 CREATE TABLE person (pid INT ); INSERT INTO person VALUES (1) , (10) , (10); SELECT DISTINCT pid FROM person WHERE pid =10; Listing 2: A functional-equivalent query of Listing 1 query by deleting the CREATE UNIQUE INDEX statement. 01 CREATE TABLE v0 (v1 TEXT ); 02 INSERT INTO v0 VALUES ('text '); 03 SELECT v1 FROM 'v0 ';