SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback
SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback
复制标题
DOI：
10.1145/3372297.3417260
复制
发表时间：
2020-06
期刊：
影响因子：
--
通讯作者：
Rui Zhong;Yongheng Chen;Hong Hu;Hangfan Zhang;Wenke Lee;Dinghao Wu
中科院分区：
文献类型：
--
作者：
Rui Zhong;Yongheng Chen;Hong Hu;Hangfan Zhang;Wenke Lee;Dinghao Wu
Fuzzing是一种越来越流行的技术，用于验证软件功能和发现安全漏洞。然而，目前基于变异的模糊不能有效地测试数据库管理系统（DBMS），严格检查输入的有效语法和语义。基于生成的测试可以保证输入的语法正确性，但它没有利用任何反馈，如代码覆盖率，以指导路径探索。在本文中，我们开发了Squirrel，一个新的模糊框架，考虑语言的有效性和覆盖反馈测试数据库管理系统。我们设计了一个中间表示（IR）来维护SQL查询的结构和信息的方式。为了生成语法正确的查询，我们对IR执行基于类型的突变，包括语句插入，删除和替换。为了减轻语义错误，我们分析每个IR，以确定参数之间的逻辑依赖关系，并生成满足这些依赖关系的查询。我们在四种流行的DBMS上评估了Squirrel：SQLite，MySQL，PostgreSQL和MariaDB。Squirrel在SQLite中发现了51个bug，在MySQL中发现了7个，在MariaDB中发现了5个。其中52个漏洞已修复，分配了12个CVE。在我们的实验中，Squirrel实现了比最先进的模糊器高2.4×-243.9×的语义正确性，并且比基于变异的工具多探索2.0×-10.9×的新边缘。这些结果表明，Squirrel在发现数据库管理系统的内存错误方面是有效的。
Fuzzing is an increasingly popular technique for verifying software functionalities and finding security vulnerabilities. However, current mutation-based fuzzers cannot effectively test database management systems (DBMSs), which strictly check inputs for valid syntax and semantics. Generation-based testing can guarantee the syntax correctness of the inputs, but it does not utilize any feedback, like code coverage, to guide the path exploration. In this paper, we develop Squirrel, a novel fuzzing framework that considers both language validity and coverage feedback to test DBMSs. We design an intermediate representation (IR) to maintain SQL queries in a structural and informative manner. To generate syntactically correct queries, we perform type-based mutations on IR, including statement insertion, deletion and replacement. To mitigate semantic errors, we analyze each IR to identify the logical dependencies between arguments, and generate queries that satisfy these dependencies. We evaluated Squirrel on four popular DBMSs: SQLite, MySQL, PostgreSQL and MariaDB. Squirrel found 51 bugs in SQLite, 7 in MySQL and 5 in MariaDB. 52 of the bugs are fixed with 12 CVEs assigned. In our experiment, Squirrel achieves 2.4×-243.9× higher semantic correctness than state-of-the-art fuzzers, and explores 2.0×-10.9× more new edges than mutation-based tools. These results show that Squirrel is effective in finding memory errors of database management systems.