Fuzz SQLite

[florent...@gmail.com]

Hi.

I launched a fuzzing on SQLite for 4 days, and AFL has found nothing.

Could you say me if my command is good ?

./afl-fuzz -i /path/afl-1.74b/testcases/others/sql/ -o ./path/output/ -x ./testcases/_extras/sql/ -- /path/src/SQLite/build/fuzzershell -f @@

Also, someone has an advice for the issue ??

Thank you very much !
Flo

[Michal Zalewski]

> ./afl-fuzz -i /path/afl-1.74b/testcases/others/sql/ -o ./path/output/ -x
> ./testcases/_extras/sql/ -- /path/src/SQLite/build/fuzzershell -f @@

Looks OK, although you probably don't strictly need -f @@, since IIRC,
fuzzershell reads from stdin by default.

That said, SQLite folks started using AFL in continuous testing
(https://www.sqlite.org/draft/testing.html#aflfuzz) and fixed around
60 issues based on my reports, so it's not gonna be easy to hit
something new.

/mz