Truffuzz / Disqillery

Description #

Project for Automated Software Testing, in a team of two.

Truffuzz generates SQL and feeds it to SQLite hunting for crashes and wrong results. Purely random SQL is almost all syntactically invalid and gets rejected before it reaches anything interesting, so the generator is grammar-aware: it builds statements that type- check against the schema it just created, which gets the input past the parser and into the query planner where the interesting bugs live. Logic bugs — where SQLite returns the wrong rows rather than crashing — are caught by differential testing, running semantically equivalent query formulations against each other and flagging any disagreement.

Disqillery handles the other half of the problem. A crashing input straight out of a fuzzer is typically hundreds of statements long and tells you nothing about the cause, so Disqillery repeatedly deletes statements, clauses and sub-expressions, keeping each reduction only if the bug still reproduces, until it reaches a minimal query that still triggers it.

The whole pipeline runs in Docker so campaigns are reproducible and a reported bug can be replayed exactly.

(Source code not provided due to university policy)