valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 01:55:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fuzzing: Reduce sqlquery false positives (#6189)

Browse Source 
This applies some query restrictions similar to the SQLite harnesses.
Examples include restricting the impact of ``randomblob(N)``.
This commit is contained in:
Teddy Reed 2020-01-29 07:37:06 -05:00 committed by GitHub
parent 041d6e93be
commit fcb6e263db
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
osquery/main/harnesses/fuzz_utils.cpp
View File

@ -7,17 +7,31 @@
*/
#include <osquery/database.h>
#include <osquery/flags.h>
#include <osquery/logger.h>
#include <osquery/registry.h>
#include <osquery/sql/sqlite_util.h>
#include <sqlite3.h>
namespace osquery {
DECLARE_bool(disable_database);
int osqueryFuzzerInitialize(int* argc, char*** argv) {
osquery::registryAndPluginInit();
FLAGS_disable_database = true;
osquery::DatabasePlugin::setAllowOpen(true);
osquery::Registry::get().setActive("database", "ephemeral");
osquery::DatabasePlugin::initPlugin();
auto* db = osquery::SQLiteDBManager::instance().get()->db();
// See https://www.sqlite.org/src/artifact/18af635f about limiting what
// effects the fuzzer triggers.
sqlite3_limit(db, SQLITE_LIMIT_VDBE_OP, 25000);
sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 50000);
osquery::PluginRequest r;
r["action"] = "detach";
r["table"] = "file";