Fuzz Testing for Database Management System Configuration Errors

Haoran Zhu, Menglin Li, Bo Wang, Tengfei Li, Jingtian Liu, Zan Zhou. 2025. Communications in computer and information science.

Read the paper · doi:10.1007/978-981-96-6465-8_28

What this paper does with SQLancer

SQLancer is described as background: a fuzz testing tool integrating TLP, PQS and NoREC to detect logic errors, with each of the three oracles explained in turn. The paper notes one limitation as its point of departure -- that SQLancer cannot test queries which do not return a result -- but no comparison is run and nothing of SQLancer's is reused. This work fuzzes DBMSs for configuration errors -- faults that appear only under particular settings, which testing at default configuration never reaches. It surveys existing logic-bug fuzzers as background before setting out its own approach to varying configuration during testing. Written by claude-opus-5 from the 5 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited as related work; no reuse of its code, generator or workload is described.

extends technique — no

No SQLancer technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer or one of its oracles is reported.

describes as state of the art — no

The text does not describe SQLancer as the state of the art.

SQLancer publications it cites (3)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
20	Ba, J., Rigger, M.: Testing database engines via query plan guidance. 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). Melbourne, Australia: IEEE, pp. 2060–2071 (2023)	sqlancer publication · QPG
21	Rigger, M., Su, Z.: Detecting optimization bugs in database engines via non-optimizing refer-ence engine construction. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symp...	sqlancer publication · NOREC
22	Rigger, M., Su, Z.: Finding bugs in database systems via query partitioning. Proceedings of the ACM on Programming Languages, 4(OOPSLA): 1–30 (2020)	sqlancer publication · TLP

Every place it refers to SQLancer (5)

5 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	In 2020, Manuel Rigger and Zhendong Su proposed SQ Lancer [ 20–22], a fuzzy testing tool that integrates a total of three methods, TLP, PQS and NoREC, which are combined to detect database logic errors.	name definition	2 Background page 3
M2	The TLP method partitions the SQL query into multiple segments and compares the concatenation of the original input results with the results from each segment post-partitioning to detect logical errors.	technique definition	2 Background page 3
M3	The PQS method selects a row in the database, generates a query that can obtain that row, then generates a random expression that is true in the WHERE clause, checks the results, and if the row does not exist in the results, then there is a logical error in the database.	technique definition	2 Background page 3
M4	The NoREC method changes the query to a form that cannot be optimized by morphing the SQL query into a logical equivalent and then compares the difference between the two results.	technique definition	2 Background page 3
M5	The disadvantage of SQ Lancer is that it cannot test queries that do not return a result indeﬁnitely.	name motivation	2 Background page 3

This page is rendered from _data/papers/paper_doi_10_1007_978_981_96_6465_8_28.json, extracted from supplied pdf. 13 pages, 27 references parsed.