Improving Multitasking DBMS Fuzzing With More Accurate Coverage and Testcase Trimming

Jiaqi Li, Yajin Zhou, Lei Wu. 2025. IEEE Transactions on Dependable and Secure Computing.

Read the paper · doi:10.1109/tdsc.2024.3521591

What this paper does with SQLancer

SQLancer's oracles appear in the comparison of existing DBMS testing approaches, where NoREC, TLP and PQS are grouped with DQE and Pinolo as metamorphic techniques for finding semantic bugs. The paper makes one observation of substance about combining them with its own approach: most of these oracles can be applied to a coverage-guided fuzzer, but PQS cannot, because it constrains the pattern of generated test cases too tightly for a coverage-driven generator to satisfy. This work improves coverage-guided DBMS fuzzing for systems that run many tasks concurrently, where coverage attributed to the wrong task makes the feedback signal misleading. It contributes more accurate per-task coverage measurement and test case trimming that shrinks inputs without losing the behaviour that made them interesting. Written by claude-opus-5 from the 3 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited as related work; no reuse of its code, generator or workload is described.

extends technique — no

No SQLancer technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer or one of its oracles is reported.

describes as state of the art — no

The text does not describe SQLancer as the state of the art.

SQLancer publications it cites (3)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
35	M. Rigger and Z. Su, “Detecting optimization bugs in database engines via non-optimizing reference engine construction,” in Proc. 28th ACM Joint Meeting Eur. Softw. Eng. Conf. Symp. Foundations Softw. Eng., 2020, pp. ...	sqlancer publication · NOREC
36	M. Rigger and Z. Su, “Finding bugs in database systems via query partitioning,” in Proc. ACM Program. Lang., vol. 4, pp. 1–30, 2020.	sqlancer publication · TLP
40	M. Rigger and Z. Su, “Testing database engines via pivoted query synthesis,” in Proc. 14th USENIX Symp. Operating Syst. Des. Implementation, 2020, pp. 667–682. Jiaqi Li received the BE degree in information security f...	sqlancer publication · PQS

Every place it refers to SQLancer (3)

3 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	NoREC [35], TLP [36], DQE [37], Pinolo [38] leverage the idea of metamorphic testing to identify semantic bugs that lead to the incorrect result of SQL statement.	technique definition	D Comparison to Existing DBMS Fuzzers page 14
M2	PQS [40] generates queries that a speciﬁc row should be returned.	technique definition	D Comparison to Existing DBMS Fuzzers page 14
M3	Most oracles can be applied to coverage-guided fuzzers except PQS because PQS puts strict limitations on the pattern of generated testcases.	technique motivation	D Comparison to Existing DBMS Fuzzers page 14

This page is rendered from _data/papers/paper_doi_10_1109_tdsc_2024_3521591.json, extracted from supplied pdf. 15 pages, 40 references parsed.