SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback

Rui Zhong, Yongheng Chen, Hong Hu, Hangfan Zhang, Wenke Lee, Dinghao Wu. 2020. Conference on Computer and Communications Security.

Read the paper · doi:10.1145/3372297.3417260 · arXiv:2006.02398

What this paper does with SQLancer

SQLancer is cited twice as related work on logic-bug detection, with PQS described as constructing queries to fetch a randomly selected row. Squirrel targets memory errors rather than logic bugs, so the two are complementary rather than compared. Squirrel combines language validity with coverage feedback for DBMS fuzzing. Mutation-based fuzzers fail against DBMSs because inputs are checked strictly for syntax and semantics, while generation-based testing guarantees syntax but ignores coverage feedback. Squirrel keeps SQL in a structural intermediate representation, performs type-based mutations on it, and analyses logical dependencies between arguments to avoid semantic errors. It found 63 bugs across SQLite, MySQL and MariaDB. Written by claude-opus-5 from the 2 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
53	M. Rigger and Z. Su. Testing Database Engines via Pivoted Query Synthesis. arXiv preprint arXiv:2001.04174, 2020.	sqlancer publication · PQS

Every place it refers to SQLancer (2)

2 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	DBMSs have been heavily tested for logic and performance defects [ 53,56, 61,64].	citation marker background	8.3 Contributions of Validity and Feedback page 12
M2	SQLancer constructs queries to fetch a randomly selected row from a table [ 53].	name definition	8.3 Contributions of Validity and Feedback page 12

This page is rendered from _data/papers/paper_doi_10_1145_3372297_3417260.json, extracted from arxiv. 16 pages, 67 references parsed.