← Research building on SQLancer

Jingzhou Fu, Jie Liang, Zhiyong Wu, Yu Jiang. 2024. International Conference on Software Engineering.

Read the paper · doi:10.1145/3597503.3639210

What this paper does with SQLancer

Three citations in related work describing SQLancer's oracles -- NoREC, PQS and query plan guidance -- as the generation-based approaches aimed at specific bug types, in contrast to Sedar's coverage-guided seed transfer. Sedar produces high-quality initial seeds for DBMS fuzzing by transferring test cases from other DBMSs, addressing the problem that many systems lack comprehensive built-in test suites. The insight is that DBMSs share many features, so a seed reaching deep paths in one can be adapted for another. Sedar executes existing test cases in their original DBMS while capturing schema information, uses an LLM guided by that information to generate new cases, and comments out unparsable sections so fuzzers can mutate them. It found 70 new vulnerabilities. Written by claude-opus-5 from the 5 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#EntryMatched as
2 JinshengBaandManuelRigger.2023. Testingdatabaseenginesviaqueryplan guidance. In Proceedings of International Conference on Software Engineering (ICSE). sqlancer publication · QPG
30 Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf... sqlancer publication · NOREC
31 ManuelRiggerandZhendongSu.2020. FindingBugsinDatabaseSystemsvia Query Partitioning. Proc. ACM Program. Lang. 4, OOPSLA, Article 211 (2020). https://doi .org/10.1145/3428279 sqlancer publication · TLP
32 Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation OSDI 20). 667–682. sqlancer publication · PQS

Every place it refers to SQLancer (5)

5 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id Sentence Found by Where
M1 The mutation-based fuzzing techniques [ 2,9,14,19,20,44,45,48] have been successfully appliedto DBMSsforeffectivetestingandbugfinding. citation marker
definition 		7 RELATED WORK
page 10
M2 Whiletheaboveare allcoverage-guidedapproaches,QPG[ 2]proposestheconceptof query plan guidance to guide the fuzzing other than code coverage. technique
background 		7 RELATED WORK
page 10
M3 Some generation-based approaches[ 15,22,30–32,34,37]areproposedtofindspecifictypes of DBMSbugs. citation marker
definition 		7 RELATED WORK
page 10
M4 NoREC[ 30]isdesignedtodetectoptimizationbugs bygenerating SQLqueriesaswellastheequivalentonesthatcannotbeoptimized. technique
definition 		7 RELATED WORK
page 11
M5 PQS[ 32]generatesqueriesthatshouldfetchaspecific row, and indicates a bug triggered when the row is not included in resultsets. technique 7 RELATED WORK
page 11

This page is rendered from _data/papers/paper_doi_10_1145_3597503_3639210.json, extracted from supplied pdf. 12 pages, 48 references parsed.