/*

** 2015-04-17

**

** The author disclaims copyright to this source code.  In place of

** a legal notice, here is a blessing:

**

**    May you do good and not evil.

**    May you find forgiveness for yourself and forgive others.

**    May you share freely, never taking more than you give.

**

*************************************************************************

**

** This is a utility program designed to aid running the SQLite library

** against an external fuzzer, such as American Fuzzy Lop (AFL)

** (http://lcamtuf.coredump.cx/afl/).  Basically, this program reads

** SQL text from standard input and passes it through to SQLite for evaluation,

** just like the "sqlite3" command-line shell.  Differences from the

** command-line shell:

**

**    (1)  The complex "dot-command" extensions are omitted.  This

**         prevents the fuzzer from discovering that it can run things

**         like ".shell rm -rf ~"

**

**    (2)  The database is opened with the SQLITE_OPEN_MEMORY flag so that

**         no disk I/O from the database is permitted.  The ATTACH command

**         with a filename still uses an in-memory database.

**

**    (3)  The main in-memory database can be initialized from a template

**         disk database so that the fuzzer starts with a database containing

**         content.

**

**    (4)  The eval() SQL function is added, allowing the fuzzer to do 

**         interesting recursive operations.

**

**    (5)  An error is raised if there is a memory leak.

**

** The input text can be divided into separate test cases using comments

** of the form:

**

**       |****<...>****|

**

** where the "..." is arbitrary text. (Except the "|" should really be "/".

** "|" is used here to avoid compiler errors about nested comments.)

** A separate in-memory SQLite database is created to run each test case.

** This feature allows the "queue" of AFL to be captured into a single big

** file using a command like this:

**

**    (for i in id:*; do echo '|****<'$i'>****|'; cat $i; done) >~/all-queue.txt

**

** (Once again, change the "|" to "/") Then all elements of the AFL queue

** can be run in a single go (for regression testing, for example) by typing:

**

**    fuzzershell -f ~/all-queue.txt

**

** After running each chunk of SQL, the database connection is closed.  The

** program aborts if the close fails or if there is any unfreed memory after

** the close.

**

** New test cases can be appended to all-queue.txt at any time.  If redundant

** test cases are added, they can be eliminated by running:

**

**    fuzzershell -f ~/all-queue.txt --unique-cases ~/unique-cases.txt

*/

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <stdarg.h>

#include <ctype.h>

#include "sqlite3.h"

#define ISDIGIT(X) isdigit((unsigned char)(X))

/*

** All global variables are gathered into the "g" singleton.

*/

struct GlobalVars {

  const char *zArgv0;              /* Name of program */

  sqlite3_mem_methods sOrigMem;    /* Original memory methods */

  sqlite3_mem_methods sOomMem;     /* Memory methods with OOM simulator */

  int iOomCntdown;                 /* Memory fails on 1 to 0 transition */

  int nOomFault;                   /* Increments for each OOM fault */

  int bOomOnce;                    /* Fail just once if true */

  int bOomEnable;                  /* True to enable OOM simulation */

  int nOomBrkpt;                   /* Number of calls to oomFault() */

  char zTestName[100];             /* Name of current test */

} g;

/*

** Maximum number of iterations for an OOM test

*/

#ifndef OOM_MAX

# define OOM_MAX 625

#endif

/*

** This routine is called when a simulated OOM occurs.  It exists as a

** convenient place to set a debugger breakpoint.

*/

static void oomFault(void){

  g.nOomBrkpt++; /* Prevent oomFault() from being optimized out */

}

/* Versions of malloc() and realloc() that simulate OOM conditions */

static void *oomMalloc(int nByte){

  if( nByte>0 && g.bOomEnable && g.iOomCntdown>0 ){

    g.iOomCntdown--;

    if( g.iOomCntdown==0 ){

      if( g.nOomFault==0 ) oomFault();

      g.nOomFault++;

      if( !g.bOomOnce ) g.iOomCntdown = 1;

      return 0;

    }

  }

  return g.sOrigMem.xMalloc(nByte);

}

static void *oomRealloc(void *pOld, int nByte){

  if( nByte>0 && g.bOomEnable && g.iOomCntdown>0 ){

    g.iOomCntdown--;

    if( g.iOomCntdown==0 ){

      if( g.nOomFault==0 ) oomFault();

      g.nOomFault++;

      if( !g.bOomOnce ) g.iOomCntdown = 1;

      return 0;

    }

  }

  return g.sOrigMem.xRealloc(pOld, nByte);

}

/*

** Print an error message and abort in such a way to indicate to the

** fuzzer that this counts as a crash.

*/

static void abendError(const char *zFormat, ...){

  va_list ap;

  if( g.zTestName[0] ){

    fprintf(stderr, "%s (%s): ", g.zArgv0, g.zTestName);

  }else{

    fprintf(stderr, "%s: ", g.zArgv0);

  }

  va_start(ap, zFormat);

  vfprintf(stderr, zFormat, ap);

  va_end(ap);

  fprintf(stderr, "\n");

  abort();

}

/*

** Print an error message and quit, but not in a way that would look

** like a crash.

*/

static void fatalError(const char *zFormat, ...){

  va_list ap;

  if( g.zTestName[0] ){

    fprintf(stderr, "%s (%s): ", g.zArgv0, g.zTestName);

  }else{

    fprintf(stderr, "%s: ", g.zArgv0);

  }

  va_start(ap, zFormat);

  vfprintf(stderr, zFormat, ap);

  va_end(ap);

  fprintf(stderr, "\n");

  exit(1);

}

/*

** Evaluate some SQL.  Abort if unable.

*/

static void sqlexec(sqlite3 *db, const char *zFormat, ...){

  va_list ap;

  char *zSql;

  char *zErrMsg = 0;

  int rc;

  va_start(ap, zFormat);

  zSql = sqlite3_vmprintf(zFormat, ap);

  va_end(ap);

  rc = sqlite3_exec(db, zSql, 0, 0, &zErrMsg);

  if( rc ) abendError("failed sql [%s]: %s", zSql, zErrMsg);

  sqlite3_free(zSql);

}

/*

** This callback is invoked by sqlite3_log().

*/

static void shellLog(void *pNotUsed, int iErrCode, const char *zMsg){

  printf("LOG: (%d) %s\n", iErrCode, zMsg);

  fflush(stdout);

}

static void shellLogNoop(void *pNotUsed, int iErrCode, const char *zMsg){

  return;

}

/*

** This callback is invoked by sqlite3_exec() to return query results.

*/

static int execCallback(void *NotUsed, int argc, char **argv, char **colv){

  int i;

  static unsigned cnt = 0;

  printf("ROW #%u:\n", ++cnt);

  if( argv ){

    for(i=0; i

      printf(" %s=", colv[i]);

      if( argv[i] ){

        printf("[%s]\n", argv[i]);

      }else{

        printf("NULL\n");

      }

    }

  }

  fflush(stdout);

  return 0;

}

static int execNoop(void *NotUsed, int argc, char **argv, char **colv){

  return 0;

}

#ifndef SQLITE_OMIT_TRACE

/*

** This callback is invoked by sqlite3_trace() as each SQL statement

** starts.

*/

static void traceCallback(void *NotUsed, const char *zMsg){

  printf("TRACE: %s\n", zMsg);

  fflush(stdout);

}

static void traceNoop(void *NotUsed, const char *zMsg){

  return;

}

#endif

/***************************************************************************

** String accumulator object

*/

typedef struct Str Str;

struct Str {

  char *z;                /* The string.  Memory from malloc() */

  sqlite3_uint64 n;       /* Bytes of input used */

  sqlite3_uint64 nAlloc;  /* Bytes allocated to z[] */

  int oomErr;             /* OOM error has been seen */

};

/* Initialize a Str object */

static void StrInit(Str *p){

  memset(p, 0, sizeof(*p));

}

/* Append text to the end of a Str object */

static void StrAppend(Str *p, const char *z){

  sqlite3_uint64 n = strlen(z);

  if( p->n + n >= p->nAlloc ){

    char *zNew;

    sqlite3_uint64 nNew;

    if( p->oomErr ) return;

    nNew = p->nAlloc*2 + 100 + n;

    zNew = sqlite3_realloc(p->z, (int)nNew);

    if( zNew==0 ){

      sqlite3_free(p->z);

      memset(p, 0, sizeof(*p));

      p->oomErr = 1;

      return;

    }

    p->z = zNew;

    p->nAlloc = nNew;

  }

  memcpy(p->z + p->n, z, (size_t)n);

  p->n += n;

  p->z[p->n] = 0;

}

/* Return the current string content */

static char *StrStr(Str *p){

 return p->z;

}

/* Free the string */

static void StrFree(Str *p){

  sqlite3_free(p->z);

  StrInit(p);

}

/***************************************************************************

** eval() implementation copied from ../ext/misc/eval.c

*/

/*

** Structure used to accumulate the output

*/

struct EvalResult {

  char *z;               /* Accumulated output */

  const char *zSep;      /* Separator */

  int szSep;             /* Size of the separator string */

  sqlite3_int64 nAlloc;  /* Number of bytes allocated for z[] */

  sqlite3_int64 nUsed;   /* Number of bytes of z[] actually used */

};

/*

** Callback from sqlite_exec() for the eval() function.

*/

static int callback(void *pCtx, int argc, char **argv, char **colnames){

  struct EvalResult *p = (struct EvalResult*)pCtx;

  int i; 

  for(i=0; i

    const char *z = argv[i] ? argv[i] : "";

    size_t sz = strlen(z);

    if( (sqlite3_int64)sz+p->nUsed+p->szSep+1 > p->nAlloc ){

      char *zNew;

      p->nAlloc = p->nAlloc*2 + sz + p->szSep + 1;

      /* Using sqlite3_realloc64() would be better, but it is a recent

      ** addition and will cause a segfault if loaded by an older version

      ** of SQLite.  */

      zNew = p->nAlloc<=0x7fffffff ? sqlite3_realloc(p->z, (int)p->nAlloc) : 0;

      if( zNew==0 ){

        sqlite3_free(p->z);

        memset(p, 0, sizeof(*p));

        return 1;

      }

      p->z = zNew;

    }

    if( p->nUsed>0 ){

      memcpy(&p->z[p->nUsed], p->zSep, p->szSep);

      p->nUsed += p->szSep;

    }

    memcpy(&p->z[p->nUsed], z, sz);

    p->nUsed += sz;

  }

  return 0;

}

/*

** Implementation of the eval(X) and eval(X,Y) SQL functions.

**

** Evaluate the SQL text in X.  Return the results, using string

** Y as the separator.  If Y is omitted, use a single space character.

*/

static void sqlEvalFunc(

  sqlite3_context *context,

  int argc,

  sqlite3_value **argv

){

  const char *zSql;

  sqlite3 *db;

  char *zErr = 0;

  int rc;

  struct EvalResult x;

  memset(&x, 0, sizeof(x));

  x.zSep = " ";

  zSql = (const char*)sqlite3_value_text(argv[0]);

  if( zSql==0 ) return;

  if( argc>1 ){

    x.zSep = (const char*)sqlite3_value_text(argv[1]);

    if( x.zSep==0 ) return;

  }

  x.szSep = (int)strlen(x.zSep);

  db = sqlite3_context_db_handle(context);

  rc = sqlite3_exec(db, zSql, callback, &x, &zErr);

  if( rc!=SQLITE_OK ){

    sqlite3_result_error(context, zErr, -1);

    sqlite3_free(zErr);

  }else if( x.zSep==0 ){

    sqlite3_result_error_nomem(context);

    sqlite3_free(x.z);

  }else{

    sqlite3_result_text(context, x.z, (int)x.nUsed, sqlite3_free);

  }

}

/* End of the eval() implementation

******************************************************************************/

/******************************************************************************

** The generate_series(START,END,STEP) eponymous table-valued function.

**

** This code is copy/pasted from ext/misc/series.c in the SQLite source tree.

*/

/* series_cursor is a subclass of sqlite3_vtab_cursor which will

** serve as the underlying representation of a cursor that scans

** over rows of the result

*/

typedef struct series_cursor series_cursor;

struct series_cursor {

  sqlite3_vtab_cursor base;  /* Base class - must be first */

  int isDesc;                /* True to count down rather than up */

  sqlite3_int64 iRowid;      /* The rowid */

  sqlite3_int64 iValue;      /* Current value ("value") */

  sqlite3_int64 mnValue;     /* Mimimum value ("start") */

  sqlite3_int64 mxValue;     /* Maximum value ("stop") */

  sqlite3_int64 iStep;       /* Increment ("step") */

};

/*

** The seriesConnect() method is invoked to create a new

** series_vtab that describes the generate_series virtual table.

**

** Think of this routine as the constructor for series_vtab objects.

**

** All this routine needs to do is:

**

**    (1) Allocate the series_vtab object and initialize all fields.

**

**    (2) Tell SQLite (via the sqlite3_declare_vtab() interface) what the

**        result set of queries against generate_series will look like.

*/

static int seriesConnect(

  sqlite3 *db,

  void *pAux,

  int argc, const char *const*argv,

  sqlite3_vtab **ppVtab,

  char **pzErr

){

  sqlite3_vtab *pNew;

  int rc;

/* Column numbers */

#define SERIES_COLUMN_VALUE 0

#define SERIES_COLUMN_START 1

#define SERIES_COLUMN_STOP  2

#define SERIES_COLUMN_STEP  3

  rc = sqlite3_declare_vtab(db,

     "CREATE TABLE x(value,start hidden,stop hidden,step hidden)");

  if( rc==SQLITE_OK ){

    pNew = *ppVtab = sqlite3_malloc( sizeof(*pNew) );

    if( pNew==0 ) return SQLITE_NOMEM;

    memset(pNew, 0, sizeof(*pNew));

  }

  return rc;

}

/*

** This method is the destructor for series_cursor objects.

*/

static int seriesDisconnect(sqlite3_vtab *pVtab){

  sqlite3_free(pVtab);

  return SQLITE_OK;

}

/*

** Constructor for a new series_cursor object.

*/

static int seriesOpen(sqlite3_vtab *p, sqlite3_vtab_cursor **ppCursor){

  series_cursor *pCur;

  pCur = sqlite3_malloc( sizeof(*pCur) );

  if( pCur==0 ) return SQLITE_NOMEM;

  memset(pCur, 0, sizeof(*pCur));

  *ppCursor = &pCur->base;

  return SQLITE_OK;

}

/*

** Destructor for a series_cursor.

*/

static int seriesClose(sqlite3_vtab_cursor *cur){

  sqlite3_free(cur);

  return SQLITE_OK;

}

/*

** Advance a series_cursor to its next row of output.

*/

static int seriesNext(sqlite3_vtab_cursor *cur){

  series_cursor *pCur = (series_cursor*)cur;

  if( pCur->isDesc ){

    pCur->iValue -= pCur->iStep;

  }else{

    pCur->iValue += pCur->iStep;

  }

  pCur->iRowid++;

  return SQLITE_OK;

}

/*

** Return values of columns for the row at which the series_cursor

** is currently pointing.

*/

static int seriesColumn(

  sqlite3_vtab_cursor *cur,   /* The cursor */

  sqlite3_context *ctx,       /* First argument to sqlite3_result_...() */

  int i                       /* Which column to return */

){

  series_cursor *pCur = (series_cursor*)cur;

  sqlite3_int64 x = 0;

  switch( i ){

    case SERIES_COLUMN_START:  x = pCur->mnValue; break;

    case SERIES_COLUMN_STOP:   x = pCur->mxValue; break;

    case SERIES_COLUMN_STEP:   x = pCur->iStep;   break;

    default:                   x = pCur->iValue;  break;

  }

  sqlite3_result_int64(ctx, x);

  return SQLITE_OK;

}

/*

** Return the rowid for the current row.  In this implementation, the

** rowid is the same as the output value.

*/

static int seriesRowid(sqlite3_vtab_cursor *cur, sqlite_int64 *pRowid){

  series_cursor *pCur = (series_cursor*)cur;

  *pRowid = pCur->iRowid;

  return SQLITE_OK;

}

/*

** Return TRUE if the cursor has been moved off of the last

** row of output.

*/

static int seriesEof(sqlite3_vtab_cursor *cur){

  series_cursor *pCur = (series_cursor*)cur;

  if( pCur->isDesc ){

    return pCur->iValue < pCur->mnValue;

  }else{

    return pCur->iValue > pCur->mxValue;

  }

}

/* True to cause run-time checking of the start=, stop=, and/or step= 

** parameters.  The only reason to do this is for testing the

** constraint checking logic for virtual tables in the SQLite core.

*/

#ifndef SQLITE_SERIES_CONSTRAINT_VERIFY

# define SQLITE_SERIES_CONSTRAINT_VERIFY 0

#endif

/*

** This method is called to "rewind" the series_cursor object back

** to the first row of output.  This method is always called at least

** once prior to any call to seriesColumn() or seriesRowid() or 

** seriesEof().

**

** The query plan selected by seriesBestIndex is passed in the idxNum

** parameter.  (idxStr is not used in this implementation.)  idxNum

** is a bitmask showing which constraints are available:

**

**    1:    start=VALUE

**    2:    stop=VALUE

**    4:    step=VALUE

**

** Also, if bit 8 is set, that means that the series should be output

** in descending order rather than in ascending order.

**

** This routine should initialize the cursor and position it so that it

** is pointing at the first row, or pointing off the end of the table

** (so that seriesEof() will return true) if the table is empty.

*/

static int seriesFilter(

  sqlite3_vtab_cursor *pVtabCursor, 

  int idxNum, const char *idxStr,

  int argc, sqlite3_value **argv

){

  series_cursor *pCur = (series_cursor *)pVtabCursor;

  int i = 0;

  if( idxNum & 1 ){

    pCur->mnValue = sqlite3_value_int64(argv[i++]);

  }else{

    pCur->mnValue = 0;

  }

  if( idxNum & 2 ){

    pCur->mxValue = sqlite3_value_int64(argv[i++]);

  }else{

    pCur->mxValue = 0xffffffff;

  }

  if( idxNum & 4 ){

    pCur->iStep = sqlite3_value_int64(argv[i++]);

    if( pCur->iStep<1 ) pCur->iStep = 1;

  }else{

    pCur->iStep = 1;

  }

  if( idxNum & 8 ){

    pCur->isDesc = 1;

    pCur->iValue = pCur->mxValue;

    if( pCur->iStep>0 ){

      pCur->iValue -= (pCur->mxValue - pCur->mnValue)%pCur->iStep;

    }

  }else{

    pCur->isDesc = 0;

    pCur->iValue = pCur->mnValue;

  }

  pCur->iRowid = 1;

  return SQLITE_OK;

}

/*

** SQLite will invoke this method one or more times while planning a query

** that uses the generate_series virtual table.  This routine needs to create

** a query plan for each invocation and compute an estimated cost for that

** plan.

**

** In this implementation idxNum is used to represent the

** query plan.  idxStr is unused.

**

** The query plan is represented by bits in idxNum:

**

**  (1)  start = $value  -- constraint exists

**  (2)  stop = $value   -- constraint exists

**  (4)  step = $value   -- constraint exists

**  (8)  output in descending order

*/

static int seriesBestIndex(

  sqlite3_vtab *tab,

  sqlite3_index_info *pIdxInfo

){

  int i;                 /* Loop over constraints */

  int idxNum = 0;        /* The query plan bitmask */

  int startIdx = -1;     /* Index of the start= constraint, or -1 if none */

  int stopIdx = -1;      /* Index of the stop= constraint, or -1 if none */

  int stepIdx = -1;      /* Index of the step= constraint, or -1 if none */

  int nArg = 0;          /* Number of arguments that seriesFilter() expects */

  const struct sqlite3_index_constraint *pConstraint;

  pConstraint = pIdxInfo->aConstraint;

  for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){

    if( pConstraint->usable==0 ) continue;

    if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;

    switch( pConstraint->iColumn ){

      case SERIES_COLUMN_START:

        startIdx = i;

        idxNum |= 1;

        break;

      case SERIES_COLUMN_STOP:

        stopIdx = i;

        idxNum |= 2;

        break;

      case SERIES_COLUMN_STEP:

        stepIdx = i;

        idxNum |= 4;

        break;

    }

  }

  if( startIdx>=0 ){

    pIdxInfo->aConstraintUsage[startIdx].argvIndex = ++nArg;

    pIdxInfo->aConstraintUsage[startIdx].omit= !SQLITE_SERIES_CONSTRAINT_VERIFY;

  }

  if( stopIdx>=0 ){

    pIdxInfo->aConstraintUsage[stopIdx].argvIndex = ++nArg;

    pIdxInfo->aConstraintUsage[stopIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY;

  }

  if( stepIdx>=0 ){

    pIdxInfo->aConstraintUsage[stepIdx].argvIndex = ++nArg;

    pIdxInfo->aConstraintUsage[stepIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY;

  }

  if( (idxNum & 3)==3 ){

    /* Both start= and stop= boundaries are available.  This is the 

    ** the preferred case */

    pIdxInfo->estimatedCost = (double)(2 - ((idxNum&4)!=0));

    pIdxInfo->estimatedRows = 1000;

    if( pIdxInfo->nOrderBy==1 ){

      if( pIdxInfo->aOrderBy[0].desc ) idxNum |= 8;

      pIdxInfo->orderByConsumed = 1;

    }

  }else{

    /* If either boundary is missing, we have to generate a huge span

    ** of numbers.  Make this case very expensive so that the query

    ** planner will work hard to avoid it. */

    pIdxInfo->estimatedCost = (double)2147483647;

    pIdxInfo->estimatedRows = 2147483647;

  }

  pIdxInfo->idxNum = idxNum;

  return SQLITE_OK;

}

/*

** This following structure defines all the methods for the 

** generate_series virtual table.

*/

static sqlite3_module seriesModule = {

  0,                         /* iVersion */

  0,                         /* xCreate */

  seriesConnect,             /* xConnect */

  seriesBestIndex,           /* xBestIndex */

  seriesDisconnect,          /* xDisconnect */

  0,                         /* xDestroy */

  seriesOpen,                /* xOpen - open a cursor */

  seriesClose,               /* xClose - close a cursor */

  seriesFilter,              /* xFilter - configure scan constraints */

  seriesNext,                /* xNext - advance a cursor */

  seriesEof,                 /* xEof - check for end of scan */

  seriesColumn,              /* xColumn - read data */

  seriesRowid,               /* xRowid - read data */

  0,                         /* xUpdate */

  0,                         /* xBegin */

  0,                         /* xSync */

  0,                         /* xCommit */

  0,                         /* xRollback */

  0,                         /* xFindMethod */

  0,                         /* xRename */

};

/* END the generate_series(START,END,STEP) implementation

*********************************************************************************/

/*

** Print sketchy documentation for this utility program

*/

static void showHelp(void){

  printf("Usage: %s [options] ?FILE...?\n", g.zArgv0);

  printf(

"Read SQL text from FILE... (or from standard input if FILE... is omitted)\n"

"and then evaluate each block of SQL contained therein.\n"

"Options:\n"

"  --autovacuum          Enable AUTOVACUUM mode\n"

"  --database FILE       Use database FILE instead of an in-memory database\n"

"  --disable-lookaside   Turn off lookaside memory\n"

"  --heap SZ MIN         Memory allocator uses SZ bytes & min allocation MIN\n"

"  --help                Show this help text\n"    

"  --lookaside N SZ      Configure lookaside for N slots of SZ bytes each\n"

"  --oom                 Run each test multiple times in a simulated OOM loop\n"

"  --pagesize N          Set the page size to N\n"

"  --pcache N SZ         Configure N pages of pagecache each of size SZ bytes\n"

"  -q                    Reduced output\n"

"  --quiet               Reduced output\n"

"  --scratch N SZ        Configure scratch memory for N slots of SZ bytes each\n"

"  --unique-cases FILE   Write all unique test cases to FILE\n"

"  --utf16be             Set text encoding to UTF-16BE\n"

"  --utf16le             Set text encoding to UTF-16LE\n"

"  -v                    Increased output\n"

"  --verbose             Increased output\n"

  );

}

/*

** Return the value of a hexadecimal digit.  Return -1 if the input

** is not a hex digit.

*/

static int hexDigitValue(char c){

  if( c>='0' && c<='9' ) return c - '0';

  if( c>='a' && c<='f' ) return c - 'a' + 10;

  if( c>='A' && c<='F' ) return c - 'A' + 10;

  return -1;

}

/*

** Interpret zArg as an integer value, possibly with suffixes.

*/

static int integerValue(const char *zArg){

  sqlite3_int64 v = 0;

  static const struct { char *zSuffix; int iMult; } aMult[] = {

    { "KiB", 1024 },

    { "MiB", 1024*1024 },

    { "GiB", 1024*1024*1024 },

    { "KB",  1000 },

    { "MB",  1000000 },

    { "GB",  1000000000 },

    { "K",   1000 },

    { "M",   1000000 },

    { "G",   1000000000 },

  };

  int i;

  int isNeg = 0;

  if( zArg[0]=='-' ){

    isNeg = 1;

    zArg++;

  }else if( zArg[0]=='+' ){

    zArg++;

  }

  if( zArg[0]=='0' && zArg[1]=='x' ){

    int x;

    zArg += 2;

    while( (x = hexDigitValue(zArg[0]))>=0 ){

      v = (v<<4) + x;

      zArg++;

    }

  }else{

    while( ISDIGIT(zArg[0]) ){

      v = v*10 + zArg[0] - '0';

      zArg++;

    }

  }

  for(i=0; i

    if( sqlite3_stricmp(aMult[i].zSuffix, zArg)==0 ){

      v *= aMult[i].iMult;

      break;

    }

  }

  if( v>0x7fffffff ) abendError("parameter too large - max 2147483648");

  return (int)(isNeg? -v : v);

}

/* Return the current wall-clock time */

static sqlite3_int64 timeOfDay(void){

  static sqlite3_vfs *clockVfs = 0;

  sqlite3_int64 t;

  if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0);

  if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){

    clockVfs->xCurrentTimeInt64(clockVfs, &t);

  }else{

    double r;

    clockVfs->xCurrentTime(clockVfs, &r);

    t = (sqlite3_int64)(r*86400000.0);

  }

  return t;

}

int main(int argc, char **argv){

  char *zIn = 0;                /* Input text */

  int nAlloc = 0;               /* Number of bytes allocated for zIn[] */

  int nIn = 0;                  /* Number of bytes of zIn[] used */

  size_t got;                   /* Bytes read from input */

  int rc = SQLITE_OK;           /* Result codes from API functions */

  int i;                        /* Loop counter */

  int iNext;                    /* Next block of SQL */

  sqlite3 *db;                  /* Open database */

  char *zErrMsg = 0;            /* Error message returned from sqlite3_exec() */

  const char *zEncoding = 0;    /* --utf16be or --utf16le */

  int nHeap = 0, mnHeap = 0;    /* Heap size from --heap */

  int nLook = 0, szLook = 0;    /* --lookaside configuration */

  int nPCache = 0, szPCache = 0;/* --pcache configuration */

  int nScratch = 0, szScratch=0;/* --scratch configuration */

  int pageSize = 0;             /* Desired page size.  0 means default */

  void *pHeap = 0;              /* Allocated heap space */

  void *pLook = 0;              /* Allocated lookaside space */

  void *pPCache = 0;            /* Allocated storage for pcache */

  void *pScratch = 0;           /* Allocated storage for scratch */

  int doAutovac = 0;            /* True for --autovacuum */

  char *zSql;                   /* SQL to run */

  char *zToFree = 0;            /* Call sqlite3_free() on this afte running zSql */

  int verboseFlag = 0;          /* --verbose or -v flag */

  int quietFlag = 0;            /* --quiet or -q flag */

  int nTest = 0;                /* Number of test cases run */

  int multiTest = 0;            /* True if there will be multiple test cases */

  int lastPct = -1;             /* Previous percentage done output */

  sqlite3 *dataDb = 0;          /* Database holding compacted input data */

  sqlite3_stmt *pStmt = 0;      /* Statement to insert testcase into dataDb */

  const char *zDataOut = 0;     /* Write compacted data to this output file */

  int nHeader = 0;              /* Bytes of header comment text on input file */

  int oomFlag = 0;              /* --oom */

  int oomCnt = 0;               /* Counter for the OOM loop */

  char zErrBuf[200];            /* Space for the error message */

  const char *zFailCode;        /* Value of the TEST_FAILURE environment var */

  const char *zPrompt;          /* Initial prompt when large-file fuzzing */

  int nInFile = 0;              /* Number of input files to read */

  char **azInFile = 0;          /* Array of input file names */

  int jj;                       /* Loop counter for azInFile[] */

  sqlite3_int64 iBegin;         /* Start time for the whole program */

  sqlite3_int64 iStart, iEnd;   /* Start and end-times for a test case */

  const char *zDbName = 0;      /* Name of an on-disk database file to open */

  iBegin = timeOfDay();

  sqlite3_shutdown();

  zFailCode = getenv("TEST_FAILURE");

  g.zArgv0 = argv[0];

  zPrompt = "<stdin>";

  for(i=1; i

    const char *z = argv[i];

    if( z[0]=='-' ){

      z++;

      if( z[0]=='-' ) z++;

      if( strcmp(z,"autovacuum")==0 ){

        doAutovac = 1;

      }else

      if( strcmp(z,"database")==0 ){

        if( i>=argc-1 ) abendError("missing argument on %s\n", argv[i]);

        zDbName = argv[i+1];

        i += 1;

      }else

      if( strcmp(z,"disable-lookaside")==0 ){

        nLook = 1;

        szLook = 0;

      }else

      if( strcmp(z, "f")==0 && i+1

        i++;

        goto addNewInFile;

      }else

      if( strcmp(z,"heap")==0 ){

        if( i>=argc-2 ) abendError("missing arguments on %s\n", argv[i]);

        nHeap = integerValue(argv[i+1]);

        mnHeap = integerValue(argv[i+2]);

        i += 2;

      }else

      if( strcmp(z,"help")==0 ){

        showHelp();

        return 0;

      }else

      if( strcmp(z,"lookaside")==0 ){

        if( i>=argc-2 ) abendError("missing arguments on %s", argv[i]);

        nLook = integerValue(argv[i+1]);

        szLook = integerValue(argv[i+2]);

        i += 2;

      }else

      if( strcmp(z,"oom")==0 ){

        oomFlag = 1;

      }else

      if( strcmp(z,"pagesize")==0 ){

        if( i>=argc-1 ) abendError("missing argument on %s", argv[i]);

        pageSize = integerValue(argv[++i]);