BAC Honours Thesis

Evocative Expressions for Database System Fuzzing

By David Vuong

Supervised by: Rahul Gopinath and Danushka Liyanage

Abstract

Fuzzing is a useful technique for testing relational database management systems (RDBMs) as it allows for various inputs to be generated and delivered to the RDBMS under test, which allows for monitoring the system under various test cases. Often, programmers may want to control the inputs which are generated by the fuzzer to target particular program behaviours, such as to trigger a particular fault. However, existing RDBMS fuzzing approaches do not primarily support such precise control of inputs. To address this research gap, we apply evocative expressions (Gopinath et al., 2021) – which describe patterns that strings derived from a grammar must follow – to RDBMS fuzzing. In particular, these evocative expressions can be used to specify grammars which generate inputs inducing a partic- ular fault. We evaluate the specialised grammars specified by these evocative expressions, which we call the evocative grammars on 11 failure inducing inputs from MySQL. That is, we created evocative expressions representing the general patterns of these failure inducing inputs which was used to specify our evocative grammars. Our experiments revealed that when fuzzing the evocative grammars, 64.5% of valid inputs reproduced the fault on the MySQL version the bug was detected in. For the evocative grammars which correspond to our unpatched faults, fuzzing such grammars on a newer MySQL version yielded 52.4% of valid inputs triggering the fault, demonstrating fault reproducibility across RDBMS versions. These results demonstrate that evocative expressions can be used to specify grammars which induce known faults within RDBMSs, demonstrating their potential for generating failure inducing in- puts, which can be applied to regression testing and verifying bug fixes.