fuzz the parser and planner pipeline; bound parser nesting and boolean operators so hostile queries report parse errors instead of overflowing the stack

Author: Aly700

.github/workflows/ci.yml

@@ -20,3 +20,52 @@ jobs:
         run: cmake --build build --parallel
       - name: Test
         run: ctest --test-dir build --output-on-failure
+
+  sanitizers:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure
+        run: >-
+          cmake -S . -B build-sanitizers
+          -DCMAKE_BUILD_TYPE=Debug
+          -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer"
+      - name: Build
+        run: cmake --build build-sanitizers --parallel 2
+      - name: Test
+        run: ctest --test-dir build-sanitizers --output-on-failure
+
+  fuzz:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure
+        run: cmake -S . -B build-fuzz -DCMAKE_BUILD_TYPE=Debug -DSQL_ENGINE_BUILD_FUZZER=ON
+      - name: Build
+        run: cmake --build build-fuzz --target sql_parser_planner_fuzz --parallel 2
+      - name: Replay corpus (regression gate)
+        run: ./build-fuzz/sql_parser_planner_fuzz -timeout=10 fuzz/corpus/*
+      - name: Short discovery session (non-blocking)
+        continue-on-error: true
+        run: >-
+          ./build-fuzz/sql_parser_planner_fuzz fuzz/corpus
+          -max_total_time=90
+          -timeout=10
+          -rss_limit_mb=2048
+          -print_final_stats=1
+      - name: Upload discovery artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: |
+            crash-*
+            timeout-*
+            oom-*
+          if-no-files-found: ignore

CMakeLists.txt

@@ -5,6 +5,8 @@ set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
+option(SQL_ENGINE_BUILD_FUZZER "Build the parser and planner fuzz target" OFF)
+
 add_library(sql_engine
     src/sql/parser.cpp
     src/sql/binder.cpp
@@ -20,6 +22,21 @@ add_library(sql_engine
 target_include_directories(sql_engine PUBLIC include)
 target_compile_options(sql_engine PRIVATE -Wall -Wextra -Wpedantic)
 
+if(SQL_ENGINE_BUILD_FUZZER)
+    if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+        message(FATAL_ERROR "SQL_ENGINE_BUILD_FUZZER requires Clang")
+    endif()
+    target_compile_options(sql_engine PRIVATE
+        -fsanitize=fuzzer-no-link,address,undefined
+        -fno-sanitize-recover=all
+        -fno-omit-frame-pointer
+    )
+    target_link_options(sql_engine INTERFACE
+        -fsanitize=address,undefined
+        -fno-sanitize-recover=all
+    )
+endif()
+
 add_executable(sql_smoke tests/smoke.cpp)
 target_link_libraries(sql_smoke PRIVATE sql_engine)
 
@@ -47,6 +64,20 @@ target_link_libraries(sql_optimizer_cost_model PRIVATE sql_engine)
 add_executable(sql_bench benchmarks/sql_bench.cpp)
 target_link_libraries(sql_bench PRIVATE sql_engine)
 
+if(SQL_ENGINE_BUILD_FUZZER)
+    add_executable(sql_parser_planner_fuzz fuzz/parser_planner_fuzz.cpp)
+    target_link_libraries(sql_parser_planner_fuzz PRIVATE sql_engine)
+    target_compile_options(sql_parser_planner_fuzz PRIVATE
+        -fsanitize=fuzzer,address,undefined
+        -fno-sanitize-recover=all
+        -fno-omit-frame-pointer
+    )
+    target_link_options(sql_parser_planner_fuzz PRIVATE
+        -fsanitize=fuzzer,address,undefined
+        -fno-sanitize-recover=all
+    )
+endif()
+
 include(CTest)
 add_test(NAME sql_smoke COMMAND sql_smoke)
 add_test(NAME sql_golden COMMAND sql_golden)

README.md

@@ -16,6 +16,9 @@ C++20, CMake, Arrow-like in-memory column batches, SIMD-friendly operator interf
 cmake -S . -B build && cmake --build build && ctest --test-dir build --output-on-failure
 ```
 
+Linux CI runs the full test suite with address and undefined-behavior sanitizers.
+Continuous parser and planner fuzzing replays known queries before a timed fuzzing run.
+
 ## Phase map
 
 1. Parser, binder, logical algebra, and golden-query oracle.

fuzz/corpus/aggregate_having.sql

@@ -0,0 +1 @@
+SELECT a, SUM(b) AS total FROM t GROUP BY a HAVING SUM(b) >= 20 ORDER BY total DESC

fuzz/corpus/anti_join.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a NOT IN (SELECT a FROM t1)

fuzz/corpus/basic.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a = 2

fuzz/corpus/boolean_tree.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a = 1 AND (b = 20 OR a = 3)

fuzz/corpus/correlated_exists.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE EXISTS (SELECT t1.b FROM t1 WHERE t1.a = t.a)

fuzz/corpus/correlated_not_in.sql

@@ -0,0 +1 @@
+SELECT b FROM t WHERE b NOT IN (SELECT t1.b FROM t1 WHERE t1.a = t.a)

fuzz/corpus/deep_or_chain.sql

@@ -0,0 +1 @@
+select a from t where a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1 or a = 1