merge main: fuzz harness, sanitizer ci, license

Author: Aly700

.github/workflows/ci.yml

@@ -20,3 +20,52 @@ jobs:
         run: cmake --build build --parallel
       - name: Test
         run: ctest --test-dir build --output-on-failure
+
+  sanitizers:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure
+        run: >-
+          cmake -S . -B build-sanitizers
+          -DCMAKE_BUILD_TYPE=Debug
+          -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer"
+      - name: Build
+        run: cmake --build build-sanitizers --parallel 2
+      - name: Test
+        run: ctest --test-dir build-sanitizers --output-on-failure
+
+  fuzz:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure
+        run: cmake -S . -B build-fuzz -DCMAKE_BUILD_TYPE=Debug -DSQL_ENGINE_BUILD_FUZZER=ON
+      - name: Build
+        run: cmake --build build-fuzz --target sql_parser_planner_fuzz --parallel 2
+      - name: Replay corpus (regression gate)
+        run: ./build-fuzz/sql_parser_planner_fuzz -timeout=10 fuzz/corpus/*
+      - name: Short discovery session (non-blocking)
+        continue-on-error: true
+        run: >-
+          ./build-fuzz/sql_parser_planner_fuzz fuzz/corpus
+          -max_total_time=90
+          -timeout=10
+          -rss_limit_mb=2048
+          -print_final_stats=1
+      - name: Upload discovery artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: |
+            crash-*
+            timeout-*
+            oom-*
+          if-no-files-found: ignore

CMakeLists.txt

@@ -5,6 +5,8 @@ set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
+option(SQL_ENGINE_BUILD_FUZZER "Build the parser and planner fuzz target" OFF)
+
 add_library(sql_engine
     src/sql/parser.cpp
     src/sql/binder.cpp
@@ -20,6 +22,21 @@ add_library(sql_engine
 target_include_directories(sql_engine PUBLIC include)
 target_compile_options(sql_engine PRIVATE -Wall -Wextra -Wpedantic)
 
+if(SQL_ENGINE_BUILD_FUZZER)
+    if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+        message(FATAL_ERROR "SQL_ENGINE_BUILD_FUZZER requires Clang")
+    endif()
+    target_compile_options(sql_engine PRIVATE
+        -fsanitize=fuzzer-no-link,address,undefined
+        -fno-sanitize-recover=all
+        -fno-omit-frame-pointer
+    )
+    target_link_options(sql_engine INTERFACE
+        -fsanitize=address,undefined
+        -fno-sanitize-recover=all
+    )
+endif()
+
 add_executable(sql_smoke tests/smoke.cpp)
 target_link_libraries(sql_smoke PRIVATE sql_engine)
 
@@ -50,6 +67,20 @@ target_link_libraries(sql_bench PRIVATE sql_engine)
 add_executable(yard_export benchmarks/yard_export.cpp)
 target_link_libraries(yard_export PRIVATE sql_engine)
 
+if(SQL_ENGINE_BUILD_FUZZER)
+    add_executable(sql_parser_planner_fuzz fuzz/parser_planner_fuzz.cpp)
+    target_link_libraries(sql_parser_planner_fuzz PRIVATE sql_engine)
+    target_compile_options(sql_parser_planner_fuzz PRIVATE
+        -fsanitize=fuzzer,address,undefined
+        -fno-sanitize-recover=all
+        -fno-omit-frame-pointer
+    )
+    target_link_options(sql_parser_planner_fuzz PRIVATE
+        -fsanitize=fuzzer,address,undefined
+        -fno-sanitize-recover=all
+    )
+endif()
+
 include(CTest)
 add_test(NAME sql_smoke COMMAND sql_smoke)
 add_test(NAME sql_golden COMMAND sql_golden)

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affan Yasir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -16,6 +16,9 @@ C++20, CMake, Arrow-like in-memory column batches, SIMD-friendly operator interf
 cmake -S . -B build && cmake --build build && ctest --test-dir build --output-on-failure
 ```
 
+Linux CI runs the full test suite with address and undefined-behavior sanitizers.
+Continuous parser and planner fuzzing replays known queries before a timed fuzzing run.
+
 `yard_export` writes `docs/yard/yard-routes.json`: every memo alternative for four workings, priced by the cost model and timed through vectorized execution. See the "Yard Routes" section of `docs/benchmarks.md`.
 
 ## Phase map

fuzz/corpus/aggregate_having.sql

@@ -0,0 +1 @@
+SELECT a, SUM(b) AS total FROM t GROUP BY a HAVING SUM(b) >= 20 ORDER BY total DESC

fuzz/corpus/anti_join.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a NOT IN (SELECT a FROM t1)

fuzz/corpus/basic.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a = 2

fuzz/corpus/boolean_tree.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE a = 1 AND (b = 20 OR a = 3)

fuzz/corpus/correlated_exists.sql

@@ -0,0 +1 @@
+SELECT a FROM t WHERE EXISTS (SELECT t1.b FROM t1 WHERE t1.a = t.a)

fuzz/corpus/correlated_not_in.sql

@@ -0,0 +1 @@
+SELECT b FROM t WHERE b NOT IN (SELECT t1.b FROM t1 WHERE t1.a = t.a)