SQLite Forum

Bug: Heap Buffer Overflow
Login
Are you not compiling with -DSQLITE_DEBUG?  Adding that #define to your
fuzzer will enable assert() statements in the code, which will often find
these kinds of problems much faster.  In particular, this problem assert()s
before ASAN finds any problems.

When MichaƂ Zalewski first invented [AFL](https://lcamtuf.coredump.cx/afl/),
it used it to finds some bugs in SQLite.  When I suggested he add the
-DSQLITE_DEBUG option, his find rate went way up.  There are over 6000
assert() statements in SQLite.  Enabling them will often find problems that
ASAN, MSAN, and UBSAN miss.