Company
Date Published
Author
Pedro Ferreira
Word count
1908
Language
English
Hacker News points
None

Summary

Fuzzing has become a crucial research topic in software development, including databases, to identify issues such as crashes, bad output, and security vulnerabilities. ClickHouse is actively tested with various fuzzers, but there was a notable gap in their capabilities, particularly in generating complex queries while maintaining query correctness. To address this, BuzzHouse, a new fuzzer, has been developed over the past 5 months, which has already found about 100 new issues in ClickHouse. Fuzzing databases is challenging due to the complexity of database systems, including query processing and optimization, data storage, buffer management, and distributed processing. The key challenge lies in generating queries that cover a wide range of scenarios while ensuring query correctness. To overcome this, BuzzHouse employs various strategies, such as using syntax assumptions, simulating user behavior, and adapting to changing database features. By focusing on generating complex yet correct queries and identifying issues beyond simple crashes, BuzzHouse complements the existing suite of tools used to test databases, including AFL and libFuzzer for code coverage-guided fuzzing, SQLsmith for complex query generation, and SQLancer for query correctness. The development of BuzzHouse underscores its value in improving the robustness and reliability of databases like ClickHouse, with over 100 new issues already uncovered.