Relational databases are used ubiquitously. They are managed by database management systems (DBMS), which allow inserting, modifying, and querying data using a domain-specific language called Structured Query Language (SQL). Popular DBMS have been extensively tested by fuzzers, which have been successful in finding crash bugs. However, approaches to finding logic bugs, such as when a DBMS computes an incorrect result set, have remained mostly untackled. Differential testing is an effective technique to test systems that support a common language by comparing the outputs of these systems. However, this technique is ineffective for DBMS, because each DBMS typically supports its own SQL dialect. To this end, we devised a novel and general approach that we have termed Pivoted Query Synthesis. The core idea of this approach is to automatically generate queries for which we ensure that they fetch a specific, randomly selected row, called the pivot row. If the DBMS fails to fetch the pivot row, the likely cause is a bug in the DBMS. We tested our approach on three widely-used and mature DBMS, namely SQLite, MySQL, and PostgreSQL. In total, we reported 123 bugs in these DBMS, 99 of which have been fixed or verified, demonstrating that the approach is highly effective and general. We expect that the wide applicability and simplicity of our approach will enable the improvement of robustness of many DBMS.

中文翻译：

---

通过 Pivoted Query Synthesis 测试数据库引擎

关系数据库被广泛使用。它们由数据库管理系统 (DBMS) 管理，允许使用称为结构化查询语言 (SQL) 的特定领域语言插入、修改和查询数据。流行的 DBMS 已经过模糊器的广泛测试，已经成功地发现了崩溃错误。然而，查找逻辑错误的方法，例如当 DBMS 计算出错误的结果集时，大多仍未解决。差异测试是通过比较这些系统的输出来测试支持公共语言的系统的有效技术。但是，这种技术对 DBMS 无效，因为每个 DBMS 通常都支持自己的 SQL 方言。为此，我们设计了一种新颖的通用方法，我们称之为 Pivoted Query Synthesis。这种方法的核心思想是自动生成查询，我们确保它们获取特定的、随机选择的行，称为枢轴行。如果 DBMS 无法获取数据透视行，则可能的原因是 DBMS 中的错误。我们在三个广泛使用且成熟的 DBMS 上测试了我们的方法，即 SQLite、MySQL 和 PostgreSQL。我们总共报告了这些 DBMS 中的 123 个错误，其中 99 个已修复或验证，表明该方法非常有效和通用。我们期望我们的方法的广泛适用性和简单性能够提高许多 DBMS 的健壮性。我们在三个广泛使用且成熟的 DBMS 上测试了我们的方法，即 SQLite、MySQL 和 PostgreSQL。我们总共报告了这些 DBMS 中的 123 个错误，其中 99 个已修复或验证，表明该方法非常有效和通用。我们期望我们的方法的广泛适用性和简单性能够提高许多 DBMS 的健壮性。我们在三个广泛使用且成熟的 DBMS 上测试了我们的方法，即 SQLite、MySQL 和 PostgreSQL。我们总共报告了这些 DBMS 中的 123 个错误，其中 99 个已修复或验证，表明该方法非常有效和通用。我们期望我们的方法的广泛适用性和简单性能够提高许多 DBMS 的健壮性。