• Victor Costan's avatar
    sqlite: Disable unused features via compile-time options. · a02af906
    Victor Costan authored
    This is a reland of b05f99c3. Unlike the
    original, this CL does not enable SQLITE_OMIT_AUTOINIT, to avoid the
    crashes caused by the problem being addressed in
    https://crrev.com/c/894692
    
    This CL shrinks the Linux binary by 26KB (139,005,496 to 138,979,176).
    Code savings aside, this makes sure we don't unintentionally start
    depending on these features.
    
    The following compile-time options are recommended in the SQLite
    documentation [1]:
    
    * SQLITE_LIKE_DOESNT_MATCH_BLOBS - The LIKE and GLOB operators don't
      work on BLOB columns. This access pattern would be a performance
      wrench, so it's nice to fail hard here.
    * SQLITE_OMIT_DEPRECATED - This removes support for deprecated SQLite
      APIs. Note that SQLite promises to maintain indefinite backwards
      compatbility for SQL queries (modulo features disabled via
      compile-time options), so this only applies to the SQLite API. We
      should never be using deprecated APIs.
    * SQLITE_OMIT_PROGRESS_CALLBACK - Remove sqlite3_progress_handler(). We
      don't use this feature, and the documentation says it comes with a
      small performance penalty.
    * SQLITE_OMIT_SHARED_CACHE - Using a shared cache sounds nice from a
      memory consumption standpoint, and we already do that for LevelDB.
      Unfortunately, Chromium's SQLite databases use a variety of page
      sizes, which makes cache sharing impossible.
    * SQLITE_USE_ALLOCA - Use alloca() instead of malloc() for allocating
      temporary spaces in functions. All of Chrome's platforms support this
      option, and it results in a slightly smaller binary and less heap churn.
    
    The following compile-time options disable features that happen not to
    be used.
    
    * SQLITE_OMIT_AUTORESET: We calls sqlite3_reset() correctly to reset prepared
      statements.
    * SQLITE_OMIT_GET_TABLE: We don't use sqlite3_{get,free}_table().
    * SQLITE_OMIT_LOAD_EXTENSION: We don't use sqlite3_{enable_}load_extension().
      Asides from the code savings, there's a tiny security benefit to
      knowing that extension loading code is definitely not reachable from WebSQL.
    * SQLITE_OMIT_TCL_VARIABLE: We don't use TCL variables.
    * SQLITE_OMIT_TRACE: We don't use sqlite3_{profile,trace}().
    
    [1] https://www.sqlite.org/compile.html#recommended_compile_time_options
    
    Bug: 807093
    Change-Id: Ic7510b32f96d5d3f98f8c5a9ba522478ad728ad0
    Reviewed-on: https://chromium-review.googlesource.com/894708
    Commit-Queue: Victor Costan <pwnall@chromium.org>
    Reviewed-by: default avatarChris Mumford <cmumford@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#534884}
    a02af906
ossfuzz.c 5.85 KB