一句话：提出通用变异模糊测试器 SQLynx，借助结构语料变异与动态实例化实现跨 SQL 方言的 DBMS 测试。
DBMS 复杂度上升易引入缺陷，模糊测试虽有效，但 SQL 方言多样导致现有工具需大量人工适配，且覆盖语法特征有限。SQLynx 是面向多方言 DBMS 的基于变异模糊测试器：通用变异基于 SQL 结构语料重构语句，生成与方言无关的多样语法结构；动态实例化利用目标数据库模式信息，将语句实例化为语义有效查询。作者实现 SQLynx 并在 MySQL、PostgreSQL 等六个常用 DBMS 上评估，总适配代码 1094 行，少于现有 fuzzer。与 Squirrel、BuzzBee、Lego、SQLsmith 相比，24 小时内分支覆盖分别提高 34%、153%、66%、41%，并多触发 8、10、7、10 个 bug。
DBMSs play a critical role in modern software ecosystems, but their increasing complexity inevitably leads to bugs. DBMS fuzzing has proven highly effective in uncovering bugs in DBMSs. However, the diversity of SQL dialects requires extensive manual adaptation to accommodate various grammar features. Moreover, such adaptations limit fuzzing to a narrow range of grammar features, leaving many bugs undetected. In this paper, we propose SQLynx, a mutation-based DBMS fuzzer aiming at generic fuzzing across dialects with generic mutation and dynamic instantiation. The generic mutation reconstructs SQL statements based on a SQL structure corpus, enabling dialect-independent generation of diverse grammar structures. The dynamic instantiation leverages schema information from the target database to instantiate semantically valid statements. We implement SQLynx and evaluate it on six widely used DBMSs, including MySQL and PostgreSQL. Adapting these DBMSs with SQLynx required 1,094 lines of code in total, which is fewer than existing fuzzers. Compared with state-of-the-art DBMS fuzzers Squirrel, BuzzBee, Lego, and SQLsmith, SQLynx covered 34%, 153%, 66%, and 41% more branches, and triggered 8, 10, 7, 10 more bugs in 24 hours, respectively, demonstrating its effectiveness. Video link: https://youtu.be/QHIGF8oDEA4
@inproceedings{MiaoLWFJM26,
title = {SQLynx: Towards Generic Mutation-Based Fuzzing for DBMSs Across Diverse Dialects},
author = {Runpei Miao and Jie Liang and Zhiyong Wu and Jingzhou Fu and Yu Jiang and Shuai Ma},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3806405}
}