WIP Polyfill fuzzer

CMakeLists.txt

@@ -272,7 +272,9 @@ set(OTHER_SOURCE_FILES
     src/apps/fuzzers/fuzzerDirectedEdge.c
     src/apps/fuzzers/fuzzerLocalIj.c
     src/apps/fuzzers/fuzzerPolygonToCells.c
+    src/apps/fuzzers/fuzzerPolygonToCellsExperimental.c
     src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c
+    src/apps/fuzzers/fuzzerPolygonToCellsExperimentalNoHoles.c
     src/apps/fuzzers/fuzzerCellToChildPos.c
     src/apps/fuzzers/fuzzerInternalAlgos.c
     src/apps/fuzzers/fuzzerInternalCoordIjk.c
@@ -547,7 +549,9 @@ if(BUILD_FUZZERS)
     add_h3_fuzzer(fuzzerDirectedEdge src/apps/fuzzers/fuzzerDirectedEdge.c)
     add_h3_fuzzer(fuzzerLocalIj src/apps/fuzzers/fuzzerLocalIj.c)
     add_h3_fuzzer(fuzzerPolygonToCells src/apps/fuzzers/fuzzerPolygonToCells.c)
+    add_h3_fuzzer(fuzzerPolygonToCellsExperimental src/apps/fuzzers/fuzzerPolygonToCellsExperimental.c)
     add_h3_fuzzer(fuzzerPolygonToCellsNoHoles src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c)
+    add_h3_fuzzer(fuzzerPolygonToCellsExperimentalNoHoles src/apps/fuzzers/fuzzerPolygonToCellsExperimentalNoHoles.c)
     add_h3_fuzzer(fuzzerCellToChildPos src/apps/fuzzers/fuzzerCellToChildPos.c)
     if(ENABLE_REQUIRES_ALL_SYMBOLS)
         add_h3_fuzzer(fuzzerInternalAlgos src/apps/fuzzers/fuzzerInternalAlgos.c)

scripts/make_countries.js

@@ -170,6 +170,7 @@ for (int res = 0; res < MAX_RES + 1; res++) {
       H3_EXPORT(maxPolygonToCellsSizeExperimental)(&COUNTRIES[index], res, CONTAINMENT_CENTER, &numHexagons);
       hexagons = calloc(numHexagons, sizeof(H3Index));
       H3_EXPORT(polygonToCellsExperimental)(&COUNTRIES[index], res, CONTAINMENT_FULL, hexagons);
+      free(hexagons);
     }
   });
 

src/apps/applib/include/utility.h

@@ -49,6 +49,7 @@ void cellBoundaryPrint(const CellBoundary *b);
 void cellBoundaryPrintln(const CellBoundary *b);
 void bboxPrint(const BBox *bbox);
 void bboxPrintln(const BBox *bbox);
+void geoPolygonPrintln(const GeoPolygon *geoPolygon);
 
 void randomGeo(LatLng *p);
 

src/apps/applib/lib/utility.c

@@ -130,6 +130,42 @@ void bboxPrintln(const BBox *bbox) {
     printf("\n");
 }
 
+static void geoLoopPrint(const GeoLoop *loop) {
+    printf("{\n");
+    printf("  .numVerts = %d", loop->numVerts);
+    if (loop->numVerts > 0) {
+        printf(", .verts = (LatLng[]){\n");
+        for (int v = 0; v < loop->numVerts; v++) {
+            printf("{%.4lf, %.4lf}", loop->verts[v].lat, loop->verts[v].lng);
+            if (v < loop->numVerts - 1) {
+                printf(",\n");
+            }
+        }
+        printf("}");
+    }
+    printf("}");
+}
+
+void geoPolygonPrintln(const GeoPolygon *geoPolygon) {
+    printf("{\n");
+    printf("  .geoloop = ");
+    geoLoopPrint(&(geoPolygon->geoloop));
+    printf(",\n");
+    printf("  .numHoles = %d", geoPolygon->numHoles);
+    if (geoPolygon->numHoles > 0) {
+        printf(",\n  .holes = (GeoLoop[]){");
+        for (int i = 0; i < geoPolygon->numHoles; i++) {
+            geoLoopPrint(&(geoPolygon->holes[i]));
+            if (i < geoPolygon->numHoles - 1) {
+                printf(",");
+            }
+        }
+        printf("}\n");
+    }
+
+    printf("}\n");
+}
+
 /**
  * Apply callback for every unidirectional edge at the given resolution.
  */

src/apps/fuzzers/README.md

@@ -11,16 +11,17 @@ such as the H3 core library.
 
 The public API of H3 is covered in the following fuzzers:
 
-| Function | File or status
-| -------- | --------------
+| Function | File
+| -------- | ----
 | latLngToCell | [fuzzerLatLngToCell](./fuzzerLatLngToCell.c)
 | cellToLatLng |  [fuzzerCellToLatLng](./fuzzerCellToLatLng.c)
 | cellToBoundary | [fuzzerCellToLatLng](./fuzzerCellToLatLng.c)
 | gridDisk | [fuzzerGridDisk](./fuzzerGridDisk.c)
 | gridDiskDistances | [fuzzerGridDisk](./fuzzerGridDisk.c)
 | gridRingUnsafe | [fuzzerGridDisk](./fuzzerGridDisk.c)
 | gridDisksUnsafe | [fuzzerGridDisk](./fuzzerGridDisk.c)
-| polygonToCells | [fuzzerPoylgonToCells](./fuzzerPolygonToCells.c)
+| polygonToCells | [fuzzerPoylgonToCells](./fuzzerPolygonToCells.c) [fuzzerPoylgonToCellsNoHoles](./fuzzerPolygonToCellsNoHoles.c)
+| polygonToCellsExperimental | [fuzzerPoylgonToCellsExperimental](./fuzzerPolygonToCellsExperimental.c) [fuzzerPoylgonToCellsExperimentalNoHoles](./fuzzerPolygonToCellsExperimentalNoHoles.c)
 | h3SetToMultiPolygon | [fuzzerH3SetToLinkedGeo](./fuzzerH3SetToLinkedGeo.c)
 | degsToRads | Trivial
 | radsToDegs | Trivial

src/apps/fuzzers/fuzzerPolygonToCells.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2022 Uber Technologies, Inc.
+ * Copyright 2022-2024 Uber Technologies, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 
 #include "aflHarness.h"
 #include "h3api.h"
+#include "polygon.h"
 #include "utility.h"
 
 typedef struct {
@@ -71,7 +72,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     int res = args->res % (MAX_RES + 1);
 
     GeoPolygon geoPolygon;
-    geoPolygon.numHoles = args->numHoles % MAX_HOLES;
+    int originalNumHoles = args->numHoles % MAX_HOLES;
+    geoPolygon.numHoles = originalNumHoles;
     if (geoPolygon.numHoles < 0) {
         return 0;
     }
@@ -88,10 +90,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         }
     }
 
-    // TODO: Fuzz the `flags` input as well when it has meaningful input
-    run(&geoPolygon, 0, res);
-    geoPolygon.numHoles = 0;
-    run(&geoPolygon, 0, res);
+    for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) {
+        geoPolygon.numHoles = originalNumHoles;
+        run(&geoPolygon, 0, res);
+        geoPolygon.numHoles = 0;
+        run(&geoPolygon, 0, res);
+    }
     free(geoPolygon.holes);
 
     return 0;

src/apps/fuzzers/fuzzerPolygonToCellsExperimental.c

@@ -0,0 +1,145 @@
+/*
+ * Copyright 2023-2024 Uber Technologies, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** @file
+ * @brief Fuzzer program for polygonToCells2 and related functions
+ */
+
+#include "aflHarness.h"
+#include "h3api.h"
+#include "polyfill.h"
+#include "polygon.h"
+#include "utility.h"
+
+typedef struct {
+    int res;
+    int numHoles;
+    // repeating: num verts, verts
+    // We add a large fixed buffer so our test case generator for AFL
+    // knows how large to make the file.
+    uint8_t buffer[1024];
+} inputArgs;
+
+const int MAX_RES = 15;
+const int MAX_SZ = 4000000;
+const int MAX_HOLES = 100;
+
+static GeoPolygon fuzzerFailure = {
+    .geoloop = {.numVerts = 1, .verts = (LatLng[]){{0.000000, 0.000000}}},
+    .numHoles = 5,
+    .holes = (GeoLoop[]){
+        {.numVerts = 9,
+         .verts =
+             (LatLng[]){
+                 {0.000000, -0.000000},
+                 {-0.000000,
+                  2748442886721409313719038754629364176612174103396910975667688045384466158239047111515156119908354033028732640897702389786583276177564900289955662483960102912.000000},
+                 {-0.000000, -0.000000},
+                 {-0.000000, -0.000000},
+                 {-0.000000, -0.000000},
+                 {-0.000000, -0.000000},
+                 {-0.000000, -0.000000},
+                 {-0.000000, 0.000000},
+                 {0.000000, 0.000000}}},
+        {.numVerts = 0},
+        {.numVerts = 0},
+        {.numVerts = 0},
+        {.numVerts = 0}}};
+
+int populateGeoLoop(GeoLoop *g, const uint8_t *data, size_t *offset,
+                    size_t size) {
+    if (size < *offset + sizeof(int)) {
+        return 1;
+    }
+    int numVerts = *(const int *)(data + *offset);
+    *offset = *offset + sizeof(int);
+    g->numVerts = numVerts;
+    if (size < *offset + sizeof(LatLng) * numVerts) {
+        return 1;
+    }
+    g->verts = (LatLng *)(data + *offset);
+    *offset = *offset + sizeof(LatLng) * numVerts;
+    return 0;
+}
+
+static H3Error countPolygonToCellsExperimental(const GeoPolygon *polygon,
+                                               int res, uint32_t flags,
+                                               int64_t *out) {
+    IterCellsPolygon iter = iterInitPolygon(polygon, res, flags);
+    *out = 0;
+    for (; iter.cell; iterStepPolygon(&iter)) *out += 1;
+    return iter.error;
+}
+
+void run(GeoPolygon *geoPolygon, uint32_t flags, int res) {
+    int64_t sz;
+    H3Error err = H3_EXPORT(maxPolygonToCellsSizeExperimental)(geoPolygon, res,
+                                                               flags, &sz);
+
+    geoPolygonPrintln(geoPolygon);
+    printf("estimate: %lld\n", sz);
+    int64_t exact;
+    H3_EXPORT(countPolygonToCellsExperimental)(geoPolygon, res, flags, &exact);
+    printf("exact: %lld\n", exact);
+
+    if (!err && sz < MAX_SZ) {
+        H3Index *out = calloc(sz, sizeof(H3Index));
+        H3_EXPORT(polygonToCellsExperimental)(geoPolygon, res, flags, out);
+        free(out);
+    }
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    // TODO: It is difficult for the fuzzer to generate inputs that are
+    // considered valid by this fuzzer. fuzzerPolygonToCellsNoHoles.c
+    // is a workaround for that.
+    if (size < sizeof(inputArgs)) {
+        return 0;
+    }
+    const inputArgs *args = (const inputArgs *)data;
+    int res = args->res % (MAX_RES + 1);
+
+    GeoPolygon geoPolygon;
+    int originalNumHoles = args->numHoles % MAX_HOLES;
+    geoPolygon.numHoles = originalNumHoles;
+    if (geoPolygon.numHoles < 0) {
+        return 0;
+    }
+    geoPolygon.holes = calloc(geoPolygon.numHoles, sizeof(GeoLoop));
+    size_t offset = sizeof(inputArgs) - sizeof(args->buffer);
+    if (populateGeoLoop(&geoPolygon.geoloop, data, &offset, size)) {
+        free(geoPolygon.holes);
+        return 0;
+    }
+    for (int i = 0; i < geoPolygon.numHoles; i++) {
+        if (populateGeoLoop(&geoPolygon.holes[i], data, &offset, size)) {
+            free(geoPolygon.holes);
+            return 0;
+        }
+    }
+
+    for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) {
+        run(&fuzzerFailure, flags, res);
+        geoPolygon.numHoles = originalNumHoles;
+        run(&geoPolygon, flags, res);
+        geoPolygon.numHoles = 0;
+        run(&geoPolygon, flags, res);
+    }
+    free(geoPolygon.holes);
+
+    return 0;
+}
+
+AFL_HARNESS_MAIN(sizeof(inputArgs));

src/apps/fuzzers/fuzzerPolygonToCellsExperimentalNoHoles.c

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2023-2024 Uber Technologies, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** @file
+ * @brief Fuzzer program for polygonToCellsExperimental and related functions,
+ * without holes
+ */
+
+#include "aflHarness.h"
+#include "h3api.h"
+#include "polyfill.h"
+#include "polygon.h"
+#include "utility.h"
+
+const int MAX_RES = 15;
+const int MAX_SZ = 4000000;
+
+void run(GeoPolygon *geoPolygon, uint32_t flags, int res) {
+    int64_t sz;
+    H3Error err = H3_EXPORT(maxPolygonToCellsSizeExperimental)(geoPolygon, res,
+                                                               flags, &sz);
+    if (!err && sz < MAX_SZ) {
+        H3Index *out = calloc(sz, sizeof(H3Index));
+        H3_EXPORT(polygonToCellsExperimental)(geoPolygon, res, flags, out);
+        free(out);
+    }
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < sizeof(int)) {
+        return 0;
+    }
+
+    uint8_t res = *data;
+    size_t vertsSize = size - 1;
+    int numVerts = vertsSize / sizeof(LatLng);
+
+    GeoPolygon geoPolygon;
+    geoPolygon.numHoles = 0;
+    geoPolygon.holes = NULL;
+    geoPolygon.geoloop.numVerts = numVerts;
+    // Offset by 1 since *data was used for `res`, above.
+    geoPolygon.geoloop.verts = (LatLng *)(data + 1);
+
+    for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) {
+        run(&geoPolygon, flags, res);
+    }
+
+    return 0;
+}
+
+AFL_HARNESS_MAIN(sizeof(H3Index) * 1024);

src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c

@@ -19,6 +19,7 @@
 
 #include "aflHarness.h"
 #include "h3api.h"
+#include "polygon.h"
 #include "utility.h"
 
 const int MAX_RES = 15;
@@ -50,8 +51,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     // Offset by 1 since *data was used for `res`, above.
     geoPolygon.geoloop.verts = (LatLng *)(data + 1);
 
-    // TODO: Fuzz the `flags` input as well when it has meaningful input
-    run(&geoPolygon, 0, res);
+    for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) {
+        run(&geoPolygon, flags, res);
+    }
 
     return 0;
 }