Skip to content

Commit 40233ea

Browse files
authored
Make polygonToCells fuzzer test portable across endianness (#964) (#1182)
The fuzzer_crash regression test built its polygon by reinterpreting a raw byte buffer as LatLng doubles (verts = (LatLng *)data), so the decoded vertices -- and the resulting cell count -- depended on the host's floating-point byte order. On big-endian architectures the same bytes decode to different doubles (the first vertex's latitude is even NaN), so maxPolygonToCellsSizeExperimental returns sz=3 instead of 1 and the sz == 1 assertion fails. Specify the vertices as explicit hex-float literals (the exact values the original bytes decoded to) so the test uses identical input on every architecture. This keeps the sz == 1 check meaningful and reproduces the original fuzzer scenario everywhere. Verified on a native big-endian POWER8 (ppc64) host: the test passes, and it continues to pass on little-endian.
1 parent e88769b commit 40233ea

2 files changed

Lines changed: 12 additions & 10 deletions

File tree

CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ The public API of this library consists of the functions declared in file
66
[h3api.h.in](./src/h3lib/include/h3api.h.in).
77

88
## [Unreleased]
9+
### Fixed
10+
- Fixed the `polygonToCells` fuzzer regression test to use explicit double literals instead of reinterpreting raw bytes, so it is portable across endianness (#964)
911

1012
## [4.5.0] - 2026-05-21
1113
### Added

src/apps/testapps/testPolygonToCellsReportedExperimental.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,22 +30,22 @@
3030
SUITE(polygonToCells_reported) {
3131
// fuzzer crash due to inconsistent handling of CONTAINMENT_OVERLAPPING
3232
TEST(fuzzer_crash) {
33-
uint8_t data[] = {
34-
0xff, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
35-
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0xff,
36-
0xff, 0x0, 0x0, 0x0, 0xa, 0xa, 0xa, 0xa, 0xa, 0xff,
33+
// The vertices below are the exact doubles that the original fuzzer
34+
// input (a raw byte buffer reinterpreted as LatLng) decoded to on a
35+
// little-endian host. Spelling them out as hex-float literals makes
36+
// the test decode identical values on every architecture regardless
37+
// of byte order, instead of reinterpreting raw bytes (see #964).
38+
LatLng verts[] = {
39+
{0x0.000000000ffffp-1022, 0x0p+0},
40+
{0x1.fff00000ap-1008, -0x1.a0a0a0a0ap+1009},
3741
};
3842

3943
uint8_t res = 0;
40-
size_t vertsSize = sizeof(data);
41-
int numVerts = vertsSize / sizeof(LatLng);
42-
4344
GeoPolygon geoPolygon;
4445
geoPolygon.numHoles = 0;
4546
geoPolygon.holes = NULL;
46-
geoPolygon.geoloop.numVerts = numVerts;
47-
// Offset by 1 since *data was used for `res`, above.
48-
geoPolygon.geoloop.verts = (LatLng *)(data);
47+
geoPolygon.geoloop.numVerts = 2;
48+
geoPolygon.geoloop.verts = verts;
4949

5050
uint32_t flags = CONTAINMENT_OVERLAPPING;
5151
int64_t sz;

0 commit comments

Comments
 (0)