Add polygonToCellsNoHoles fuzzer

CMakeLists.txt

@@ -240,6 +240,7 @@ set(OTHER_SOURCE_FILES
     src/apps/fuzzers/fuzzerDirectedEdge.c
     src/apps/fuzzers/fuzzerLocalIj.c
     src/apps/fuzzers/fuzzerPolygonToCells.c
+    src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c
     src/apps/benchmarks/benchmarkPolygonToCells.c
     src/apps/benchmarks/benchmarkPolygon.c
     src/apps/benchmarks/benchmarkH3SetToLinkedGeo.c
@@ -678,6 +679,7 @@ if(BUILD_FUZZERS)
     add_h3_fuzzer(fuzzerDirectedEdge src/apps/fuzzers/fuzzerDirectedEdge.c)
     add_h3_fuzzer(fuzzerLocalIj src/apps/fuzzers/fuzzerLocalIj.c)
     add_h3_fuzzer(fuzzerPolygonToCells src/apps/fuzzers/fuzzerPolygonToCells.c)
+    add_h3_fuzzer(fuzzerPolygonToCellsNoHoles src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c)
 endif()
 
 if(BUILD_BENCHMARKS)

src/apps/fuzzers/fuzzerPolygonToCells.c

@@ -25,7 +25,7 @@ typedef struct {
     int res;
     int numHoles;
     // repeating: num verts, verts
-    // We add a large fixed buffer so our test case generator for AL
+    // We add a large fixed buffer so our test case generator for AFL
     // knows how large to make the file.
     uint8_t buffer[1024];
 } inputArgs;
@@ -65,6 +65,8 @@ void run(GeoPolygon *geoPolygon, int res) {
 }
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    // TODO: It is difficult for the fuzzer to generate inputs that are
+    // considered valid by this fuzzer.
     if (size < sizeof(inputArgs)) {
         return 0;
     }
@@ -77,7 +79,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         return 0;
     }
     geoPolygon.holes = calloc(geoPolygon.numHoles, sizeof(GeoLoop));
-    size_t offset = sizeof(inputArgs);
+    size_t offset = sizeof(inputArgs) - sizeof(args->buffer);
     if (populateGeoLoop(&geoPolygon.geoloop, data, &offset, size)) {
         free(geoPolygon.holes);
         return 0;

src/apps/fuzzers/fuzzerPolygonToCellsNoHoles.c

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2022 Uber Technologies, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** @file
+ * @brief Fuzzer program for polygonToCells and related functions, without holes
+ */
+
+#include "aflHarness.h"
+#include "h3api.h"
+#include "utility.h"
+
+const int MAX_RES = 15;
+const int MAX_SZ = 4000000;
+
+void run(GeoPolygon *geoPolygon, int res) {
+    int64_t sz;
+    H3Error err = H3_EXPORT(maxPolygonToCellsSize)(geoPolygon, res, &sz);
+    if (!err && sz < MAX_SZ) {
+        if (sz < 0) {
+            // TODO: Check on this once rebased
+            printf("Oh no - sz is negative\n");
+        }
+        H3Index *out = calloc(sz, sizeof(H3Index));
+        H3_EXPORT(polygonToCells)(geoPolygon, res, out);
+        free(out);
+    }
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < sizeof(int)) {
+        return 0;
+    }
+
+    uint8_t res = *data;
+    size_t vertsSize = size - 1;
+    int numVerts = vertsSize / sizeof(LatLng);
+
+    GeoPolygon geoPolygon;
+    geoPolygon.numHoles = 0;
+    geoPolygon.holes = NULL;
+    geoPolygon.geoloop.numVerts = numVerts;
+    geoPolygon.geoloop.verts = (LatLng *)(data + 1);
+
+    run(&geoPolygon, res);
+
+    return 0;
+}
+
+AFL_HARNESS_MAIN(sizeof(H3Index) * 1024);