Polygon to cells experimental fuzzer #800
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,6 +10,7 @@ | |
| /lib/ | ||
| # Travis CI build directory | ||
| /build/ | ||
| /build*/ | ||
| # Local build directories | ||
| /Debug/ | ||
| /Release/ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| /* | ||
| * Copyright 2023-2024 Uber Technologies, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| /** @file | ||
| * @brief Fuzzer program for polygonToCells2 and related functions | ||
| */ | ||
|
|
||
| #include "aflHarness.h" | ||
| #include "h3api.h" | ||
| #include "polyfill.h" | ||
| #include "polygon.h" | ||
| #include "utility.h" | ||
|
|
||
| typedef struct { | ||
| int res; | ||
| int numHoles; | ||
| // repeating: num verts, verts | ||
| // We add a large fixed buffer so our test case generator for AFL | ||
| // knows how large to make the file. | ||
| uint8_t buffer[1024]; | ||
| } inputArgs; | ||
|
|
||
| const int MAX_RES = 15; | ||
| const int MAX_SZ = 4000000; | ||
| const int MAX_HOLES = 100; | ||
|
|
||
| int populateGeoLoop(GeoLoop *g, const uint8_t *data, size_t *offset, | ||
| size_t size) { | ||
| if (size < *offset + sizeof(int)) { | ||
| return 1; | ||
| } | ||
| int numVerts = *(const int *)(data + *offset); | ||
| *offset = *offset + sizeof(int); | ||
| g->numVerts = numVerts; | ||
| if (size < *offset + sizeof(LatLng) * numVerts) { | ||
| return 1; | ||
| } | ||
| g->verts = (LatLng *)(data + *offset); | ||
| *offset = *offset + sizeof(LatLng) * numVerts; | ||
| return 0; | ||
| } | ||
|
|
||
| void run(GeoPolygon *geoPolygon, uint32_t flags, int res) { | ||
| int64_t sz; | ||
| H3Error err = H3_EXPORT(maxPolygonToCellsSizeExperimental)(geoPolygon, res, | ||
| flags, &sz); | ||
| if (!err && sz < MAX_SZ) { | ||
| H3Index *out = calloc(sz, sizeof(H3Index)); | ||
| H3_EXPORT(polygonToCellsExperimental)(geoPolygon, res, flags, out); | ||
| free(out); | ||
| } | ||
| } | ||
|
|
||
| int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { | ||
| // TODO: It is difficult for the fuzzer to generate inputs that are | ||
| // considered valid by this fuzzer. fuzzerPolygonToCellsNoHoles.c | ||
| // is a workaround for that. | ||
| if (size < sizeof(inputArgs)) { | ||
| return 0; | ||
| } | ||
| const inputArgs *args = (const inputArgs *)data; | ||
| int res = args->res % (MAX_RES + 1); | ||
|
|
||
| GeoPolygon geoPolygon; | ||
| int originalNumHoles = args->numHoles % MAX_HOLES; | ||
| geoPolygon.numHoles = originalNumHoles; | ||
| if (geoPolygon.numHoles < 0) { | ||
| return 0; | ||
| } | ||
| geoPolygon.holes = calloc(geoPolygon.numHoles, sizeof(GeoLoop)); | ||
| size_t offset = sizeof(inputArgs) - sizeof(args->buffer); | ||
| if (populateGeoLoop(&geoPolygon.geoloop, data, &offset, size)) { | ||
| free(geoPolygon.holes); | ||
| return 0; | ||
| } | ||
| for (int i = 0; i < geoPolygon.numHoles; i++) { | ||
| if (populateGeoLoop(&geoPolygon.holes[i], data, &offset, size)) { | ||
| free(geoPolygon.holes); | ||
| return 0; | ||
| } | ||
| } | ||
|
|
||
| for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) { | ||
| geoPolygon.numHoles = originalNumHoles; | ||
| run(&geoPolygon, flags, res); | ||
| geoPolygon.numHoles = 0; | ||
| run(&geoPolygon, flags, res); | ||
| } | ||
| free(geoPolygon.holes); | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| AFL_HARNESS_MAIN(sizeof(inputArgs)); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| * Copyright 2023-2024 Uber Technologies, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| /** @file | ||
| * @brief Fuzzer program for polygonToCellsExperimental and related functions, | ||
| * without holes | ||
| */ | ||
|
|
||
| #include "aflHarness.h" | ||
| #include "h3api.h" | ||
| #include "polyfill.h" | ||
| #include "polygon.h" | ||
| #include "utility.h" | ||
|
|
||
| const int MAX_RES = 15; | ||
| const int MAX_SZ = 4000000; | ||
|
|
||
| void run(GeoPolygon *geoPolygon, uint32_t flags, int res) { | ||
| int64_t sz; | ||
| H3Error err = H3_EXPORT(maxPolygonToCellsSizeExperimental)(geoPolygon, res, | ||
| flags, &sz); | ||
| if (!err && sz < MAX_SZ) { | ||
| H3Index *out = calloc(sz, sizeof(H3Index)); | ||
| H3_EXPORT(polygonToCellsExperimental)(geoPolygon, res, flags, out); | ||
| free(out); | ||
| } | ||
| } | ||
|
|
||
| int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { | ||
| if (size < sizeof(int)) { | ||
| return 0; | ||
| } | ||
|
|
||
| uint8_t res = *data; | ||
| size_t vertsSize = size - 1; | ||
| int numVerts = vertsSize / sizeof(LatLng); | ||
|
|
||
| GeoPolygon geoPolygon; | ||
| geoPolygon.numHoles = 0; | ||
| geoPolygon.holes = NULL; | ||
| geoPolygon.geoloop.numVerts = numVerts; | ||
| // Offset by 1 since *data was used for `res`, above. | ||
| geoPolygon.geoloop.verts = (LatLng *)(data + 1); | ||
|
|
||
| for (uint32_t flags = 0; flags < CONTAINMENT_INVALID; flags++) { | ||
| run(&geoPolygon, flags, res); | ||
| } | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| AFL_HARNESS_MAIN(sizeof(H3Index) * 1024); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm. These additional checks might get the fuzzer to pass, but they miss the point of
CONTAINMENT_OVERLAPPING_BBOX, which is to do a much faster check thanCONTAINMENT_OVERLAPPING. The perf impact here is likely significant, since we're going from a fast bbox check to a slow set of polygon-based checks.Are all of these additional checks needed to make the fuzzer pass? Or can we narrow down to find the check that's actually missed by
CONTAINMENT_OVERLAPPING_BBOX?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All but the change around line 511 seem to be necessary to prevent crashes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I admit that I'm not seeing any significant differences in the benchmarks after this change, assuming I'm running them correctly. I think I'm ok with this to get the new algo out the door, though I'd really like to look through the logic here and understand what's missing in the bbox check - it doesn't make a lot of sense to me conceptually that these would work when the bbox doesn't, so we must be messing up the bbox check in some way.