uber · isaacbrodsky · Jan 23, 2022 · Dec 22, 2021 · Dec 22, 2021 · Dec 22, 2021
diff --git a/src/apps/fuzzers/fuzzerGridDisk.c b/src/apps/fuzzers/fuzzerGridDisk.c
@@ -26,7 +26,7 @@ typedef struct {
     int64_t k;
 } inputArgs;
 
-const int64_t MAX_GRID_DISK_SIZE = 0x1000000000;
+const int64_t MAX_GRID_DISK_SIZE = 0x10000000;
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     if (size < sizeof(inputArgs)) {

diff --git a/src/apps/testapps/testDirectedEdge.c b/src/apps/testapps/testDirectedEdge.c
@@ -141,6 +141,21 @@ SUITE(directedEdge) {
             "getting the origin from a null index returns error");
     }
 
+    TEST(getDirectedEdgeOriginBadInput) {
+        H3Index sf;
+        t_assertSuccess(H3_EXPORT(latLngToCell)(&sfGeo, 9, &sf));
+        H3Index ring[7] = {0};
+        t_assertSuccess(H3_EXPORT(gridRingUnsafe)(sf, 1, ring));
+        H3Index sf2 = ring[0];
+
+        H3Index edge;
+        t_assertSuccess(H3_EXPORT(cellsToDirectedEdge)(sf, sf2, &edge));
+        H3_SET_RESERVED_BITS(edge, INVALID_DIGIT);
+        H3Index out;
+        t_assert(H3_EXPORT(getDirectedEdgeDestination)(edge, &out) == E_FAILED,
+                 "Invalid directed edge fails");
+    }
+
     TEST(getDirectedEdgeDestination) {
         H3Index hexagon = 0x891ea6d6533ffff;
 

diff --git a/src/apps/testapps/testGridDisk.c b/src/apps/testapps/testGridDisk.c
@@ -329,6 +329,19 @@ SUITE(gridDisk) {
         t_assert(out == origin, "Moving to self goes to self");
     }
 
+    TEST(h3NeighborRotations_invalid) {
+        // This is undefined behavior, but it's helpful for it to make sense.
+        H3Index origin = 0x811d7ffffffffffL;
+        int rotations = 0;
+        H3Index out;
+        t_assert(h3NeighborRotations(origin, -1, &rotations, &out) == E_FAILED,
+                 "Invalid direction fails (-1)");
+        t_assert(h3NeighborRotations(origin, 7, &rotations, &out) == E_FAILED,
+                 "Invalid direction fails (7)");
+        t_assert(h3NeighborRotations(origin, 100, &rotations, &out) == E_FAILED,
+                 "Invalid direction fails (100)");
+    }
+
     TEST(cwOffsetPent) {
         // Try to find a case where h3NeighborRotations would not pass the
         // cwOffsetPent check, and would hit a line marked as unreachable.

diff --git a/src/h3lib/lib/algos.c b/src/h3lib/lib/algos.c
@@ -335,6 +335,9 @@ H3Error h3NeighborRotations(H3Index origin, Direction dir, int *rotations,
                             H3Index *out) {
     H3Index current = origin;
 
+    if (dir < CENTER_DIGIT || dir >= INVALID_DIGIT) {
+        return E_FAILED;
+    }
     for (int i = 0; i < *rotations; i++) {
         dir = _rotate60ccw(dir);
     }
@@ -352,7 +355,6 @@ H3Error h3NeighborRotations(H3Index origin, Direction dir, int *rotations,
     int r = H3_GET_RESOLUTION(current) - 1;
     while (true) {
         if (r == -1) {
-            // TODO: dir may be invalid here (verify via fuzzerDirectedEdge)
             H3_SET_BASE_CELL(current, baseCellNeighbors[oldBaseCell][dir]);
             newRotations = baseCellNeighbor60CCWRots[oldBaseCell][dir];