Add fuzz tests for TileCover and fix out of bounds access crash.

2 files changed, 60 insertions, 1 deletions

diff --git a/src/mbgl/util/tile_cover_impl.cpp b/src/mbgl/util/tile_cover_impl.cpp
index f796cc7bd3..799ff2666a 100644
--- a/src/mbgl/util/tile_cover_impl.cpp
+++ b/src/mbgl/util/tile_cover_impl.cpp
@@ -32,6 +32,8 @@ void start_list_on_local_minimum(PointList& points) {
         next_pt++;
         if (next_pt == points.end()) { next_pt = std::next(points.begin()); }
     }
+    if (pt == points.end())
+        return;
     //Re-close linear rings with first_pt = last_pt
     if (points.back() == points.front()) {
         points.pop_back();
diff --git a/test/util/tile_cover.test.cpp b/test/util/tile_cover.test.cpp
index eb65c6686a..72d77450a4 100644
--- a/test/util/tile_cover.test.cpp
+++ b/test/util/tile_cover.test.cpp
@@ -3,7 +3,8 @@
 #include <mbgl/map/transform.hpp>
 
 #include <algorithm>
-
+#include <stdlib.h>     /* srand, rand */
+#include <time.h>       /* time */
 #include <gtest/gtest.h>
 
 using namespace mbgl;
@@ -313,3 +314,59 @@ TEST(TileCount, BoundsCrossingAntimeridian) {
     EXPECT_EQ(4u, util::tileCount(crossingBounds, 3));
     EXPECT_EQ(8u, util::tileCount(crossingBounds, 4));
 }
+
+TEST(TileCover, DISABLED_FuzzPoly) {
+    while(1)
+    {
+        std::srand (time(NULL));
+        std::size_t len = std::rand() % 10000 + 3;
+        Polygon<double> polygon;
+
+        std::size_t num_rings = 1;
+        num_rings += std::rand() % 5;
+        while (num_rings > 0) {
+            LinearRing<double> ring;
+            for (std::size_t i = 0; i < len; ++i) {
+                double x = std::rand() % 180;
+                double y = std::rand() % 90;
+
+                ring.push_back({x,y});
+            }
+            polygon.emplace_back(ring);
+            --num_rings;
+        }
+        
+        std::clog << ".";
+        util::TileCover tc(polygon, 5);
+        while(tc.next()) {
+        };
+    }
+}
+
+TEST(TileCover, DISABLED_FuzzLine) {
+    while(1)
+    {
+        std::srand (time(NULL));
+        std::size_t len = std::rand() % 10000 + 3;
+        MultiLineString<double> mls;
+
+        std::size_t num_lines = 1;
+        num_lines += std::rand() % 5;
+        while (num_lines > 0) {
+            LineString<double> line;
+            for (std::size_t i = 0; i < len; ++i) {
+                double x = std::rand() % 180;
+                double y = std::rand() % 90;
+
+                line.push_back({x,y});
+            }
+            mls.emplace_back(line);
+            --num_lines;
+        }
+        
+        std::clog << ".";
+        util::TileCover tc(mls, 5);
+        while(tc.next()) {
+        };
+    }
+}