Fix out of bounds read in _baseCellToCCWrot60 for face == NUM_ICOSA_FACES (#978)

[nileshpatil6]

Fixes #978.

The bug

_baseCellToCCWrot60 guards its face argument with:

if (face < 0 || face > NUM_ICOSA_FACES) return INVALID_ROTATIONS;

The table it then indexes is declared as:

static const BaseCellRotation faceIjkBaseCells[NUM_ICOSA_FACES][3][3][3]

so valid indices are 0 .. NUM_ICOSA_FACES - 1. face == NUM_ICOSA_FACES (20) passes the check and the loop reads one whole [3][3][3] row past the end of the array.

The sibling function _faceIjkToBaseCell and friends use the correct >= form; this one is the odd one out.

Reproduction

Built with the same sanitizer flags the repo CI already uses in .github/workflows/test-linux.yml (-fsanitize=address -fno-sanitize-recover=address), calling _baseCellToCCWrot60(16, NUM_ICOSA_FACES):

==ERROR: AddressSanitizer: global-buffer-overflow on address ...
    #0 ... in _baseCellToCCWrot60 src/h3lib/lib/baseCells.c:882

exit code 1. With the fix applied the same binary passes.

Note for reviewers: in a plain non-sanitizer build the added assertion happens to pass without the fix, because the out of bounds read is undefined behaviour that usually returns garbage that does not equal INVALID_ROTATIONS anyway. It is an effective regression test specifically under the ASAN/MSAN/UBSAN/Valgrind jobs this repo already runs on every PR, which is where the bug is actually detectable.

Change

• > becomes >= in the bounds check.
• Regression test in testBaseCellsInternal.c alongside the existing invalid-face assertions.
• CHANGELOG entry.

This is one of the checks called out in #430: "I did not port two of the checks in baseCells.c since I could not readily test them. They could be added in a future PR."

Testing

Full suite under ASAN: 100% tests passed, 0 tests failed out of 317.

[CLAassistant]

All committers have signed the CLA.

[coveralls]

coverage: 99.7%. remained the same — nileshpatil6:fix/basecell-face-oob-978 into uber:master

[nileshpatil6]

Thanks for the review!

Flagging the one red check: LibFuzzer clang failed with SUMMARY: libFuzzer: timeout (exit 70) in fuzzerPolygonToCellsExperimentalNoHoles. I do not think it is related to this change.

• The only non-test caller of _baseCellToCCWrot60 in the library is cellToVertex in vertex.c. polygonToCells and the experimental variants never reach it, so this fuzzer does not exercise the changed line at all.
• For every in-range face (0 through NUM_ICOSA_FACES - 1) the old and new conditions are identical; the only input whose behavior changes is face == NUM_ICOSA_FACES, which previously read out of bounds.
• The same job failed with the same libFuzzer: timeout signature on a plain push to master in run 31322611252 (2026-08-09), with no pull request involved.

Happy to rebase or push an empty commit if you would like the fuzzer job re-run, though that would dismiss the approval, so I would rather leave it to you.

[nrabinowitz]

Thanks for the fix! The fuzzer issue does not look related, I think we can ignore for this PR.