Bug: Issue 487202422: assimp:assimp_fuzzer_fbx: Undefined-shift in mapbox::detail::Earcut<unsigned int>::zOrder

https://issues.oss-fuzz.com/issues/487202422

Reference Info: 487202422 assimp:assimp_fuzzer_fbx: Undefined-shift in mapbox::detail::Earcut::zOrder
component: [Public Trackers > 1362134 > OSS Fuzz](https://issues.oss-fuzz.com/components/1638179)
status: New
reporter: [87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com)
cc: [ki...@assimp.org](mailto:ki...@assimp.org), [kim.kulling@googlemail.com](mailto:kim.kulling@googlemail.com), [re...@fastmail.com](mailto:re...@fastmail.com)
collaborators: [co...@oss-fuzz.com](mailto:co...@oss-fuzz.com)
type: Bug
access level: Limited visibility
priority: P2
severity: S4
hotlist: [Reproducible](https://issues.oss-fuzz.com/hotlists/6182481), [Stability-UndefinedBehaviorSanitizer](https://issues.oss-fuzz.com/hotlists/6182509)
retention: Component default
Project: assimp
Reported: Feb 24, 2026

[87...@developer.gserviceaccount.com](mailto:87...@developer.gserviceaccount.com) added [comment #1](https://issues.oss-fuzz.com/issues/487202422#comment1):
Detailed Report: [https://oss-fuzz.com/testcase?key=5738652516024320](https://www.google.com/url?q=https://oss-fuzz.com/testcase?key%3D5738652516024320&sa=D&source=buganizer&usg=AOvVaw05xbEAiFnDjuJNIdX4t_Mw)

Project: assimp
Fuzzing Engine: libFuzzer
Fuzz Target: assimp_fuzzer_fbx
Job Type: libfuzzer_ubsan_assimp
Platform Id: linux

Crash Type: Undefined-shift
Crash Address:
Crash State:
mapbox::detail::Earcut::zOrder
mapbox::detail::Earcut::earcutLinked
void mapbox::detail::Earcut::operator

Sanitizer: undefined (UBSAN)

Regressed: [https://oss-fuzz.com/revisions?job=libfuzzer_ubsan_assimp&range=202601210716:202601220724](https://www.google.com/url?q=https://oss-fuzz.com/revisions?job%3Dlibfuzzer_ubsan_assimp%26range%3D202601210716:202601220724&sa=D&source=buganizer&usg=AOvVaw0rXFL0123_29nLf3KP5xLD)

Reproducer Testcase: [https://oss-fuzz.com/download?testcase_id=5738652516024320](https://www.google.com/url?q=https://oss-fuzz.com/download?testcase_id%3D5738652516024320&sa=D&source=buganizer&usg=AOvVaw0n2dgTVFuFOJ3XnLUQa8Xh)

Issue filed automatically.

See [https://google.github.io/oss-fuzz/advanced-topics/reproducing](https://www.google.com/url?q=https://google.github.io/oss-fuzz/advanced-topics/reproducing&sa=D&source=buganizer&usg=AOvVaw2PF-rd9_FrkFJ-mNErDWkF) for instructions to reproduce this bug locally.
When you fix this bug, please
* mention the fix revision(s).
* state whether the bug was a short-lived regression or an old bug in any stable releases.
* add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at [https://github.com/google/oss-fuzz/issues](https://www.google.com/url?q=https://github.com/google/oss-fuzz/issues&sa=D&source=buganizer&usg=AOvVaw3uDxRzHL584JLrGWXGLu6V). Comments on individual Monorail issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.

Generated by Google IssueTracker notification system.

Start with the OSS-Fuzz reproducer for testcase 5738652516024320 and the assimp_fuzzer_fbx target, following the linked OSS-Fuzz instructions to reproduce the UBSAN report. Trace the failure through mapbox::detail::Earcut::zOrder and earcutLinked. Done means the reproducer no longer triggers undefined-shift under UBSAN and the FBX fuzz target still runs successfully.

Written by the indexing model from the issue text.