Fuzz corpora

[Shnatsel]

Fuzzing on CI will be much more effective if it starts from a corpus generated by the fuzzer earlier instead of from scratch.

I have combined the generated corpora from three different libraries I've fuzzed, used that to fuzz zune-png (specifically the decode_buffer target) for a while, and then ran cargo fuzz cmin. The result should be a good starting point for fuzzing on CI:
zune_png_decode_buffer.tar.gz

I'll see if I can prepare the same for JPEG next.

[etemesi254]

Hi, we need a better solution for this, it will just get worse with time.

The repo is already 103 MB in size with only two decoders.

We should separate code with tests as much as possible.

[Shnatsel]

This corpus is only 170KB, so it's actually viable to keep the fuzzing data in-tree. But I agree about all the test images.

[etemesi254]

I'm open to suggestions

We can keep fuzzers in the repo

Hopefully one directory and then we should probably move test files away

[Shnatsel]

Git LFS has very low file transfer caps, so it's not really useful here.

There's S3 but you have to pay for bandwidth if it exceeds 100GB, it might be possible to mount a denial-of-savings attack by downloading it a lot so you'd rack up a large AWS bill. There doesn't seem to be a way to limit bandwidth.

The best idea I got is (ab)using the Github releases mechanism, tagging a snapshot and attaching the new archive with the test files every time. Then CI can download and extract it.

[etemesi254]

Initially setup the fuzzer and updated CI.

There is a new directory fuzz-corpus, and there is a sub-directory for png that contains the corpus you shared. The CI fuzzer for png will use those files as seed runs

[Shnatsel]

Here's the corpus for zune-inflate, seeded with my previous fuzzing attempts and then ran for 50 million executions:
zune-inflate-corpus-ac4a162d.tar.gz

[etemesi254]

83c11db

[Shnatsel]

Here's the corpus for zune-jpeg seeded with my previous corpora and then ran for 250 million executions with no issues (plus more up until then that were finding panics): zune-jpeg-fuzz-seeds.tar.gz

[etemesi254]

1cbc0aa and d427e42