Fuzz FuzzedDataProviderImpl

[br-lewis]

This adds a very large fuzz test for the FuzzedDataProviderImpl and modifies building fuzzed_data_provider.cpp to make it possible for the normal and shaded FuzzedDataProvider to at least load properly by duplicating the selffuzz symbols into fuzzed_data_provider.cpp manually.

I also removed the segfault fix I did just to make sure our tooling can catch it again.

[ci-fuzz-check]

	2 open findings detected  View Findings
	The final number may be higher than displayed as the scan progresses in the background. For more information, check the Code Intelligence Documentation

[ci-fuzz-check]

	2 open findings detected  View Findings
	The final number may be higher than displayed as the scan progresses in the background. For more information, check the Code Intelligence Documentation

[fmeum]

We shouldn't include this in the current PR, but I found the following patch to work locally in cifuzz. I do get coverage feedback from the native methods backing FuzzedDataProvider with it. I also tried this out with UBSan, but that fails with an obscure error that is probably a bootstrapping problem.

It runs with --asan and -fsanitize=address, but didn't find a planted use-after-free directly. This could be interesting to look into more.

diff --git a/.github/workflows/fuzzing-featured.yaml b/.github/workflows/fuzzing-featured.yaml
index a5680d5b..6c8c9fb8 100644
--- a/.github/workflows/fuzzing-featured.yaml
+++ b/.github/workflows/fuzzing-featured.yaml
@@ -57,7 +57,10 @@ jobs:
         shell: bash
       - id: build-jazzer
         name: Build Jazzer deps
-        run: cd $CHECKOUT_DIR && bazel build //deploy:jazzer-junit-project //deploy:jazzer-project //deploy:jazzer-api-project //selffuzz:jazzer_selffuzz //selffuzz:jazzer_api_selffuzz
+        run: |
+          cd $CHECKOUT_DIR
+          bazel build //deploy:jazzer-junit-project //deploy:jazzer-project //deploy:jazzer-api-project 
+          bazel build --fsanitize=fuzzer-no-link //selffuzz:jazzer_selffuzz //selffuzz:jazzer_api_selffuzz
 
       - id: build-fuzzers
         name: Build Fuzzers
diff --git a/.github/workflows/fuzzing.yaml b/.github/workflows/fuzzing.yaml
index 13a8ef5c..10306606 100644
--- a/.github/workflows/fuzzing.yaml
+++ b/.github/workflows/fuzzing.yaml
@@ -49,7 +49,10 @@ jobs:
         shell: bash
       - id: build-jazzer
         name: Build Jazzer deps
-        run: cd $CHECKOUT_DIR && bazel build //deploy:jazzer-junit-project //deploy:jazzer-project //deploy:jazzer-api-project //selffuzz:jazzer_selffuzz //selffuzz:jazzer_api_selffuzz
+        run: |
+          cd $CHECKOUT_DIR
+          bazel build //deploy:jazzer-junit-project //deploy:jazzer-project //deploy:jazzer-api-project 
+          bazel build --copt=-fsanitize=fuzzer-no-link //selffuzz:jazzer_selffuzz //selffuzz:jazzer_api_selffuzz
 
       - id: build-fuzzers
         name: Build Fuzzers
diff --git a/selffuzz/cifuzz.yaml b/selffuzz/cifuzz.yaml
index 95f3af76..b4f61d55 100644
--- a/selffuzz/cifuzz.yaml
+++ b/selffuzz/cifuzz.yaml
@@ -38,6 +38,7 @@
 ## See https://llvm.org/docs/LibFuzzer.html#options
 engine-args:
  - --experimental_mutator
+ - --native
 
 ## Maximum time to run fuzz tests. The default is to run indefinitely.
 #timeout: 30m

[fmeum]

Looks good, thanks! I can't approve again as that results in a 500 from GitHub, just assume I did.