Add fuzzer for OSS-Fuzz integration

[DavidKorczynski]

Hello!

This PR adds a first fuzzer and the goal is to set up an integration of Numactl with OSS-Fuzz. OSS-Fuzz is a service run by Google for important open source projects that will continuously build and run fuzzers. There is a corresponding PR in the OSS-Fuzz repository (with the fuzzer included there too, but we can remove that if you're happy to accept this PR) here google/oss-fuzz#9877

The fuzzer will be build with a set of different sanitizer (ASAN, UBSAN, MSAN) and any bugs found will be reported to maintainers listed in the corresponding project.yaml on the OSS-Fuzz repo (in the linked PR there is project.yaml with my email in for now) -- if you'd be happy to integrate then please provide a set of emails for those that should receive bug reports.

[andikleen]

Thanks! Although I'm not sure people really use the parser with untrusted input, but i suppose it cannot hurt.

I suppose should also cover numa_parse_cpustring(), that's another text parser.
And then there is a lot of parsing for the sysfs inputs, but I guess you consider that attack vector out of scope?

[DavidKorczynski]

Thanks @andikleen ! Can I attach your email from your github commits to the OSS-Fuzz maintainer list? That way you'll get notified in the event an issue is found.

We can try to fuzz the inputs where parsing is done on trusted input -- we can then decide if the bugs are worth fixing if they show up? i.e. am not against fuzzing for trusted input unless the fuzzing produces a lot of noise.

I'll try to come up with some more fuzzers for other parts of the code too!

[andikleen]

On Wed, Mar 15, 2023 at 03:05:55AM -0700, DavidKorczynski wrote: Thanks ***@***.*** ! Can I attach your email from your github commits to the OSS-Fuzz maintainer list? That way you'll get notified in the event an issue is found.

Sure that is fine.

We can try to fuzz the inputs where parsing is done on trusted input -- we can then decide if the bugs are worth fixing if they show up? i.e. am not against fuzzing for trusted input unless the fuzzing produces a lot of noise.

Yes makes sense.

I'll try to come up with some more fuzzers for other parts of the code too!

Thanks!