Add .NET Libraries fuzzing targets and automation

[MihaZupan]

This PR introduces a new DotnetFuzzing project under src/libraries/Fuzzing which contains fuzzing targets and relevant automation for fuzzing locally, and to automatically submit jobs to OneFuzz.

The goal is that it should be easy to author new fuzzing targets without having to deal with the infrastructure aspects.

I included the following targets for now:

• HttpHeadersFuzzer
• JsonDocumentFuzzer
• SearchValuesByteCharFuzzer
• SearchValuesStringFuzzer
• UTF8Fuzzer

The new deploy-to-onefuzz.yml internal pipeline will periodically build the runtime and resubmit fuzzing jobs to OneFuzz.

See the new README.md for details about what it looks like to run locally / add new targets.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-meta
See info in area-owners.md if you want to be subscribed.

[stephentoub]

So for right now, until the workaround is no longer needed, to add new tests one adds a new test file and then also updates this file?

[MihaZupan]

Yes.

When you add a new target and test it locally, the prepare-onefuzz part of
dotnet publish -o publish && publish/DotnetFuzzing.exe prepare-onefuzz deployment
will also update this file for you, so you should only have to:

• Add 1 file
• Test changes
• Commit the 2 changed files

[stephentoub]

This can't share the same settings that the rest of the repo uses?

[MihaZupan]

I think it should be possible, I just gave up after spending a few hours bashing my head against different configurations that wouldn't compile.
We have similar isolated configurations for HttpStress / SslStress.

[stephentoub]

We can't use xunit's asserts directly, and/or AssertExtensions?

[MihaZupan]

I think we'd have to figure out #101993 (comment) first.
Given it's just helpers for Equal(T, T) and Equal(Span<T>, Span<T>) at this point, I didn't think it mattered enough.

[stephentoub]

This only works on Windows?

[MihaZupan]

As-is, yes.

We could make it work on Linux as well if needed, it's "just work". Namely updating the pipeline, and tweaking how we consume local bits to avoid the limitation in SharpFuzz to instrument mixed-mode assemblies only on Windows.

[stephentoub]

Feels unsustainable to be assigning these to a specific alias. Can we create some kind of team alias that these are assigned to instead?

[MihaZupan]

Sadly can't assign work items to groups / multiple people in AzDo.
I've changed it to always assign me for now, and I'll re-assign as needed (we shouldn't be getting these reports all that often anyway).

[stephentoub]

Is this overridden anywhere?

[MihaZupan]

The JsonDocumentFuzzer sets json.dict

[stephentoub]

We're ok downloading such executables from an arbitrary repo?

[MihaZupan]

I don't know of a great alternative.

I figured that since the version is pinned (checksum), it's pretty much the same thing as us using the SharpFuzz 2.1.1 NuGet package from the internal mirror / asking anyone working on fuzzers to install dotnet tool install --global SharpFuzz.CommandLine.

[GrabYourPitchforks]

Isn't pooling in this fashion potentially going to allocate dozens of GB of memory? Especially in the SearchValues and UTF-8 tests, the elementCount parameter could potentially be any arbitrary integer 0 .. 4096, depending on where the fuzzer places certain delimiter characters we're searching for.

[MihaZupan]

Should be around 400 MB I believe (8k sizes, 2 variants of poison placement each, 2-3 memory pages each, one for chars + one for bytes).

Note that we're only pooling 1 buffer for each (type, size, placement) as that's enough for practically all uses by fuzzers.

[MihaZupan]

@MihuBot fuzz HttpHeaders

[MihuBot]

System.ArgumentException: The value cannot be an empty string or composed entirely of whitespace. (Parameter 'receivedBy')
   at System.ArgumentException.ThrowNullOrWhiteSpaceException(String argument, String paramName)
   at System.ArgumentException.ThrowIfNullOrWhiteSpace(String argument, String paramName)
   at System.Net.Http.Headers.ViaHeaderValue.CheckReceivedBy(String receivedBy)
   at System.Net.Http.Headers.ViaHeaderValue..ctor(String protocolVersion, String receivedBy, String protocolName, String comment)
   at System.Net.Http.Headers.ViaHeaderValue.GetViaLength(String input, Int32 startIndex, Object& parsedValue)
   at System.Net.Http.Headers.GenericHeaderParser.GetParsedValueLength(String value, Int32 startIndex, Object storeValue, Object& parsedValue)
   at System.Net.Http.Headers.BaseHeaderParser.TryParseValue(String value, Object storeValue, Int32& index, Object& parsedValue)
   at System.Net.Http.Headers.HttpHeaders.TryParseAndAddRawHeaderValue(HeaderDescriptor descriptor, HeaderStoreItemInfo info, String value, Boolean addWhenInvalid)
   at System.Net.Http.Headers.HttpHeaders.ParseSingleRawHeaderValue(HeaderStoreItemInfo info, HeaderDescriptor descriptor, String rawValue)
   at System.Net.Http.Headers.HttpHeaders.ParseRawHeaderValues(HeaderDescriptor descriptor, HeaderStoreItemInfo info)
   at System.Net.Http.Headers.HttpHeaders.GetEnumeratorCore()+MoveNext()
   at DotnetFuzzing.Fuzzers.HttpHeadersFuzzer.<FuzzTarget>g__Test|9_0(HttpHeaders headers, String name, String value) in D:\a\runtime-utils\runtime-utils\Runner\runtime\src\libraries\Fuzzing\DotnetFuzzing\Fuzzers\HttpHeadersFuzzer.cs:line 64
   at SharpFuzz.Fuzzer.LibFuzzer.Run(ReadOnlySpanAction action, Boolean ignoreExceptions)
==7560== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
MS: 1 ChangeBit-; base unit: 4a6630db769ab42662c2b49ccea16d1c3754aede
0x52,0x7,0x74,0x0,0x9,0x0,0x0,0x20,
R\007t\000\011\000\000 
artifact_prefix='./'; Test unit written to fuzz-artifact-2
Base64: Ugd0AAkAACA=

HttpHeadersFuzzer-input.bin (8 B)