Improve fuzzing corpus

[fancycode]

The GraphicsMagick oss-fuzz build fully supports all of the libheif "Supported formats", including VVC (using vvenc/vvdec) and Uncompressed. To date, no oss-fuzz issues (build or fuzzing) have been encountered regarding VVC or Uncompressed, but this is likely due to a lack of such files in the provided corpus for heif. The VVC-related code has been building each day without fail.

I have no knowledge of VVC, but am impressed by the size and apparent rapid development of the code.

We need a way to develop a good HEIF corpus which includes small samples for all of the codecs. If GraphicsMagick had a HEIF writer, then I could make that happen, but it does not have a writer yet.

Assuming proper functioning of the instrumented (e.g. ASAN/UBSAN) oss-fuzz build, it seems possible to use the build product to create the associated corpus of good files during the oss-fuzz build. I am not aware of any projects doing such a thing, but why not?

Originally posted by @bobfriesenhahn in #1350

I agree that the fuzzing corpus should include (small) examples for all supported codecs / features.

[farindk]

I've added a small file for each codec.

[fancycode]

Thanks! Looks like the coverage build also needs some work (currently broken in svt-av1):
https://introspector.oss-fuzz.com/project-profile?project=libheif

[farindk]

The encoder_fuzzer seems to only cover AVIF and HEIC and it takes always the first encoder found, which will be aom and not svt-av1.

[farindk]

The encoder_fuzzer detects a leak in x265 that we cannot handle on our side. I have added a suppression file. Let's see whether that is picked up. When running locally, I had to run the fuzzer with

LSAN_OPTIONS=suppressions=encoder_fuzzer_lsan_suppressions.txt ./encoder_fuzzer

[bobfriesenhahn]

FreeType uses a separate repository to assist with oss-fuzz. Some other projects also use a separate repository to store stuff like image samples. It is useful to have image samples in the libheif main repository, but it seems useful to have another repository to store many more files so that most permutations are included.