git: add 5 harnesses for object parsing, fsck, and refname format

[tc-agent]

Add five new fuzz harnesses targeting central git parsing surfaces that the existing harness set does not exercise.

Baseline

Per Fuzz Introspector (May 7, 2026 build): 1.98% line coverage (2,514 / 126,869) across the 8 existing harnesses, none of which individually exceeds 0.79%.

New harnesses

Harness	Target	Source
fuzz-parse-commit	parse_commit_buffer()	commit.h
fuzz-parse-tag	parse_tag_buffer()	tag.h
fuzz-tree-walk	init_tree_desc_gently() + tree_entry_gently()	tree-walk.h
fuzz-fsck	fsck_buffer() for all four object types	fsck.h
fuzz-refname	check_refname_format() with three flag combinations	refs.h

fuzz-fsck uses the first input byte (mod 4) to select the object type so a single harness exercises commit, tree, blob, and tag validation. The remainder of the buffer is the object body.

fuzz-refname invokes the validator three times per input — bare, with REFNAME_ALLOW_ONELEVEL, and with REFNAME_REFSPEC_PATTERN — so each input touches all three branches of the flag matrix.

The four object-parsing harnesses initialize a clean repository, set the SHA-1 hash algorithm, run the parser, and clear the repository. This pattern matches the existing fuzz-commit-graph harness.

Build integration

The harness .c files are copied into the upstream oss-fuzz/ directory of the git source tree by build.sh so the existing fuzz-all make target compiles and links them with the correct EXTLIBS (pcre2, z, curl, ssl, …). New FUZZ_OBJS lines are inserted into the Makefile just after the existing fuzz-url-decode-mem.o entry.

Seed corpora

Each new harness ships a small text-or-script-generated seed corpus (seeds/<harness>/), packaged as <harness>_seed_corpus.zip. Seeds are produced by seeds/gen_seeds.py to keep the diff human-auditable. Each seed exercises a distinct parser branch (commit minimal vs with parent; tag of commit vs tree vs blob; tree single vs multi-entry vs special modes; per-type fsck dispatch; refname flag-bearing forms).

Coverage after 5 minutes per harness (libfuzzer, ASan)

Locally measured against git source at the current master (denominator 126,939 lines, in the same ballpark as Fuzz Introspector's 126,869):

Harness	Lines covered	Coverage
fuzz-parse-commit (new)	739	0.59%
fuzz-parse-tag (new)	737	0.59%
fuzz-tree-walk (new)	543	0.43%
fuzz-fsck (new)	1,578	1.25%
fuzz-refname (new)	153	0.12%
fuzz-config	502	0.40%
fuzz-credential-from-url-gently	238	0.19%
fuzz-date	934	0.74%
fuzz-pack-headers	103	0.08%
fuzz-pack-idx	73	0.06%
fuzz-parse-attr-line	539	0.43%
fuzz-url-decode-mem	150	0.12%
fuzz-commit-graph	0	0.00% (empty local corpus)
Combined	3,777	2.98%

The combined coverage of 2.98% is +1.0 percentage point over the Fuzz Introspector baseline (1.98%), driven entirely by the new harnesses.

[github-actions]

Fuzzing Coverage Report

Tested: project git · base c4ba43b → head 679de46 · 300s total fuzz budget · updated 2026-05-28 05:28 UTC · workflow run

Metric	Before	After	Delta
Static reachability	>45m	>45m	—

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}