nginx: add proxy_protocol_fuzzer

[tc-agent]

Adds a libFuzzer harness for the PROXY protocol parser
(ngx_proxy_protocol_read and ngx_proxy_protocol_get_tlv).

Why

Fuzz Introspector reports the project at 13.24% line
coverage
(May 8, 2026 build),
hit by a single existing harness.
src/core/ngx_proxy_protocol.c
is 614 lines and is currently unreached by any harness — the PROXY
protocol is parsed before HTTP request handling and the existing
harness's nginx config does not enable proxy_protocol on its
listener. Both v1 (text, with TCP4/TCP6/UNKNOWN forms) and v2
(binary, with TLV records) are exercised.

How

fuzz/proxy_protocol_fuzzer.cc calls ngx_proxy_protocol_read on
the fuzz input with a fresh per-iteration ngx_pool_t. When the v2
parse succeeds and TLVs are present, the harness then invokes
ngx_proxy_protocol_get_tlv for each known TLV name (alpn,
authority, unique_id, netns, the ssl_* family) plus a
hex-form name to cover the 0xNN lookup branch. Input is copied
into a heap allocation before parsing so ASan flags any out-of-bounds
read.

Build is wired through auto/make_fuzzers. The new harness only
needs LIB_FUZZING_ENGINE (no libprotobuf-mutator), so its link
line is shorter than the existing one.

A small seed corpus is generated inline in build.sh: three v1
text inputs (TCP4, TCP6, UNKNOWN) and two v2 binary inputs (one
plain, one with an alpn=h2 TLV).

Coverage

After 5 minutes of local fuzzing on the new harness (libFuzzer,
ASan, single core, with the seed corpus and dictionary above):

harness	runs	exec/s	edges	features	corpus
proxy_protocol_fuzzer	12,807,757	~42,500	183	486	153

[github-actions]

Fuzzing Coverage Report

Tested: project nginx · base c4ba43b → head 8fbe842 · 300s total fuzz budget · updated 2026-05-27 18:44 UTC · workflow run

Metric	Before	After	Delta
Static reachability	>45m	>45m	—
Line coverage	10.9% (10644/97755)	0%	removed
Branch coverage	12.3% (4043/33004)	0%	removed
Function coverage	6.4% (435/6813)	0%	removed

Per-harness

Harness	Lines before	Lines after	Δ
http_request_fuzzer	10.9% (10644/97755)	0%	removed

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}