dnsmasq: add option-parsing + DNS-reply harnesses

[tc-agent]

Summary

Follow-up to #59 (which enabled the four legacy C harnesses) and
supersedes the abandoned google/oss-fuzz#11779 once #59 lands. Adds two
new harnesses covering code paths the existing ones can't reach:

• fuzz_option drives option.c::one_opt() directly to fuzz
  config-line parsing.
• fuzz_dns_reply drives forward.c::process_reply and
  dnssec.c::dnssec_validate_reply / _by_ds / _ds against
  synthesized upstream DNS responses. Enables -DHAVE_DNSSEC so
  dnssec.c gets linked in.

Both target attacker-controlled inputs:

• one_opt() parses every config line — anyone able to write the
  dnsmasq config (or exploit a config-injection bug) controls those
  bytes.
• process_reply / dnssec_validate_reply walk the bytes returned by
  the upstream resolver, which can be spoofed on the wire.

Baseline:
https://introspector.oss-fuzz.com/project-profile?project=dnsmasq
(fuzz_util is the only running harness today; 1.65% / 418 lines).

Keeping the two new harnesses in one PR because both need the same
build glue (die() longjmp override, COPTS=-DHAVE_DNSSEC, nettle/gmp
link). Splitting would force two near-identical build.sh diffs.

Build-side glue

• sed un-statics one_opt (option.c) and process_reply (forward.c).
• sed renames die() -> die_orig() in log.c; a fuzz-aware die()
  appended to dnsmasq.c that longjmps back to the harness when armed
  (so bad-config paths inside one_opt don't terminate the fuzzer).
• Dockerfile installs nettle-dev, libgmp-dev for DNSSEC crypto.
• fuzz_dns_reply.options sets detect_leaks=0 — dnssec_validate_reply
  lazily allocates daemon->rr_status; the harness frees it per call.

Coverage

Local 5-minute fuzz_for_pr:

Global: lines 19.7% (5732/29143)  branches 15.1% (2775/18368)
  option.c   52.3% (2360/4509)
  rfc1035.c  31.3% ( 531/1695)
  rfc2131.c  14.2% ( 337/2372)
  dnssec.c   19.4% ( 299/1545)
  util.c     51.6% ( 316/612)
  edns0.c    32.2% ( 120/373)
  auth.c     15.6% ( 112/719)
  cache.c     6.2% ( 111/1795)
  forward.c   4.1% (  89/2159)
  rfc3315.c   5.8% (  99/1704)

13.7x the Fuzz Introspector baseline in absolute lines (5,732 vs
418). The percentage looks close to the no-DNSSEC build because
enabling HAVE_DNSSEC also grew the denominator by ~2,900 lines.

[github-actions]

Fuzzing Coverage Report

Tested: project dnsmasq · base 0575acd → head 76d9f77 · 300s total fuzz budget · updated 2026-05-27 23:55 UTC · workflow run

Metric	Before	After	Delta
Static reachability	5.4% (29/533)	78.6% (481/612)	+73.2%
Line coverage	1.4% (367/25382)	21.7% (6313/29146)	+1620.2%
Branch coverage	0.9% (151/16210)	16.8% (3093/18370)	+1948.3%
Function coverage	3.2% (17/533)	32.0% (202/632)	+1088.2%

Per-harness

Harness	Lines before	Lines after	Δ
fuzz_auth	0%	2.4% (668/28403)	new
fuzz_dhcp	0%	3.8% (1066/28412)	new
fuzz_dhcp6	0%	2.1% (587/28418)	new
fuzz_dns_reply	0%	5.0% (1421/28438)	new
fuzz_option	0%	11.1% (3156/28417)	new
fuzz_rfc1035	0%	4.0% (1131/28599)	new
fuzz_util	1.4% (367/25382)	1.8% (512/28252)	+39.5%

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}