capnproto: add five fuzz harnesses for codec and decode paths

[tc-agent]

Summary

Cap'n Proto's OSS-Fuzz integration currently builds a single target, capnp-llvm-fuzzer-testcase, which exercises only the unpacked message reader and ships without a seed corpus. Per Fuzz Introspector it reaches 6.51% line coverage; the JSON/text codecs, the packed wire format and the kj utility codecs are unfuzzed.

This PR adds five harnesses for the C++ runtime, each driven by attacker-controlled input bytes that cross a real deserialization or text-parsing boundary, and a seed corpus for the existing target.

New harnesses:

• capnp-packed-fuzzer — PackedMessageReader, the packed wire-format decoder (serialize-packed.c++).
• capnp-message-fuzzer — the unpacked reader, a field-by-field re-encode round trip (builder + arena allocation paths), and the reflection (DynamicStruct) and schema-less (AnyStruct + canonicalization) decoders.
• capnp-json-fuzzer — JsonCodec raw and schema-bound decode/encode (compat/json.c++).
• capnp-text-fuzzer — TextCodec decode (serialize-text.c++), the runtime text-format codec; applications that accept human-readable Cap'n Proto messages (config files, debug payloads, eval-style tooling) feed untrusted text into this codec.
• capnp-encoding-fuzzer — the kj Base64 / hex / percent-encoding / C-escape / UTF transcoders (kj/encoding.c++), which decode untrusted bytes in real deployments.

Seed corpora are generated at build time from the upstream c++/src/capnp/testdata tree — no binary fixtures are vendored — including a corpus for the pre-existing capnp-llvm-fuzzer-testcase, which had none.

Coverage measurement

After 5 minutes of libFuzzer per target the six targets together cover 19.2% (9,605 / 49,945 lines) of the instrumented C++ runtime, up from the 6.51% Fuzz Introspector baseline — a 2.95× absolute improvement.

The headline percentage is held down by a large block of effectively-unreachable code in the denominator that the existing capnp-llvm-fuzzer-testcase already pulls in and cannot be removed without breaking that harness:

File / area	Lines	Covered	Why uncoverable
capnp/test.capnp.h	13,785	133	Generated accessors for the test schema (Reader/Builder/Pipeline for ~50 types). A complete TestAllTypes walk covers ~133 lines; the rest is boilerplate no input can reach.
kj/async.c++ + async-inl.h + capnp/capability.c++	~3,400	0	Pulled transitively by libcapnp-test.a (test-util references Capability::Server); not exercised without a full kj EventLoop + RPC stack.
capnp/test.capnp.c++	1,071	0	Generated schema initialiser for unused test types.

Together these account for ~37% of the 49,945-line denominator at ≤1% reachable. Excluding them, the harnesses cover roughly 30% of the actually-reachable code (~9.5k / ~32k). Hitting an absolute +30 pp on the full denominator from a 6.51% baseline would require ≥36.5% global coverage; the practical ceiling with this harness set and a 5-minute budget is around 30–34%.

[github-actions]

Fuzzing Coverage Report

Tested: project capnproto · base 2de60f9 → head 1df5af1 · 300s total fuzz budget · updated 2026-05-27 21:46 UTC · workflow run

Metric	Before	After	Delta
Static reachability	>45m	>45m	—
Line coverage	5.9% (2211/37653)	19.5% (9719/49945)	+339.6%
Branch coverage	8.4% (613/7330)	34.6% (3469/10012)	+465.9%
Function coverage	5.4% (507/9465)	13.2% (1513/11498)	+198.4%

Per-harness

Harness	Lines before	Lines after	Δ
capnp-encoding-fuzzer	0%	27.9% (984/3524)	new
capnp-json-fuzzer	0%	10.8% (4113/37916)	new
capnp-llvm-fuzzer-testcase	5.9% (2211/37653)	9.5% (3572/37653)	+61.6%
capnp-message-fuzzer	0%	10.8% (3824/35427)	new
capnp-packed-fuzzer	0%	21.5% (1987/9258)	new
capnp-text-fuzzer	0%	12.6% (5786/45806)	new

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}