vlc: extend seed corpus for low-coverage demuxers and codecs

[tc-agent]

Adds Python-generated seed corpora (and one new libFuzzer dictionary) for
several VLC demuxers and codecs whose line coverage in the latest
OSS-Fuzz coverage report
sits at 0 % or in the low single digits.

All seeds are produced deterministically from generate_seeds.py (no
binary blobs), invoked from build.sh as before.

New fuzz targets: the new seeds/nsv/ and seeds/mjpeg/ directories
add two harness target binaries (vlc-demux-dec-libfuzzer-nsv and
vlc-demux-dec-libfuzzer-mjpeg) through the existing per-seed-dir loop
in build.sh, matching the per-format target pattern already used for
asf, mp4, ogg, etc.

Coverage gained (locally measured, 5 min fuzz_for_pr per harness)

Before / after, line coverage of the targeted files (whole-project
harness-excluded):

file	before	after
modules/demux/mjpeg.c	2.1 %	78.2 %
modules/demux/asf/asfpacket.c	2.8 %	68.3 %
modules/demux/nsv.c	1.8 %	61.0 %
modules/demux/asf/asf.c	6.0 %	43.9 %
modules/demux/mp4/libmp4.c	40.9 %	50.0 %

(Baseline column re-measured on a clean build of the same tree, then
re-measured after the seed additions. fuzz_for_pr runs all targets
concurrently for 5 minutes wall-time.)

New generators

• ASF data packets — minimal but structurally valid header + data
  object with a Property Flags byte (0x1D) encoding the field layout
  read by
  asfpacket.c
  (replicated-data-length 1 B at bits 0–1, offset-into-media-object 4 B
  at bits 2–3, media-object-number 1 B at bits 4–5; the stream-number
  byte is read directly and has no length-type field). Exercises the
  streaming loop in
  asf.c
  and asfpacket payload parsing — upstream vlc-fuzz-corpus seeds carry
  only a header object so the streaming loop never runs.

• TS rich descriptors — PMT with stream descriptors (registration,
  AC-3, E-AC-3, DTS, metadata, MPEG-4 SL) and a program-level IOD
  descriptor, targeting
  ts_sl.c,
  ts_metadata.c
  and
  mpeg4_iod.c.

• TS service information — TDT/TOT on PID 0x0014 and a minimal EIT
  on PID 0x0012, exercising
  ts_si.c.
  Section length and the standard PSI header come from the existing
  psi_section() helper.

• MP4 per-codec sample entries — separate seeds for Opus, FLAC, AC-3,
  E-AC-3, DTS, A-law, μ-law, AV1, VP9, HEVC and Motion-JPEG. Each is a
  complete ftyp + mdat + moov tree with a one-sample stbl so
  essetup.c
  walks the per-FourCC Track*Setup paths during track creation. The
  fLaC variant's dfLa box is built as a FullBox (4-byte version+flags
  prefix) so essetup.c's GetDWBE(blob)==0 check passes.

• MP4 sample-table extras — variants carrying edit lists (`edts`),
  composition offsets (`ctts`), sync sample tables (`stss`), shadow
  sync (`stsh`), sample-group description / mapping (`sbgp`/`sgpd`),
  padding bits (`padb`), sample-dependency types (`sdtp`), MP4
  metadata (`udta`/`meta`/`ilst`) and an Object Descriptor box
  (`iods`) — all under-exercised box parsers in
  libmp4.c.

• MP4 fragmented (DASH-style) — mvex + trex init segment
  followed by a single fragment (moof / mfhd / traf / tfhd /
  tfdt / trun) and mdat, exercising fragmented-MP4 handling.

• NSV — Nullsoft Streaming Video, with both an NSVf header + NSVs
  sync-chunk variant and a streaming-only variant targeting
  modules/demux/nsv.c.

• MJPEG — a raw two-frame MJPEG stream and a
  multipart/x-mixed-replace variant, plus a libFuzzer dictionary, for
  modules/demux/mjpeg.c.

• Native FLAC — fLaC magic + a STREAMINFO metadata block + a frame
  header for
  modules/demux/flac.c.
  The upstream flac/ seeds are MP4-in-FLAC, so the native demuxer's
  STREAMINFO/frame parser is barely reached.

• TY series 2 — a 128-KiB master chunk (TIVO_PES_FILEID magic +
  chunk-type 2 + chunk-size header that
  ty.c::Open
  validates), followed by a stream chunk carrying the SubRec types
  tivo_demux dispatches (0x01 video PES, 0x02 audio PES, 0x09
  program info, 0x03 CC data).

• LPCM in PS — DVD-style private_stream_1 LPCM substream with the
  7-byte private LPCM header for
  modules/codec/lpcm.c,
  routed through the existing PS demuxer.

• OGG multi-bitstream seek — two logical bitstreams (different
  serial numbers) whose BOS pages carry the canonical Vorbis
  identification packet so Ogg_LogicalStreamSetup recognises them and
  the seek/recovery paths in
  modules/demux/oggseek.c
  are reachable.

• OGG Vorbis identification — the canonical three-packet Vorbis
  setup (identification, comment, setup) plus an audio page, exercising
  Vorbis stream-type detection in
  modules/demux/ogg.c
  and the VorbisComment parser in
  xiph_metadata.c.

[github-actions]

Fuzzing Coverage Report

Tested: project vlc · base 2de60f9 → head 0c13b23 · 300s total fuzz budget · updated 2026-05-27 18:12 UTC · workflow run

Metric	Before	After	Delta
Static reachability	>45m	>45m	—
Line coverage	18.1% (58464/322397)	18.7% (60439/322397)	+3.4%
Branch coverage	15.2% (23154/152498)	15.7% (23975/152498)	+3.5%
Function coverage	23.3% (3081/13218)	23.8% (3150/13218)	+2.2%

Per-harness

Harness	Lines before	Lines after	Δ
vlc-demux-dec-libfuzzer	4.0% (13006/322397)	4.0% (12949/322397)	-0.4%
vlc-demux-dec-libfuzzer-aiff	1.8% (5752/322397)	1.7% (5395/322397)	-6.2%
vlc-demux-dec-libfuzzer-asf	1.5% (4829/322397)	1.8% (5889/322397)	+22.0%
vlc-demux-dec-libfuzzer-au	1.8% (5730/322397)	1.8% (5730/322397)	+0.0%
vlc-demux-dec-libfuzzer-avi	2.9% (9477/322397)	3.0% (9636/322397)	+1.7%
vlc-demux-dec-libfuzzer-caf	2.1% (6923/322397)	2.2% (7066/322397)	+2.1%
vlc-demux-dec-libfuzzer-cdg	1.7% (5383/322397)	1.7% (5383/322397)	+0.0%
vlc-demux-dec-libfuzzer-dmxmus	1.6% (5165/322397)	1.6% (5166/322397)	+0.0%
vlc-demux-dec-libfuzzer-dts	2.0% (6412/322397)	2.0% (6349/322397)	-1.0%
vlc-demux-dec-libfuzzer-flac	1.8% (5884/322397)	1.8% (5878/322397)	-0.1%
vlc-demux-dec-libfuzzer-h264	2.6% (8493/322397)	2.6% (8391/322397)	-1.2%
vlc-demux-dec-libfuzzer-h265	2.0% (6492/322397)	2.3% (7436/322397)	+14.5%
vlc-demux-dec-libfuzzer-heif	1.3% (4056/322397)	1.3% (4056/322397)	+0.0%
vlc-demux-dec-libfuzzer-hx	2.1% (6743/322397)	2.2% (7076/322397)	+4.9%
vlc-demux-dec-libfuzzer-image	3.1% (9918/322397)	3.1% (10084/322397)	+1.7%
vlc-demux-dec-libfuzzer-mjpeg	0%	2.1% (6856/322397)	new
vlc-demux-dec-libfuzzer-mkv	4.0% (12959/322397)	4.0% (12959/322397)	+0.0%
vlc-demux-dec-libfuzzer-mp3	2.9% (9508/322397)	3.0% (9710/322397)	+2.1%
vlc-demux-dec-libfuzzer-mp4	3.3% (10510/322397)	3.4% (11121/322397)	+5.8%
vlc-demux-dec-libfuzzer-mpc	1.3% (4056/322397)	1.3% (4056/322397)	+0.0%
vlc-demux-dec-libfuzzer-mpgv	2.3% (7295/322397)	2.2% (7073/322397)	-3.0%
vlc-demux-dec-libfuzzer-nsv	0%	1.8% (5791/322397)	new
vlc-demux-dec-libfuzzer-nuv	2.3% (7502/322397)	2.7% (8589/322397)	+14.5%
vlc-demux-dec-libfuzzer-ogg	2.9% (9335/322397)	3.0% (9571/322397)	+2.5%
vlc-demux-dec-libfuzzer-ps	3.7% (11779/322397)	3.6% (11698/322397)	-0.7%
vlc-demux-dec-libfuzzer-pva	2.7% (8726/322397)	2.2% (7181/322397)	-17.7%
vlc-demux-dec-libfuzzer-rawdv	2.0% (6439/322397)	2.0% (6439/322397)	+0.0%
vlc-demux-dec-libfuzzer-smf	1.6% (5279/322397)	1.6% (5279/322397)	+0.0%
vlc-demux-dec-libfuzzer-stl	1.7% (5451/322397)	1.7% (5401/322397)	-0.9%
vlc-demux-dec-libfuzzer-subtitle	2.4% (7724/322397)	2.4% (7733/322397)	+0.1%
vlc-demux-dec-libfuzzer-ts	5.2% (16729/322397)	5.1% (16574/322397)	-0.9%
vlc-demux-dec-libfuzzer-tta	1.7% (5461/322397)	1.7% (5461/322397)	+0.0%
vlc-demux-dec-libfuzzer-ttml	2.1% (6809/322397)	2.1% (6795/322397)	-0.2%
vlc-demux-dec-libfuzzer-ty	1.4% (4367/322397)	1.4% (4367/322397)	+0.0%
vlc-demux-dec-libfuzzer-vc1	1.8% (5924/322397)	1.8% (5946/322397)	+0.4%
vlc-demux-dec-libfuzzer-voc	1.8% (5870/322397)	1.8% (5828/322397)	-0.7%
vlc-demux-dec-libfuzzer-wav	2.0% (6344/322397)	2.0% (6346/322397)	+0.0%
vlc-demux-dec-libfuzzer-webvtt	2.5% (7929/322397)	2.6% (8310/322397)	+4.8%
vlc-demux-dec-libfuzzer-xa	1.6% (5159/322397)	1.6% (5087/322397)	-1.4%

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}