cups: add fuzz harnesses for eight cups subsystems

[tc-agent]

Adds eight libFuzzer harnesses that cover cups subsystems with no existing target in OpenPrinting/fuzzing. The Dockerfile overlays this project's harnesses/ and seeds/ onto the cloned fuzzing repo so oss_fuzz_build.sh picks them up unmodified — the intent is to upstream each harness to OpenPrinting/fuzzing once the API surface is settled, at which point this oss-fuzz overlay can go away.

New harnesses

Harness	Targets
fuzz_ipp_support	cups/ipp-support.c — ippAttributeString, ippCreateRequestedArray, and the full ipp{Op,Tag,Error,Enum,State}String/Value lookup tables.
fuzz_encode	cups/encode.c — cupsParseOptions + cupsEncodeOptions{,2} for each IPP_TAG_* group; iterates _ippFindOption.
fuzz_transcode	cups/transcode.c — cupsCharsetToUTF8 / cupsUTF8ToCharset / cupsUTF8ToUTF32 / cupsUTF32ToUTF8 across the cups_encoding_t enum.
fuzz_form	cups/form.c — cupsFormDecode + cupsFormEncode round-trip.
fuzz_ppd_emit	cups/ppd-emit.c — ppdOpenFile + ppdMarkDefaults/ppdMarkOption + ppdEmit{,String,JCL,JCLEnd,Fd} over every ppd_section_t.
fuzz_ipp_file	cups/ipp-file.c — ippFileNew/ippFileOpen/ippFileRead on text-format ipptool .test files.
fuzz_hash	cups/hash.c, cups/md5.c — cupsHashData/cupsHashString across the supported algorithm table.
fuzz_pwg	cups/pwg-media.c — pwgMediaForLegacy/PPD/PWG/Size + pwgFormatSizeName.

Coverage motivation

Per the Fuzz Introspector baseline the existing 9 OSS-Fuzz harnesses leave large cups source files at 0% line coverage: ipp-support.c (1679 lines), ipp-file.c (1193), ppd-emit.c (643), pwg-media.c (483), encode.c (296), form.c (204), md5.c (153), hash.c (118), with transcode.c at 10%. Each new harness walks an explicit list of entry points / lookup keys so coverage is meaningful in the first few minutes of fuzzing rather than relying on libFuzzer to rediscover them.

Routing note

Long-term these harnesses belong in OpenPrinting/fuzzing alongside the existing cups harnesses; this PR is the smallest-possible vehicle to start exercising the listed files in OSS-Fuzz immediately while a parallel upstream conversation happens. The Dockerfile change is two COPY lines and reverts cleanly.

Seed corpora

All committed seeds are human-readable: PPDs are copied from cups/test/ and cups/cups/, .test files from cups/test/ and cups/examples/, and the form/pwg/encode/transcode seeds are committed text. Harnesses that pick an enum case from the first input byte (fuzz_transcode, fuzz_hash) rely on libFuzzer mutation rather than committing binary seeds.

[github-actions]

Fuzzing Coverage Report

Tested: project cups · base 766921e → head 78f40e6 · 300s total fuzz budget · updated 2026-05-28 03:17 UTC · workflow run

Metric	Before	After	Delta
Static reachability	99.4% (319/321)	99.5% (413/415)	+0.1%
Line coverage	17.3% (5242/30273)	30.3% (9716/32033)	+85.3%
Branch coverage	15.9% (2659/16688)	24.4% (4290/17590)	+61.3%
Function coverage	23.9% (188/788)	34.2% (284/831)	+51.1%

Per-harness

Harness	Lines before	Lines after	Δ
fuzz_array	0.0% (0/18070)	0.0% (0/18070)	—
fuzz_cups	2.7% (706/26054)	2.7% (702/26054)	-0.6%
fuzz_encode	0%	7.4% (1337/18177)	new
fuzz_form	0%	5.9% (1066/18057)	new
fuzz_hash	0%	4.3% (766/17845)	new
fuzz_http_core	6.5% (1163/18027)	6.0% (1082/18027)	-7.0%
fuzz_ipp	9.3% (1668/17861)	10.1% (1809/17861)	+8.5%
fuzz_ipp_file	0%	3.5% (670/19062)	new
fuzz_ipp_gen	9.3% (1665/17859)	9.1% (1619/17859)	-2.8%
fuzz_ipp_support	0%	14.5% (2593/17927)	new
fuzz_ppd_emit	0%	11.1% (3002/27078)	new
fuzz_ppd_gen_1	7.5% (1972/26379)	2.8% (727/26379)	-63.1%
fuzz_ppd_gen_cache	2.9% (763/26610)	2.9% (764/26610)	+0.1%
fuzz_ppd_gen_conflicts	3.2% (836/26379)	2.8% (726/26379)	-13.2%
fuzz_pwg	0%	5.7% (1047/18344)	new
fuzz_raster	2.7% (527/19427)	2.7% (527/19427)	+0.0%
fuzz_transcode	0%	2.0% (354/17869)	new

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}