test: coverage-guided fuzz targets and a nightly fuzz job

rust/fuzz (cargo-fuzz, nightly, its own workspace with the same IronRDP
patches) has targets for the Telnet IAC parser, the IRC parser + state
machine + mIRC formatter, VNC framebuffer updates and decoders,
~/.ssh/config parsing and the update manifest. They reach the private
parsers through hidden entry points behind nexus-core's 'fuzzing'
feature. A nightly workflow runs each for two minutes and uploads any
crashing input. A first 45 s run of each locally found nothing.

rust/fuzz/.gitignore

@@ -0,0 +1,4 @@
+target/
+corpus/
+artifacts/
+coverage/

rust/fuzz/Cargo.toml

@@ -0,0 +1,60 @@
+[package]
+name = "nexus-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2024"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+nexus-core = { path = "../core", features = ["fuzzing"] }
+
+# Its own workspace (cargo-fuzz needs nightly and its own profile), so the root's IronRDP
+# patches are repeated here; see ../vendor/README.md.
+[workspace]
+members = ["."]
+
+[patch.crates-io]
+picky = { path = "../vendor/picky" }
+sspi = { path = "../vendor/sspi" }
+ironrdp-session = { path = "../vendor/ironrdp-session" }
+
+[profile.release]
+debug = 1
+
+[[bin]]
+name = "telnet"
+path = "fuzz_targets/telnet.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "irc"
+path = "fuzz_targets/irc.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "vnc"
+path = "fuzz_targets/vnc.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "sshconfig"
+path = "fuzz_targets/sshconfig.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "updater"
+path = "fuzz_targets/updater.rs"
+test = false
+doc = false
+bench = false

rust/fuzz/fuzz_targets/irc.rs

@@ -0,0 +1,3 @@
+#![no_main]
+
+libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::irc::fuzz_lines(data));

rust/fuzz/fuzz_targets/sshconfig.rs

@@ -0,0 +1,3 @@
+#![no_main]
+
+libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::sshconfig::fuzz_parse(data));

rust/fuzz/fuzz_targets/telnet.rs

@@ -0,0 +1,3 @@
+#![no_main]
+
+libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::telnet::fuzz_negotiation(data));

rust/fuzz/fuzz_targets/updater.rs

@@ -0,0 +1,3 @@
+#![no_main]
+
+libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::updater::fuzz_manifest(data));

rust/fuzz/fuzz_targets/vnc.rs

@@ -0,0 +1,3 @@
+#![no_main]
+
+libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::vnc::fuzz_updates(data));