fuzz: add a fuzzer for the qcow2 converter

systemd-importd runs qcow2_detect()/qcow2_convert() over images it has just
downloaded (see pull-raw.c), so the header, the L1/L2 tables and every offset
and cluster descriptor in them are attacker controlled. There is a manual test
for the happy path, but nothing that feeds it a malformed image.

The corpus is two images, a plain data cluster and a zlib-compressed one (i.e.
decompress_zlib_raw()), at the 512 byte minimum cluster size and trimmed to the
last byte the converter reads, so 2K each. A zero cluster and a QCOW3 header are
a flipped descriptor bit and a bumped version field away from these, so they are
left to the fuzzer rather than carried in the tree.

src/import/fuzz-qcow2.c

@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "fd-util.h"
+#include "fuzz.h"
+#include "memfd-util.h"
+#include "qcow2-util.h"
+
+/* systemd-importd runs this over images it just downloaded (see pull-raw.c), so the header, the L1/L2
+ * tables and every offset in them are attacker controlled. */
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+        _cleanup_close_ int qcow2_fd = -EBADF, raw_fd = -EBADF;
+
+        if (size < sizeof(uint32_t))
+                return 0;
+
+        fuzz_setup_logging();
+
+        qcow2_fd = memfd_new_and_seal("fuzz-qcow2-in", data, size);
+        if (qcow2_fd < 0)
+                return 0;
+
+        raw_fd = memfd_new("fuzz-qcow2-out");
+        if (raw_fd < 0)
+                return 0;
+
+        if (qcow2_detect(qcow2_fd) <= 0)
+                return 0;
+
+        (void) qcow2_convert(qcow2_fd, raw_fd);
+        return 0;
+}

src/import/meson.build

@@ -93,6 +93,10 @@ executables += [
                 'sources' : files('test-oci-util.c'),
                 'import' : ['systemd-importd'],
         },
+        fuzz_template + {
+                'sources' : files('fuzz-qcow2.c'),
+                'import' : ['systemd-importd'],
+        },
 ]
 
 install_data('org.freedesktop.import1.conf',