[minimp3] Add new project integration

[s2ongmo]

Add minimp3 fuzzing integration

Project

minimp3 — Minimalistic, single-header MP3 decoder library (C, public domain/CC0).

• 1.8K GitHub stars
• Widely embedded in game engines, audio tools, and language bindings (Go, Rust, Python wrappers)
• Processes untrusted MP3 input from network/file sources

Fuzz Targets

Target	API Coverage
fuzz_decode_frame	mp3dec_decode_frame() — core frame-level decoder (minimp3.h)
fuzz_decode_buf	mp3dec_load_buf(), mp3dec_iterate_buf() — full-buffer decode + iteration (minimp3_ex.h)
fuzz_decode_ex	mp3dec_ex_open_buf(), mp3dec_ex_read(), mp3dec_ex_seek() — streaming API with seek (minimp3_ex.h)

Build

Header-only library. Each target compiles with $CC -c and links with $CXX $LIB_FUZZING_ENGINE -lm. All three targets build cleanly with ASAN, UBSAN, and MSAN.

Seed Corpus & Dictionary

• Seed corpus: auto-collected from upstream vectors/ directory (.bit test files)
• Dictionary: mp3.dict with MP3 sync words, ID3/APE/Xing tokens, and common frame headers

Security Relevance

These fuzz targets already found a confirmed security bug: an integer narrowing chain in mp3dec_ex_seek() leading to OOB read (lieff/minimp3#136), which was fixed in lieff/minimp3#139.

Upstream fuzz target PR: lieff/minimp3#137

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

s2ongmo is integrating a new project:
- Main repo: https://github.com/lieff/minimp3.git
- Criticality score: 0.39081

[s2ongmo]

Signed the CLA. Please re-check.