r: add fuzzing targets for the R programming language

[kevinushey]

Adds the R programming language as a new OSS-Fuzz project.

R is one of the most widely used languages for statistics, data analysis, and
scientific computing, with a very large user base across academia and industry.
Base R is implemented largely in C, and much of that C code parses untrusted
input: readRDS() deserialization, the regex engines, delimited-text/CSV
reading, date/time parsing, and decompression are all routinely fed data from
external sources.

Fuzz targets

Eight libFuzzer harnesses, each embedding R via Rf_initEmbeddedR():

Target	Exercises
parse	R_ParseVector — the lexer/parser
unserialize	unserialize() / readRDS — the deserializer (security-critical)
grep	the TRE and PCRE2 regex engines, plus sub()
coerce	string→type conversion (as.numeric, as.complex, as.logical, type.convert)
datetime	strptime / as.Date / as.POSIXct / as.POSIXlt
decompress	memDecompress — R's gzip/bzip2/xz wrapper layer
scan	scan() — the delimited-text parser behind read.table/read.csv
agrep	agrep/agrepl — TRE approximate (edit-distance) matching

Structure

Following the existing aspell project (which clones gnuaspell/aspell-fuzz),
the harnesses and build logic are maintained in a separate repository,
r-devel/r-oss-fuzz, so the R
maintainers can update them without a google/oss-fuzz PR. The project here is
a thin bootstrap: the Dockerfile checks out R (SVN trunk) and clones that
repo, and build.sh delegates to its ossfuzz.sh.

R is built with --enable-strict-barrier (strict GC write-barrier checking) to
surface additional memory-safety issues. A few targets set detect_leaks=0
(via [asan] options) for known benign leaks in R internals and the bundled TRE
regex library; all other AddressSanitizer checks remain enabled.

Testing

python3 infra/helper.py build_fuzzers and check_build pass locally under the
address and undefined sanitizers, and the coverage build succeeds.

Primary contact: kevin@posit.co

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

kevinushey is integrating a new project:
- Main repo: https://svn.r-project.org/R/trunk
- Criticality score: N/A

[DavidKorczynski]

The project looks good.

However, we would like to see maintainer involvement/endorsement when integrating into OSS-Fuzz. Can you help me understand the R governance so I can validate if we have maintainer(s) onboard? I tried to look at e.g. https://www.r-project.org/contributors.html and didn't see your name (from github) there. Am not sure what the best approach here, but can you somehow assist in ensuring we have core maintainers in the project.yaml CCs list and they are happy to integrate into OSS-Fuzz?

[kevinushey]

Thanks David!

To confirm, the work in this project is funded by an RSMF grant (https://blog.r-project.org/2025/12/17/rsmf-enabling-the-next-generation-of-contributors-to-r/), and is being overseen by Heather Turner (@hturner) and Simon Urbanek (@s-u), both members of the R Core team. I'll add them as CC's for the project, and also ask them to sign off on this PR as well.

[DavidKorczynski]

Thanks David!

To confirm, the work in this project is funded by an RSMF grant (https://blog.r-project.org/2025/12/17/rsmf-enabling-the-next-generation-of-contributors-to-r/), and is being overseen by Heather Turner (@hturner) and Simon Urbanek (@s-u), both members of the R Core team. I'll add them as CC's for the project, and also ask them to sign off on this PR as well.

thank you! Once we get confirmation from them then this should be good!

[kevinushey]

Thanks! We're deliberating internally to iron out who the primary contact + cc's should be -- we'll get back soon.

[kevinushey]

@DavidKorczynski Thanks for your patience! We now have an e-mail alias set up for the fuzz reports, and I've updated the PR. We should now be all good to go -- @s-u can you sign off here to confirm we're ready?

[s-u]

@DavidKorczynski sorry for the delay, we were sorting out the communication details and setting up dedicated address on our end. In my capacity as an R core developer and president of the R foundation, I am confirming this has been filed on behalf of the R project. Thanks.

[hturner]

As Project Lead of the RSMF-funded project and an R core developer, I also confirm support for this PR.