fix(fuzz): restrict ClusterFuzzLite to the address sanitizer

cargo-fuzz builds Rust fuzz targets with AddressSanitizer hard-coded and
ignores $SANITIZER, so the undefined/memory matrix legs produced ASan
binaries that OSS-Fuzz bad_build_check rejected:

  BAD BUILD: UBSan build of fuzz_glob_expansion seems to be compiled with ASan

Advertise and build only the address sanitizer, which is the set cargo-fuzz
actually supports for Rust and already covers the relevant memory-safety
classes. build.sh now honours $SANITIZER (defaulting to address) so the
requested and produced sanitizer always agree.

- .clusterfuzzlite/project.yaml: sanitizers -> [address]
- cflite_pr.yml / cflite_batch.yml: matrix sanitizer -> [address]
- build.sh: cargo +nightly fuzz build --sanitizer ${SANITIZER:-address}

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU

Author: claude

.clusterfuzzlite/build.sh

@@ -17,8 +17,9 @@ if ! command -v cargo-fuzz >/dev/null 2>&1; then
     RUSTFLAGS="" cargo install cargo-fuzz --locked
 fi
 
-# Build all fuzz targets
-cargo +nightly fuzz build
+# Build all fuzz targets. cargo-fuzz only supports the address sanitizer for
+# Rust; honour $SANITIZER when set (OSS-Fuzz exports it) but default to address.
+cargo +nightly fuzz build --sanitizer "${SANITIZER:-address}"
 
 # Copy fuzz targets to $OUT
 for target in fuzz/target/*/release/fuzz_*; do

.clusterfuzzlite/project.yaml

@@ -7,10 +7,13 @@ primary_contact: "jonathan.jewell@open.ac.uk"
 auto_ccs:
   - "jonathan.jewell@open.ac.uk"
 
+# Rust fuzz targets are built by cargo-fuzz, which hard-codes AddressSanitizer
+# and ignores $SANITIZER. Advertising `undefined`/`memory` makes OSS-Fuzz's
+# bad_build_check fail ("UBSan build ... seems to be compiled with ASan"),
+# because the produced binary is always ASan. ASan already covers Rust's
+# relevant memory-safety classes here, so `address` is the supported set.
 sanitizers:
   - address
-  - undefined
-  - memory
 
 fuzzing_engines:
   - libfuzzer

.github/workflows/cflite_batch.yml

@@ -24,7 +24,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined, memory]
+        # cargo-fuzz hard-codes ASan for Rust, so only `address` yields a valid
+        # build (see .clusterfuzzlite/project.yaml for the full rationale).
+        sanitizer: [address]
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

.github/workflows/cflite_pr.yml

@@ -23,7 +23,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # cargo-fuzz hard-codes ASan for Rust, so only `address` yields a valid
+        # build (see .clusterfuzzlite/project.yaml for the full rationale).
+        sanitizer: [address]
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4