Repository: go
Issue: image: add sample fuzz tests for prototype of "fuzzing as a first class citizen"
Labels: NeedsInvestigation

### Summary

As a follow-up to #30719 and in support of the proposal to "make fuzzing a first class citizen" in #19109, the suggestion here is to add `Fuzz` functions for the following three standard library packages:

1. `image/jpeg`, using https://github.com/dvyukov/go-fuzz-corpus/blob/master/jpeg/jpeg.go

2. `image/png`, using https://github.com/dvyukov/go-fuzz-corpus/blob/master/png/png.go
  
3. `image/gif`, using a modified https://github.com/dvyukov/go-fuzz-corpus/blob/master/gif/gif.go (some additional discussion below).

Note that this issue is solely about the `Fuzz` functions themselves, and this issue does not cover checking in any resulting fuzzing corpus (which is likely going to be a separate repository such as `golang/x/corpus` or `golang.org/x/fuzz` or perhaps using oss-fuzz; the intent is to discuss that aspect separately in a follow-up issue).

### Background

See the "Background" section of #30719 or https://github.com/golang/go/issues/19109#issuecomment-441442080.

### Additional Details

Following the pattern set by #30719 and https://golang.org/cl/167097, the following are likely true for how to proceed here:

1. The build tag should be `// +build gofuzz`
2. The name of the files should be `fuzz.go`
3. The license header should be the Go standard library license. @dvyukov might need to make a similar statement as he made in [CL 167097](https://go-review.googlesource.com/c/image/+/167097/1/tiff/fuzz.go#1).
4. In general, even for `Fuzz` functions guarded by a build tag, care should be taken to avoid introducing new dependencies, especially with the introduction of modules. Note that `go mod tidy` looks across all build tags, so `+build gofuzz` does not reduce module dependencies. 

For reference, here is a gist showing the [diff](https://gist.github.com/thepudds/de47bc3558e2d4613bc8bf3392359725/revisions) between [dvyukov/go-fuzz-corpus/tiff/tiff.go](https://github.com/dvyukov/go-fuzz-corpus/blob/master/tiff/tiff.go) and the [final form](https://github.com/golang/image/blob/master/tiff/fuzz.go) of that file as merged into `golang/x/image` repo as part of #30719. For the first two listed above (`image/png` and `image/jpeg`), hopefully it would be as straightforward as that diff illustrates.

For [`dvyukov/go-fuzz-corpus/gif`](https://github.com/dvyukov/go-fuzz-corpus/blob/master/gif/gif.go#L74), it currently depends on "github.com/dvyukov/go-fuzz-corpus/fuzz" for a utility function `fuzz.DeepEqual`. I think that dependency on `dvyukov/go-fuzz-corpus` would need to be eliminated prior to putting `go-fuzz-corpus/gif/gif.go` into the standard library. Possible solutions might be: (a) to start, that piece of the `Fuzz` function could simply be eliminated for now, or (b) a roughly corresponding `DeepEqual` from the standard library could be substituted, or (c) that `github.com/dvyukov/go-fuzz-corpus/fuzz` utility function could temporarily be placed directly in `image/gif/fuzz.go`, or (d) some other solution. 

Happy to discuss any aspect of this, and of course happy to be corrected if any of the above is different than how people would like to proceed here.

CC @dvyukov @josharian @nigeltao @FiloSottile @acln0