Fix implementation of COVFUZZ_ADDITIONAL_ARGS

Problem

The COVFUZZ_ADDITIONAL_ARGS configuration variable for coverage guided fuzzing allows a user to provide additional command line arguments to the fuzzer being run. The implementation is not correct resulting in several issues that should be addressed.

  1. The entire value is appended to an arguments array. If multiple arguments are provided they will be passed as a single argument to the fuzzer. Instead the value should be parsed using an argument parser and each separate argument added to the arguments list.
  2. The value is added to the end of the arguments array without thought for where arguments should be inserted into the argument list. A quick review of the fuzzing clients shows, in almost all cases, the values are added to the wrong place. It's likely that this variable is broken for the majority of fuzzer clients.
  3. The documentation for the variable doesn't specifically state this is additive in nature and seems to imply allowing more control than is currently possible.
    1. Users have tried to use this variable to override existing command line arguments, such as -max_total_time for libfuzzer. Should this be supported? If so support for this would be needed.

Level of effort estimated to be 2-3 days.

Edited by 🤖 GitLab Bot 🤖