protobuf-python: restore builds and fuzz DescriptorPool inputs

projects/protobuf-python/Dockerfile

@@ -16,6 +16,6 @@
 
 FROM gcr.io/oss-fuzz-base/base-builder-python:ubuntu-24-04
 RUN curl -L -O https://raw.githubusercontent.com/protobuf-c/protobuf-c/39cd58f5ff06048574ed5ce17ee602dc84006162/t/test-full.proto
-RUN git clone https://github.com/protocolbuffers/protobuf.git
-RUN cd protobuf && bazel build --nobuild //:protoc //python/dist:binary_wheel --noenable_bzlmod
+RUN git clone --depth 1 https://github.com/protocolbuffers/protobuf.git
+RUN cd protobuf && bazel build --nobuild //:protoc //python/dist:binary_wheel
 COPY build.sh fuzz_* $SRC/

projects/protobuf-python/build.sh

@@ -20,6 +20,10 @@ if [[ $CFLAGS = *sanitize=address* ]]
 then
     BAZEL_FLAGS="$BAZEL_FLAGS --config=asan"
 fi
+if [[ $CFLAGS = *sanitize=fuzzer-no-link* ]]
+then
+    BAZEL_FLAGS="$BAZEL_FLAGS --copt=-fsanitize=fuzzer-no-link"
+fi
 
 # Build protoc with default options.
 unset CFLAGS CXXFLAGS
@@ -30,7 +34,7 @@ cd $SRC/protobuf
   type -a python3
   /usr/bin/python3 --version
 )
-bazel build $BAZEL_FLAGS //:protoc //python/dist:binary_wheel --noenable_bzlmod
+bazel build $BAZEL_FLAGS //:protoc //python/dist:binary_wheel
 PROTOC=$(realpath bazel-bin/protoc)
 
 # Install the protobuf python runtime.

projects/protobuf-python/fuzz_descriptor_pool.py

@@ -0,0 +1,41 @@
+#!/usr/bin/python3
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+  from google.protobuf import descriptor_pool
+
+
+@atheris.instrument_func
+def TestOneInput(input_bytes):
+  """Builds an isolated descriptor pool from a serialized file descriptor."""
+  pool = descriptor_pool.DescriptorPool()
+  try:
+    pool.AddSerializedFile(input_bytes)
+  except (TypeError, ValueError):
+    pass
+
+
+def main():
+  atheris.instrument_all()
+  atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+  atheris.Fuzz()
+
+
+if __name__ == "__main__":
+  main()