Add sections about fuzzing APIs with callbacks

[Evian-Zhang]

I found that Rust APIs with callbacks need special handling when writing fuzzing harnesses, and I wrote a simple crate touched to make things easier. I think it may be great to add a section to make more people aware of this problem.

[fitzgen]

The content looks good ot me, but this isn't really about callbacks, it is more about ASan and accessing data. For example, you could have

pub fn api_with_return(user_data: &[u8]) -> &[u8] {
    let dangling_data_ptr: *mut u32 = process_user_data(user_data);
    let data_len: usize = HARDCODED_VALUE;
    let data = unsafe { std::slice::from_raw_parts(dangling_data_ptr, data_len) };
    data
}

which would exhibit the same issues as the callback example.

I think a better title for this page would be something like

Writing Oracles that Access Data

or something along those lines.

[Evian-Zhang]

Thank you for this great suggestion! I have updated the text. :)

[fitzgen]

Thanks, just one final nitpick below.