libFuzzer
In-process, coverage-guided evolutionary fuzzing engine from LLVM for testing C and C++ libraries with AddressSanitizer.
Technical Architecture & Overview
libFuzzer is an in-process, coverage-guided evolutionary fuzzing engine that ships as part of LLVM compiler-rt. It links directly against fuzz targets and uses SanitizerCoverage feedback to guide input mutation, and it is one of the fuzzing engines used by OSS-Fuzz. Its original authors have stopped active work on it, and the LLVM documentation says to expect bug fixes rather than major new features.
Targeted Technical Use Cases
Fuzzing C/C++ libraries with custom fuzz targets in continuous fuzzing infrastructure like OSS-Fuzz.
Evaluation & Trade-offs
Core Strengths
- +Tight in-process integration with AddressSanitizer and UndefinedBehaviorSanitizer for precise crash detection.
- +Included in Clang since version 6.0, requiring no separate installation.
- +The LLVM documentation credits it with thousands of bugs found on OSS-Fuzz.
Trade-Offs & Limitations
- -No major new features are planned, since the original authors moved to the Centipede engine.
- -Requires writing and compiling a fuzz target harness in C or C++.
- -In-process design means a single crash terminates the fuzzer unless the experimental fork mode is enabled.
Defensive Security Application
Continuous fuzzing of parsers, codecs, and cryptographic libraries to find memory corruption bugs before release.
Frequently Asked Questions
What is libFuzzer?→
libFuzzer is an in-process, coverage-guided evolutionary fuzzing engine that ships as part of LLVM compiler-rt. It links directly against fuzz targets and uses SanitizerCoverage feedback to guide input mutation, and it is one of the fuzzing engines used by OSS-Fuzz. Its original authors have stopped active work on it, and the LLVM documentation says to expect bug fixes rather than major new features.
What is libFuzzer used for?→
Fuzzing C/C++ libraries with custom fuzz targets in continuous fuzzing infrastructure like OSS-Fuzz.
What are the strengths of libFuzzer?→
- +Tight in-process integration with AddressSanitizer and UndefinedBehaviorSanitizer for precise crash detection.
- +Included in Clang since version 6.0, requiring no separate installation.
- +The LLVM documentation credits it with thousands of bugs found on OSS-Fuzz.
What are the limitations of libFuzzer?→
- +No major new features are planned, since the original authors moved to the Centipede engine.
- +Requires writing and compiling a fuzz target harness in C or C++.
- +In-process design means a single crash terminates the fuzzer unless the experimental fork mode is enabled.
How is libFuzzer used defensively?→
Continuous fuzzing of parsers, codecs, and cryptographic libraries to find memory corruption bugs before release.