libFuzzer
In-process, coverage-guided evolutionary fuzzing engine from LLVM for testing C and C++ libraries with AddressSanitizer.
Technical Architecture & Overview
libFuzzer is an in-process, coverage-guided evolutionary fuzzing engine that ships as part of LLVM compiler-rt. It links directly against fuzz targets and uses SanitizerCoverage feedback to guide input mutation, making it the de-facto standard for fuzzing C/C++ code in OSS-Fuzz and Chromium.
Targeted Technical Use Cases
Fuzzing C/C++ libraries with custom fuzz targets in continuous fuzzing infrastructure like OSS-Fuzz.
Evaluation & Trade-offs
Core Strengths
- +Tight in-process integration with AddressSanitizer and UndefinedBehaviorSanitizer for precise crash detection.
- +Ships with LLVM/Clang, requiring no separate installation for most C/C++ projects.
- +Industry standard used by OSS-Fuzz, Chromium, and thousands of open-source projects.
Trade-Offs & Limitations
- -Requires writing and compiling a fuzz target harness in C or C++.
- -In-process design means a single crash terminates the fuzzer, unlike fork-server models.
Defensive Security Application
Continuous fuzzing of parsers, codecs, and cryptographic libraries to find memory corruption bugs before release.
Frequently Asked Questions
What is libFuzzer?→
libFuzzer is an in-process, coverage-guided evolutionary fuzzing engine that ships as part of LLVM compiler-rt. It links directly against fuzz targets and uses SanitizerCoverage feedback to guide input mutation, making it the de-facto standard for fuzzing C/C++ code in OSS-Fuzz and Chromium.
What is libFuzzer used for?→
Fuzzing C/C++ libraries with custom fuzz targets in continuous fuzzing infrastructure like OSS-Fuzz.
What are the strengths of libFuzzer?→
- +Tight in-process integration with AddressSanitizer and UndefinedBehaviorSanitizer for precise crash detection.
- +Ships with LLVM/Clang, requiring no separate installation for most C/C++ projects.
- +Industry standard used by OSS-Fuzz, Chromium, and thousands of open-source projects.
What are the limitations of libFuzzer?→
- +Requires writing and compiling a fuzz target harness in C or C++.
- +In-process design means a single crash terminates the fuzzer, unlike fork-server models.
How is libFuzzer used defensively?→
Continuous fuzzing of parsers, codecs, and cryptographic libraries to find memory corruption bugs before release.