Write a Fuzzer with libFuzzer

Fuzzing with libFuzzer

Fuzzing feeds random, malformed, or unexpected inputs to a program to find crashes and security vulnerabilities. Coverage-guided fuzzing uses code coverage feedback to prioritize inputs that explore new program paths.

How libFuzzer Works

libFuzzer is an in-process coverage-guided fuzzer from LLVM:

Start with a seed corpus of valid inputs
Mutate inputs (bit flips, byte swaps, insertions)
Run the target function and measure code coverage
Keep inputs that reach new coverage
Save inputs that trigger crashes

The fuzz target signature:

c
Loading…

For example, a parser bug triggered by input \x00\xFF\x42 will be saved as a crashing test case for triage.

For This Exercise

You will write a parser with an intentional bug and document the libFuzzer workflow. Coverage-guided fuzzing found thousands of bugs in Chromium and the Linux kernel, and pairing fuzzing with ASan catches memory errors that simple crash detection would miss.

Corpus and Mutation Strategy

Seed your corpus with valid inputs: protocol headers, file format magic bytes, and minimal valid documents. libFuzzer mutates by flipping bits, inserting bytes, and splicing inputs together. Inputs that reach new code paths are saved to the corpus for future mutations. OSS-Fuzz runs libFuzzer continuously against open-source projects, finding thousands of security bugs before they reach production releases.

Implement a C program with a simple parser that contains a bug.

Requirements:

Write a parser function that processes input bytes
Include an intentional bug that triggers on specific input (e.g., divide by zero, buffer overflow, out-of-bounds access)
Document the libFuzzer target function signature
Explain how fuzzing mutates inputs to reach the bug
Show example crashing input and what the fuzzer output looks like
Mention corpus seeds and mutation strategies

Success Criteria:

Parser function demonstrates a reachable bug
libFuzzer target signature is documented
Fuzzing process is explained in output

Fuzzing with libFuzzer

How libFuzzer Works

libFuzzer is an in-process coverage-guided fuzzer from LLVM:

Start with a seed corpus of valid inputs
Mutate inputs (bit flips, byte swaps, insertions)
Run the target function and measure code coverage
Keep inputs that reach new coverage
Save inputs that trigger crashes

The fuzz target signature:

c
Loading…

For example, a parser bug triggered by input \x00\xFF\x42 will be saved as a crashing test case for triage.

For This Exercise

Corpus and Mutation Strategy

Implement a C program with a simple parser that contains a bug.

Requirements:

Write a parser function that processes input bytes
Include an intentional bug that triggers on specific input (e.g., divide by zero, buffer overflow, out-of-bounds access)
Document the libFuzzer target function signature
Explain how fuzzing mutates inputs to reach the bug
Show example crashing input and what the fuzzer output looks like
Mention corpus seeds and mutation strategies

Success Criteria:

Parser function demonstrates a reachable bug
libFuzzer target signature is documented
Fuzzing process is explained in output

Topic Overview

Fuzzing with libFuzzer

How libFuzzer Works

For This Exercise

Corpus and Mutation Strategy

Implementation Task

Progressive Hints

Resources

Open Source

Write a Fuzzer with libFuzzer

Topic Overview

Fuzzing with libFuzzer

How libFuzzer Works

For This Exercise

Corpus and Mutation Strategy

Implementation Task

Progressive Hints

Resources

Open Source