Fuzzing with libFuzzer
Find edge-case crashes by fuzzing your code with libFuzzer.
Fuzzing with libFuzzer is a free C++ Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C++ Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Fuzz?
Fuzzing generates random inputs to find crashes, hangs, and security bugs. Modern fuzzers use coverage feedback to evolve inputs that explore new code paths.
libFuzzer
libFuzzer is part of LLVM and integrates with sanitizers. Write a single function that fuzzes one entry point; the framework drives input generation.
Writing a Fuzz Target
The signature is fixed: take a byte array, return 0.
#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
parse_input(reinterpret_cast<const char*>(data), size);
return 0;
}Compiling for libFuzzer
Use Clang with the -fsanitize=fuzzer,address combination. Link directly — no main needed.
clang++ -g -O1 -fsanitize=fuzzer,address fuzz.cpp parser.cpp -o fuzz_target
./fuzz_targetCoverage-Guided Mutation
libFuzzer tracks which code paths each input executes. It mutates promising inputs to explore deeper paths — much more efficient than blind random generation.
A Corpus
Seed the fuzzer with a directory of known interesting inputs. The fuzzer evolves new inputs by mutating them.
./fuzz_target corpus/Dictionary Files
Provide a dictionary of common tokens to speed up exploration of grammatical inputs (HTML, JSON, protocol messages).
Combine with Sanitizers
Running under AddressSanitizer turns silent corruptions into immediate crashes the fuzzer can detect.
Performance
A single core can do tens of thousands of executions per second on small targets. Run for hours or days; let it run in the background of CI.
Reproducing Crashes
When libFuzzer finds a crash, it saves the input to disk. Replay later to debug.
./fuzz_target crash-abc123OSS-Fuzz
Google s OSS-Fuzz runs fuzzers on open-source projects continuously and reports bugs. Many high-profile libraries integrate with it.
AFL and Honggfuzz
Other fuzzers exist:
- AFL/AFL++ — process-based, fork-server speedups
- Honggfuzz — supports network protocols
libFuzzer is the easiest C++ integration.
When to Fuzz
Fuzz any code that handles untrusted input:
- Parsers (JSON, XML, protobuf)
- Decoders (image, audio, video)
- Network protocol handlers
- Anything reading external data
Quick Check
What makes coverage-guided fuzzing more effective than purely random fuzzing?
Recap
libFuzzer is a coverage-guided fuzzer integrated with Clang. Write a small LLVMFuzzerTestOneInput entry, build with -fsanitize=fuzzer,address, and let it search for crashes. Combine with sanitizers and corpora; fuzz any code touching untrusted input.
Frequently asked questions
Is the “Fuzzing with libFuzzer” lesson free?
Yes — the full text of “Fuzzing with libFuzzer” is free to read here on the web, and the C++ Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C++ Academy course, upgrade to CoddyKit PRO.
What will I learn in “Fuzzing with libFuzzer”?
Find edge-case crashes by fuzzing your code with libFuzzer. You practise C++ Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start C++ Academy?
No prior experience is required. C++ Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Fuzzing with libFuzzer” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this C++ Academy lesson?
Yes. Every C++ Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.