atheris

You can fuzz test Python C extensions by executing them under a coverage-guided fuzzer using libFuzzer and AddressSanitizer. This workflow automates discovery of crashes and memory errors in native extensions by instrumenting the code with Atheris.

Coverage-guided fuzzing for Python code is an automated testing technique that discovers crashes and edge-case bugs by feeding mutated inputs to a target function. It tracks code execution paths to maximize coverage and efficiently find memory-safety issues.

Yes, you need a suitable compiler toolchain including clang and sanitizers to fuzz Python libraries, especially when testing C extensions. The provided Dockerfile sets up this complete reproducible environment for safe fuzzing in CI or local development.

To set up a fuzzing harness, create a Python script that imports Atheris, instrument your target imports using atheris.instrument_imports, and define a test function that feeds byte buffers to your API. Then execute the script to start fuzzing.

Yes, you can run fuzzing in CI workflows for mixed-language projects. The Docker-based environment provides a reproducible setup with the complete clang toolchain, allowing you to safely fuzz pure Python code and native extensions during continuous integration.

Fuzzing pure Python code primarily catches logical crashes and unhandled exceptions, whereas fuzzing native C extensions can discover severe memory-safety issues like buffer overflows. Both require proper instrument_imports and instrument_func configuration to achieve high coverage.