atheris

Fuzz Python C extensions to uncover memory-safety defects by writing a test harness, instrumenting your target code with Atheris, and executing coverage-guided fuzzing campaigns based on libFuzzer.

Coverage-guided fuzzing for Python code automatically explores input spaces to discover memory-safety and logic defects. Atheris uses libFuzzer instrumentation to maximize code coverage and uncover hidden bugs during security testing.

Yes, you can run fuzzing in CI pipelines for native extensions. Atheris integrates with sanitizer-enabled builds like ASan and UBSan, providing Docker-ready environments to automatically execute fuzz campaigns.

Docker setup is optional for setting up fuzzing for Python libraries. You can create a minimal harness and instrument your pure Python or native extension code directly, but Docker-ready environments are supported for CI workflows.

Fuzzing pure Python targets logic defects, while fuzzing native C extensions targets memory-safety defects. Atheris supports harnesses for both, requiring sanitizer-enabled builds to effectively uncover underlying vulnerabilities in C extensions.

Your Python fuzzing campaign may fail to find defects in native extensions if you lack sanitizer-enabled builds. Integrating ASan or UBSan with Atheris instrumentation is required to expose underlying memory-safety vulnerabilities.