harness-writing

Implement the LLVMFuzzerTestOneInput function that receives a uint8_t data pointer and size, then call your target function. Compile with clang++ using -fsanitize=fuzzer,address to link the fuzzing runtime and detect memory bugs.

Use FuzzedDataProvider to consume typed values like integers and strings from raw bytes via methods such as ConsumeIntegral and ConsumeBytesWithTerminator. In Rust, the arbitrary crate derives deserialization directly into your structs.

libFuzzer uses an in-process LLVMFuzzerTestOneInput callback and can start with an empty corpus. AFL++ typically reads from stdin or files, requires seed inputs, and achieves best performance with persistent mode using __AFL_LOOP.

Non-reproducible crashes usually come from non-determinism or global state. Replace rand() with a PRNG seeded from fuzzer input, mock time and system calls, and reset all global state at the start of each harness iteration.

Use interleaved fuzzing when multiple related operations share similar input types, such as arithmetic or CRUD operations. A mode byte selects the operation, letting one shared corpus benefit all operations and revealing interaction bugs.

The arbitrary crate does not offer reverse serialization, so you cannot manually construct byte arrays mapping to specific structs. It works best starting from an empty corpus with libFuzzer, but is problematic for AFL++ which needs seed inputs.