harness-writing

Define the entry point extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size), validate the input size, then call your target function. Compile with clang++ -fsanitize=fuzzer,address and run against a corpus directory.

Use FuzzedDataProvider in C++ to consume typed values like integers and terminated strings from the raw byte stream. In Rust, the arbitrary crate derives deserialization of raw bytes directly into your structs.

libFuzzer uses the LLVMFuzzerTestOneInput callback and can start with an empty corpus. AFL++ works best with persistent mode using __AFL_LOOP for 10-100x speedup and requires at least one seed input.

Non-reproducible crashes usually come from non-determinism or global state. Replace rand() with a PRNG seeded from fuzzer input, mock time and system calls, and reset all global state at the start of each harness iteration.

Use interleaved fuzzing when multiple related operations share similar input types, such as arithmetic or CRUD operations. A mode byte selects the operation, letting one shared corpus discover bugs across all operations and their interactions.

Slow campaigns usually come from logging, blocking I/O, or heavy per-iteration work in the harness. Remove logging, mock I/O with in-memory buffers, free all allocations, and keep each iteration fast and focused.