libfuzzer

Coverage-guided fuzzing for C++ is set up by compiling your code with Clang and the -fsanitize=fuzzer flag. This integrates libFuzzer to perform in-process mutations and quickly discover crashes in your target codebase.

In-process fuzzing executes test inputs within the same process memory space, enabling rapid iteration and immediate crash detection. You need it for fast, coverage-guided bug discovery in C/C++ projects without the overhead of process spawning.

Designing a fuzz harness involves writing a function that accepts arbitrary byte arrays and passes them to your target APIs. The harness is compiled with -fsanitize=fuzzer to let libFuzzer inject mutated inputs and detect memory errors during execution.

Sanitizers integrate directly with libFuzzer by adding flags like -fsanitize=address during Clang compilation. This combination detects memory errors and undefined behavior while the fuzzer generates coverage-guided inputs.

libFuzzer requires Clang because it is part of the LLVM toolchain and relies on the -fsanitize=fuzzer instrumentation. It is designed for C/C++ projects built with Clang to ensure tight integration and reliable bug discovery.

Corpus management for C/C++ fuzzing involves storing effective test inputs in a directory that libFuzzer accesses during campaigns. The coverage-guided fuzzer uses these seed inputs to scale coverage and discover new code paths over time.