skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

libfuzzer

Guides coverage-guided fuzzing of C/C++ code using LLVM libFuzzer with Clang.

Updated Apr 5, 2026
Search Tags:#security testing#c++#clang#AddressSanitizer#fuzzing#coverage-guided#libFuzzer
One-click install
npx skills add https://github.com/marumo333/atrox --skill libfuzzer-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: libfuzzer
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/testing-handbook-skills/skills/libfuzzer
Command: npx skills add https://github.com/marumo333/atrox --skill libfuzzer-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Setting up effective fuzzing for C/C++ projects requires knowing the right compiler flags, harness patterns, sanitizer configurations, and corpus strategies, and mistakes lead to slow campaigns or missed bugs. ## Core Features & Use Cases - Harness Authoring Guidance: Provides LLVMFuzzerTestOneInput patterns, FuzzedDataProvider usage, and interleaved fuzzing techniques for complex inputs. - Compilation & Sanitizer Integration: Covers -fsanitize=fuzzer builds with AddressSanitizer, UndefinedBehaviorSanitizer, and MemorySanitizer, including CMake and static library setups. - Campaign Management: Explains corpus creation and minimization, dictionaries, multi-core options, coverage analysis with llvm-cov, and troubleshooting. - Use Case: Fuzz libpng by compiling it with fuzzer-no-link instrumentation, linking a read harness against the static library, and running a campaign with a PNG dictionary and seed corpus. ## Quick Start Write a libFuzzer harness for my C++ parsing function and show me how to compile and run it with AddressSanitizer.

Frequently Asked Questions about libfuzzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a libFuzzer harness for C++ code?▼

Implement the LLVMFuzzerTestOneInput function that receives raw bytes and calls your target function. Compile with clang++ -fsanitize=fuzzer,address -g -O2, then run the binary against a corpus directory to start fuzzing.

libFuzzer vs AFL++ which fuzzer should I use?▼

libFuzzer suits quick setup and single-core fuzzing of Clang-compiled C/C++ projects, while AFL++ offers better multi-core support and diverse mutations. Harnesses written for libFuzzer are compatible with AFL++, easing later transitions.

Does libFuzzer work on Windows and macOS?▼

libFuzzer works on macOS via Homebrew or Nix LLVM installs, and on Windows through Clang in Visual Studio. Linux provides the best support, so fuzzing on a Linux x86_64 VM is recommended.

Why does libFuzzer run out of memory with AddressSanitizer?▼

AddressSanitizer reserves roughly 20TB of virtual memory, which trips default RSS limits. Disable the limit by setting -rss_limit_mb=0 or ASAN_OPTIONS=rss_limit_mb=0 when running the fuzzer.

How do I continue fuzzing after libFuzzer finds a crash?▼

Run the fuzzer with -fork=1 -ignore_crashes=1 so the campaign continues after crashes. Crash inputs are saved as crash-<hash> files that you can re-execute individually for reproduction.

When should I not use libFuzzer?▼

Avoid libFuzzer for serious multi-core fuzzing, GCC-only codebases, or hardware-based coverage needs. Consider AFL++, Honggfuzz, or LibAFL for those scenarios instead.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

implementing-fuzz-testing-in-cicd-with-aflplusplus

Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines to detect memory corruption vulnerabilities.

Community
Advanced
remiconnessonremiconnesson

debug

Diagnose software bugs through reproduction, hypothesis testing, and root-cause analysis.

Community
Advanced
SuperlendSuperlend

coverage-analysis

Analyze code coverage from fuzzing campaigns and generate reports with LLVM tools.

Official
Intermediate
IagoPrandiIagoPrandi

libafl

Build custom Rust-based fuzzers using LibAFL's modular fuzzing library components.

Community
Advanced