libfuzzer

Coverage-guided fuzzing in Clang requires compiling your C/C++ code with the -fsanitize=fuzzer flag and linking it with libFuzzer to enable deterministic crash discovery. You also need to write a fuzz harness to feed inputs to your target functions.

A fuzz harness is a lightweight C/C++ function that receives arbitrary byte data from libFuzzer and passes it to the target code you want to test. You create it by defining the LLVMFuzzerTestOneInput function, which accepts a pointer and size, then triggering your target logic.

Yes, you can use sanitizers with libFuzzer to find security issues by compiling with flags like -fsanitize=address alongside -fsanitize=fuzzer. This combination detects memory errors like buffer overflows and use-after-frees during fuzzing runs.

Fuzzing with libFuzzer requires the Clang compiler because libFuzzer is integrated directly into the LLVM toolchain. You need Clang to apply the necessary build configurations and compiler flags for coverage instrumentation and sanitizer support.

Corpus management in libFuzzer involves specifying a directory to store seed inputs and evolved test cases that increase code coverage. The fuzzer automatically saves interesting inputs that trigger new execution paths into this corpus directory for future regression testing.

If libFuzzer is not finding crashes, your harness might not be reaching deep code paths, or you may be missing sanitizer flags like -fsanitize=address. Ensure your build configuration includes both fuzzing and sanitizer instrumentation, and verify your harness passes data effectively.