libfuzzer

Write a harness defining LLVMFuzzerTestOneInput that passes fuzzer data to your target function, then compile with clang++ -fsanitize=fuzzer,address and run the binary against a corpus directory. The fuzzer mutates inputs to maximize code coverage and saves crashing inputs automatically.

libFuzzer is best for quick setup and single-core fuzzing of Clang-compilable C/C++ projects. AFL++ is better for serious multi-core fuzzing and diverse mutations. Harnesses written for libFuzzer are compatible with AFL++, so transitioning later is straightforward.

libFuzzer works on macOS via Homebrew or Nix LLVM installs, and on Windows through Clang in Visual Studio. However, Linux provides the best support and performance, so fuzzing on a Linux x86_64 VM is recommended.

ASan reserves roughly 20TB of virtual memory, which can trigger RSS limits. Disable the limit by running the fuzzer with -rss_limit_mb=0 or setting ASAN_OPTIONS=rss_limit_mb=0 before starting the campaign.

Run the fuzzer with -fork=1 -ignore_crashes=1 to continue the campaign after crashes are found. By default libFuzzer stops at the first crash, but these experimental flags let it keep exploring while saving each crash artifact.

Avoid libFuzzer when you need serious multi-core fuzzing, hardware-based coverage, or when your project only compiles with GCC. In those cases use AFL++, Honggfuzz, or LibAFL instead.