libfuzzer

Detects C++ and other unprocessable-language bugs in your code.

6.5k|561|Updated Jan 14, 2026

Search Tags:#coverage #llvm #fuzzing #harness #libfuzzer #sanitizer

Ready to run

npx skills add https://github.com/trailofbits/skills --skill libfuzzer-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: libfuzzer
Source: https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/libfuzzer
Command: npx skills add https://github.com/trailofbits/skills --skill libfuzzer-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fuzzing is essential for uncovering memory-safety defects and logic bugs in C/C++ code, and libFuzzer provides a lightweight, in-process fuzzing engine that integrates tightly with the LLVM toolchain to simplify bug discovery.

Core Features & Use Cases

In-process, coverage-guided fuzzing tightly integrated with LLVM, offering fast feedback and minimal setup.
Easy harness integration, with compatibility that supports rapid bootstrapping of fuzz tests for libraries, parsers, and security-critical code.
Flexible workflows that can be extended with AFL++ or LibAFL when multi-core fuzzing or more advanced features are needed.

Quick Start

Compile your harness with libFuzzer support and run the resulting binary to start a fuzzing campaign.

Frequently Asked Questions about libfuzzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I fuzz C/C++ code to find memory-safety bugs?▼

Fuzz C/C++ code to uncover memory-safety and logic bugs using libFuzzer, which provides lightweight, in-process, coverage-guided fuzzing tightly integrated with the LLVM toolchain. It targets projects built with Clang/LLVM for fast feedback and minimal setup.

How do I set up a libFuzzer harness for my C/C++ project?▼

Compile a C/C++ harness compatible with the LLVMFuzzerTestOneInput entry point using the -fsanitize=fuzzer flag. You can optionally add AddressSanitizer (ASan) via -fsanitize=address to enable runtime memory checks during the fuzzing campaign.

Does libFuzzer work with Clang and LLVM projects?▼

Yes, libFuzzer requires projects built with Clang/LLVM to enable quick, single-process fuzzing integrated with the LLVM toolchain. This integration allows for fast feedback and simplified bug discovery in security-critical code.

Can I use libFuzzer with AFL++ or LibAFL for multi-core fuzzing?▼

Yes, libFuzzer workflows can be extended with AFL++ or LibAFL when multi-core fuzzing or more advanced features are needed. This allows you to scale your fuzzing campaign beyond the default single-process setup.

Do I need AddressSanitizer to fuzz C/C++ code with libFuzzer?▼

AddressSanitizer is optional but recommended for memory checks. You compile your harness with -fsanitize=fuzzer and add ASan using -fsanitize=address to detect memory-safety defects during your fuzzing campaign.