libFuzzer

libFuzzer is an in-process, coverage-guided, evolutionary fuzzing engine that is part of the LLVM project. It is linked with the library under test and feeds fuzzed inputs to it through a specific entry point, the fuzz target function.

The fuzzer tracks which areas of the code are reached, using LLVM’s SanitizerCoverage instrumentation, and generates mutations of a corpus of input data to maximise code coverage. It is usually combined with sanitizers such as AddressSanitizer or UndefinedBehaviorSanitizer to detect memory errors and undefined behaviour, and provides options for dictionaries, corpus minimisation and parallel runs. Many other fuzzers, such as Atheris, Jazzer and cargo-fuzz, are built on libFuzzer.

libFuzzer is distributed with Clang and is open source under the Apache 2.0 licence with LLVM exceptions. Its original authors have moved to the Centipede engine; libFuzzer remains supported, with important bugs still being fixed.