Fuzzing
Feeds coverage-guided random input to parsers and decoders to find crashes, panics and hangs.
Sub-techniques
3
| ID | Name | Description |
|---|---|---|
V1022.001 | Coverage-guided fuzzing | libFuzzer or AFL style harnesses per entry point. |
V1022.002 | Continuous fuzzing | Run fuzzers continuously (for example OSS-Fuzz) and file crashes as issues. |
V1022.003 | Corpus regression | Replay the saved corpus and crash cases in normal CI. |
Craft it
- Write one harness per parser or decoder entry point.
- Seed the corpus with real inputs and commit it.
- Run short fuzz jobs on PRs and long ones on a schedule.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- fuzz/ directories, fuzz_targets, or project.yaml for OSS-Fuzz.
- CIFuzz or cargo fuzz steps in workflows.
Where the scanned repositories configure it:
.github/workflows/*.ymlin 2 repositoriesCargo.tomlin 1 repositoriesfuzz_stream_map.rsin 1 repositoriesruff_fix_validity.rsin 1 repositories
Detected by the scanner as: Fuzzing (crashes, panics and hangs on malformed input, especially in parsers and decoders.)
Open-source packages
4
- cargo-fuzz rust-fuzz/cargo-fuzz
- Atheris google/atheris
- Jazzer CodeIntelligenceTesting/jazzer
- AFL++ AFLplusplus/AFLplusplus
Tools seen in scans
by repositories that run them
| Tool | Repos | Command seen | Runs in | Docs |
|---|---|---|---|---|
cargo-fuzz |
6 | cargo fuzz build -s none |
ci | docs |
Procedure examples
repositories that run it, most-starred first
| Repository | Tools | Runs in | Evidence |
|---|---|---|---|
| astral-sh/ruff | cargo-fuzz |
ci | .github/workflows/ci.yaml jobs.cargo-fuzz-build.steps[4] |
| tokio-rs/tokio | cargo-fuzz |
ci | .github/workflows/ci.yml jobs.check-fuzzing.steps[4] (Check /tokio/) |