Skip to content

Verification · Testing · Fuzzing

Coverage-guided fuzzing

libFuzzer or AFL style harnesses per entry point.

How to build it

Write one harness for each parser or decoder entry point.
Build each harness with the coverage instrumentation the fuzzer requires.
Run each harness for a fixed time budget locally and in CI.

Signals in a repository

A fuzz directory with one target file per parser entry point.
A cargo fuzz target, atheris or jazzer harness that takes raw input bytes.
Fuzzer command lines in a Makefile or workflow.

In practice

6 repositories run a tool for this check in the scanned set.

cargo-fuzz · 6 repos

Examples

astral-sh/ruff · cargo-fuzz
```
cargo fuzz build -s none
```
tokio-rs/tokio · cargo-fuzz
```
cargo fuzz check --all-features
```