Fuzzing

Find edge cases, crashes, and security vulnerabilities by testing your code against millions of random inputs.

Fuzzing is especially valuable for testing code that handles untrusted data like parsers, file format handlers, and network protocols.

Key Features

• What is Fuzzing?: Understanding fuzzing and its benefits
• When to Use Fuzzing: Identifying good candidates for fuzz testing
• Writing Fuzz Targets: Creating effective fuzz tests
• Running Fuzz Tests: VSCode and command-line usage
• Integrate with Non-Template Projects: Adding fuzzing to existing projects

What is Fuzzing?

Fuzzing works by:

1. Generating random input data (bytes, strings, structured data)
2. Feeding that data to your code
3. Watching for crashes, panics, or assertion failures
4. Saving inputs that cause problems so you can reproduce and fix bugs

What Can Fuzzing Find?

• Buffer overflows and out-of-bounds access
• Panics on malformed or unexpected input
• Infinite loops or excessive memory usage
• Integer overflows and arithmetic errors
• Logic errors in edge cases

When to Use Fuzzing

Writing Fuzz Targets

Basic Fuzz Target:

#![no_main]

use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    // fuzzed code goes here
});

Example: Fuzzing a Parser:

#![no_main]

use libfuzzer_sys::fuzz_target;
use my_library::parse_config;

fuzz_target!(|data: &[u8]| {
    // Convert bytes to string, ignore invalid UTF-8
    if let Ok(input) = std::str::from_utf8(data) {
        // Your parser should handle any input without panicking
        let _ = parse_config(input);
    }
});

Fuzz targets live in fuzz/fuzz_targets/. The template includes fuzz_example.rs as a starting point.

Running Fuzz Tests

Using VSCode Tasks:

Press Ctrl+Shift+P → "Run Task" → Select List Fuzz Targets to see available targets.

Using Command Line:

cd src
# Run the default fuzz target
cargo +nightly fuzz run fuzz_example

# List all available fuzz targets
cargo +nightly fuzz list

# Run with a time limit (60 seconds)
cargo +nightly fuzz run fuzz_example -- -max_total_time=60

Windows Setup:

When a Bug is Found:

Fuzzing saves crash-inducing inputs to fuzz/artifacts/fuzz_example/. Use these to reproduce and fix bugs:

# Reproduce a crash
cargo +nightly fuzz run fuzz_example fuzz/artifacts/fuzz_example/crash-xxxxx

Integrate with Non-Template Projects

Install cargo-fuzz:

cargo install cargo-fuzz

Initialize fuzzing in your project:

cd src  # or your project root
cargo fuzz init

This creates a fuzz/ directory with a basic fuzz target.

Create a fuzz target:

Edit fuzz/fuzz_targets/fuzz_example.rs (or create a new target):

#![no_main]

use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    // Call your code with random input
});

VSCode Tasks Setup

Add this task configuration to your .vscode/tasks.json (create the file if it doesn't exist):

{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "List Fuzz Targets",
      "type": "shell",
      "command": "cargo install cargo-fuzz --quiet && cargo +nightly fuzz list",
      "group": "test",
      "presentation": {
        "reveal": "always"
      },
      "problemMatcher": []
    }
  ]
}