Write a Fuzzer with libFuzzer

Topic Overview

Fuzzing with libFuzzer

Fuzzing feeds random, malformed, or unexpected inputs to a program to find crashes and security vulnerabilities. Coverage-guided fuzzing uses code coverage feedback to prioritize inputs that explore new program paths.

How libFuzzer Works

libFuzzer is an in-process coverage-guided fuzzer from LLVM:

1. Start with a seed corpus of valid inputs
2. Mutate inputs (bit flips, byte swaps, insertions)
3. Run the target function and measure code coverage
4. Keep inputs that reach new coverage
5. Save inputs that trigger crashes

The fuzz target signature:

cCopy
Loading…

For example, a parser bug triggered by input \x00\xFF\x42 will be saved as a crashing test case for triage.

For This Exercise

You will instrument a buggy parser exactly the way libFuzzer would: feed it one fuzz input given as a hex string, count how many of its checks the input passes (the coverage signal), and report the first crash the parser reaches: the unchecked length byte overflowing buffer[16], or the divide-by-zero behind it. The crash hash you compute for the saved crashing input mirrors the corpus file libFuzzer writes for triage.

Corpus and Mutation Strategy

Seed your corpus with valid inputs: protocol headers, file format magic bytes, and minimal valid documents. libFuzzer mutates by flipping bits, inserting bytes, and splicing inputs together. Inputs that reach new code paths are saved to the corpus for future mutations. OSS-Fuzz runs libFuzzer continuously against open-source projects, finding thousands of security bugs before they reach production releases.

Write a C program that acts as the fuzz target instrumentation: it parses one input (given as a hex string on stdin) against a buggy parser and reports coverage and crash class.

The parser under test accepts 4-byte magic "FUZZ", reads byte 4 as an unchecked length, copies that many payload bytes into buffer[16], then divides a checksum by data[5].

Requirements:

• Decode the hex input into bytes
• Advance coverage as checks pass: size >= 4 (magic readable), magic == FUZZ, size >= 5 (length byte readable), payload copy runs, copy completes without exceeding buffer[16]
• If the length byte exceeds 16, report STACK-BUFFER-OVERFLOW with the exact overflow byte count (length - 16) at the coverage point where it fires
• Otherwise, if data[5] is 0, report DIVIDE-BY-ZERO; otherwise count the final branch and print the payload checksum
• For every crash, compute an FNV-1a hash over the input bytes and name the saved crash file crash-<hash>; for rejects and clean parses the fuzzer keeps mutating

Success Criteria:

• Coverage counts increase stepwise with how deep the input reaches the parser
• Both bug classes are reachable and reported with their computed overflow amount
• The crash-file hash is computed from the input bytes, not hardcoded