This repo contains configuration for fuzz-testing the Rust compiler using libfuzzer-sys, taking inspiration from cargo-fuzz and fuzz-targets.

Because rustc is a bootstrapping compiler, its build process has several stages and involves juggling many flags, attributes, and environment variables. These complications create some difficulties for cleanly setting up fuzz testing. We work around those difficulties with some light modifications to rustc and some additional configuration.

./run-fuzzer.sh

You may add some example inputs in the ./seeds/ directory.

New interesting test cases are automatically written to the ./corpus/ directory as they are found.

The run-fuzzer.sh script passes trailing arguments on to the underlying libfuzzer binary, so you can pass any of these options: https://llvm.org/docs/LibFuzzer.html#options .

For example, this invocation will run 4 jobs in parallel and will only try ascii inputs:

./run_fuzzer.sh -jobs=4 -only_ascii=1

#62524 #62546 #62554 #62863 #62881 #62894 #62895 #62913 #62973 #63116 #63135 #66473 #68629 #68730 #68890 #69130 #69310 #69378 #69396 #69401 #69600 #69602 #70549 #70552 #70594 #70608 #70677 #70724 #70736 #70763 #70813 #70942 #71297 #71471 #71798 #72410 #84104 #84117 #84148 #84149 #86895 #88770 #89868 #92267 #102114 #102751 #102878 #110014 #111148

These projects have found lots more bugs:

• jruderman/fuzz-rustc
• matthiaskrgr/icemaker

All files in this repository are licensed CC0.