fuzz-testing

Fuzz Testing for Rust Projects

Coverage-guided fuzzing uses libFuzzer to generate random inputs that exercise code paths, catching panics, buffer overflows, and logic bugs that unit tests miss. Rust's cargo-fuzz wraps libFuzzer with a Cargo-native workflow.

Getting Started

Install and initialize:

cargo install cargo-fuzz --locked
cargo fuzz init                    # creates fuzz/ directory
cargo fuzz add parse_input         # creates a fuzz target

Directory structure after init:

fuzz/
  Cargo.toml              # workspace member with [[bin]] per target
  corpus/
    parse_input/           # seed corpus for each target
  fuzz_targets/
    parse_input.rs         # fuzz harness source

The fuzz/Cargo.toml declares each target as a [[bin]] entry and depends on your crate via path = "..".

Writing Effective Fuzz Targets

Basic &[u8] Harness

The simplest form — feed raw bytes to your parser:

#![no_main]
use libfuzzer_sys::fuzz_target;
use my_crate::parse;

fuzz_target!(|data: &[u8]| {
    let _ = parse(data);
});

Structured Harness with Arbitrary

For APIs that take structured types, derive Arbitrary to generate valid inputs:

#![no_main]
use libfuzzer_sys::fuzz_target;
use arbitrary::Arbitrary;

#[derive(Arbitrary, Debug)]
struct FuzzInput {
    header: u8,
    payload: Vec<u8>,
    flag: bool,
}

fuzz_target!(|input: FuzzInput| {
    my_crate::process(input.header, &input.payload, input.flag);
});

Add arbitrary as a dependency in fuzz/Cargo.toml:

[dependencies]
arbitrary = { version = "1", features = ["derive"] }

Common Target Types

Target Type	Input Strategy	What It Finds
Parser	&[u8] or &str	Panics, infinite loops, stack overflows
Serializer	Roundtrip: deserialize then re-serialize	Data corruption, lossy encoding
Unsafe code	Structured inputs targeting unsafe blocks	Memory safety violations
Format handler	File-like &[u8] (image, binary format)	Buffer overflows, OOB reads
State machine	Sequence of Arbitrary operations	Invalid state transitions, panics