ClusterFuzzLite

ClusterFuzzLite (repo) is a continuous fuzzing solution that runs as part of Continuous Integration (CI) workflows to find vulnerabilities faster than ever before. With just a few lines of code, GitHub users can integrate ClusterFuzzLite into their workflow and fuzz pull requests to catch bugs before they are committed.

ClusterFuzzLite is based on ClusterFuzz.

Features

Quick code change (pull request) fuzzing to find bugs before they land
Downloads of crashing testcases
Continuous longer running fuzzing (batch fuzzing) to asynchronously find deeper bugs missed during code change fuzzing and build a corpus for use in code change fuzzing
Coverage reports showing which parts of your code are fuzzed
Modular functionality, so you can decide which features you want to use

Supported Languages

C
C++
Java (and other JVM-based languages)
Go
Python
Rust
Swift

Supported CI Systems

GitHub Actions
GitLab
Google Cloud Build
Prow
Support for more CI systems is in-progess, and extending support to other CI systems is easy

Supported Fuzzing Engine and Sanitizers

libFuzzer for coverage-guided testing
AddressSanitizer for finding memory safety issues
MemorySanitizer for finding use of uninitialized memory
UndefinedBehaviorSanitizer for finding undefined behavior (e.g. integer overflows)

Getting Started

If you’re new to using libFuzzer and sanitizers, start with the Overview for an explanation of terms and the fuzzing process.

If you’re already familiar with using libFuzzer and sanitizers, start with Step 1: Build Integration.

Staying in touch

Join our mailing list for announcements and discussions.

If you use ClusterFuzzLite, please fill out this form so we know who is using it. This gives us an idea of the impact of ClusterFuzzLite and allows us to justify future work.

Please file an issue if you experience any trouble or have feature requests.