Fuzz Rustc

This repo contains configuration for fuzz-testing the Rust compiler using libfuzzer-sys, taking inspiration from cargo-fuzz and fuzz-targets.

Because rustc is a bootstrapping compiler, its build process has several stages and involves juggling many flags, attributes, and environment variables. These complications create some difficulties for cleanly setting up fuzz testing. We work around those difficulties with some light modifications to rustc and some additional configuration.

Running

./run-fuzzer.sh

You may add some example inputs in the ./seeds/ directory.

New interesting test cases are automatically written to the ./corpus/ directory as they are found.

The run-fuzzer.sh script passes trailing arguments on to the underlying libfuzzer binary, so you can pass any of these options: https://llvm.org/docs/LibFuzzer.html#options .

For example, this invocation will run 4 jobs in parallel and will only try ascii inputs:

./run_fuzzer.sh -jobs=4 -only_ascii=1

Bugs found

#62524 #62546 #62554 #62863 #62881 #62894 #62895 #62913 #62973 #63116 #63135 #66473 #68629 #68730 #68890 #69130 #69310 #69378 #69396 #69401 #69600 #69602 #70549 #70552 #70594 #70608 #70677 #70724 #70736 #70763 #70813 #70942 #71297 #71471 #71798 #72410 #84104 #84117 #84148 #84149 #86895 #88770 #92267 #102114 #102751 #102878

TODO

Generalize this setup to also work other fuzzing engines, like AFL and Honggfuzz.

License

All files in this repository are licensed CC0.