Projects integrate via build files (Dockerfile + build.sh) that define how to build fuzz targets. OSS-Fuzz compiles the code with a chosen fuzzing engine (libFuzzer/AFL++/Honggfuzz/Centipede) and sanitizers (address/memory/undefined), then runs them at scale on the distributed ClusterFuzz infrastructure. Detected crashes are deduplicated, minimized and reported to maintainers under a responsible-disclosure process, and fixes are automatically verified. The OSS-Fuzz-Gen extension uses LLMs to generate new fuzz harnesses and benchmarks them against existing ones for compilability, runtime crashes and code coverage.
Critical open source software was fuzzed rarely and ad hoc, so serious vulnerabilities (e.g. Heartbleed) went undetected for long periods. OSS-Fuzz provides continuous, automated fuzzing on Google infrastructure with fast reporting of crashes and regressions to maintainers.
Scalable backend that runs fuzz targets across many machines, deduplicates and minimizes crashes and manages their lifecycle.
libFuzzer, AFL++, Honggfuzz and Centipede — engines that generate and mutate inputs to trigger crashes.
Official
AddressSanitizer, MemorySanitizer and UndefinedBehaviorSanitizer detect memory errors and undefined behavior while running fuzz targets.
Official
Docker images with build.sh scripts define a reproducible way to compile each project's fuzz targets.
Framework that uses large language models (Gemini, GPT) to automatically write and benchmark fuzz harnesses for OSS-Fuzz projects.
Official
Google launches OSS-Fuzz (announced Dec 1, 2016) after Heartbleed, in cooperation with the Core Infrastructure Initiative.
Google releases OSS-Fuzz-Gen, a framework using LLMs to automatically generate fuzz targets.
LLM-generated targets in OSS-Fuzz-Gen found 30 new bugs, including CVE-2024-9143 in OpenSSL, unreachable by prior hand-written targets.
Engine that generates inputs for the fuzz target.
Instrumentation that detects runtime errors. Defaults to address and undefined.
Programming language of the fuzzed project.
Fuzzing is CPU-bound; OSS-Fuzz runs targets on x86_64/i386 clusters without accelerators.
