fuzz-tool-selector

Overview

Decision tree routing a fuzz-target authoring task to the right per-language fuzzer skill. Composes the seven per-language skills + the two references in the plugin. Picks based on target language, source-availability, and OSS-Fuzz eligibility.

When to use

• Authoring a fuzz target - pick the right fuzzer before writing the harness.
• Reviewing an existing fuzz target - verify the right fuzzer was selected.

Decision tree

Step 1: Identify target language(s).
        ↓
+-------+----------+--------+--------+-------+--------+--------+
| C/C++ |   Rust   |   Go   | Python |  JVM  | Other  | Binary |
|       |          |        |        |       |        | (no    |
|       |          |        |        |       |        | source)|
+-------+----------+--------+--------+-------+--------+--------+
    ↓        ↓         ↓        ↓        ↓        ↓        ↓
  Step 2:                                            AFL++
  Library    cargo-    go test  Atheris  Jazzer    Choose    -Q mode
  function?   fuzz     -fuzz                       per LLVM
   YES                                              -fsanitize
    ↓                                                support
  libFuzzer
  (in-process)
   OR
  AFL++ (file-driven)

Step 3: Is this a mature open-source project?
        ↓
        YES → also submit to OSS-Fuzz
                                            ↓
                                          ossfuzz-integration

Routing rules

Routing rationale

C/C++

Prefer libFuzzer for callable APIs (parsers, validators, decoders). In-process iteration is fastest. Pair with ASan + UBSan per sanitiser-integration-reference.

Switch to AFL++ when:

• The target reads input via stdin or file argument (file-format tools, command-line utilities)
• You need QEMU mode for closed-source binaries
• You want a different mutation engine - AFL++ and libFuzzer find different bugs

Many mature projects run both libFuzzer and AFL++ targets in parallel.

Rust

Prefer cargo-fuzz - integrates with cargo, supports Arbitrary for structured input. Requires nightly toolchain.

For Rust binaries (not callable library APIs), AFL++ works similarly to C/C++ - wrap the binary with AFL++.

Go

Use Go native fuzzing - built into the standard testing package as of Go 1.18. Failing inputs auto-save as regression fixtures.

For binary-level Go fuzzing or fuzzing CGo dependencies, AFL++ in -Q mode works.

Python

Use Atheris - Google's libFuzzer-backed Python fuzzer. Supports both pure-Python and CPython native extensions.

For pure property-based testing in Python (without coverage guidance), consider Hypothesis in the hypothesis-testing skill (qa-property-based plugin) - complementary, not competing.

JVM

Use Jazzer - Code Intelligence's libFuzzer-backed JVM fuzzer. JUnit 5 integration via @FuzzTest. Ships JVM-level sanitisers (deserialization, SSRF, ReDoS, OS command injection).

Other languages

Languages with libFuzzer-compatible sanitiser-coverage support (Swift, Objective-C, some Haskell setups): use libFuzzer directly via the language's FFI / wrapper.

Languages without native fuzzer support (e.g., Erlang, OCaml): test via AFL++ on the compiled binary.

OSS-Fuzz overlay

Independent of the per-language choice: if the project is open-source, mature, and security-relevant, also onboard to ossfuzz-integration. OSS-Fuzz runs the existing libFuzzer / AFL++ / Jazzer harness 24x7 on Google infrastructure with automatic crash reports.

Anti-patterns

Limitations

• Doesn't replace per-language expertise. Knowing libFuzzer's flags vs AFL++'s requires reading the linked skill.
• Doesn't handle cross-language targets. A JNI library: Java side via Jazzer, C side via libFuzzer; two separate campaigns.
• OSS-Fuzz eligibility heuristic. "Mature open-source" is judgemental; OSS-Fuzz acceptance committee has the final say.

References

• Composes per-language skills: libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration.
• Composes references: corpus-management-reference, sanitiser-integration-reference.