1--- 2layout: default 3title: OSS-Fuzz 4permalink: / 5nav_order: 1 6has_children: true 7has_toc: false 8--- 9 10# OSS-Fuzz 11 12[Fuzz testing] is a well-known technique for uncovering programming errors in 13software. Many of these detectable errors, like [buffer overflow], can have 14serious security implications. Google has found [thousands] of security 15vulnerabilities and stability bugs by deploying [guided in-process fuzzing of 16Chrome components], and we now want to share that service with the open source 17community. 18 19[Fuzz testing]: https://en.wikipedia.org/wiki/Fuzz_testing 20[buffer overflow]: https://en.wikipedia.org/wiki/Buffer_overflow 21[thousands]: https://bugs.chromium.org/p/chromium/issues/list?q=label%3AStability-LibFuzzer%2CStability-AFL%20-status%3ADuplicate%2CWontFix&can=1 22[guided in-process fuzzing of Chrome components]: https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html 23 24In cooperation with the [Core Infrastructure Initiative] and the [OpenSSF], 25OSS-Fuzz aims to make common open source software more secure and stable by 26combining modern fuzzing techniques with scalable, distributed execution. 27 28[Core Infrastructure Initiative]: https://www.coreinfrastructure.org/ 29[OpenSSF]: https://www.openssf.org/ 30 31We support the [libFuzzer], [AFL++], and [Honggfuzz] fuzzing engines in 32combination with [Sanitizers], as well as [ClusterFuzz], a distributed fuzzer 33execution environment and reporting tool. 34 35[libFuzzer]: https://llvm.org/docs/LibFuzzer.html 36[AFL++]: https://github.com/AFLplusplus/AFLplusplus 37[Honggfuzz]: https://github.com/google/honggfuzz 38[Sanitizers]: https://github.com/google/sanitizers 39[ClusterFuzz]: https://github.com/google/clusterfuzz 40 41Currently, OSS-Fuzz supports C/C++, Rust, Go, Python and Java/JVM code. Other 42languages supported by [LLVM] may work too. OSS-Fuzz supports fuzzing x86_64 43and i386 builds. 44 45[LLVM]: https://llvm.org 46 47## Learn more about fuzzing 48 49This documentation describes how to use OSS-Fuzz service for your open source 50project. To learn more about fuzzing in general, we recommend reading [libFuzzer 51tutorial] and the other docs in [google/fuzzing] repository. These and some 52other resources are listed on the [useful links] page. 53 54[google/fuzzing]: https://github.com/google/fuzzing/tree/master/docs 55[libFuzzer tutorial]: https://github.com/google/fuzzing/blob/master/tutorial/libFuzzerTutorial.md 56[useful links]: {{ site.baseurl }}/reference/useful-links/#tutorials 57 58## Trophies 59As of June 2021, OSS-Fuzz has found over [30,000] bugs in [500] open source 60projects. 61 62[30,000]: https://bugs.chromium.org/p/oss-fuzz/issues/list?q=-status%3AWontFix%2CDuplicate%20-component%3AInfra&can=1 63[500]: https://github.com/google/oss-fuzz/tree/master/projects 64 65