# OSS-Fuzz | Continuous Fuzzing Of Open Source Software

**URL:** <https://onehack.st/t/oss-fuzz-continuous-fuzzing-of-open-source-software/93545>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [June 24, 2020, 2:02pm UTC](https://onehack.st/t/oss-fuzz-continuous-fuzzing-of-open-source-software/93545 "2020-06-24T14:02:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [June 24, 2020, 2:02pm UTC](https://onehack.st/t/oss-fuzz-continuous-fuzzing-of-open-source-software/93545/1 "2020-06-24T14:02:52Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/8/1/81395160e52d9d21b0cbb8c325e3c5530f2cae78.png)

[Fuzz testing](https://en.wikipedia.org/wiki/Fuzz_testing) is a well-known technique for uncovering programming errors in software. Many of these detectable errors, like [buffer overflow](https://en.wikipedia.org/wiki/Buffer_overflow), can have serious security implications. Google has found [thousands](https://bugs.chromium.org/p/chromium/issues/list?q=label%3AStability-LibFuzzer%2CStability-AFL%20-status%3ADuplicate%2CWontFix&can=1) of security vulnerabilities and stability bugs by deploying [guided in-process fuzzing of](https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html)Chrome components, and we now want to share that service with the open source community.  
In cooperation with the [Core Infrastructure Initiative](https://www.coreinfrastructure.org/), OSS-Fuzz aims to make common open source software more secure and stable by combining modern fuzzing techniques with scalable, distributed execution.

We support the [libFuzzer](http://llvm.org/docs/LibFuzzer.html) and [AFL](https://lcamtuf.coredump.cx/afl/) fuzzing engines in combination with [Sanitizers](https://github.com/google/sanitizers), as well as [ClusterFuzz](https://github.com/google/clusterfuzz), a distributed fuzzer execution environment and reporting tool.  
Currently, OSS-Fuzz supports C/C++, Rust, and Go code. Other languages supported by [LLVM](http://llvm.org/) may work too. OSS-Fuzz supports fuzzing x86\_64 and i386 builds.

**Documentation**  
Read our [detailed documentation](https://google.github.io/oss-fuzz) to learn how to use OSS-Fuzz.

**Trophies**  
As of January 2020, OSS-Fuzz has found over [16,000](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=-status%3AWontFix%2CDuplicate%20-component%3AInfra&can=1) bugs in [250](https://github.com/google/oss-fuzz/tree/master/projects) open source projects.

**Blog posts**

- 2016-12-01 – [Announcing OSS-Fuzz: Continuous fuzzing for open source software](https://opensource.googleblog.com/2016/12/announcing-oss-fuzz-continuous-fuzzing.html)
- 2017-05-08 – [OSS-Fuzz: Five months later, and rewarding projects](https://opensource.googleblog.com/2017/05/oss-fuzz-five-months-later-and.html)
- 2018-11-06 – [A New Chapter for OSS-Fuzz](https://security.googleblog.com/2018/11/a-new-chapter-for-oss-fuzz.html)

## GitHub:

> **[GitHub - google/oss-fuzz: OSS-Fuzz - continuous fuzzing for open source...](https://github.com/google/oss-fuzz)**
>
> OSS-Fuzz - continuous fuzzing for open source software.