#fuzzer — Public Fediverse posts

Oh look, new version of #LibAFL !!

With 0.16.0 we moved all reusable and non-fuzzer-related parts into their own crates.

Crates for pinning cores, rngs, getting BSODs for processes, and just in general helpful rust things.

Have fun using them for other projects <3

A lot of actual #fuzzer improvements, too, read more at:
https://github.com/AFLplusplus/LibAFL/releases/tag/0.16.0

Oh look, new version of #LibAFL !!

With 0.16.0 we moved all reusable and non-fuzzer-related parts into their own crates.

Crates for pinning cores, rngs, getting BSODs for processes, and just in general helpful rust things.

Have fun using them for other projects <3

A lot of actual #fuzzer improvements, too, read more at:
https://github.com/AFLplusplus/LibAFL/releases/tag/0.16.0

The Go "context deadline exceeded" bug when fuzzing with fuzztime is SUPER frustrating and breaks workflows. Anyone know someone that can move the existing fix CL along?

Go change: https://go-review.googlesource.com/c/go/+/774140

GH bug tracking and reproducer:
https://github.com/golang/go/issues/75804

#Go #Golang #fuzzer

The Go "context deadline exceeded" bug when fuzzing with fuzztime is SUPER frustrating and breaks workflows. Anyone know someone that can move the existing fix CL along?

Go change: https://go-review.googlesource.com/c/go/+/774140

GH bug tracking and reproducer:
https://github.com/golang/go/issues/75804

#Go #Golang #fuzzer

pysource-codegen is well on its way to becoming a perfect #python #fuzzer. This means it will be capable of generating EVERY possible Python construct, but it will NOT generate invalid python code.

The fuzzer with no mercy 😄

A Fuzzer for the Toy Optimizer

https://bernsteinbear.com/blog/toy-fuzzer/

#HackerNews #Fuzzer #ToyOptimizer #SoftwareTesting #Programming #Security

A Fuzzer for the Toy Optimizer

https://bernsteinbear.com/blog/toy-fuzzer/

#HackerNews #Fuzzer #ToyOptimizer #SoftwareTesting #Programming #Security

AFL++ v4.40c release - best performance ever - optimal hidden coverage instrumentation, FrameShift, LLVM 22 support, IJON fixes, a lot of minor and bigger enhancements! #fuzzer #fuzzing https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.40c

AFL++ v4.40c release - best performance ever - optimal hidden coverage instrumentation, FrameShift, LLVM 22 support, IJON fixes, a lot of minor and bigger enhancements! #fuzzer #fuzzing https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.40c

Published my first PyPI package today, called lafleur.

#lafleur is a specialized CPython JIT fuzzer that uses a coverage-guided, evolutionary approach. It executes test cases, observes their effect on the JIT's state by analyzing verbose trace logs, and uses that feedback to guide its mutations, becoming smarter at finding interesting code paths over time.

Let me know if you use it or have any questions.

https://pypi.org/project/lafleur/
https://github.com/devdanzin/lafleur

#Python #CPython #fuzzer #fuzzing #JIT

Published my first PyPI package today, called lafleur.

#lafleur is a specialized CPython JIT fuzzer that uses a coverage-guided, evolutionary approach. It executes test cases, observes their effect on the JIT's state by analyzing verbose trace logs, and uses that feedback to guide its mutations, becoming smarter at finding interesting code paths over time.

Let me know if you use it or have any questions.

https://pypi.org/project/lafleur/
https://github.com/devdanzin/lafleur

#Python #CPython #fuzzer #fuzzing #JIT

AFL++ 4.35c release! Complete hidden coverage gathering, GUIFuzz++ support, IJON for qemu, various fixes! https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.35c #fuzzing #fuzzer

AFL++ 4.35c release! Complete hidden coverage gathering, GUIFuzz++ support, IJON for qemu, various fixes! https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.35c #fuzzing #fuzzer

There's a researcher, Jiang Yuancheng, who's doing a great work finding CPython crashes and memory leaks: https://github.com/python/cpython/issues?q=is%3Aissue%20author%3AYuanchengJiang

They've come up with a very clever idea for a new way of fuzzing, made a fine tool out of it, and are reaping great results.

Fuzzing can be a diminishing returns endeavor: you only have so many bugs to find. Their approach has shown itself to cover different areas and kinds of issues well, as shown by their track record.

#CPython #Python #Fuzzer #Fuzzing #fusil

There's a researcher, Jiang Yuancheng, who's doing a great work finding CPython crashes and memory leaks: https://github.com/python/cpython/issues?q=is%3Aissue%20author%3AYuanchengJiang

They've come up with a very clever idea for a new way of fuzzing, made a fine tool out of it, and are reaping great results.

Fuzzing can be a diminishing returns endeavor: you only have so many bugs to find. Their approach has shown itself to cover different areas and kinds of issues well, as shown by their track record.

#CPython #Python #Fuzzer #Fuzzing #fusil

It turns out that, by running it on an interpreter with ASan enabled, I was the culprit of my fuzzer lafleur using way too much memory.

That even led to me buying some DDR5 to be able to fuzz a bit more comfortably. Running without ASan reduces memory usage to 1/15. So I guess now I'll have some spare RAM, and less money, going forward :)

I'll enhance the JIT fuzzer to run on a different interpreter than the fuzzing scripts, which benefit from ASan.

#lafleur #Python #CPython #fuzzer #fuzzing

It turns out that, by running it on an interpreter with ASan enabled, I was the culprit of my fuzzer lafleur using way too much memory.

That even led to me buying some DDR5 to be able to fuzz a bit more comfortably. Running without ASan reduces memory usage to 1/15. So I guess now I'll have some spare RAM, and less money, going forward :)

I'll enhance the JIT fuzzer to run on a different interpreter than the fuzzing scripts, which benefit from ASan.

#lafleur #Python #CPython #fuzzer #fuzzing

So someone found a segfault in NumPy and reported it as a security bug: https://huntr.com/bounties/49928a2c-c6bb-4c1c-80ec-5d7bf708bf28. After some back and forth, the NumPy developers agreed it was a security bug (with a low score, but still).

However, since fusil had already found that crash and I had reported it 2 months earlier (https://github.com/numpy/numpy/issues/28829), the report was deemed a duplicate and no CVE was assigned.

We didn't find a CVE, but avoided one :)

Link to fix: https://github.com/numpy/numpy/pull/30071

#fusil #fuzzer #fuzzing #numpy #python

So someone found a segfault in NumPy and reported it as a security bug: https://huntr.com/bounties/49928a2c-c6bb-4c1c-80ec-5d7bf708bf28. After some back and forth, the NumPy developers agreed it was a security bug (with a low score, but still).

However, since fusil had already found that crash and I had reported it 2 months earlier (https://github.com/numpy/numpy/issues/28829), the report was deemed a duplicate and no CVE was assigned.

We didn't find a CVE, but avoided one :)

Link to fix: https://github.com/numpy/numpy/pull/30071

#fusil #fuzzer #fuzzing #numpy #python

Fuzzing pyhacl (https://codeberg.org/drlazor8/pyhacl), a package of Cython bindings for HACL* (the High Assurance Cryptographic Library), with fusil we only found one crash.

It turned out to actually be a silly bug in #Cython:

Issue: https://github.com/cython/cython/issues/7263

Fix: https://github.com/cython/cython/pull/7264

Goes to show how fuzzing a C-extension can uncover crashes in many different layers.

Thanks @drlazor8 for taking up the call for C-extensions maintainers to fuzz their code.

#fusil #Python #pyhacl #hacl #fuzzing #fuzzer

Fuzzing pyhacl (https://codeberg.org/drlazor8/pyhacl), a package of Cython bindings for HACL* (the High Assurance Cryptographic Library), with fusil we only found one crash.

It turned out to actually be a silly bug in #Cython:

Issue: https://github.com/cython/cython/issues/7263

Fix: https://github.com/cython/cython/pull/7264

Goes to show how fuzzing a C-extension can uncover crashes in many different layers.

Thanks @drlazor8 for taking up the call for C-extensions maintainers to fuzz their code.

#fusil #Python #pyhacl #hacl #fuzzing #fuzzer

After a pause, we're back to running fusil. This time, to fuzz cereggii, a package of very interesting thread synchronization utilities for #Python, made of C-extensions.

We tailored #fusil to target these #cereggii utilities, finding more issues.

Daniele Parmeggiani (dpdani), the maintainer, has been helping in the effort and being very supportive. That's the best welcome fusil has received in any project :)

Here are the issues we found: https://github.com/dpdani/cereggii/issues?q=label%3A%22fusil-fuzzer%22

#CPython #fuzzing #fuzzer

After a pause, we're back to running fusil. This time, to fuzz cereggii, a package of very interesting thread synchronization utilities for #Python, made of C-extensions.

We tailored #fusil to target these #cereggii utilities, finding more issues.

Daniele Parmeggiani (dpdani), the maintainer, has been helping in the effort and being very supportive. That's the best welcome fusil has received in any project :)

Here are the issues we found: https://github.com/dpdani/cereggii/issues?q=label%3A%22fusil-fuzzer%22

#CPython #fuzzing #fuzzer

Been running a fusil campaign for a week, targeting a C-extension. The fuzzer has found 9 issues so far, feels good.

The maintainer is helping with the campaign and eager to fix the issues, which is great.

Some maintainers see us with suspicion and often disregard issues, as if we're after accolades, pointing fingers or complaining about the code.

We fuzz to help, that's all.

Anyway, if you have a C-extension and would like it fuzzed, hit me up :)

#fusil #Python #CPython #fuzzing #fuzzer

Been running a fusil campaign for a week, targeting a C-extension. The fuzzer has found 9 issues so far, feels good.

The maintainer is helping with the campaign and eager to fix the issues, which is great.

Some maintainers see us with suspicion and often disregard issues, as if we're after accolades, pointing fingers or complaining about the code.

We fuzz to help, that's all.

Anyway, if you have a C-extension and would like it fuzzed, hit me up :)

#fusil #Python #CPython #fuzzing #fuzzer

lafleur, the CPython JIT fuzzer, now can compare timings for running a piece of code with JIT on and off.

The idea is that if the run with JIT on is much slower that with JIT off, we have found a performance bug.

Brandt Bucher suggested this mode. It took a while to get started on it, but it was simple to implement on top of Differential Mode.

So many modes, so little compute available...

#lafleur #JIT #fuzzing #fuzzer #CPython #Python

lafleur, the CPython JIT fuzzer, now can compare timings for running a piece of code with JIT on and off.

The idea is that if the run with JIT on is much slower that with JIT off, we have found a performance bug.

Brandt Bucher suggested this mode. It took a while to get started on it, but it was simple to implement on top of Differential Mode.

So many modes, so little compute available...

#lafleur #JIT #fuzzing #fuzzer #CPython #Python

Differential Mode has just landed in lafleur, the CPython JIT fuzzer. It runs the same code with and without the JIT, compares the result, and flags any discrepancies.

It does this while mutating the code in a feedback-guided loop, so it evolves the fuzzing scripts trying to find one where the JIT gives wrong results.

This is actually the 2nd time this feature is implemented (now better and more robust): it used to work, broke, and now is back.

#lafleur #JIT #fuzzing #fuzzer #CPython #Python

Differential Mode has just landed in lafleur, the CPython JIT fuzzer. It runs the same code with and without the JIT, compares the result, and flags any discrepancies.

It does this while mutating the code in a feedback-guided loop, so it evolves the fuzzing scripts trying to find one where the JIT gives wrong results.

This is actually the 2nd time this feature is implemented (now better and more robust): it used to work, broke, and now is back.

#lafleur #JIT #fuzzing #fuzzer #CPython #Python

The ActivityPub Fuzzer. Probably important if you're a fediverse app dev or other feditech person. It seems interesting.

#activitypub #fediverse #fuzzer

https://asml.cyber.harvard.edu/2025/10/01/introducing-the-asml-activitypub-fuzzer-improving-testing-in-the-fediverse/

The ActivityPub Fuzzer. Probably important if you're a fediverse app dev or other feditech person. It seems interesting.

#activitypub #fediverse #fuzzer

https://asml.cyber.harvard.edu/2025/10/01/introducing-the-asml-activitypub-fuzzer-improving-testing-in-the-fediverse/

AFL++ v4.34c release - IJON support, UnicornAFL v3, LLVM 22 support, enhanced CMPLOG, bug fixes :-) https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.34c #afl #fuzzing #fuzzer

AFL++ v4.34c release - IJON support, UnicornAFL v3, LLVM 22 support, enhanced CMPLOG, bug fixes :-) https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.34c #afl #fuzzing #fuzzer

Posted a topic about lafleur, the CPython JIT fuzzer I'm developing: https://discuss.python.org/t/introducing-lafleur-a-cpython-jit-fuzzer/103452

It has many details about the project, the results (4 JIT crashes so far), calls for help and ideas for the future.

If any of this interests you, please give a read. Boosts welcome :)

#lafleur #fusil #Python #fuzzer #fuzzing #CPython #JIT

Posted a topic about lafleur, the CPython JIT fuzzer I'm developing: https://discuss.python.org/t/introducing-lafleur-a-cpython-jit-fuzzer/103452

It has many details about the project, the results (4 JIT crashes so far), calls for help and ideas for the future.

If any of this interests you, please give a read. Boosts welcome :)

#lafleur #fusil #Python #fuzzer #fuzzing #CPython #JIT

Preparing a post about lafleur, the CPython JIT fuzzer I develop.

It has found 4 JIT crashes so far:
#136996: "JIT: `executor->vm_data.valid` assertion failure in `unlink_executor`".
#137007: "JIT: assertion failure in _PyObject_GC_UNTRACK".
#137728: "Assertion failure or `SystemError` in `_PyEval_EvalFrameDefault` in a JIT build".
#137762: "Assertion failure in `optimize_uops` in a JIT build".

Contributions welcome!

https://github.com/search?q=repo%3Apython%2Fcpython+lafleur&type=issues

#Python #CPython #fuzzer #fuzzing #lafleur #JIT

Preparing a post about lafleur, the CPython JIT fuzzer I develop.

It has found 4 JIT crashes so far:
#136996: "JIT: `executor->vm_data.valid` assertion failure in `unlink_executor`".
#137007: "JIT: assertion failure in _PyObject_GC_UNTRACK".
#137728: "Assertion failure or `SystemError` in `_PyEval_EvalFrameDefault` in a JIT build".
#137762: "Assertion failure in `optimize_uops` in a JIT build".

Contributions welcome!

https://github.com/search?q=repo%3Apython%2Fcpython+lafleur&type=issues

#Python #CPython #fuzzer #fuzzing #lafleur #JIT

Here's how lafleur works:

Starts from a corpus of seed files (generated by fusi)l. It runs each file and parses the JIT debug output to record micro ops (UOPs) and edges between them.

Then it applies mutations to these files and when a mutation results in a new UOP or edge, it adds the mutated file to the corpus.

All the while, it monitors the execution of these files for crashes.

And it's smart about which file to mutate next.

Simple, eh?

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

Here's how lafleur works:

Starts from a corpus of seed files (generated by fusi)l. It runs each file and parses the JIT debug output to record micro ops (UOPs) and edges between them.

Then it applies mutations to these files and when a mutation results in a new UOP or edge, it adds the mutated file to the corpus.

All the while, it monitors the execution of these files for crashes.

And it's smart about which file to mutate next.

Simple, eh?

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

One obvious thing from fuzzing the CPython JIT with the lafleur fuzzer is that finding crashes is much lower probability than fuzzing CPython with fusil.

Whenever fusil found a crash, it would find hits for it again and again pretty quickly.

With lafleur, we only got 3 hits (2 issues) in thousands of fuzzing hours.

I'm throwing more compute at it, but maybe we'll need to improve the core ideas to get better results.

https://github.com/devdanzin/lafleur

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

One obvious thing from fuzzing the CPython JIT with the lafleur fuzzer is that finding crashes is much lower probability than fuzzing CPython with fusil.

Whenever fusil found a crash, it would find hits for it again and again pretty quickly.

With lafleur, we only got 3 hits (2 issues) in thousands of fuzzing hours.

I'm throwing more compute at it, but maybe we'll need to improve the core ideas to get better results.

https://github.com/devdanzin/lafleur

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

Reviewed the 3 PRs we got for lafleur: https://github.com/devdanzin/lafleur/pulls?q=is%3Apr

All 3 marked as "good first issue". They've clear signs of being created by or with help from AI, like tentative code ("# do this in case... ") and removing docstrings.

Merged one and gave feedback on 2, including tips on how to get AI to fix their issues.

I might get unfollows for this, but I welcome AI generated code as long as it's good enough. In fact, AI made this project viable.

#Python #fuzzer #fuzzing #fusil #lafleur #AI

Reviewed the 3 PRs we got for lafleur: https://github.com/devdanzin/lafleur/pulls?q=is%3Apr

All 3 marked as "good first issue". They've clear signs of being created by or with help from AI, like tentative code ("# do this in case... ") and removing docstrings.

Merged one and gave feedback on 2, including tips on how to get AI to fix their issues.

I might get unfollows for this, but I welcome AI generated code as long as it's good enough. In fact, AI made this project viable.

#Python #fuzzer #fuzzing #fusil #lafleur #AI

Busy day, good day: the new CPython fuzzer lafleur found its first 2 crashes this morning!

Happiness only marred by the bad job I did reducing the testcases and making the reports reproducible. Thanks Brandt Bucher and and Ken Jin for the patience! Next bug reports will be more polished and reliable.

Also, we got 3 new PRs for the fuzzer but I didn't have time to review them, will have to leave that for tomorrow.

https://github.com/devdanzin/lafleur/

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

Busy day, good day: the new CPython fuzzer lafleur found its first 2 crashes this morning!

Happiness only marred by the bad job I did reducing the testcases and making the reports reproducible. Thanks Brandt Bucher and and Ken Jin for the patience! Next bug reports will be more polished and reliable.

Also, we got 3 new PRs for the fuzzer but I didn't have time to review them, will have to leave that for tomorrow.

https://github.com/devdanzin/lafleur/

#Python #CPython #fuzzer #fuzzing #fusil #lafleur

Launching a new project on a Sunday night: lafleur, a CPython JIT fuzzer.

https://github.com/devdanzin/lafleur

It's a feedback driven fuzzer (using JIT debug output) with corpus prioritization and JIT-targeted AST-based mutations. Calling it "evolutionary" may be a stretch, but sounds good.

It's also a fuzzer that so far hasn't found any crashes or bugs. Still working on that ;)

If you want to understand how it works, there is a good amount of docs.

#Python #CPython #lafleur #fusil #Fuzzer #Fuzzing #JIT

Launching a new project on a Sunday night: lafleur, a CPython JIT fuzzer.

https://github.com/devdanzin/lafleur

It's a feedback driven fuzzer (using JIT debug output) with corpus prioritization and JIT-targeted AST-based mutations. Calling it "evolutionary" may be a stretch, but sounds good.

It's also a fuzzer that so far hasn't found any crashes or bugs. Still working on that ;)

If you want to understand how it works, there is a good amount of docs.

#Python #CPython #lafleur #fusil #Fuzzer #Fuzzing #JIT

Trying real hard to build a fuzzer targeting the CPython JIT, lots of features implemented but not a single crash or bug discovered so far.

Such is life when hunting for crashes in robust code.

This weekend I'll be spinning off a new fuzzer that grew from fusil. Wish me luck 🙂

#Python #CPython #JIT #Fuzzer #Fuzzing #fusil #lafleur

Trying real hard to build a fuzzer targeting the CPython JIT, lots of features implemented but not a single crash or bug discovered so far.

Such is life when hunting for crashes in robust code.

This weekend I'll be spinning off a new fuzzer that grew from fusil. Wish me luck 🙂

#Python #CPython #JIT #Fuzzer #Fuzzing #fusil #lafleur

AFL++ v4.33c released! Instrumentation of hidden edges (+5% edges), better syncing, corner case features, bug fixes :-) https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.33c #afl #fuzzer #fuzzing

AFL++ v4.33c released! Instrumentation of hidden edges (+5% edges), better syncing, corner case features, bug fixes :-) https://github.com/AFLplusplus/AFLplusplus/releases/tag/v4.33c #afl #fuzzer #fuzzing

So, what's next for fuzzing CPython with fusil?

The results point to interesting future ideas, including expanding fuzzing to new environments like subinterpreters, using more tools like Thread Sanitizer, and developing more advanced fuzzing techniques.

A huge thank you to everyone who contributed!

And thank you for reading!

P.S.: if you have a C/Rust extension, we can fuzz it too: https://mastodon.social/@danzin/114383188014599269

(5/5)

#Python #CPython #fuzzing #fuzzer #fusil

So, what's next for fuzzing CPython with fusil?

The results point to interesting future ideas, including expanding fuzzing to new environments like subinterpreters, using more tools like Thread Sanitizer, and developing more advanced fuzzing techniques.

A huge thank you to everyone who contributed!

And thank you for reading!

P.S.: if you have a C/Rust extension, we can fuzz it too: https://mastodon.social/@danzin/114383188014599269

(5/5)

#Python #CPython #fuzzing #fuzzer #fusil

One finding I really like is the bug discovery pattern.

There wasn't a steady stream of bugs, but spikes of findings: 1st, a huge number of crashes as I started testing a CPython that hadn't been fuzzed by fusil in a decade.

Later, a new wave of issues tied to the addition of new features to the fuzzer, like support for "weird classes" and typing objects.

So periodic campaigns may have better cost-benefit than continuous fuzzing.

(4/5)

#Python #CPython #fuzzing #fuzzer #fusil

One finding I really like is the bug discovery pattern.

There wasn't a steady stream of bugs, but spikes of findings: 1st, a huge number of crashes as I started testing a CPython that hadn't been fuzzed by fusil in a decade.

Later, a new wave of issues tied to the addition of new features to the fuzzer, like support for "weird classes" and typing objects.

So periodic campaigns may have better cost-benefit than continuous fuzzing.

(4/5)

#Python #CPython #fuzzing #fuzzer #fusil

The credit for fusil's effective design goes all to Victor Stinner (@vstinner), who created it nearly two decades ago. It was responsible for finding release blockers way back in 2008. I just contributed a little to revive and enhance it.

Some enhancements included running generated code in threads and adopting new "interesting" objects and values as inputs, helping to discover more crashes.

(3/5)

#Python #CPython #fuzzing #fuzzer #fusil