afl.rs

afl.rs brings AFLplusplus fuzz testing to Rust. Fuzz testing feeds pseudo-random input into a program to surface security and stability bugs, and AFLplusplus is a modern, coverage-guided fuzzer descended from American Fuzzy Lop. afl.rs wires that fuzzer into the Rust toolchain so you can fuzz Rust code with minimal setup.

The afl crate provides the fuzz!/fuzz_target! macros you place inside a fuzz target to feed input into the code under test, while the companion cargo-afl subcommand instruments and builds the target with AFL++ coverage feedback (including CMPLOG) and runs the fuzzing campaign. It also offers helpers like cargo afl system-config to tune the host for better crash detection and throughput.

What You Get

• The afl crate with fuzz! and fuzz_target! macros for defining fuzz targets
• The cargo-afl subcommand to instrument, build, and run AFL++ fuzzing
• AFL++ coverage feedback including CMPLOG instrumentation for better code coverage
• Host-tuning helpers such as cargo afl system-config for optimal fuzzing performance

Common Use Cases

• Fuzzing parsers, decoders, and other input-handling Rust code to find crashes
• Adding coverage-guided fuzz targets to a Rust project’s testing workflow
• Reproducing and triaging security or stability bugs from fuzzer-discovered inputs

Under The Hood

Architecture — afl.rs is a Cargo workspace split into three crates: afl (the runtime library exposing the fuzz!/fuzz_target! macros linked into fuzz targets), cargo-afl (the cargo subcommand that instruments and builds targets against AFL++ and launches the fuzzer), and cargo-afl-common (shared logic). At build time cargo-afl compiles the target with AFL++ instrumentation — including CMPLOG unless disabled — and sets the fuzzing cfg; at run time the afl macros pump fuzzer input into the harness.

Tech Stack — Rust throughout, bridging to the external AFLplusplus toolchain. Behavior is tunable via environment variables such as AFLRS_NO_CMPLOG and command-line flags passed through to AFL++, with cargo afl system-config shelling out (via sudo) to tune the host kernel for fuzzing.

Code Quality — A long-lived, mature project (since 2015) with active development, a maintained CHANGES log, clippy/rustfmt configuration, and tests across the crates. Documentation lives in the Rust Fuzz Book rather than the repo README.

API Design — The developer experience is intentionally thin: wrap the code under test in a fuzz! closure and run cargo afl build/cargo afl fuzz. This mirrors the normal cargo workflow so existing Rust developers can start fuzzing without learning a separate build system, while advanced AFL++ knobs remain available through flags and env vars.