Fuzzing

Purpose

Zig has an in-tree fuzzer integrated with std.Build. It targets functions marked with the @import("std").testing.fuzz API and reports crashes via the build runner.

Components

File	Role
lib/fuzzer.zig (~63 KB)	The fuzz engine. Implements coverage-guided input generation, corpus management, and crash reporting.
lib/std/Build/Fuzz.zig (~22 KB)	Build-system integration. Constructs and runs fuzz steps.
lib/std/Build/Step/	The fuzz step type plugs into the standard step machinery.
tools/dump-cov.zig	Coverage dump utility used during fuzz development.

How it works

graph LR
  Test["zig test --fuzz target.zig"] --> Build["std.Build.Fuzz"]
  Build --> Engine["lib/fuzzer.zig"]
  Engine -->|input| Target["user fuzz function"]
  Target -->|coverage| Engine
  Engine -->|crash| Report["std.Build progress"]

• The user writes a function that consumes a []const u8 and runs the code under test.
• The build runner compiles the target with coverage instrumentation.
• The engine in lib/fuzzer.zig mutates inputs, runs the target in-process, and tracks coverage to direct mutation.
• Crashes are reproduced and reported through std.Build.Step so they show up in the build summary.

Running

zig build fuzz
# or, for a specific target:
zig build test --fuzz

The exact step name depends on what build.zig exposes; this repository uses Fuzz.zig to wire the step graph.

Integration points

• std.testing for the user-facing API.
• std.Build.Step for step plumbing.
• std.Progress for live status.

Key source files

File	Purpose
lib/fuzzer.zig	The fuzz engine.
lib/std/Build/Fuzz.zig	Build-system integration.
tools/dump-cov.zig	Coverage dumping.
lib/std/testing.zig	The user-facing fuzz API.