Fuzz testing is described as a technique that injects random data into software functions to reveal crashes and vulnerabilities, thereby improving security and reliability. The process relies on a fuzzing engine that instruments code, measures coverage, and generates malformed inputs to exercise edge cases. Errors such as crashes, memory leaks, and undefined behavior are detected, often in conjunction with address and undefined sanitizers. The approach is considered especially useful for libraries handling untrusted input, such as parsers, decoders, and network protocols, and is employed by Boost.Json, Boost.URL, and Boost.Mysql. Unit tests are reinforced rather than replaced, since fuzzing monitors for crashes without asserting output correctness.
Read more…