РебятЫ из Security Research Labs (https://www.srlabs.de/) решили запилить свой фаззер для Go на основе LibAFL.

GoLibAFL — Fuzzing Go binaries using LibAFL
https://www.srlabs.de/blog-post/golibafl---fuzzing-go-binaries-using-libafl

During a recent engagement, our team set out to fuzz a Go codebase and explored existing fuzzers. In the process, we discovered that available Go fuzzing solutions lack key features, such as the ability to solve path constraints, like string or integer comparisons. Some Go fuzzers were even incompatible with the latest Go toolchain.

To overcome these limitations, we explored more effective methods for fuzzing Go. This research led us to discover that Go code can also be fuzzed using LibAFL by leveraging Go’s native libFuzzer-compatible instrumentation.

Для сравнения и оценки ситуации они взяли:
- https://github.com/dvyukov/go-fuzz (сейчас мёртв, по факту, поэтому не участвовал в сравнении)
- Go fuzz, который входит в тулчейн самого Go (https://go.dev/doc/security/fuzz)
- https://github.com/AdamKorcz/go-118-fuzz-build

Native support for coverage-guided fuzzing is included in the standard toolchain since Go v1.18. Unfortunately, this built-in fuzzing support is limited and lacks advanced features such as tracing comparisons for guided mutations and dictionary-based input generation. These are essential to improve fuzzing efficiency and discover deeper bugs. The Go team has taken initiatives to enhance native fuzzing support, as highlighted in this issue. However, progress on these efforts appears to have stalled, with no updates since 2022.

Go-118-fuzz-build transforms native Go fuzzing harnesses into archive files that can then be linked with libFuzzer to leverage advanced fuzzing features while maintaining compatibility with Go v1.18 and beyond. Despite its name, Go-118-fuzz-build is not limited to Go v1.18; compatibility with newer versions can be enabled by updating the Go version in the project’s go.mod file. While this approach improves the fuzzing performance of native Go fuzzers, it remains dependent on libFuzzer, which is no longer actively maintained and lacks support for recent advancements in fuzzing.

В статье достаточно подробно описаны многие моменты касающиеся как самого фаззинга непосредственно, так и примеры использования инструмента от SRL.

Результаты видно на скринах к посту. Бенчмарки гоняли напротив Prometheus (https://github.com/prometheus/prometheus), Caddy (https://github.com/caddyserver/caddy) и burntsushi-toml (https://github.com/BurntSushi/toml).
Понятно что бенчмарки и стату можно "подгонять" по-разному, но, ЯЩИТАЮ, чем больше разных конкурирующих проектов, тем лучше 🌝

GitHub - https://github.com/srlabs/golibafl