AFL++ vs ClusterFuzz

AFL++ is a coverage-guided fuzzer that changes input and checks whether a target binary reaches a new execution path. Its afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. Documentation covers source-available software, binary-only targets, network services and GUI programs, with build options for source-only, binary-only or combined distributions. A Docker image supports x86_64 and arm64; its example mounts target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build guidance covers x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and create heavy filesystem activity. AFL++ is available free under AGPL terms; modified versions offered as network services must provide users the corresponding source. A commercial license is listed at €20,000 a year.

ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided engines libFuzzer, AFL++, and Honggfuzz, alongside blackbox fuzzing. Its workflow can find crashes, group duplicates, minimize testcases, use bisection to locate regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz. The system is designed to run on clusters of any size; Google’s instance runs on 30,000 VMs. Production deployments use Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring. Local instances are supported on Linux and macOS, with some BigQuery- and Stackdriver-dependent features disabled. Although the overview mentions Monorail and Jira as examples, the architecture currently supports only Chromium-hosted Monorail. The software runs on Linux, macOS, and Windows and is licensed under Apache-2.0. Its listed price is free.