AFL++ vs Csmith

AFL++ is a coverage-guided fuzzer that changes input and checks whether a target binary reaches a new execution path. Its afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. Documentation covers source-available software, binary-only targets, network services and GUI programs, with build options for source-only, binary-only or combined distributions. A Docker image supports x86_64 and arm64; its example mounts target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build guidance covers x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and create heavy filesystem activity. AFL++ is available free under AGPL terms; modified versions offered as network services must provide users the corresponding source. A commercial license is listed at €20,000 a year.

Csmith is a free, open-source generator of random C programs for finding compiler bugs through differential testing. Its output avoids undefined behavior and includes statistics for each generated program. A documented workflow compiles programs with GCC and Clang, then compares their outputs to identify differences. The tool can also create material for a C test suite when users do not want to write one themselves. Command-line options shown by csmith -h and csmith -hh customize random generation. Csmith runs locally on Linux and Windows. Ubuntu source builds require g++, CMake, and m4, followed by CMake and make; Windows builds are documented with Visual Studio or WSL. The project says it should build on most modern machines with a C++ compiler. Generated programs may loop indefinitely, so execution timeouts are recommended. The repository includes a COPYING license file. Bug reports and suggestions go through GitHub issues, with discussion on a mailing list; maintainers warn replies may be delayed.