Clone this repo:


  1. 17789d1 Fix compilation with GCC 7 by Tomáš Popela · 19 hours ago master
  2. 428ad71 Update expat build rules by Vitaly Buka · 19 hours ago
  3. 0627b37 pkg-config is needed by cmake to find some dependencies by Vitaly Buka · 8 days ago
  4. df4f45a Remove dependence on docbook2x by Vitaly Buka · 8 days ago
  5. 34287f8 Pin googletest version by Vitaly Buka · 14 days ago



libprotobuf-mutator is a library to randomly mutate protobuffers.
It could be used together with guided fuzzing engines, such as libFuzzer.

Quick start on Debian/Ubuntu

Install prerequisites:

sudo apt-get update
sudo apt-get install binutils cmake ninja-build liblzma-dev libz-dev pkg-config

Compile and test everything:

mkdir build
cd build
ninja check

Clang is only needed for libFuzzer integration.
By default, the system-installed version of protobuf is used. However, on some systems, the system version is too old. You can pass LIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF=ON to cmake to automatically download and build a working version of protobuf.


To use libprotobuf-mutator simply include protobuf_mutator.h and into your build files.

The ProtobufMutator class implements mutations of the protobuf tree structure and mutations of individual fields. The field mutation logic is very basic -- for better results you should override the ProtobufMutator::Mutate* methods with more sophisticated logic, e.g. using libFuzzer's mutators.

To apply one mutation to a protobuf object do the following:

class MyProtobufMutator : public protobuf_mutator::Mutator {
  MyProtobufMutator(uint32_t seed) : protobuf_mutator::Mutator(seed) {}
  // Optionally redefine the Mutate* methods to perform more sophisticated mutations.
void Mutate(MyMessage* message) {
  MyProtobufMutator mutator(my_random_seed);
  mutator.Mutate(message, 200);

See also the ProtobufMutatorMessagesTest.UsageExample test from

Integrating with libFuzzer

LibFuzzerProtobufMutator can help to integrate with libFuzzer. For example

#include "src/libfuzzer/libfuzzer_macro.h"

DEFINE_PROTO_FUZZER(const MyMessageType& input) {
  // Code which needs to be fuzzed.

Please see as an example.