AddressSanitizer

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// What you write:
int array[10];
array[i] = 42;
 
// What ASan-compiled code effectively becomes:
int array[10];
// ... plus redzone padding on stack ...
 
// Before every memory access:
if (!is_addressable(&array[i], sizeof(int))) {
    report_error("stack-buffer-overflow", &array[i]);
}
array[i] = 42;
 
// The is_addressable check is HIGHLY optimized:
// 1. Uses shadow memory for O(1) lookup
// 2. Inlined as few instructions (not a function call)
// 3. Shadow computation uses bit shifts, not division
 
// Assembly-level view of the check:
// mov  rdi, address
// shr  rdi, 3           ; Divide by 8 to get shadow byte address
// add  rdi, shadow_base
// movzbl al, [rdi]      ; Load shadow byte
// test al, al           ; Is it zero (fully addressable)?
// jne  slow_path        ; If not, do detailed check
// [original memory access]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

ASan Shadow Memory Encoding
════════════════════════════════════════════════════════════════
 
Application Memory     Shadow Byte    Meaning
────────────────────────────────────────────────────────────────
[8 bytes valid]           0x00       All 8 bytes addressable
[7 bytes valid]           0x07       First 7 bytes addressable  
[6 bytes valid]           0x06       First 6 bytes addressable
[5 bytes valid]           0x05       First 5 bytes addressable
[4 bytes valid]           0x04       First 4 bytes addressable
[3 bytes valid]           0x03       First 3 bytes addressable
[2 bytes valid]           0x02       First 2 bytes addressable
[1 byte valid]            0x01       First 1 byte addressable
 
Special Shadow Values (Negative):
────────────────────────────────────────────────────────────────
Heap left redzone         0xfa       Padding before heap allocation
Heap right redzone        0xfb       Padding after heap allocation
Freed heap                0xfd       Memory was freed
Stack left redzone        0xf1       Before stack variable
Stack mid redzone         0xf2       Between stack variables  
Stack right redzone       0xf3       After stack variables
Global redzone            0xf9       Padding around global variables
Stack use after return    0xf5       Stack frame after function returned
 
Shadow Memory Layout (64-bit Linux):
────────────────────────────────────────────────────────────────
Shadow address = (ApplicationAddress >> 3) + 0x7fff8000
 
Application:  0x10000000000 - 0x7fffffffffff  (High Memory)
              ↓ >> 3 + offset ↓
Shadow:       0x2000000000  - 0x10007fff7fff
 
This gives ~1/8 of address space to shadow memory

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

Heap Allocation Layout with ASan
═════════════════════════════════════════════════════════════
 
malloc(16):
 
┌─────────────┬─────────────────────────────┬─────────────┐
│ Left Redzone│      User Memory (16)       │Right Redzone│
│ (poisoned)  │        (valid)              │ (poisoned)  │
└─────────────┴─────────────────────────────┴─────────────┘
     │                    │                        │
     ▼                    ▼                        ▼
 Access = ERROR     Access = OK            Access = ERROR
 
Stack Variable Layout:
 
Function with: int a; int b[10]; int c;
 
┌────────┬──────┬────────┬───────────┬────────┬──────┬────────┐
│Redzone │  a   │Redzone │   b[10]   │Redzone │  c   │Redzone │
│  (F1)  │ (4B) │  (F2)  │   (40B)   │  (F2)  │ (4B) │  (F3)  │
└────────┴──────┴────────┴───────────┴────────┴──────┴────────┘
 
This catches:
- b[-1] → hits redzone between a and b
- b[10] → hits redzone between b and c  
- Overflow from a into b's memory

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// Example: What ASan DOESN'T catch
 
#include <string.h>
 
struct User {
    char name[16];    // Offset 0-15
    int is_admin;     // Offset 16-19
};
 
void vulnerable(struct User* u, const char* input) {
    // If input is "AAAAAAAAAAAAAAAA1" (17 chars)
    // name overflows into is_admin
    strcpy(u->name, input);  // ASan sees valid access within struct!
    
    // is_admin is now corrupted
    if (u->is_admin) {
        grant_admin_access();  // Security vulnerability!
    }
}
 
// ASan doesn't detect this because:
// 1. The struct is one allocation
// 2. name and is_admin are within the same 24-byte block
// 3. Access is to valid (allocated) memory
// 4. No redzone exists BETWEEN struct members
 
// Detection requires:
// - Bounds checking at the field level (some compilers can do this)
// - Stack buffer overflow protection (partial)
// - Careful code review

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# Clang (recommended - most complete implementation)
clang -fsanitize=address -g -O1 program.c -o program
 
# GCC
gcc -fsanitize=address -g -O1 program.c -o program
 
# C++
clang++ -fsanitize=address -g -O1 program.cpp -o program
 
# Explanation of flags:
# -fsanitize=address  : Enable AddressSanitizer
# -g                  : Include debug symbols (essential for readable reports)
# -O1                 : Optimization level 1 (recommended)
#                       -O0 works but slightly slower
#                       -O2/-O3 work but may complicate stack traces
 
# Additional useful flags:
clang -fsanitize=address \
      -fno-omit-frame-pointer \    # Better stack traces
      -fno-optimize-sibling-calls \ # Clearer call stacks
      -g \
      program.c -o program
 
# For shared libraries (all must be ASan-compiled):
clang -fsanitize=address -shared -fPIC lib.c -o libfoo.so
clang -fsanitize=address program.c -L. -lfoo -o program
 
# Static linking of ASan runtime (for distribution):
clang -fsanitize=address -static-libasan program.c -o program

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# CMake ASan integration
 
# Option to enable sanitizers
option(ENABLE_ASAN "Enable AddressSanitizer" OFF)
option(ENABLE_UBSAN "Enable UndefinedBehaviorSanitizer" OFF)
 
if(ENABLE_ASAN)
    add_compile_options(-fsanitize=address -fno-omit-frame-pointer)
    add_link_options(-fsanitize=address)
endif()
 
if(ENABLE_UBSAN)
    add_compile_options(-fsanitize=undefined)
    add_link_options(-fsanitize=undefined)
endif()
 
# ASan + UBSan together (recommended combination)
if(ENABLE_ASAN AND ENABLE_UBSAN)
    add_compile_options(-fsanitize=address,undefined -fno-omit-frame-pointer)
    add_link_options(-fsanitize=address,undefined)
endif()
 
# Usage:
# cmake -DENABLE_ASAN=ON -DCMAKE_BUILD_TYPE=Debug ..
# make

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# ASan behavior is controlled via ASAN_OPTIONS environment variable
 
# Increase verbosity
ASAN_OPTIONS=verbosity=1 ./program
 
# Enable leak detection (on by default on Linux, off on macOS)
ASAN_OPTIONS=detect_leaks=1 ./program
 
# Disable leak detection (faster, when leaks aren't the focus)
ASAN_OPTIONS=detect_leaks=0 ./program
 
# Abort on first error (default: continue and show all errors)
ASAN_OPTIONS=halt_on_error=1 ./program
 
# Continue on errors, don't abort
ASAN_OPTIONS=halt_on_error=0 ./program
 
# Detect stack-use-after-return (extra overhead)
ASAN_OPTIONS=detect_stack_use_after_return=1 ./program
 
# Increase heap quarantine (better UAF detection, more memory)
ASAN_OPTIONS=quarantine_size_mb=256 ./program
 
# Larger redzones (catch larger overflows, more memory)
ASAN_OPTIONS=redzone=128 ./program
 
# Multiple options combined
ASAN_OPTIONS=detect_leaks=1:halt_on_error=0:verbosity=1 ./program
 
# Write output to file
ASAN_OPTIONS=log_path=/tmp/asan ./program
# Creates /tmp/asan.<pid>
 
# Suppress specific errors (like Valgrind)
ASAN_OPTIONS=suppressions=asan.supp ./program
 
# Fast stack unwinding (less accurate but faster)
ASAN_OPTIONS=fast_unwind_on_malloc=1 ./program

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x614000000050 at pc 0x00000050f8b2 bp 0x7ffc6d6d0e50 sp 0x7ffc6d6d0e48
WRITE of size 4 at 0x614000000050 thread T0
    #0 0x50f8b1 in main /home/user/demo.c:8:14
    #1 0x7f3d8c0e1c86 in __libc_start_main /build/glibc-2.27/csu/../csu/libc-start.c:310
    #2 0x41c499 in _start (/home/user/demo+0x41c499)
 
0x614000000050 is located 0 bytes to the right of 80-byte region [0x614000000000,0x614000000050)
allocated by thread T0 here:
    #0 0x4de3a8 in malloc /llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x50f871 in main /home/user/demo.c:6:20
    #2 0x7f3d8c0e1c86 in __libc_start_main /build/glibc-2.27/csu/../csu/libc-start.c:310
 
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/demo.c:8:14 in main
Shadow bytes around the buggy address:
  0x0c287fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff7fd0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c287fff7fe0: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa
  0x0c287fff7ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one byte per 8 bytes of mem):
  Addressable:           00
  Heap left redzone:      fa
  Heap right redzone:     fb
  Freed heap region:      fd
  ...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

// MSan detects uninitialized memory reads
 
#include <stdio.h>
#include <stdlib.h>
 
int main() {
    int* p = malloc(sizeof(int));
    // p points to allocated but UNINITIALIZED memory
    
    if (*p > 0) {  // MSan ERROR: use of uninitialized value
        printf("positive
");
    }
    
    free(p);
    return 0;
}
 
// Compile: clang -fsanitize=memory -g program.c
// Run: ./a.out
// 
// Output:
// ==12345==WARNING: MemorySanitizer: use-of-uninitialized-value
//     #0 0x... in main program.c:8:9
 
// IMPORTANT: MSan requires ALL code to be MSan-compiled
// Including libc! Use MemorySanitizer-instrumented libc
// or many false positives from library code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// TSan detects data races
 
#include <pthread.h>
 
int counter = 0;
 
void* increment(void* arg) {
    for (int i = 0; i < 1000000; i++) {
        counter++;  // DATA RACE: unsynchronized access
    }
    return NULL;
}
 
int main() {
    pthread_t t1, t2;
    pthread_create(&t1, NULL, increment, NULL);
    pthread_create(&t2, NULL, increment, NULL);
    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    printf("Counter: %d
", counter);
    return 0;
}
 
// Compile: clang -fsanitize=thread -g program.c -pthread
//
// Output:
// WARNING: ThreadSanitizer: data race (pid=12345)
//   Write of size 4 at 0x... by thread T2:
//     #0 increment program.c:8
//   Previous write of size 4 at 0x... by thread T1:
//     #0 increment program.c:8

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

// UBSan detects undefined behavior
 
#include <stdint.h>
#include <stdio.h>
 
int main() {
    int x = INT32_MAX;
    x = x + 1;  // Signed integer overflow - UNDEFINED!
    printf("%d
", x);
    
    int arr[10];
    int y = arr[20];  // Array OOB (UBSan also catches this)
    
    int* p = NULL;
    int z = *p;  // Null pointer dereference
    
    return 0;
}
 
// Compile: clang -fsanitize=undefined -g program.c
// 
// Output:
// program.c:7:9: runtime error: signed integer overflow:
// 2147483647 + 1 cannot be represented in type 'int'
//
// UBSan sub-sanitizers (can enable individually):
// -fsanitize=signed-integer-overflow
// -fsanitize=null 
// -fsanitize=alignment
// -fsanitize=shift
// -fsanitize=vptr (C++ virtual calls)
// ... many more

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

# GitHub Actions: Comprehensive Sanitizer Testing
 
name: Sanitizer Tests
 
on: [push, pull_request]
 
jobs:
  asan:
    name: AddressSanitizer + UBSan
    runs-on: ubuntu-latest
    env:
      ASAN_OPTIONS: detect_leaks=1:halt_on_error=1:abort_on_error=1
      UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
    steps:
      - uses: actions/checkout@v3
      - name: Build with ASan + UBSan
        run: |
          cmake -B build \
            -DCMAKE_C_COMPILER=clang \
            -DCMAKE_CXX_COMPILER=clang++ \
            -DCMAKE_C_FLAGS="-fsanitize=address,undefined -g" \
            -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -g"
          cmake --build build
      - name: Test
        run: ctest --test-dir build --output-on-failure
 
  tsan:
    name: ThreadSanitizer
    runs-on: ubuntu-latest
    env:
      TSAN_OPTIONS: halt_on_error=1
    steps:
      - uses: actions/checkout@v3
      - name: Build with TSan
        run: |
          cmake -B build \
            -DCMAKE_C_FLAGS="-fsanitize=thread -g" \
            -DCMAKE_CXX_FLAGS="-fsanitize=thread -g"
          cmake --build build
      - name: Test
        run: ctest --test-dir build --output-on-failure
 
  msan:
    name: MemorySanitizer
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Build with MSan
        # Note: MSan requires MSan-instrumented libraries
        run: |
          cmake -B build \
            -DCMAKE_C_FLAGS="-fsanitize=memory -g" \
            -DCMAKE_CXX_FLAGS="-fsanitize=memory -g"
          cmake --build build || echo "MSan build may need special setup"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# LibFuzzer + ASan = Powerful bug finding
 
# Create a fuzz target
cat > fuzz_target.c << 'EOF'
#include <stdint.h>
#include <stddef.h>
 
// Your code under test
void parse_input(const uint8_t* data, size_t size);
 
// LibFuzzer entry point
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    parse_input(data, size);
    return 0;
}
EOF
 
# Compile with fuzzing + ASan
clang -fsanitize=fuzzer,address -g fuzz_target.c parse.c -o fuzzer
 
# Create seed corpus directory
mkdir corpus
echo "normal input" > corpus/seed1
 
# Run fuzzer (will run indefinitely, Ctrl-C to stop)
./fuzzer corpus/ -max_len=1024
 
# If a crash is found, fuzzer saves reproducer to crash-*
# Run again to see ASan report:
./fuzzer crash-abc123
 
# LibFuzzer automatically stops on ASan errors
# Minimizes crashing input to smallest reproducer

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

Comprehensive Memory Safety Testing Strategy
═══════════════════════════════════════════════════════════════
 
Development Phase:
──────────────────
□ ASan + UBSan as default debug build
  - Fast enough for regular development
  - Catches most bugs immediately
  
□ TSan build for concurrent code
  - Separate build, run periodically
  - Essential for multithreaded code
 
Continuous Integration:
───────────────────────
□ ASan + UBSan on every PR
  - Full test suite with sanitizers
  - Block merge on any sanitizer error
  
□ TSan weekly/nightly
  - More overhead, but catches data races
  - Run on dedicated CI resources
 
□ Fuzzing with ASan continuously
  - ClusterFuzz, OSS-Fuzz, or own setup
  - 24/7 bug hunting
 
Periodic Deep Analysis:
───────────────────────
□ Valgrind monthly or on major releases
  - Comprehensive leak analysis
  - Catches some things ASan misses
  - Good for uninitialized reads if MSan is hard to set up
 
□ Static analysis (Clang Static Analyzer, Coverity)
  - Catches bugs statically
  - Complement to dynamic analysis
 
Release Testing:
────────────────
□ Full sanitizer test suite pass required
□ Clean Valgrind run on critical paths
□ Fuzz testing milestone (N hours without new bugs)