AddressSanitizer
A compiler instrumentation in Clang and GCC that detects out-of-bounds accesses, use-after-free, double free and other memory errors at run time, with about a twofold slowdown. Run tests and fuzzers with it enabled; it is a testing tool, not a production defense.
- Also called
- ASan
- Defined in
- Clang documentation: AddressSanitizer
Covered in
Find, fix and contain memory-safety bugs in C and C++
Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.
Fuzz a parser and turn crashes into lasting regressions
Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.
Practice: Buffer over-read lab: Stop a heartbeat over-read · Local project: Parse bounded JSON and XML invoices safely · Local project: Repair a native parser using sanitizer evidence