Address Sanitizer Internals
blog.gistre.epita.fr
Address Sanitizer Internals
1–10 of 30 posts
Re: Address Sanitizer Internals
#2This is great! I found these videos helpful, too: https://youtu.be/Tl1uZ7FBwFQ
Does anyone know of a good explanation of HWAddress Sanitizer internals?
Re: Address Sanitizer Internals
#3One thing this explains is why ASan has false negatives. It's a great tool, but the typical comment that it fully mitigates memory safety issues is just not true (even assuming your tests actually trigger the memory safety bugs, which unlike eg code coverage there's no knowing if you achieved or not)
Re: Address Sanitizer Internals
#4One thing this explains is why ASan has false negatives. It's a great tool, but the typical comment that it fully mitigates memory safety issues is just not true (even assuming your tests actually trigger the memory safety bugs, which unlike eg code coverage there's no knowing if you achieved or not)
I've never seen anyone claim that.
Re: Address Sanitizer Internals
#5One thing this explains is why ASan has false negatives. It's a great tool, but the typical comment that it fully mitigates memory safety issues is just not true (even assuming your tests actually trigger the memory safety bugs, which unlike eg code coverage there's no knowing if you achieved or not)
I've never seen anyone claim that.
It comes up a lot in HN C++-related comment threads, for starters
Re: Address Sanitizer Internals
#6Who sanitizes the sanitizer? One of the most hilarious bugs I've previously seen is when someone found a memory out-of-bound access inside the run time support library of Asan.
Re: Address Sanitizer Internals
#7Re: Address Sanitizer Internals
#8Earlier quoted context omitted.
I've never seen anyone claim that.
It comes up a lot in HN C++-related comment threads, for starters
I frequently bring up ASan on HN. it's a great way to mitigate C and C++'s shortcomings. But it's not a panacea and unlikely to be described that way here without swift rebuttal.
C or C++ w/o ASan and UBSan is like skydiving w/o a parachute.
Re: Address Sanitizer Internals
#9Earlier quoted context omitted.
It comes up a lot in HN C++-related comment threads, for starters
I've never seen anyone claim that asan fully mitigates memory safety issues in C++. Perhaps you could link to one?
I've never seen that particular claim either, but I did previously believe that asan would reliably detect an out-of-bounds write if and when it occurs.
So I learned something new from the OP (that this type of false negative is possible).
Re: Address Sanitizer Internals
#10sanitizers are a constant source of pain