Back to Details

address-sanitizer

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

AddressSanitizer (ASan)

AddressSanitizer (ASan)

AddressSanitizer (ASan) is a widely adopted memory error detection tool used extensively during software testing, particularly fuzzing. It helps detect memory corruption bugs that might otherwise go unnoticed, such as buffer overflows, use-after-free errors, and other memory safety violations.
AddressSanitizer (ASan)是一款被广泛采用的内存错误检测工具，在软件测试（尤其是模糊测试fuzzing）中大量使用。它能检测出原本可能被忽略的内存损坏漏洞，例如缓冲区溢出、释放后使用错误以及其他内存安全违规问题。

Overview

概述

ASan is a standard practice in fuzzing due to its effectiveness in identifying memory vulnerabilities. It instruments code at compile time to track memory allocations and accesses, detecting illegal operations at runtime.
由于ASan在识别内存漏洞方面的有效性，它已成为模糊测试中的标准实践。它会在编译阶段对代码进行插桩（Instrumentation），以跟踪内存分配与访问情况，在运行时检测非法操作。

Key Concepts

核心概念

ConceptDescription
InstrumentationASan adds runtime checks to memory operations during compilation
Shadow MemoryMaps 20TB of virtual memory to track allocation state
Performance CostApproximately 2-4x slowdown compared to non-instrumented code
Detection ScopeFinds buffer overflows, use-after-free, double-free, and memory leaks
Concept描述
InstrumentationASan会在编译阶段为内存操作添加运行时检查
Shadow Memory映射20TB虚拟内存以跟踪内存分配状态
Performance Cost与未插桩的代码相比，性能大约下降2-4倍
Detection Scope可检测缓冲区溢出、释放后使用、重复释放以及内存泄漏问题

When to Apply

适用场景

Apply this technique when:
  • Fuzzing C/C++ code for memory safety vulnerabilities
  • Testing Rust code with unsafe blocks
  • Debugging crashes related to memory corruption
  • Running unit tests where memory errors are suspected
Skip this technique when:
  • Running production code (ASan can reduce security)
  • Platform is Windows or macOS (limited ASan support)
  • Performance overhead is unacceptable for your use case
  • Fuzzing pure safe languages without FFI (e.g., pure Go, pure Java)
以下场景适用该技术：
  • 对C/C++代码进行模糊测试以查找内存安全漏洞
  • 测试包含unsafe块的Rust代码
  • 调试与内存损坏相关的崩溃问题
  • 运行疑似存在内存错误的单元测试
以下场景不适用该技术：
  • 运行生产环境代码（ASan会降低安全性）
  • 运行在Windows或macOS平台（ASan支持有限）
  • 性能开销不符合你的使用需求
  • 对纯安全语言进行模糊测试且无FFI调用（例如纯Go、纯Java）

Quick Reference

快速参考

TaskCommand/Pattern
Enable ASan (Clang/GCC)
-fsanitize=address
Enable verbosity
ASAN_OPTIONS=verbosity=1
Disable leak detection
ASAN_OPTIONS=detect_leaks=0
Force abort on error
ASAN_OPTIONS=abort_on_error=1
Multiple options
ASAN_OPTIONS=verbosity=1:abort_on_error=1
任务命令/配置
启用ASan（Clang/GCC）
-fsanitize=address
启用详细日志
ASAN_OPTIONS=verbosity=1
禁用泄漏检测
ASAN_OPTIONS=detect_leaks=0
检测到错误时强制终止
ASAN_OPTIONS=abort_on_error=1
多选项配置
ASAN_OPTIONS=verbosity=1:abort_on_error=1

Step-by-Step

操作步骤

Step 1: Compile with ASan

步骤1：使用ASan编译代码

Compile and link your code with the 
-fsanitize=address
flag:
bash
clang -fsanitize=address -g -o my_program my_program.c
The 
-g
flag is recommended to get better stack traces when ASan detects errors.
使用
-fsanitize=address
标志编译并链接代码：
bash
clang -fsanitize=address -g -o my_program my_program.c
推荐添加
-g
标志，以便在ASan检测到错误时获取更清晰的堆栈跟踪。

Step 2: Configure ASan Options

步骤2：配置ASan选项

Set the 
ASAN_OPTIONS
environment variable to configure ASan behavior:
bash
export ASAN_OPTIONS=verbosity=1:abort_on_error=1:detect_leaks=0
设置
ASAN_OPTIONS
环境变量来配置ASan的行为：
bash
export ASAN_OPTIONS=verbosity=1:abort_on_error=1:detect_leaks=0

Step 3: Run Your Program

步骤3：运行程序

Execute the ASan-instrumented binary. When memory errors are detected, ASan will print detailed reports:
bash
./my_program
执行经过ASan插桩的二进制文件。当检测到内存错误时，ASan会打印详细的报告：
bash
./my_program

Step 4: Adjust Fuzzer Memory Limits

步骤4：调整模糊测试工具的内存限制

ASan requires approximately 20TB of virtual memory. Disable fuzzer memory restrictions:
  • libFuzzer: 
    -rss_limit_mb=0
  • AFL++: 
    -m none
ASan需要约20TB的虚拟内存。请禁用模糊测试工具的内存限制：
  • libFuzzer：
    -rss_limit_mb=0
  • AFL++：
    -m none

Common Patterns

常见使用模式

Pattern: Basic ASan Integration

模式：基础ASan集成

Use Case: Standard fuzzing setup with ASan
Before:
bash
clang -o fuzz_target fuzz_target.c
./fuzz_target
After:
bash
clang -fsanitize=address -g -o fuzz_target fuzz_target.c
ASAN_OPTIONS=verbosity=1:abort_on_error=1 ./fuzz_target
使用场景： 标准模糊测试环境下的ASan配置
配置前：
bash
clang -o fuzz_target fuzz_target.c
./fuzz_target
配置后：
bash
clang -fsanitize=address -g -o fuzz_target fuzz_target.c
ASAN_OPTIONS=verbosity=1:abort_on_error=1 ./fuzz_target

Pattern: ASan with Unit Tests

模式：ASan与单元测试结合

Use Case: Enable ASan for unit test suite
Before:
bash
gcc -o test_suite test_suite.c -lcheck
./test_suite
After:
bash
gcc -fsanitize=address -g -o test_suite test_suite.c -lcheck
ASAN_OPTIONS=detect_leaks=1 ./test_suite
使用场景： 为单元测试套件启用ASan
配置前：
bash
gcc -o test_suite test_suite.c -lcheck
./test_suite
配置后：
bash
gcc -fsanitize=address -g -o test_suite test_suite.c -lcheck
ASAN_OPTIONS=detect_leaks=1 ./test_suite

Advanced Usage

高级用法

Tips and Tricks

技巧与建议

TipWhy It Helps
Use 
-g
flag		Provides detailed stack traces for debugging
Set 
verbosity=1
Confirms ASan is enabled before program starts
Disable leaks during fuzzingLeak detection doesn't cause immediate crashes, clutters output
Enable 
abort_on_error=1
Some fuzzers require 
abort()
instead of 
_exit()
技巧作用
使用
-g
标志		提供详细的堆栈跟踪以辅助调试
设置
verbosity=1
在程序启动前确认ASan已启用
模糊测试时禁用泄漏检测泄漏检测不会导致立即崩溃，会使输出信息杂乱
启用
abort_on_error=1
部分模糊测试工具需要
abort()
而非
_exit()
来处理错误

Understanding ASan Reports

理解ASan报告

When ASan detects a memory error, it prints a detailed report including:
  • Error type: Buffer overflow, use-after-free, etc.
  • Stack trace: Where the error occurred
  • Allocation/deallocation traces: Where memory was allocated/freed
  • Memory map: Shadow memory state around the error
Example ASan report:
==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000eff4 at pc 0x00000048e6a3
READ of size 4 at 0x60300000eff4 thread T0
    #0 0x48e6a2 in main /path/to/file.c:42
当ASan检测到内存错误时，会打印包含以下内容的详细报告：
  • 错误类型：缓冲区溢出、释放后使用等
  • 堆栈跟踪：错误发生的位置
  • 分配/释放跟踪：内存分配与释放的位置
  • 内存映射：错误发生区域的影子内存状态
ASan报告示例：
==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000eff4 at pc 0x00000048e6a3
READ of size 4 at 0x60300000eff4 thread T0
    #0 0x48e6a2 in main /path/to/file.c:42

Combining Sanitizers

与其他Sanitizer结合使用

ASan can be combined with other sanitizers for comprehensive detection:
bash
clang -fsanitize=address,undefined -g -o fuzz_target fuzz_target.c
ASan可与其他Sanitizer结合使用以实现全面检测：
bash
clang -fsanitize=address,undefined -g -o fuzz_target fuzz_target.c

Platform-Specific Considerations

平台特定注意事项

Linux: Full ASan support with best performance macOS: Limited support, some features may not work Windows: Experimental support, not recommended for production fuzzing
Linux：完全支持ASan，性能最佳 macOS：支持有限，部分功能可能无法正常工作 Windows：实验性支持，不推荐用于生产环境模糊测试

Anti-Patterns

反模式

Anti-PatternProblemCorrect Approach
Using ASan in productionCan make applications less secureUse ASan only for testing
Not disabling memory limitsFuzzer may kill process due to 20TB virtual memorySet 
-rss_limit_mb=0
or 
-m none
Ignoring leak reportsMemory leaks indicate resource management issuesReview leak reports at end of fuzzing campaign
反模式问题正确做法
在生产环境中使用ASan会降低应用程序的安全性仅在测试阶段使用ASan
未禁用内存限制模糊测试工具可能因20TB虚拟内存需求而终止进程设置
-rss_limit_mb=0
或
-m none
忽略泄漏报告内存泄漏表明存在资源管理问题在模糊测试结束后查看泄漏报告

Tool-Specific Guidance

工具特定指南

libFuzzer

libFuzzer

Compile with both fuzzer and address sanitizer:
bash
clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz
Run with unlimited RSS:
bash
./fuzz -rss_limit_mb=0
Integration tips:
  • Always combine 
    -fsanitize=fuzzer
    with 
    -fsanitize=address
  • Use 
    -g
    for detailed stack traces in crash reports
  • Consider 
    ASAN_OPTIONS=abort_on_error=1
    for better crash handling
See: libFuzzer: AddressSanitizer
同时使用模糊测试工具和地址Sanitizer编译：
bash
clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz
无限制内存运行：
bash
./fuzz -rss_limit_mb=0
集成技巧：
  • 始终将
    -fsanitize=fuzzer
    与
    -fsanitize=address
    结合使用
  • 使用
    -g
    标志以在崩溃报告中获取详细堆栈跟踪
  • 考虑设置
    ASAN_OPTIONS=abort_on_error=1
    以优化崩溃处理
参考：libFuzzer: AddressSanitizer

AFL++

AFL++

Use the 
AFL_USE_ASAN
environment variable:
bash
AFL_USE_ASAN=1 afl-clang-fast++ -g harness.cc -o fuzz
Run with unlimited memory:
bash
afl-fuzz -m none -i input_dir -o output_dir ./fuzz
Integration tips:
  • AFL_USE_ASAN=1
    automatically adds proper compilation flags
  • Use 
    -m none
    to disable AFL++'s memory limit
  • Consider 
    AFL_MAP_SIZE
    for programs with large coverage maps
See: AFL++: AddressSanitizer
使用
AFL_USE_ASAN
环境变量：
bash
AFL_USE_ASAN=1 afl-clang-fast++ -g harness.cc -o fuzz
无限制内存运行：
bash
afl-fuzz -m none -i input_dir -o output_dir ./fuzz
集成技巧：
  • AFL_USE_ASAN=1
    会自动添加正确的编译标志
  • 使用
    -m none
    禁用AFL++的内存限制
  • 对于覆盖范围较大的程序，考虑调整
    AFL_MAP_SIZE
参考：AFL++: AddressSanitizer

cargo-fuzz (Rust)

cargo-fuzz（Rust）

Use the 
--sanitizer=address
flag:
bash
cargo fuzz run fuzz_target --sanitizer=address
Or configure in 
fuzz/Cargo.toml
:
toml
[profile.release]
opt-level = 3
debug = true
Integration tips:
  • ASan is useful for fuzzing unsafe Rust code or FFI boundaries
  • Safe Rust code may not benefit as much (compiler already prevents many errors)
  • Focus on unsafe blocks, raw pointers, and C library bindings
See: cargo-fuzz: AddressSanitizer
使用
--sanitizer=address
标志：
bash
cargo fuzz run fuzz_target --sanitizer=address
或在
fuzz/Cargo.toml
中配置：
toml
[profile.release]
opt-level = 3
debug = true
集成技巧：
  • ASan对测试不安全的Rust代码或FFI边界非常有用
  • 安全的Rust代码可能受益有限（编译器已阻止许多错误）
  • 重点关注unsafe块、原始指针和C库绑定
参考：cargo-fuzz: AddressSanitizer

honggfuzz

honggfuzz

Compile with ASan and link with honggfuzz:
bash
honggfuzz -i input_dir -o output_dir -- ./fuzz_target_asan
Compile the target:
bash
hfuzz-clang -fsanitize=address -g target.c -o fuzz_target_asan
Integration tips:
  • honggfuzz works well with ASan out of the box
  • Use feedback-driven mode for better coverage with sanitizers
  • Monitor memory usage, as ASan increases memory footprint
使用ASan编译目标并链接honggfuzz：
bash
honggfuzz -i input_dir -o output_dir -- ./fuzz_target_asan
编译目标程序：
bash
hfuzz-clang -fsanitize=address -g target.c -o fuzz_target_asan
集成技巧：
  • honggfuzz与ASan开箱即用，兼容性良好
  • 使用反馈驱动模式以结合Sanitizer实现更好的覆盖范围
  • 监控内存使用情况，因为ASan会增加内存占用

Troubleshooting

故障排除

IssueCauseSolution
Fuzzer kills process immediatelyMemory limit too low for ASan's 20TB virtual memoryUse 
-rss_limit_mb=0
(libFuzzer) or 
-m none
(AFL++)
"ASan runtime not initialized"Wrong linking order or missing runtimeEnsure 
-fsanitize=address
used in both compile and link
Leak reports clutter outputLeakSanitizer enabled by defaultSet 
ASAN_OPTIONS=detect_leaks=0
Poor performance (>4x slowdown)Debug mode or unoptimized buildCompile with 
-O2
or 
-O3
alongside 
-fsanitize=address
ASan not detecting obvious bugsBinary not instrumentedCheck with 
ASAN_OPTIONS=verbosity=1
that ASan prints startup info
False positivesInterceptor conflictsCheck ASan FAQ for known issues with specific libraries
问题原因解决方案
模糊测试工具立即终止进程ASan需要20TB虚拟内存，而工具的内存限制过低使用
-rss_limit_mb=0
（libFuzzer）或
-m none
（AFL++）
"ASan runtime not initialized"链接顺序错误或缺少运行时库确保编译和链接阶段都使用了
-fsanitize=address
标志
泄漏报告使输出杂乱LeakSanitizer默认启用设置
ASAN_OPTIONS=detect_leaks=0
性能极差（慢于4倍）调试模式或未优化的构建结合
-O2
或
-O3
与
-fsanitize=address
进行编译
ASan未检测到明显的bug二进制文件未被插桩使用
ASAN_OPTIONS=verbosity=1
确认ASan在启动时打印了初始化信息
误报拦截器冲突查看ASan FAQ了解特定库的已知问题

Related Skills

相关技术

Tools That Use This Technique

使用该技术的工具

SkillHow It Applies
libfuzzerCompile with 
-fsanitize=fuzzer,address
for integrated fuzzing with memory error detection
aflppUse 
AFL_USE_ASAN=1
environment variable during compilation
cargo-fuzzUse 
--sanitizer=address
flag to enable ASan for Rust fuzz targets
honggfuzzCompile target with 
-fsanitize=address
for ASan-instrumented fuzzing
技术应用方式
libfuzzer使用
-fsanitize=fuzzer,address
编译，实现集成式模糊测试与内存错误检测
aflpp编译时使用
AFL_USE_ASAN=1
环境变量
cargo-fuzz使用
--sanitizer=address
标志为Rust模糊测试目标启用ASan
honggfuzz使用
-fsanitize=address
编译目标程序以进行ASan插桩的模糊测试

Related Techniques

相关技术

SkillRelationship
undefined-behavior-sanitizerOften used together with ASan for comprehensive bug detection (undefined behavior + memory errors)
fuzz-harness-writingHarnesses must be designed to handle ASan-detected crashes and avoid false positives
coverage-analysisCoverage-guided fuzzing helps trigger code paths where ASan can detect memory errors
技术关系
undefined-behavior-sanitizer常与ASan结合使用，实现全面的漏洞检测（未定义行为+内存错误）
fuzz-harness-writing测试桩需要设计为能处理ASan检测到的崩溃并避免误报
coverage-analysis覆盖导向的模糊测试有助于触发ASan可检测到内存错误的代码路径

Resources

资源

Key External Resources

主要外部资源

AddressSanitizer on Google Sanitizers Wiki
The official ASan documentation covers:
  • Algorithm and implementation details
  • Complete list of detected error types
  • Performance characteristics and overhead
  • Platform-specific behavior
  • Known limitations and incompatibilities
SanitizerCommonFlags
Common configuration flags shared across all sanitizers:
  • verbosity
    : Control diagnostic output level
  • log_path
    : Redirect sanitizer output to files
  • symbolize
    : Enable/disable symbol resolution in reports
  • external_symbolizer_path
    : Use custom symbolizer
AddressSanitizerFlags
ASan-specific configuration options:
  • detect_leaks
    : Control memory leak detection
  • abort_on_error
    : Call 
    abort()
    vs 
    _exit()
    on error
  • detect_stack_use_after_return
    : Detect stack use-after-return bugs
  • check_initialization_order
    : Find initialization order bugs
AddressSanitizer FAQ
Common pitfalls and solutions:
  • Linking order issues
  • Conflicts with other tools
  • Platform-specific problems
  • Performance tuning tips
Clang AddressSanitizer Documentation
Clang-specific guidance:
  • Compilation flags and options
  • Interaction with other Clang features
  • Supported platforms and architectures
GCC Instrumentation Options
GCC-specific ASan documentation:
  • GCC-specific flags and behavior
  • Differences from Clang implementation
  • Platform support in GCC
AddressSanitizer: A Fast Address Sanity Checker (USENIX Paper)
Original research paper with technical details:
  • Shadow memory algorithm
  • Virtual memory requirements (historically 16TB, now ~20TB)
  • Performance benchmarks
  • Design decisions and tradeoffs
AddressSanitizer on Google Sanitizers Wiki
官方ASan文档涵盖：
  • 算法与实现细节
  • 可检测错误类型的完整列表
  • 性能特征与开销
  • 平台特定行为
  • 已知限制与不兼容性
SanitizerCommonFlags
所有Sanitizer共享的通用配置标志：
  • verbosity
    ：控制诊断输出级别
  • log_path
    ：将Sanitizer输出重定向到文件
  • symbolize
    ：启用/禁用报告中的符号解析
  • external_symbolizer_path
    ：使用自定义符号解析工具
AddressSanitizerFlags
ASan特定的配置选项：
  • detect_leaks
    ：控制内存泄漏检测
  • abort_on_error
    ：检测到错误时调用
    abort()
    而非
    _exit()
  • detect_stack_use_after_return
    ：检测栈上的释放后使用漏洞
  • check_initialization_order
    ：查找初始化顺序错误
AddressSanitizer FAQ
常见问题与解决方案：
  • 链接顺序问题
  • 与其他工具的冲突
  • 平台特定问题
  • 性能调优技巧
Clang AddressSanitizer Documentation
Clang特定指南：
  • 编译标志与选项
  • 与其他Clang功能的交互
  • 支持的平台与架构
GCC Instrumentation Options
GCC特定的ASan文档：
  • GCC特定的标志与行为
  • 与Clang实现的差异
  • GCC中的平台支持
AddressSanitizer: A Fast Address Sanity Checker (USENIX Paper)
包含技术细节的原始研究论文：
  • 影子内存算法
  • 虚拟内存需求（历史为16TB，当前约20TB）
  • 性能基准测试
  • 设计决策与权衡