Instruments C/C++ and Rust code with AddressSanitizer to detect buffer overflows, use-after-free, and memory errors during fuzzing.
npx claudepluginhub trailofbits/skills --plugin testing-handbook-skillsThis skill uses the workspace's default tool permissions.
AddressSanitizer (ASan) is a widely adopted memory error detection tool used extensively during software testing, particularly fuzzing. It helps detect memory corruption bugs that might otherwise go unnoticed, such as buffer overflows, use-after-free errors, and other memory safety violations.
Use AddressSanitizer to detect memory safety bugs in C/C++ programs. Identifies use-after-free, buffer overflow, memory leaks, and other memory errors.
Guides setup and execution of LLVM libFuzzer for coverage-guided fuzzing of C/C++ code with Clang, including harnesses, compilation, and cross-platform installs.
Performs coverage-guided fuzzing of compiled binaries with AFL++ to discover crashes and vulnerabilities. Instruments targets, manages corpora, runs parallel campaigns, triages crashes.
Share bugs, ideas, or general feedback.
AddressSanitizer (ASan) is a widely adopted memory error detection tool used extensively during software testing, particularly fuzzing. It helps detect memory corruption bugs that might otherwise go unnoticed, such as buffer overflows, use-after-free errors, and other memory safety violations.
ASan is a standard practice in fuzzing due to its effectiveness in identifying memory vulnerabilities. It instruments code at compile time to track memory allocations and accesses, detecting illegal operations at runtime.
| Concept | Description |
|---|---|
| Instrumentation | ASan adds runtime checks to memory operations during compilation |
| Shadow Memory | Maps 20TB of virtual memory to track allocation state |
| Performance Cost | Approximately 2-4x slowdown compared to non-instrumented code |
| Detection Scope | Finds buffer overflows, use-after-free, double-free, and memory leaks |
Apply this technique when:
Skip this technique when:
| Task | Command/Pattern |
|---|---|
| Enable ASan (Clang/GCC) | -fsanitize=address |
| Enable verbosity | ASAN_OPTIONS=verbosity=1 |
| Disable leak detection | ASAN_OPTIONS=detect_leaks=0 |
| Force abort on error | ASAN_OPTIONS=abort_on_error=1 |
| Multiple options | ASAN_OPTIONS=verbosity=1:abort_on_error=1 |
Compile and link your code with the -fsanitize=address flag:
clang -fsanitize=address -g -o my_program my_program.c
The -g flag is recommended to get better stack traces when ASan detects errors.
Set the ASAN_OPTIONS environment variable to configure ASan behavior:
export ASAN_OPTIONS=verbosity=1:abort_on_error=1:detect_leaks=0
Execute the ASan-instrumented binary. When memory errors are detected, ASan will print detailed reports:
./my_program
ASan requires approximately 20TB of virtual memory. Disable fuzzer memory restrictions:
-rss_limit_mb=0-m noneUse Case: Standard fuzzing setup with ASan
Before:
clang -o fuzz_target fuzz_target.c
./fuzz_target
After:
clang -fsanitize=address -g -o fuzz_target fuzz_target.c
ASAN_OPTIONS=verbosity=1:abort_on_error=1 ./fuzz_target
Use Case: Enable ASan for unit test suite
Before:
gcc -o test_suite test_suite.c -lcheck
./test_suite
After:
gcc -fsanitize=address -g -o test_suite test_suite.c -lcheck
ASAN_OPTIONS=detect_leaks=1 ./test_suite
| Tip | Why It Helps |
|---|---|
Use -g flag | Provides detailed stack traces for debugging |
Set verbosity=1 | Confirms ASan is enabled before program starts |
| Disable leaks during fuzzing | Leak detection doesn't cause immediate crashes, clutters output |
Enable abort_on_error=1 | Some fuzzers require abort() instead of _exit() |
When ASan detects a memory error, it prints a detailed report including:
Example ASan report:
==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000eff4 at pc 0x00000048e6a3
READ of size 4 at 0x60300000eff4 thread T0
#0 0x48e6a2 in main /path/to/file.c:42
ASan can be combined with other sanitizers for comprehensive detection:
clang -fsanitize=address,undefined -g -o fuzz_target fuzz_target.c
Linux: Full ASan support with best performance macOS: Limited support, some features may not work Windows: Experimental support, not recommended for production fuzzing
| Anti-Pattern | Problem | Correct Approach |
|---|---|---|
| Using ASan in production | Can make applications less secure | Use ASan only for testing |
| Not disabling memory limits | Fuzzer may kill process due to 20TB virtual memory | Set -rss_limit_mb=0 or -m none |
| Ignoring leak reports | Memory leaks indicate resource management issues | Review leak reports at end of fuzzing campaign |
Compile with both fuzzer and address sanitizer:
clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz
Run with unlimited RSS:
./fuzz -rss_limit_mb=0
Integration tips:
-fsanitize=fuzzer with -fsanitize=address-g for detailed stack traces in crash reportsASAN_OPTIONS=abort_on_error=1 for better crash handlingSee: libFuzzer: AddressSanitizer
Use the AFL_USE_ASAN environment variable:
AFL_USE_ASAN=1 afl-clang-fast++ -g harness.cc -o fuzz
Run with unlimited memory:
afl-fuzz -m none -i input_dir -o output_dir ./fuzz
Integration tips:
AFL_USE_ASAN=1 automatically adds proper compilation flags-m none to disable AFL++'s memory limitAFL_MAP_SIZE for programs with large coverage mapsUse the --sanitizer=address flag:
cargo fuzz run fuzz_target --sanitizer=address
Or configure in fuzz/Cargo.toml:
[profile.release]
opt-level = 3
debug = true
Integration tips:
See: cargo-fuzz: AddressSanitizer
Compile with ASan and link with honggfuzz:
honggfuzz -i input_dir -o output_dir -- ./fuzz_target_asan
Compile the target:
hfuzz-clang -fsanitize=address -g target.c -o fuzz_target_asan
Integration tips:
| Issue | Cause | Solution |
|---|---|---|
| Fuzzer kills process immediately | Memory limit too low for ASan's 20TB virtual memory | Use -rss_limit_mb=0 (libFuzzer) or -m none (AFL++) |
| "ASan runtime not initialized" | Wrong linking order or missing runtime | Ensure -fsanitize=address used in both compile and link |
| Leak reports clutter output | LeakSanitizer enabled by default | Set ASAN_OPTIONS=detect_leaks=0 |
| Poor performance (>4x slowdown) | Debug mode or unoptimized build | Compile with -O2 or -O3 alongside -fsanitize=address |
| ASan not detecting obvious bugs | Binary not instrumented | Check with ASAN_OPTIONS=verbosity=1 that ASan prints startup info |
| False positives | Interceptor conflicts | Check ASan FAQ for known issues with specific libraries |
| Skill | How It Applies |
|---|---|
| libfuzzer | Compile with -fsanitize=fuzzer,address for integrated fuzzing with memory error detection |
| aflpp | Use AFL_USE_ASAN=1 environment variable during compilation |
| cargo-fuzz | Use --sanitizer=address flag to enable ASan for Rust fuzz targets |
| honggfuzz | Compile target with -fsanitize=address for ASan-instrumented fuzzing |
| Skill | Relationship |
|---|---|
| undefined-behavior-sanitizer | Often used together with ASan for comprehensive bug detection (undefined behavior + memory errors) |
| fuzz-harness-writing | Harnesses must be designed to handle ASan-detected crashes and avoid false positives |
| coverage-analysis | Coverage-guided fuzzing helps trigger code paths where ASan can detect memory errors |
AddressSanitizer on Google Sanitizers Wiki
The official ASan documentation covers:
Common configuration flags shared across all sanitizers:
verbosity: Control diagnostic output levellog_path: Redirect sanitizer output to filessymbolize: Enable/disable symbol resolution in reportsexternal_symbolizer_path: Use custom symbolizerASan-specific configuration options:
detect_leaks: Control memory leak detectionabort_on_error: Call abort() vs _exit() on errordetect_stack_use_after_return: Detect stack use-after-return bugscheck_initialization_order: Find initialization order bugsCommon pitfalls and solutions:
Clang AddressSanitizer Documentation
Clang-specific guidance:
GCC-specific ASan documentation:
AddressSanitizer: A Fast Address Sanity Checker (USENIX Paper)
Original research paper with technical details: