{"id":7225,"date":"2023-03-13T21:03:58","date_gmt":"2023-03-13T13:03:58","guid":{"rendered":"https:\/\/yanjingang.com\/blog\/?p=7225"},"modified":"2023-05-23T11:23:18","modified_gmt":"2023-05-23T03:23:18","slug":"c%e5%86%85%e5%ad%98%e9%94%99%e8%af%af%e6%a3%80%e6%b5%8b-addresssanitizer","status":"publish","type":"post","link":"https:\/\/yanjingang.com\/blog\/?p=7225","title":{"rendered":"C++\u5185\u5b58\u9519\u8bef\u68c0\u6d4b\u5229\u5668\u2014AddressSanitizer"},"content":{"rendered":"<p data-pid=\"xuj5Qgma\">\u81ea\u64cd\u4f5c\u7cfb\u7edf\u8bde\u751f\u4ee5\u6765\uff0c\u7f16\u5199\u5185\u5b58\u5b89\u5168\u7684\u4ee3\u7801\u4e00\u76f4\u662f\u4e00\u4e2a\u6bd4\u8f83\u56f0\u96be\u7684\u95ee\u9898 (\u53e6\u4e00\u4e2a\u95ee\u9898\u5219\u662f\u4fdd\u8bc1\u7ebf\u7a0b\u5b89\u5168)\u3002\u6765\u81ea\u5fae\u8f6f\u5b89\u5168\u54cd\u5e94\u4e2d\u5fc3\uff08MSRC\uff09\u8fd120\u5e74\u6765\u7684\u5b89\u5168\u6570\u636e\u663e\u793a\uff0c\u6709\u7ea6 70% \u7684\u5b89\u5168\u6f0f\u6d1e\u8865\u4e01\u662f\u9488\u5bf9\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u7684\u4fee\u590d\u3002<\/p>\n<p data-pid=\"xuj5Qgma\">\u7531\u4e8e C\/C++ \u4e0d\u662f\u4e00\u95e8\u5185\u5b58\u5b89\u5168\u7684\u8bed\u8a00\uff0c\u6240\u4ee5\u6b64\u7c7b\u95ee\u9898\u4f1a\u7ecf\u5e38\u9047\u5230\u3002\u5728\u7f16\u5199C++\u7a0b\u5e8f\u65f6\uff0c\u5185\u5b58\u6cc4\u6f0f\u3001\u5185\u5b58\u6ea2\u51fa\u3001\u5185\u5b58\u8e29\u8e0f\u7b49\u95ee\u9898\u5c42\u51fa\u4e0d\u7a77\uff0c\u8f7b\u5219\u5bfc\u81f4\u7a0b\u5e8f\u5185\u5b58\u6d6a\u8d39\u3001\u8ba1\u7b97\u9519\u8bef\uff0c\u91cd\u5219\u5f15\u8d77\u7a0b\u5e8f\u5d29\u6e83\uff0c\u96be\u4ee5\u6392\u67e5\u548c\u5b9a\u4f4d\uff0c\u4e25\u91cd\u5f71\u54cd\u9879\u76ee\u8fdb\u5ea6\u548c\u7a0b\u5e8f\u7684\u7a33\u5b9a\u6027\u3002\u672c\u6587\u4e3b\u8981\u8bb2\u89e3\u5982\u4f55\u4f7f\u7528AddressSanitizer\u5de5\u5177\u6765\u5feb\u901f\u68c0\u6d4b\u5b9a\u4f4d\u6b64\u7c7b\u95ee\u9898\u3002<\/p>\n<h1>\u4e00\u3001\u6982\u8ff0<\/h1>\n<h4>1\u3001\u5e38\u89c1\u5185\u5b58\u95ee\u9898\u573a\u666f<\/h4>\n<p>\u5f00\u59cb\u4e4b\u524d\uff0c\u5148\u7b80\u5355\u4ecb\u7ecd\u4e0b\u5185\u5b58\u76f8\u5173\u7684\u51e0\u4e2a\u5f02\u5e38\u6982\u5ff5\uff1a<\/p>\n<ul>\n<li id=\"\u91ce\u6307\u9488\"><strong>\u91ce\u6307\u9488\uff1a<\/strong>\u6307\u9488\u672a\u521d\u59cb\u5316\u5c31\u4f7f\u7528(\u975e\u6cd5\u7684\u968f\u673a\u503c)\u3001\u6307\u9488\u8d8a\u754c\u975e\u6cd5\u8bbf\u95ee\uff0c\u6216\u6307\u5411\u4e00\u4e2a\u5df2\u91ca\u653e\u7684\u5bf9\u8c61\u7b49\u3002<\/li>\n<li><strong>\u5185\u5b58\u6cc4\u9732\uff1a<\/strong>\u7533\u8bf7\u7684\u5806\u5185\u5b58\u4f7f\u7528\u5b8c\u6bd5\u540e\u5fd8\u8bb0\u91ca\u653e\uff0c\u5185\u5b58\u8fd8\u5360\u7740\uff0c\u4f46\u5730\u5740\u4e22\u5931\uff0c\u81ea\u5df1\u5df2\u7ecf\u4e0d\u80fd\u63a7\u5236\u8fd9\u5757\u5185\u5b58\uff0c\u800c\u7cfb\u7edf\u4e5f\u4e0d\u80fd\u518d\u6b21\u5c06\u5b83\u5206\u914d\u7ed9\u9700\u8981\u7684\u7a0b\u5e8f\u3002\u5185\u5b58\u6cc4\u6f0f\u6b21\u6570\u591a\u4e86\u5c31\u4f1a\u5bfc\u81f4\u5185\u5b58\u6ea2\u51fa\u3002<\/li>\n<li><strong>\u5185\u5b58\u6ea2\u51fa\uff1a<\/strong>Out Of Memory\uff0c\u7b80\u79f0OOM\uff0c\u6307\u7cfb\u7edf\u5df2\u7ecf\u4e0d\u80fd\u518d\u5206\u914d\u51fa\u4f60\u6240\u9700\u8981\u7684\u7a7a\u95f4\u3002<\/li>\n<li><strong>\u5185\u5b58\u8e29\u8e0f\uff1a<\/strong>\u6307\u8bbf\u95ee\u4e86\u4e0d\u5408\u6cd5\u7684\u5730\u5740\uff08\u8bbf\u95ee\u4e86\u4e0d\u5c5e\u4e8e\u81ea\u5df1\u7684\u5730\u5740\uff09\uff0c\u5982\u679c\u8bbf\u95ee\u7684\u5730\u5740\u662f\u5176\u4ed6\u53d8\u91cf\u7684\u5730\u5740\u5e76\u8fdb\u884c\u4e86\u4fee\u6539\uff0c\u5c31\u4f1a\u7834\u574f\u522b\u4eba\u7684\u6570\u636e\uff0c\u4ece\u800c\u5bfc\u81f4\u7a0b\u5e8f\u8fd0\u884c\u5f02\u5e38\u3002\u5e38\u53d1\u751f\u5728buffer overflow\uff0c\u91ce\u6307\u9488\u64cd\u4f5c\uff0cwrite after free\u7b49\u573a\u666f\u3002<\/li>\n<\/ul>\n<h4>2\u3001\u5e38\u89c1\u5185\u5b58\u68c0\u6d4b\u5de5\u5177<\/h4>\n<p data-pid=\"YN_R5yO8\">\u5728AddressSanitizer\u51fa\u73b0\u4e4b\u524d\uff0c\u5e02\u9762\u4e0a\u5c31\u5df2\u7ecf\u5b58\u5728\u4e86\u8bb8\u591a\u5185\u5b58\u68c0\u6d4b\u5668\uff0c\u4f8b\u5982\uff1a<\/p>\n<ul>\n<li data-pid=\"Z4ThkZAA\">Dr.Memory\uff1a\u68c0\u6d4b\u672a\u521d\u59cb\u5316\u7684\u5185\u5b58\u8bbf\u95ee\u3001double free\u3001use after free \u7b49\u9519\u8bef<\/li>\n<li data-pid=\"Ax8pRU-X\">Mudflap\uff1a\u68c0\u6d4b\u6307\u9488\u7684\u89e3\u5f15\u7528\uff0c\u9759\u6001\u63d2\u6869<\/li>\n<li data-pid=\"_Z4iBHSt\">Insure++\uff1a\u68c0\u6d4b\u5185\u5b58\u6cc4\u6f0f<\/li>\n<li data-pid=\"QUqWAfEJ\">Valgrind\uff1a\u53ef\u4ee5\u68c0\u6d4b\u975e\u5e38\u591a\u7684\u5185\u5b58\u9519\u8bef<\/li>\n<\/ul>\n<p data-pid=\"m5LMWGj_\">\u5176\u4e2d\uff0cDr.Memory\u3001Insure++ \u548c Mudflap \u867d\u7136\u5728\u8fd0\u884c\u65f6\u9020\u6210\u7684\u989d\u5916\u635f\u8017\u6bd4\u8f83\u5c11\uff0c\u4f46\u662f\u68c0\u6d4b\u573a\u666f\u6709\u9650\uff1bValgrind \u867d\u7136\u80fd\u591f\u5728\u8bb8\u591a\u573a\u666f\u7684\u68c0\u6d4b\u51fa\u9519\u8bef\uff0c\u4f46\u662f\u5b83\u5b9e\u73b0\u4e86\u81ea\u5df1\u7684\u4e00\u5957 ISA \u5e76\u5728\u5176\u4e4b\u4e0a\u8fd0\u884c\u76ee\u6807\u7a0b\u5e8f\uff0c\u56e0\u6b64\u5b83\u4f1a\u4e25\u91cd\u62d6\u6162\u76ee\u6807\u7a0b\u5e8f\u7684\u901f\u5ea6\u3002\u800c AddressSanitizer \u5728\u8bbe\u8ba1\u65f6\u5c31\u7efc\u5408\u8003\u8651\u4e86\u68c0\u6d4b\u573a\u666f\u3001\u901f\u5ea6\u7684\u5f71\u54cd\u56e0\u7d20\uff0c\u7ed3\u5408\u4e86 Mudflap \u7684\u9759\u6001\u63d2\u6869\u3001Valgrind \u7684\u591a\u573a\u666f\u68c0\u6d4b\u80fd\u529b\uff0c\u6545\u672c\u6587\u4e3b\u8981\u8bb2\u89e3AddressSanitizer\u3002<\/p>\n<h4>3\u3001\u4ec0\u4e48\u662fAddressSanitizer<\/h4>\n<p>AddressSanitizer\u5373\u5730\u5740\u6d88\u6bd2\u6280\u672f\uff0c\u7b80\u79f0ASan\uff0c\u662f\u4e00\u4e2a\u5feb\u901f\u7684\u5185\u5b58\u9519\u8bef\u68c0\u6d4b\u5de5\u5177\u3002\u5b83\u53ef\u4ee5\u7528\u6765\u68c0\u6d4b\u5185\u5b58\u95ee\u9898\uff0c\u4f8b\u5982\u7f13\u51b2\u533a\u6ea2\u51fa\u6216\u5bf9\u60ac\u7a7a\u6307\u9488\u7684\u975e\u6cd5\u8bbf\u95ee\u7b49\u3002<\/p>\n<p>\u68c0\u6d4b\u7c7b\u578b\uff1a<\/p>\n<ul>\n<li><strong>Use after free(dangling pointer dereference)\uff1a<\/strong>\u91ca\u653e\u540e\u4f7f\u7528\uff08\u5806\u4e0a\u5206\u914d\u7684\u7a7a\u95f4free\u4e4b\u540e\u88ab\u518d\u6b21\u4f7f\u7528\uff09\u3002<\/li>\n<li><strong>Heap buffer overflow\uff1a<\/strong>\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\uff08\u8bbf\u95ee\u7684\u533a\u57df\u5728\u5806\u4e0a, \u4e14\u8d85\u8fc7\u4e86\u5206\u914d\u7684\u7a7a\u95f4\uff09\u3002<\/li>\n<li><strong>Stack buffer overflow\uff1a<\/strong>\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\uff08\u8bbf\u95ee\u7684\u533a\u57df\u5728\u6808\u4e0a, \u4e14\u8d85\u8fc7\u4e86\u5206\u914d\u7ed9\u5b83\u7684\u7a7a\u95f4\uff09\u3002<\/li>\n<li><strong>Global buffer overflow\uff1a<\/strong>\u5168\u5c40\u7f13\u51b2\u533a\u6ea2\u51fa\uff08\u8bbf\u95ee\u7684\u533a\u57df\u662f\u5168\u5c40\u53d8\u91cf, \u4e14\u8d85\u8fc7\u4e86\u5206\u914d\u7ed9\u5b83\u7684\u7a7a\u95f4\uff09\u3002<\/li>\n<li><strong>Use after return\uff1a<\/strong>Return\u540e\u4f7f\u7528\uff08\u51fd\u6570\u5728\u6808\u4e0a\u7684\u5c40\u90e8\u53d8\u91cf\u5728\u51fd\u6570\u8fd4\u56de\u540e\u88ab\u4f7f\u7528\u9ed8\u8ba4\u4e0d\u5f00\u542f\uff09\u3002<\/li>\n<li><strong>Use after scope\uff1a<\/strong>\u5728\u4f5c\u7528\u57df\u5916\u4f7f\u7528\uff08\u5c40\u90e8\u53d8\u91cf\u79bb\u5f00\u4f5c\u7528\u57df\u4ee5\u540e\u7ee7\u7eed\u4f7f\u7528\uff09\u3002<\/li>\n<li><strong>Initialization order bugs\uff1a<\/strong>\u521d\u59cb\u5316\u987a\u5e8f\u9519\u8bef\uff08\u68c0\u67e5\u5168\u5c40\u53d8\u91cf\u6216\u9759\u6001\u53d8\u91cf\u521d\u59cb\u5316\u7684\u65f6\u5019\u6709\u6ca1\u6709\u5229\u7528\u672a\u521d\u59cb\u5316\u7684\u53d8\u91cf\uff0c\u9ed8\u8ba4\u4e0d\u5f00\u542f\uff09\u3002<\/li>\n<li><strong>Memory leaks\uff1a<\/strong>\u5185\u5b58\u6cc4\u6f0f\uff08\u672a\u91ca\u653e\u5806\u4e0a\u5206\u914d\u7684\u5185\u5b58\uff09\u3002<\/li>\n<\/ul>\n<p>\u636e\u8c37\u6b4c\u7684\u5de5\u7a0b\u5e08\u4ecb\u7ecd \uff0cASan \u5df2\u5728 chromium \u9879\u76ee\u4e0a\u68c0\u6d4b\u51fa\u4e86300\u591a\u4e2a\u6f5c\u5728\u7684\u672a\u77e5bug\uff0c\u800c\u4e14\u5728\u4f7f\u7528 ASan \u4f5c\u4e3a\u5185\u5b58\u9519\u8bef\u68c0\u6d4b\u5de5\u5177\u5bf9\u7a0b\u5e8f\u6027\u80fd\u635f\u8017\u4e5f\u662f\u53ca\u5176\u53ef\u89c2\u7684\u3002\u6839\u636e\u68c0\u6d4b\u7ed3\u679c\u663e\u793a\u53ef\u80fd\u5bfc\u81f4\u6027\u80fd\u964d\u4f4e2\u500d\u5de6\u53f3\uff0c\u6bd4Valgrind\uff08\u5b98\u65b9\u7ed9\u7684\u6570\u636e\u5927\u6982\u662f\u964d\u4f4e10-50\u500d\uff09\u5feb\u4e86\u4e00\u4e2a\u6570\u91cf\u7ea7\u3002\u800c\u4e14\u76f8\u6bd4\u4e8eValgrind\u53ea\u80fd\u68c0\u67e5\u5230\u5806\u5185\u5b58\u7684\u8d8a\u754c\u8bbf\u95ee\u548c\u60ac\u7a7a\u6307\u9488\u7684\u8bbf\u95ee\uff0cASan \u4e0d\u4ec5\u53ef\u4ee5\u68c0\u6d4b\u5230\u5806\u5185\u5b58\u7684\u8d8a\u754c\u548c\u60ac\u7a7a\u6307\u9488\u7684\u8bbf\u95ee\uff0c\u8fd8\u80fd\u68c0\u6d4b\u5230\u6808\u548c\u5168\u5c40\u5bf9\u8c61\u7684\u8d8a\u754c\u8bbf\u95ee\u3002\u8fd9\u4e5f\u662f ASan \u5728\u4f17\u591a\u5185\u5b58\u68c0\u6d4b\u5de5\u5177\u7684\u6bd4\u8f83\u4e0a\u51fa\u7c7b\u62d4\u8403\u7684\u91cd\u8981\u539f\u56e0\uff0c\u57fa\u672c\u4e0a\u73b0\u5728 C\/C++ \u9879\u76ee\u90fd\u4f1a\u4f7f\u7528ASan\u6765\u4fdd\u8bc1\u4ea7\u54c1\u8d28\u91cf\uff0c\u5c24\u5176\u662f\u5927\u9879\u76ee\u4e2d\u66f4\u4e3a\u9700\u8981\u3002<\/p>\n<p>\u4ecegcc 4.8\u5f00\u59cb\uff0cAddressSanitizer\u6210\u4e3agcc\u7684\u4e00\u90e8\u5206\uff0c\u4f46\u8fd8\u4e0d\u5b8c\u5584\u3002\u8981\u83b7\u5f97\u66f4\u597d\u7684\u4f53\u9a8c\uff0c\u5efa\u8bae\u4f7f\u75284.9\u53ca\u4ee5\u4e0a\u7248\u672c\u3002<\/p>\n<h4>4\u3001AddressSanitizer\u68c0\u6d4b\u539f\u7406<\/h4>\n<p>ASan\u63a5\u7ba1\u4e86\u6bcf\u6b21\u5185\u5b58\u5206\u914d\/\u91ca\u653e\uff0c\u5e76\u4e14\u6bcf\u4e00\u6b21\u5bf9\u5185\u5b58\u7684\u8bfb\/\u5199\u90fd\u52a0\u4e0a\u4e86\u4e00\u4e2a\u68c0\u67e5 (\u9700\u8981\u7f16\u8bd1\u5668\u7684\u914d\u5408)\u3002<\/p>\n<p><strong>\u7b97\u6cd5\u601d\u8def<\/strong>\uff1a\u5982\u679c\u60f3\u9632\u4f4fBuffer Overflow\u6f0f\u6d1e\uff0c\u53ea\u9700\u8981\u5728\u6bcf\u5757\u5185\u5b58\u533a\u57df\u53f3\u7aef\uff08\u6216\u4e24\u7aef\uff0c\u80fd\u9632overflow\u548cunderflow\uff09\u52a0\u4e00\u5757\u533a\u57df\uff08RedZone\uff09\uff0c\u4f7fRedZone\u7684\u533a\u57df\u7684\u5f71\u5b50\u5185\u5b58\uff08Shadow Memory)\u8bbe\u7f6e\u4e3a\u4e0d\u53ef\u5199\u5373\u53ef\u3002<\/p>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory.png\"><img loading=\"lazy\" class=\"alignnone size-large wp-image-7235\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory-1024x610.png\" alt=\"\" width=\"625\" height=\"372\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory-1024x610.png 1024w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory-300x179.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory-768x458.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory-624x372.png 624w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-shadow-memory.png 1311w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/a><\/p>\n<p id=\"h_512578904_8\">\u9632\u62a4\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u57fa\u672c\u6b65\u9aa4\uff1a<\/p>\n<ul>\n<li data-pid=\"8YCGcbqe\">\u5728\u88ab\u4fdd\u62a4\u7684\u5168\u5c40\u53d8\u91cf\u3001\u5806\u3001\u6808\u524d\u540e\u521b\u5efa redzone\uff0c\u5e76\u5c06 redzone \u6807\u8bb0\u4e3a\u4e2d\u6bd2\u72b6\u6001\u3002<\/li>\n<li data-pid=\"vvWyIzyV\">\u5c06\u7f13\u51b2\u533a\u548c redzone \u6bcf 8 \u5b57\u8282\u5bf9\u5e94 1 \u5b57\u8282\u7684\u6620\u5c04\u65b9\u5f0f\u5efa\u7acb\u5f71\u5b50\u5185\u5b58\u533a\uff08\u5f71\u5b50\u5185\u5b58\u533a\u4f7f\u7528\u51fd\u6570 MemToShadow \u83b7\u53d6\uff09\u3002<\/li>\n<li data-pid=\"zbMJvHIw\">\u51fa\u73b0\u5bf9 redzone \u7684\u8bbf\u95ee\uff08\u8bfb\u5199\u6267\u884c\uff09\u884c\u4e3a\u65f6\uff0c\u7531\u4e8e redzone \u5bf9\u5e94\u7684\u5f71\u5b50\u5185\u5b58\u533a\u88ab\u6807\u8bb0\u4e3a\u4e2d\u6bd2\u72b6\u6001\u89e6\u53d1\u62a5\u9519\u3002<\/li>\n<li data-pid=\"qPdqc1cV\">\u62a5\u9519\u4fe1\u606f\u5305\u542b\u53d1\u751f\u9519\u8bef\u7684\u8fdb\u7a0b\u53f7\u3001\u9519\u8bef\u7c7b\u578b\u3001\u51fa\u9519\u7684\u6e90\u6587\u4ef6\u540d\u3001\u884c\u53f7\u3001\u51fd\u6570\u8c03\u7528\u5173\u7cfb\u3001\u5f71\u5b50\u5185\u5b58\u72b6\u6001\u3002\u5176\u4e2d\u5f71\u5b50\u5185\u5b58\u72b6\u6001\u4fe1\u606f\u4e2d\u51fa\u9519\u7684\u90e8\u5206\u7528\u4e2d\u62ec\u53f7\u6807\u8bc6\u51fa\u6765\u3002<\/li>\n<li data-pid=\"SFHBCo4f\">\u4e2d\u6bd2\u72b6\u6001\uff1a\u5185\u5b58\u5bf9\u5e94\u7684 shadow \u533a\u6807\u8bb0\u8be5\u5185\u5b58\u4e0d\u80fd\u8bbf\u95ee\u7684\u72b6\u6001\u3002<\/li>\n<\/ul>\n<p><img loading=\"lazy\" class=\"aligncenter wp-image-7228\" title=\"asan\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan.png\" sizes=\"(max-width: 541px) 100vw, 541px\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan.png 541w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/asan-300x17.png 300w\" alt=\"\" width=\"541\" height=\"31\" \/><\/p>\n<p>ASan\u4e3b\u8981\u5305\u62ec\u4e24\u90e8\u5206\uff1a\u63d2\u6869(Instrumentation)\u548c\u52a8\u6001\u8fd0\u884c\u5e93(Run-time library)\u3002<\/p>\n<ul>\n<li><strong>\u63d2\u6869\uff1a<\/strong>\u4e3b\u8981\u662f\u9488\u5bf9\u5728llvm\u7f16\u8bd1\u5668\u7ea7\u522b\u5bf9\u8bbf\u95ee\u5185\u5b58\u7684\u64cd\u4f5c(store\uff0cload\uff0calloca\u7b49)\uff0c\u5c06\u5b83\u4eec\u8fdb\u884c\u5904\u7406\u3002\u4e3a\u4e86\u9632\u6b62buffer overflow\uff0c\u9700\u8981\u5c06\u539f\u6765\u5206\u914d\u7684\u5185\u5b58\u4e24\u8fb9\u5206\u914d\u989d\u5916\u7684\u5185\u5b58Redzone\uff0c\u5e76\u5c06\u8fd9\u4e24\u8fb9\u7684\u5185\u5b58\u52a0\u9501\uff0c\u8bbe\u4e3a\u4e0d\u80fd\u8bbf\u95ee\u72b6\u6001(\u4e2d\u6bd2\u72b6\u6001)\u3002<\/li>\n<li><strong>\u52a8\u6001\u8fd0\u884c\u5e93\uff1a<\/strong>\u4e3b\u8981\u63d0\u4f9b\u4e00\u4e9b\u8fd0\u884c\u65f6\u7684\u590d\u6742\u7684\u529f\u80fd(\u6bd4\u5982poison\/unpoison shadow memory)\u4ee5\u53ca\u5c06malloc,free\u7b49\u7cfb\u7edf\u8c03\u7528\u51fd\u6570hook\u4f4f\u3002\u5728\u4f7f\u7528\u51fd\u6570 free \u91ca\u653e\u5185\u5b58\u65f6\uff0c\u6240\u91ca\u653e\u7684\u5185\u5b58\u88ab\u9694\u79bb\u5f00\u6765\uff08\u6682\u65f6\u4e0d\u4f1a\u88ab\u5206\u914d\u51fa\u53bb\uff09\uff0c\u5e76\u88ab\u6807\u8bb0\u4e3a\u4e0eRedZone\u76f8\u540c\u7684\u4e2d\u6bd2\u72b6\u6001\uff0c\u4e2d\u6bd2\u7684\u5185\u5b58\u4e00\u65e6\u88ab\u8bbf\u95ee\uff0c\u5373\u53ef\u88ab\u68c0\u6d4b\u5230\u3002ASan \u4f7f\u7528 shadow memory \u8ddf\u8e2a\u54ea\u4e9b\u5b57\u8282\u4e3a\u6b63\u5e38\u5185\u5b58\uff0c\u54ea\u4e9b\u5b57\u8282\u4e3a\u4e2d\u6bd2\u5185\u5b58\u3002\u5b57\u8282\u53ef\u4ee5\u6807\u8bb0\u4e3a\u5b8c\u5168\u6b63\u5e38\uff08shadow memory \u503c\u4e3a 0\uff09\u3001\u5b8c\u5168\u4e2d\u6bd2\uff08shadow memory \u503c\u4e3a\u8d1f\u503c\uff09\u6216\u524d\u9762 k \u4e2a\u5b57\u8282\u672a\u4e2d\u6bd2\uff08shadow memory \u503c\u4e3a k\uff09\u3002\u5982\u679c shadow memory \u663e\u793a\u67d0\u4e2a\u5b57\u8282\u4e2d\u6bd2\uff0c\u5219 ASan \u4f1a\u4f7f\u7a0b\u5e8f\u5d29\u6e83\uff0c\u5e76\u8f93\u51fa\u6709\u7528\u7684\u8c03\u8bd5\u4fe1\u606f\uff0c\u5305\u62ec\u8c03\u7528\u5806\u6808\u3001\u5f71\u5b50\u5185\u5b58\u6620\u5c04\u3001\u5185\u5b58\u8fdd\u4f8b\u7c7b\u578b\u3001\u8bfb\u53d6\u6216\u5199\u5165\u7684\u5185\u5bb9\u3001\u5bfc\u81f4\u8fdd\u4f8b\u7684\u8ba1\u7b97\u673a\u4ee5\u53ca\u5185\u5b58\u5185\u5bb9\u3002<\/li>\n<\/ul>\n<p>\u63d2\u6869\u793a\u4f8b\uff1a<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">\/\/ \u539f\u59cb\u4ee3\u7801\uff1a\r\nvoid foo() {\r\n  char a[8];\r\n  ...\r\n  return;\r\n}\r\n\r\n\/\/ \u63d2\u6869\u540e\u7684\u68c0\u6d4b\u4ee3\u7801\uff1a\r\nvoid foo() {\r\n  char redzone1[32];  \/\/ 32-byte aligned\r\n  char a[8];          \/\/ 32-byte aligned\r\n  char redzone2[24];\r\n  char redzone3[32];  \/\/ 32-byte aligned\r\n  int  *shadow_base = MemToShadow(redzone1);\r\n  shadow_base[0] = 0xffffffff;  \/\/ poison redzone1\r\n  shadow_base[1] = 0xffffff00;  \/\/ poison redzone2, unpoison 'a'\r\n  shadow_base[2] = 0xffffffff;  \/\/ poison redzone3\r\n  ...\r\n  shadow_base[0] = shadow_base[1] = shadow_base[2] = 0; \/\/ unpoison all\r\n  return;\r\n}<\/code><\/pre>\n<p>\u4ece\u4ee5\u4e0a\u793a\u4f8b\u4e2d\u53ef\u4ee5\u770b\u5230ASan\u5c06malloc\/free\u51fd\u6570\u8fdb\u884c\u4e86\u66ff\u6362\uff0c\u5728malloc\u51fd\u6570\u4e2d\u989d\u5916\u7684\u5206\u914d\u4e86Redzone\u533a\u57df\u7684\u5185\u5b58\uff0c\u5c06\u4e0eRedzone\u533a\u57df\u5bf9\u5e94\u7684\u5f71\u5b50\u5185\u5b58\u52a0\u9501\uff0c\u4e3b\u8981\u7684\u5185\u5b58\u533a\u57df\u5bf9\u5e94\u7684\u5f71\u5b50\u5185\u5b58\u4e0d\u52a0\u9501\u3002free\u51fd\u6570\u5c06\u6240\u6709\u5206\u914d\u7684\u5185\u5b58\u533a\u57df\u52a0\u9501\uff0c\u5e76\u653e\u5230\u4e86\u9694\u79bb\u533a\u57df\u7684\u961f\u5217\u4e2d(\u4fdd\u8bc1\u5728\u4e00\u5b9a\u7684\u65f6\u95f4\u5185\u4e0d\u4f1a\u518d\u88abmalloc\u51fd\u6570\u5206\u914d)\uff0c\u53ef\u68c0\u6d4bUse after free\u7c7b\u7684\u95ee\u9898\u3002<\/p>\n<p>&nbsp;<\/p>\n<h1>\u4e8c\u3001\u4f7f\u7528<\/h1>\n<h4>1\u3001\u7528\u6cd5<\/h4>\n<h6>1.1\u3001\u542f\u7528AddressSanitizer<\/h6>\n<p>\u7528-fsanitize=address\u9009\u9879\u7f16\u8bd1\u548c\u94fe\u63a5\u4f60\u7684\u7a0b\u5e8f\uff0c\u7528-fno-omit-frame-pointer\u7f16\u8bd1\uff0c\u4ee5\u5f97\u5230\u66f4\u5bb9\u6613\u7406\u89e3stack trace\uff1a<\/p>\n<pre class=\"line-numbers language-cpp\"><code class=\" language-cpp\">gcc -Werror<code class=\"\">-rdynamic<\/code><span class=\"token operator\">-<\/span>fsanitize<span class=\"token operator\">=<\/span>address <span class=\"token operator\">-<\/span>fno<span class=\"token operator\">-<\/span>omit<span class=\"token operator\">-<\/span>frame<span class=\"token operator\">-<\/span>pointer <span class=\"token operator\">-<\/span>g test<span class=\"token punctuation\">.<\/span>cc <span class=\"token operator\">-<\/span>o test<\/code><\/pre>\n<p>\u6216\u5728CMakeLists.txt\u4e2d\u914d\u7f6e\uff1a<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">set(CMAKE_CXX_FLAGS \"${CMAKE_CXX_FLAGS} -Werror -rdynamic -fsanitize=address -fno-omit-frame-pointer -g\")<\/code><\/pre>\n<h6>1.2\u3001export\u7f16\u8bd1\u9009\u9879<\/h6>\n<p>ASAN_OPTIONS\u662fAddress-Sanitizier\u7684\u8fd0\u884c\u9009\u9879\u73af\u5883\u53d8\u91cf\uff0c\u53ef\u4ee5\u6839\u636e\u9700\u8981\u9009\u62e9\u6027\u8bbe\u7f6e\uff1a<\/p>\n<ul>\n<li>halt_on_error=0\uff1a\u68c0\u6d4b\u5185\u5b58\u9519\u8bef\u540e\u7ee7\u7eed\u8fd0\u884c<\/li>\n<li>detect_leaks=1:\u4f7f\u80fd\u5185\u5b58\u6cc4\u9732\u68c0\u6d4b<\/li>\n<li>malloc_context_size=15\uff1a\u5185\u5b58\u9519\u8bef\u53d1\u751f\u65f6\uff0c\u663e\u793a\u7684\u8c03\u7528\u6808\u5c42\u6570\u4e3a15<\/li>\n<li>log_path=\/home\/xos\/asan.log:\u5185\u5b58\u68c0\u67e5\u95ee\u9898\u65e5\u5fd7\u5b58\u653e\u6587\u4ef6\u8def\u5f84<\/li>\n<li>suppressions=$SUPP_FILE:\u5c4f\u853d\u6253\u5370\u67d0\u4e9b\u5185\u5b58\u9519\u8bef<\/li>\n<li>detect_stack_use_after_return=1\uff1a\u68c0\u67e5\u8bbf\u95ee\u6307\u5411\u5df2\u88ab\u91ca\u653e\u7684\u6808\u7a7a\u95f4<\/li>\n<li>handle_segv=1\uff1a\u5904\u7406\u6bb5\u9519\u8bef\uff1b\u4e5f\u53ef\u4ee5\u6dfb\u52a0handle_sigill=1\u5904\u7406SIGILL\u4fe1\u53f7<\/li>\n<li>quarantine_size=4194304:\u5185\u5b58cache\u53ef\u7f13\u5b58free\u5185\u5b58\u5927\u5c0f4M<\/li>\n<\/ul>\n<p>\u4f8b\u5982\uff1a<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">export ASAN_OPTIONS=halt_on_error=0:detect_leaks=1:malloc_context_size=15:log_path=.\/asan.log<\/code><\/pre>\n<p>&nbsp;<\/p>\n<h4>2\u3001\u573a\u666f\u6d4b\u8bd5<\/h4>\n<h6>2.1\u3001 (heap) use after free \u91ca\u653e\u540e\u4f7f\u7528<\/h6>\n<p>\u4e0b\u9762\u7684\u4ee3\u7801\u4e2d\uff0c\u5206\u914darray\u6570\u7ec4\u5e76\u91ca\u653e\uff0c\u7136\u540e\u8fd4\u56de\u5b83\u7684\u4e00\u4e2a\u5143\u7d20\u3002<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">$ vim test_mem.cc\r\n1 \/**\r\n2  * @file\ttest_mem.cc\r\n3  * @brief   mem\u95ee\u9898asan\u68c0\u6d4b\u6d4b\u8bd5\r\n4  * @author\tyanjingang\r\n5  * @date\t2023-3-13\r\n6  * @note    g++ test_mem.cc -std=c++11  -Wall  -Werror -rdynamic -fsanitize=address -fno-omit-frame-pointer -g -o build\/test_mem\r\n7  *\/\r\n8 \r\n9 \r\n10 \/\/ \u5806\u4e0a\u5206\u914d\u7684\u7a7a\u95f4\u88abfree\u4e4b\u540e\u518d\u6b21\u4f7f\u7528\r\n11 int use_after_free(){\r\n12    int *array = new int[100];\r\n13    delete[] array;\r\n14    return array[1];\r\n15 }\r\n16 \r\n17 int main(int argc, char **argv){\r\n18     use_after_free();\r\n19 }\r\n\r\n\r\n\/\/ build\r\n$ g++ test_mem.cc -std=c++11  -Wall  -Werror -rdynamic -fsanitize=address -fno-omit-frame-pointer -g -o build\/test_mem\r\n\r\n\/\/ test\r\n$ .\/build\/test_mem<\/code><\/pre>\n<p>\u4ece\u4e0b\u56fe\u63d0\u793a\u7684\u9519\u8bef\u4fe1\u606f\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u975e\u5e38\u660e\u786e\u7684\u770b\u5230\u5185\u5b58\u5f02\u5e38\u8bbf\u95ee\u4fe1\u606f\uff1a<\/p>\n<ul>\n<li><strong>ERROR\uff1a<\/strong>\u5f02\u5e38\u7c7b\u578b\u4e3aheap-use-after-free\u5806\u5185\u5b58\u91ca\u653e\u540e\u88ab\u4f7f\u7528\u3002<\/li>\n<li><strong>READ\uff1a<\/strong>\u5f02\u5e38\u64cd\u4f5c\u7c7b\u578b\u4e3a\u8bfb\uff0c\u5728T0\u7ebf\u7a0b\uff0c\u4f4d\u7f6e\u5728test_mem.cc:14\u884c\u3002<\/li>\n<li><strong>freed\uff1a<\/strong>\u5185\u5b58\u91ca\u653e\u4f4d\u7f6e\u5728test_mem.cc:13\u884c\u3002<\/li>\n<li><strong>previously allocated\uff1a<\/strong>\u5185\u5b58\u5206\u914d\u4f4d\u7f6e\u5728test_mem.cc:12\u884c\u3002<\/li>\n<li><strong>fa\/fd\uff1a<\/strong>\u6700\u4e0b\u65b9\u7684\u5806\u5185\u5b58\u4e2d\uff0cfa\u8868\u793aRedzone\u9632\u62a4\u7f13\u51b2\u533a\uff0cfd\u8868\u793a\u5df2\u88abfree\u91ca\u653e\u7684\u5806\u5185\u5b58\u533a\u57df\u3002<\/li>\n<\/ul>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free.png\"><img loading=\"lazy\" class=\"alignnone size-large wp-image-7248\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free-1024x737.png\" alt=\"\" width=\"625\" height=\"450\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free-1024x737.png 1024w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free-300x216.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free-768x552.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free-624x449.png 624w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/use-after-free.png 1236w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/a><\/p>\n<h6>2.2\u3001 heap buffer overflow \u5806\u7f13\u5b58\u8bbf\u95ee\u6ea2\u51fa<\/h6>\n<p>\u5982\u4e0b\u4ee3\u7801\u4e2d\uff0c\u8bbf\u95ee\u7684\u4f4d\u7f6e\u8d85\u51fa\u5806\u4e0a\u6570\u7ec4array\u7684\u8fb9\u754c\u3002<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">17  \/\/ \u5806\u7f13\u51b2\u533a\u6ea2\u51fa\r\n18  int heap_buffer_overflow(){\r\n19     int* array = new int[100];\r\n20     int res = array[100];\r\n21     delete [] array;\r\n22     return res;\r\n23 }\r\n...\r\n28 heap_buffer_overflow();<\/code><\/pre>\n<p>\u4e0b\u56fe\u63d0\u793a\u7684\u9519\u8bef\u4fe1\u606f\u6307\u51fa\uff1a<\/p>\n<ul>\n<li><strong>ERROR\uff1a<\/strong>\u5f02\u5e38\u7c7b\u578b\u4e3aheap-buffer-overflow\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u3002<\/li>\n<li><strong>READ\uff1a<\/strong>\u5f02\u5e38\u64cd\u4f5c\u7c7b\u578b\u4e3a\u8bfb\uff0c\u5728T0\u7ebf\u7a0b\uff0c\u4f4d\u7f6e\u5728test_mem.cc:20\u884c\u3002<\/li>\n<li><strong>allocated\uff1a<\/strong>\u5185\u5b58\u5206\u914d\u4f4d\u7f6e\u5728test_mem.cc:19\u884c\u3002<\/li>\n<li><strong>fa\uff1a<\/strong>\u6700\u4e0b\u65b9\u7684\u5806\u5185\u5b58\u4e2d\uff0cfa\u8868\u793aRedzone\u9632\u62a4\u7f13\u51b2\u6bd2\u533a\uff0c\u88ab\u5f02\u5e38\u8bbf\u95ee\u3002<\/li>\n<\/ul>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow.png\"><img loading=\"lazy\" class=\"alignnone size-large wp-image-7253\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow-1024x598.png\" alt=\"\" width=\"625\" height=\"365\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow-1024x598.png 1024w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow-300x175.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow-768x448.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow-624x364.png 624w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/heap-buffer-overflow.png 1264w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/a><\/p>\n<h6>2.3\u3001 stack buffer overflow \u6808\u7f13\u5b58\u8bbf\u95ee\u6ea2\u51fa<\/h6>\n<p>\u5982\u4e0b\u4ee3\u7801\u4e2d\uff0c\u8bbf\u95ee\u7684\u4f4d\u7f6e\u8d85\u51fa\u6808\u4e0a\u6570\u7ec4array\u7684\u8fb9\u754c\u3002<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">24 \/\/ \u6808\u7f13\u51b2\u533a\u6ea2\u51fa\r\n25 int stack_buffer_overflow(){\r\n26     int array[100];\r\n27     return array[100];\r\n28 }\r\n...\r\n35 stack_buffer_overflow();<\/code><\/pre>\n<p>\u4e0b\u56fe\u63d0\u793a\u7684\u9519\u8bef\u4fe1\u606f\u6307\u51fa\uff1a<\/p>\n<ul>\n<li><strong>ERROR\uff1a<\/strong>\u5f02\u5e38\u7c7b\u578b\u4e3astack-buffer-overflow\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u3002<\/li>\n<li><strong>READ\uff1a<\/strong>\u5f02\u5e38\u64cd\u4f5c\u7c7b\u578b\u4e3a\u8bfb\uff0c\u5728T0\u7ebf\u7a0b\uff0c\u4f4d\u7f6e\u5728test_mem.cc:27\u884c\u3002<\/li>\n<li><strong>Address\uff1a<\/strong>\u6808\u5757\u5728\u7ebf\u7a0bT0\u7684\u6808\u4e0a448\u504f\u79fb\u4f4d\u7f6e\u4e0a\uff0cMemory access at offset 448 overflows this variable\u3002<\/li>\n<li><strong>f1\/f3\uff1a<\/strong>f1\u4e3aStack Left Redzone\u9632\u62a4\u7f13\u51b2\u6bd2\u533a\uff0cf3\u4e3aStack Right Redzone\u9632\u62a4\u7f13\u51b2\u6bd2\u533a\uff0c\u8fd9\u91cc\u88ab\u5f02\u5e38\u8bbf\u95ee\u3002<\/li>\n<\/ul>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow.png\"><img loading=\"lazy\" class=\"alignnone size-large wp-image-7254\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow-1024x598.png\" alt=\"\" width=\"625\" height=\"365\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow-1024x598.png 1024w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow-300x175.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow-768x448.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow-624x364.png 624w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/stack-buffer-overflow.png 1264w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/a><\/p>\n<h6>2.4\u3001 global buffer overflow \u5168\u5c40\u7f13\u51b2\u8bbf\u95ee\u6ea2\u51fa<\/h6>\n<p>\u5982\u4e0b\u4ee3\u7801\u4e2d\uff0c\u8bbf\u95ee\u7684\u4f4d\u7f6e\u8d85\u51fa\u5168\u5c40\u6570\u7ec4array\u7684\u8fb9\u754c\u3002<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">29 \/\/ \u5168\u5c40\u7f13\u51b2\u533a\u6ea2\u51fa\r\n30 int array[100];\r\n31 int global_buffer_overflow(){\r\n32     return array[100];\r\n33 }\r\n...\r\n40 global_buffer_overflow();<\/code><\/pre>\n<p>\u4e0b\u56fe\u63d0\u793a\u7684\u4fe1\u606f\u6307\u51fa\uff1a<\/p>\n<ul>\n<li><strong>ERROR\uff1a<\/strong>\u5f02\u5e38\u7c7b\u578b\u4e3aglobal-buffer-overflow\u5168\u5c40\u7f13\u51b2\u533a\u6ea2\u51fa\u3002<\/li>\n<li><strong>READ\uff1a<\/strong>\u5f02\u5e38\u64cd\u4f5c\u7c7b\u578b\u4e3a\u8bfb\uff0c\u5728T0\u7ebf\u7a0b\uff0c\u4f4d\u7f6e\u5728test_mem.cc:32\u884c\u3002<\/li>\n<li><strong>global variable\uff1a<\/strong>\u5168\u5c40\u7f13\u5b58\u5757\u5728test_mem.cc:30\u884c\u5b9a\u4e49\u3002<\/li>\n<li><strong>f9\uff1a<\/strong>f9\u4e3aGlobal Redzone\u9632\u62a4\u7f13\u51b2\u6bd2\u533a\uff0c\u8fd9\u91cc\u88ab\u5f02\u5e38\u8bbf\u95ee\u3002<\/li>\n<\/ul>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow.png\"><img loading=\"lazy\" class=\"alignnone size-large wp-image-7255\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow-1024x500.png\" alt=\"\" width=\"625\" height=\"305\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow-1024x500.png 1024w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow-300x146.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow-768x375.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow-624x304.png 624w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/global-buffer-overflow.png 1273w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/a><\/p>\n<h6>2.5\u3001 memory leaks \u5185\u5b58\u6cc4\u9732<\/h6>\n<p>\u68c0\u6d4b\u5185\u5b58\u7684LeakSanitizer\u662f\u96c6\u6210\u5728AddressSanitizer\u4e2d\u7684\u4e00\u4e2a\u76f8\u5bf9\u72ec\u7acb\u7684\u5de5\u5177\uff0c\u5b83\u5de5\u4f5c\u5728\u68c0\u67e5\u8fc7\u7a0b\u7684\u6700\u540e\u9636\u6bb5\u3002\u4e0b\u9762\u4ee3\u7801\u4e2d\uff0cp\u6307\u5411\u7684\u5185\u5b58\u6ca1\u6709\u91ca\u653e\u3002<\/p>\n<pre class=\"pure-highlightjs\"><code class=\"\">34 \/\/ \u5185\u5b58\u6cc4\u6f0f\r\n35 void* p;    \/\/ p\u6307\u5411\u7684\u5185\u5b58\u6ca1\u6709\u91ca\u653e\r\n36 int memory_leaks(){\r\n37     p = malloc(7);\r\n38     p = 0;\r\n39     return 0;\r\n40 }\r\n...\r\n49 memory_leaks();<\/code><\/pre>\n<p>\u4e0b\u56fe\u7684\u9519\u8bef\u4fe1\u606f\u6307\u51fa\uff1a<\/p>\n<ul>\n<li>\u5f02\u5e38\u7c7b\u578b\u4e3amemory leaks\u5185\u5b58\u6cc4\u6f0f\u3002<\/li>\n<li>\u7f13\u5b58\u5757\u5728test_mem.cc:37\u884c\u5b9a\u4e49\uff0c\u4f46\u672a\u91ca\u653e\u3002<\/li>\n<\/ul>\n<p><a href=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-7256\" src=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks.png\" alt=\"\" width=\"976\" height=\"239\" srcset=\"https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks.png 976w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks-300x73.png 300w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks-768x188.png 768w, https:\/\/yanjingang.com\/blog\/wp-content\/uploads\/2023\/03\/memory-leaks-624x153.png 624w\" sizes=\"(max-width: 976px) 100vw, 976px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h1>\u4e09\u3001\u5176\u4ed6<\/h1>\n<p>ASan\u4e5f\u4e0d\u662f\u4e07\u80fd\u7684\uff0c\u5b83\u5728\u6253\u5f00\u7684\u60c5\u51b5\u4e0b\u5bf9\u8fd0\u884c\u6027\u80fd\u6709\u660e\u663e\u5f71\u54cd\uff0c\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u4e5f\u4f1a\u51fa\u73b0\u8bef\u62a5\uff0c\u5728\u5b9e\u9645\u7684\u4f7f\u7528\u8fc7\u7a0b\u4e2d\u53ef\u4ee5\u4f5c\u4e3a\u4e00\u4e2a\u6d4b\u8bd5\u6d41\u6c34\u7ebf\u73af\u8282\u8fdb\u884c\u68c0\u6d4b\uff0c\u4ee5\u63d0\u9ad8\u7cfb\u7edf\u7684\u7a33\u5b9a\u6027\u3002<\/p>\n<h4>1\u3001\u5185\u5b58\u6cc4\u6f0f\u8bef\u62a5\u573a\u666f<\/h4>\n<ul>\n<li data-pid=\"-YfQbZxS\">\u7ed3\u6784\u4f53\u975e 4 \u5b57\u8282\u5bf9\u9f50\uff1a\u62a5\u9519\u63d0\u793a\u7ed3\u6784\u4f53 A \u5185\u5b58\u6cc4\u6f0f\uff0cA \u5185\u5b58\u7684\u6307\u9488\u5b58\u653e\u5728\u7ed3\u6784\u4f53 B \u4e2d\uff0cA \u5185\u5b58\u6307\u9488\u5728\u7ed3\u6784\u4f53 B \u4e2d\u7684\u504f\u79fb\u91cf\u975e 4 \u7684\u6574\u6570\u500d\uff0c\u7531\u4e8e ASan \u626b\u63cf\u5185\u5b58\u65f6\u662f\u6309\u7167 4 \u5b57\u8282\u504f\u79fb\u8fdb\u884c\uff0c\u4ece\u800c\u626b\u63cf\u4e0d\u5230 A \u5185\u5b58\u6307\u9488\u5bfc\u81f4\u8bef\u62a5\u3002\u89e3\u51b3\u65b9\u6cd5\uff1a\u5bf9\u975e4\u5b57\u8282\u5bf9\u9f50\u7684\u7ed3\u6784\u4f53\u8fdb\u884c\u6574\u6539\u3002<\/li>\n<li data-pid=\"m0dKKEvN\">\u4fe1\u53f7\u6808\u5185\u5b58\uff1a\u8be5\u5185\u5b58\u662f\u5728\u4fe1\u53f7\u5904\u7406\u51fd\u6570\u6267\u884c\u65f6\u505a\u6808\u5185\u5b58\u7528\u7684\uff0c\u5176\u6307\u9488\u4f1a\u4fdd\u5b58\u5728\u5185\u6838\u4e2d\uff0c\u6240\u4ee5\u5728\u7528\u6237\u6001\u7684 ASan \u626b\u63cf\u4e0d\u5230\uff0c\u4ea7\u751f\u8bef\u62a5\uff1b<\/li>\n<li data-pid=\"HElUeSLV\">\u5185\u5b58\u6307\u9488\u504f\u79fb\u540e\u4fdd\u5b58\uff1a<\/li>\n<li data-pid=\"PugTZUL0\">\u5b58\u5728ASan\u672a\u76d1\u63a7\u7684\u5185\u5b58\u63a5\u53e3\uff1a<\/li>\n<li data-pid=\"SiaOROuR\">\u8d8a\u754c\u592a\u79bb\u8c31\uff0c\u8d8a\u754c\u8bbf\u95ee\u7684\u5730\u5740\u4e0d\u5728 buffer \u7684 redzone \u5185\uff1a<\/li>\n<li data-pid=\"gIiYVlia\">\u5bf9\u4e8ememcpy\u7684dest\u548csrc\u662f\u5728\u540c\u4e00\u4e2amalloc\u7684\u5185\u5b58\u5757\u4e2d\u65f6\uff0c\u5185\u5b58\u91cd\u53e0\u7684\u60c5\u51b5\u65e0\u6cd5\u68c0\u6d4b\u5230\u3002<\/li>\n<li data-pid=\"4nRJYRqV\">ASan\u5bf9\u4e8eoverflow\u7684\u68c0\u6d4b\u4f9d\u8d56\u4e8e\u5b89\u5168\u533a\uff0c\u800c\u5b89\u5168\u533a\u603b\u5f52\u662f\u6709\u5927\u5c0f\u7684\u3002\u5b83\u53ef\u80fd\u662f64bytes\uff0c128bytes\u6216\u8005\u5176\u4ed6\u4ec0\u4e48\u503c\uff0c\u4f46\u4e0d\u7ba1\u600e\u4e48\u6837\u7ec8\u5f52\u662f\u6709\u9650\u7684\u3002\u5982\u679c\u67d0\u6b21\u8e29\u8e0f\u8de8\u8fc7\u4e86\u5b89\u5168\u533a\uff0c\u8e29\u8e0f\u5230\u53e6\u4e00\u7247\u53ef\u5bfb\u5740\u7684\u5185\u5b58\u533a\u57df\uff0cASan\u540c\u6837\u4e0d\u4f1a\u62a5\u9519\u3002\u8fd9\u662fASan\u7684\u53e6\u4e00\u79cd\u6f0f\u68c0\u3002<\/li>\n<li data-pid=\"atpkGA0V\">ASan\u5bf9\u4e8eUseAfterFree\u7684\u68c0\u6d4b\u4f9d\u8d56\u4e8e\u9694\u79bb\u533a\uff0c\u800c\u9694\u79bb\u65f6\u95f4\u662f\u975e\u6c38\u4e45\u7684\u3002\u4e5f\u5c31\u610f\u5473\u7740\u5df2\u7ecffree\u7684\u533a\u57df\u8fc7\u4e00\u6bb5\u65f6\u95f4\u540e\u53c8\u4f1a\u91cd\u65b0\u88ab\u5206\u914d\u7ed9\u5176\u4ed6\u4eba\u3002\u5f53\u5b83\u88ab\u91cd\u65b0\u5206\u914d\u7ed9\u5176\u4ed6\u4eba\u540e\uff0c\u539f\u5148\u7684\u6301\u6709\u8005\u518d\u6b21\u8bbf\u95ee\u6b64\u5757\u533a\u57df\u5c06\u4e0d\u4f1a\u62a5\u9519\u3002\u56e0\u4e3a\u8fd9\u4e00\u5757\u533a\u57df\u7684shadow memory\u4e0d\u518d\u662f0xfd\u3002\u6240\u4ee5\u8fd9\u7b97\u662fASan\u6f0f\u68c0\u7684\u4e00\u79cd\u60c5\u51b5\u3002<\/li>\n<\/ul>\n<h4>2\u3001\u5728\u9879\u76ee\u4e2d\u7684\u5e94\u7528\u6ce8\u610f\u4e8b\u9879<\/h4>\n<ul>\n<li data-pid=\"WDV6kexr\">\u9879\u76ee\u7684\u6784\u5efa\u65b9\u6848\u5e94\u5f53\u6709\u7f16\u8bd1\u9009\u9879\uff0c\u80fd\u968f\u65f6\u542f\u7528\/\u5173\u95edASan\u3002<\/li>\n<li data-pid=\"U4vLOoc7\">\u9879\u76ee\u9001\u6d4b\u9636\u6bb5\u53ef\u4ee5\u6253\u5f00ASan\uff0c\u4ee5\u5e2e\u52a9\u66b4\u9732\u66f4\u591a\u7684\u4f4e\u6982\u7387\u8be1\u5f02\u95ee\u9898\u3002<\/li>\n<li data-pid=\"WzlCxHpd\"><span style=\"color: #ff0000;\">\u8bf7\u52ff\u5728\u751f\u4ea7\u7248\u672c\u4e2d\u542f\u7528ASan<\/span>\uff0c\u5176\u4f1a<span style=\"color: #ff0000;\">\u964d\u4f4e\u7a0b\u5e8f\u8fd0\u884c\u901f\u5ea6<\/span>\u5927\u69822-5\u500d\uff0c\u5e76\u4f1a\u51fa\u73b0<span style=\"color: #ff0000;\">\u5185\u5b58\u6301\u7eed\u589e\u957f<\/span>\u73b0\u8c61\uff08\u5360\u7528\u7684RedZone\u5e76\u4e0d\u4f1a\u81ea\u52a8\u91ca\u653e\uff0c\u6240\u4ee5\u4f1a\u51fa\u73b0\u5185\u5b58\u6ea2\u51fa\u7684\u5047\u8c61\uff0c\u5173\u95edASan\u73b0\u8c61\u5373\u4f1a\u6d88\u5931\uff09\u3002<\/li>\n<li data-pid=\"soEo88Md\">\u5b9e\u9645\u5f00\u53d1\u6d4b\u8bd5\u8fc7\u7a0b\u4e2d\u901a\u8fc7ASan\u626b\u51fa\u7684\u5e38\u89c1\u95ee\u9898\u6709\uff1a\u591a\u7ebf\u7a0b\u4e0b\u4e34\u754c\u8d44\u6e90\u672a\u52a0\u4fdd\u62a4\u5bfc\u81f4\u540c\u65f6\u51fa\u73b0\u8bfb\u5199\u8bbf\u95ee\uff0c\u89e3\u51b3\u65b9\u6848\u4e00\u822c\u662f\u5bf9\u8be5\u8d44\u6e90\u6070\u5f53\u5730\u52a0\u9501\u5373\u53ef\uff1b\u5185\u5b58\u8d8a\u754c\uff0c\u5982\u7533\u8bf7\u4e86N\u5b57\u8282\u7684\u5185\u5b58\u5374\u5411\u5176\u5185\u5b58\u5730\u5740\u62f7\u8d1d\u5927\u4e8eN\u5b57\u8282\u7684\u6570\u636e\uff0c\u8fd9\u79cd\u60c5\u51b5\u5728\u6ca1\u6709\u5f00\u542fASan\u7684\u60c5\u51b5\u4e0b\u4e00\u822c\u90fd\u5f88\u96be\u53d1\u73b0\u3002<\/li>\n<li data-pid=\"3av0Aaer\">\u4e00\u4e9b\u663e\u800c\u6613\u89c1\u7684\u8bbf\u95ee\u65e0\u6548\u5185\u5b58\u64cd\u4f5c\u53ef\u80fd\u4f1a\u88ab\u7f16\u8bd1\u5668\u4f18\u5316\u800c\u4f1a\u6f0f\u62a5\u3002<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>yan 3.13<\/p>\n<p>\u53c2\u8003\uff1a<\/p>\n<p>https:\/\/github.com\/google\/sanitizers\/wiki\/AddressSanitizerAlgorithm<\/p>\n<p>https:\/\/blog.csdn.net\/u013171226\/article\/details\/126876335<\/p>\n<p>https:\/\/blog.csdn.net\/yuanbinquan\/article\/details\/106767635<\/p>\n<p>https:\/\/www.jianshu.com\/p\/3a2df9b7c353<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u81ea\u64cd\u4f5c\u7cfb\u7edf\u8bde\u751f\u4ee5\u6765\uff0c\u7f16\u5199\u5185\u5b58\u5b89\u5168\u7684\u4ee3\u7801\u4e00\u76f4\u662f\u4e00\u4e2a\u6bd4\u8f83\u56f0\u96be\u7684\u95ee\u9898 (\u53e6\u4e00\u4e2a\u95ee\u9898\u5219\u662f\u4fdd\u8bc1\u7ebf\u7a0b\u5b89\u5168)\u3002\u6765\u81ea\u5fae\u8f6f\u5b89\u5168\u54cd [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1264,1293],"tags":[],"_links":{"self":[{"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/7225"}],"collection":[{"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7225"}],"version-history":[{"count":4,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/7225\/revisions"}],"predecessor-version":[{"id":7631,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/7225\/revisions\/7631"}],"wp:attachment":[{"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yanjingang.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}