c/c++动态检测内存错误利器 - ASan(转)
https://www.extutorial.com/blog/391954html
c/c++动态检测内存错误利器 - ASan
由
Existence 提交于 周四, 04/15/2021 - 21:44
ASan，即Address Sanitizer，是一个适用于c/c++的动态内存错误检测器，它由一个编译器检测模块（LLVM pass）和一个替换malloc函数的运行时库组成，在性能及检测内存错误方面都优于Valgrind。node
1、适用平台
在LLVM3.1版以后，ASan就是其的一个组成部分，因此全部适用LLVM的平台，且llvm版本大于3.1的，均可以适用asan来检查c/c++内存错误。linux
对于gcc，则是4.8版本以后才加入asan，可是asan的完整功能则是要gcc版本在4.9.2以上。c++
2、强大功能
ASan做为编译器内置功能，支持检测各类内存错误：git
- 缓冲区溢出
①、堆内存溢出
②、栈上内存溢出
③、全局区缓存溢出 - 悬空指针（引用）
①、使用释放后的堆上内存
②、使用返回的栈上内存
③、使用退出做用域的变量 - 非法释放
①、重复释放
②、无效释放 - 内存泄漏
- 初始化顺序致使的问题
ASan和Valgrind对好比下图：github
3、如何使用
一、使用ASan时，只需gcc选项加上-fsanitize=address；sql
二、若是想要在使用asan的时候获取更好的性能，能够加上O1或者更高的编译优化选项；bootstrap
三、想要在错误信息中让栈追溯信息更友好，能够加上-fno-omit-frame-pointer选项。ubuntu
本文针对linux x86-64平台，gcc编译器环境实验。swift
本文实验环境：
[root@yglocal ~]# lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch Distributor ID: CentOS Description: CentOS Linux release 8.1.1911 (Core) Release: 8.1.1911 Codename: Core [root@yglocal ~]# uname -r 4.18.0-147.el8.x86_64 [root@yglocal ~]# gcc --version gcc (GCC) 8.3.1 20190507 (Red Hat 8.3.1-4) Copyright (C) 2018 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE[root@yglocal ~]# lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch Distributor ID: CentOS Description: CentOS Linux release 8.1.1911 (Core) Release: 8.1.1911 Codename: Core [root@yglocal ~]# uname -r 4.18.0-147.el8.x86_64 [root@yglocal ~]# gcc --version gcc (GCC) 8.3.1 20190507 (Red Hat 8.3.1-4) Copyright (C) 2018 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE在centos上使用ASan，编译会报以下错误（gcc 4.8.5）：
[root@localhost test]# gcc -g -O2 -fsanitize=address -fno-omit-frame-pointer hello.c /usr/bin/ld: cannot find /usr/lib64/libasan.so.0.0.0 collect2: error: ld returned 1 exit status[root@localhost test]# gcc -g -O2 -fsanitize=address -fno-omit-frame-pointer hello.c /usr/bin/ld: cannot find /usr/lib64/libasan.so.0.0.0 collect2: error: ld returned 1 exit status安装libasan便可：
[root@localhost test]# yum install libasan[root@localhost test]# yum install libasan注：ubuntu x86-64系统只需gcc版本高于4.8便可；可是在rhel/centos上使用ASan功能，除了gcc版本大于4.8以外，还须要安装libasan。
下面针对内存的几种c/c++常见内存错误，编写例子，看下ASan的报错输出：
一、堆缓冲区溢出
测试代码：
[root@yglocal asan_test]# vi heap_ovf_test.c #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { char *heap_buf = (char*)malloc(32*sizeof(char)); memcpy(heap_buf+30, "overflow", 8); //在heap_buf的第30个字节开始，拷贝8个字符 free(heap_buf); return 0; }[root@yglocal asan_test]# vi heap_ovf_test.c #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { char *heap_buf = (char*)malloc(32*sizeof(char)); memcpy(heap_buf+30, "overflow", 8); //在heap_buf的第30个字节开始，拷贝8个字符 free(heap_buf); return 0; }编译并运行：
[root@yglocal asan_test]# gcc -fsanitize=address -fno-omit-frame-pointer -o heap_ovf_test heap_ovf_test.c [root@yglocal asan_test]# ./heap_ovf_test ================================================================= ==40602==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000030 at pc 0x7f3de8f91a1d bp 0x7ffd4b4ebb60 sp 0x7ffd4b4eb308 WRITE of size 8 at 0x603000000030 thread T0 #0 0x7f3de8f91a1c (/lib64/libasan.so.5+0x40a1c) #1 0x400845 in main (/root/asan_test/heap_ovf_test+0x400845) #2 0x7f3de8bb1872 in __libc_start_main (/lib64/libc.so.6+0x23872) #3 0x40075d in _start (/root/asan_test/heap_ovf_test+0x40075d) 0x603000000030 is located 0 bytes to the right of 32-byte region [0x603000000010,0x603000000030) allocated by thread T0 here: #0 0x7f3de9040ba8 in __interceptor_malloc (/lib64/libasan.so.5+0xefba8) #1 0x400827 in main (/root/asan_test/heap_ovf_test+0x400827) #2 0x7f3de8bb1872 in __libc_start_main (/lib64/libc.so.6+0x23872) SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x40a1c) Shadow bytes around the buggy address: 0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c067fff8000: fa fa 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa 0x0c067fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow