当前位置:首页 > 公众号精选 > C语言与CPP编程
[导读]来自公众号:大胖聊编程作者:大胖ASan,即AddressSanitizer,是一个适用于c/c程序的动态内存错误检测器,它由一个编译器检测模块(LLVMpass)和一个替换malloc函数的运行时库组成,在性能及检测内存错误方面都优于Valgrind,你值得拥有。一适用平台在L...


来自公众号:大胖聊编程


作者:大胖


ASan,即Address Sanitizer,是一个适用于c/c 程序的动态内存错误检测器,它由一个编译器检测模块(LLVM pass)和一个替换malloc函数的运行时库组成,在性能及检测内存错误方面都优于Valgrind,你值得拥有。
一适用平台在LLVM3.1版之后,ASan就是其的一个组成部分,所以所有适用LLVM的平台,且llvm版本大于3.1的,都可以适用ASan来检查c/c 内存错误。对于gcc,则是4.8版本之后才加入ASan,但是ASan的完整功能则是要gcc版本在4.9.2以上。



二强大功能ASan作为编译器内置功能,支持检测各种内存错误:
  • 缓冲区溢出
    ① 堆内存溢出
    ② 栈上内存溢出
    ③ 全局区缓存溢出
  • 悬空指针(引用)
    ① 使用释放后的堆上内存
    ② 使用返回的栈上内存
    ③ 使用退出作用域的变量
  • 非法释放
    ① 重复释放
    ② 无效释放
  • 内存泄漏
  • 初始化顺序导致的问题
ASan和Valgrind对比如下图:



三如何使用
  1. 使用ASan时,只需gcc选项加上-fsanitize=address选项;
  2. 如果想要在使用asan的时候获取更好的性能,可以加上O1或者更高的编译优化选项;
  3. 想要在错误信息中让栈追溯信息更友好,可以加上-fno-omit-frame-pointer选项。
  4. 本文针对linux x86-64平台,gcc编译器环境实验。

本文实验环境:
[root@yglocal ~]# lsb_release -aLSB Version: :core-4.1-amd64:core-4.1-noarchDistributor ID: CentOSDescription: CentOS Linux release 8.1.1911 (Core) Release: 8.1.1911Codename: Core[root@yglocal ~]# uname -r4.18.0-147.el8.x86_64[root@yglocal ~]# gcc --versiongcc (GCC) 8.3.1 20190507 (Red Hat 8.3.1-4)Copyright (C) 2018 Free Software Foundation, Inc.This is free software; see the source for copying conditions. There is NOwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE
在centos上使用ASan,编译会报如下错误(gcc 4.8.5):


[root@localhost test]# gcc -g -O2 -fsanitize=address -fno-omit-frame-pointer hello.c /usr/bin/ld: cannot find /usr/lib64/libasan.so.0.0.0collect2: error: ld returned 1 exit status


安装libasan即可:
[root@localhost test]# yum install libasan


注:ubuntu x86-64系统只需gcc版本高于4.8即可;但是在rhel/centos上使用ASan功能,除了gcc版本大于4.8之外,还需要安装libasan。
下面针对内存的几种c/c 常见内存错误,编写例子,看下ASan的检测输出情况:


1
堆缓冲区溢出


测试代码:
[root@yglocal asan_test]# vi heap_ovf_test.c
#include #include #include

int main(){ char *heap_buf = (char*)malloc(32*sizeof(char)); memcpy(heap_buf 30, "overflow", 8); //在heap_buf的第30个字节开始,拷贝8个字符
free(heap_buf);
return 0;}
编译并运行:


[root@yglocal asan_test]# gcc -fsanitize=address -fno-omit-frame-pointer -o heap_ovf_test heap_ovf_test.c [root@yglocal asan_test]# ./heap_ovf_test ===================================================================40602==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000030 at pc 0x7f3de8f91a1d bp 0x7ffd4b4ebb60 sp 0x7ffd4b4eb308WRITE of size 8 at 0x603000000030 thread T0 #0 0x7f3de8f91a1c (/lib64/libasan.so.5 0x40a1c) #1 0x400845 in main (/root/asan_test/heap_ovf_test 0x400845) #2 0x7f3de8bb1872 in __libc_start_main (/lib64/libc.so.6 0x23872) #3 0x40075d in _start (/root/asan_test/heap_ovf_test 0x40075d)
0x603000000030 is located 0 bytes to the right of 32-byte region [0x603000000010,0x603000000030)allocated by thread T0 here: #0 0x7f3de9040ba8 in __interceptor_malloc (/lib64/libasan.so.5 0xefba8) #1 0x400827 in main (/root/asan_test/heap_ovf_test 0x400827) #2 0x7f3de8bb1872 in __libc_start_main (/lib64/libc.so.6 0x23872)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5 0x40a1c) Shadow bytes around the buggy address: 0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00=>0x0c067fff8000: fa fa 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa 0x0c067fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa faShadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb==40602==ABORTING[root@yglocal asan_test]#
可以看到asan报错:==40602==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000030 at xxxx,下面也列出了发生heap-buffer-overflow时的调用链及heap buffer在哪里申请的。



2
栈缓冲区溢出


测试代码:
[root@yglocal asan_test]# vi stack_ovf_test.c
#include #include
int main(){ char stack_buf[4] = {0}; strcpy(stack_buf, "1234");
return 0;}
编译并运行:


[root@yglocal asan_test]# ./stack_ovf_test ===================================================================38634==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcf3d8b8d4 at pc 0x7f8714bbaa1d bp 0x7ffcf3d8b8a0 sp 0x7ffcf3d8b048WRITE of size 5 at 0x7ffcf3d8b8d4 thread T0 #0 0x7f8714bbaa1c (/lib64/libasan.so.5 0x40a1c) #1 0x400949 in main (/root/asan_test/stack_ovf_test 0x400949) #2 0x7f87147da872 in __libc_start_main (/lib64/libc.so.6 0x23872) #3 0x4007cd in _start (/root/asan_test/stack_ovf_test 0x4007cd)
Address 0x7ffcf3d8b8d4 is located in stack of thread T0 at offset 36 in frame #0 0x400895 in main (/root/asan_test/stack_ovf_test 0x400895)
This frame has 1 object(s): [32, 36) 'stack_buf' <== Memory access at offset 36 overflows this variableHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C exceptions *are* supported)SUMMARY: AddressSanitizer: stack-buffer-overflow (/lib64/libasan.so.5 0x40a1c) Shadow bytes around the buggy address: 0x10001e7a96c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a96d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a96e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a96f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a9700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00=>0x10001e7a9710: 00 00 00 00 00 00 f1 f1 f1 f1[04]f2 f2 f2 f3 f3 0x10001e7a9720: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a9730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a9740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a9750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10001e7a9760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00......


可以看到asan报错:==38634==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcf3d8b8d4 at xxx,发生stack buffer overflow时函数的调用链信息。


3
使用悬空指针


测试代码:
[root@yglocal asan_test]# vi dangling_pointer_test.c
#include #include #include
int main(){ char *p = (char*)malloc(32*sizeof(char)); free(p);
int a = p[1];
return 0;} 编译并运行:
[root@yglocal asan_test]# gcc -fsanitize=address -fno-omit-frame-pointer -o dangling_pointer_test dangling_pointer_test.c [root@yglocal asan_test]# ./dangling_pointer_test ===================================================================83532==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000011 at pc 0x0000004007c4 bp 0x7ffd7f562760 sp 0x7ffd7f562750READ of size 1 at 0x603000000011 thread T0 #0 0x4007c3 in main (/root/asan_test/dangling_pointer_test 0x4007c3) #1 0x7f56196cd872 in __libc_start_main (/lib64/libc.so.6 0x23872) #2 0x4006ad in _start (/root/asan_test/dangling_pointer_test 0x4006ad)
0x603000000011 is located 1 bytes inside of 32-byte region [0x603000000010,0x603000000030)freed by thread T0 here: #0 0x7f5619b5c7e0 in __interceptor_free (/lib64/libasan.so.5 0xef7e0) #1 0x400787 in main (/root/asan_test/dangling_pointer_test 0x400787) #2 0x7f56196cd872 in __libc_start_main (/lib64/libc.so.6 0x23872)
previously allocated by thread T0 here: #0 0x7f5619b5cba8 in __interceptor_malloc (/lib64/libasan.so.5 0xefba8) #1 0x400777 in main (/root/asan_test/dangling_pointer_test 0x400777) #2 0x7f56196cd872 in __libc_start_main (/lib64/libc.so.6 0x23872)
SUMMARY: AddressSanitizer: heap-use-after-free (/root/asan_test/dangling_pointer_test 0x4007c3) in mainShadow bytes around the buggy address: 0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00=>0x0c067fff8000: fa fa[fd]fd fd fd fa fa fa fa fa fa fa fa fa fa 0x0c067fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa faShadow byte legend (one shadow byte represents 8 application bytes):......
4
使用栈上返回的变量


[root@yglocal asan_test]# vi use-after-return.c
#include #include #include int *ptr;void get_pointer(){ int local[10]; ptr =
本站声明: 本文章由作者或相关机构授权发布,目的在于传递更多信息,并不代表本站赞同其观点,本站亦不保证或承诺内容真实性等。需要转载请联系该专栏作者,如若文章内容侵犯您的权益,请及时联系本站删除。
换一批
延伸阅读

三星宣布,其最新的LPDDR5X内存已通过验证,可在骁龙(Snapdragon)移动平台上使用,该内存速度可达到当前业界最快的8.5 千兆比特每秒(Gbps)。通过优化应用处理器和存储器之间的高速信号环境,三星超过了自身...

关键字: GBPS 三星 内存 LPDDR5

(全球TMT2022年10月18日讯)三星宣布,其最新的LPDDR5X内存已通过验证,可在骁龙(Snapdragon)移动平台上使用,该内存速度可达到当前业界最快的8.5 千兆比特每秒(Gbps)。通过优化应用处理器和...

关键字: GBPS 三星 亚马逊 内存

在三星 Tech Day 2022 活动上,三星电子总裁兼内存业务负责人 Jung-bae Lee 表示,三星 40 多年来共生产了 1 万亿 GB 内存,仅在过去三年中就产生了大约一半。

关键字: 三星 内存 储存芯片

搁在四五年前,板载内存极大可能会被用户视为一台轻薄本的缺点,其实这也很好理解,板载内存无法扩容,而且当时内存容量并不大,板载内存的频率也普遍偏低,性能稍差,所以很多朋友选购轻薄本的时候,都会避开板载内存。

关键字: 板载 内存 半导体

继DDR5 DRAM成为英特尔“Alder Lake”第12代处理器的标准配置之后,AMD近日也宣布其7000系列处理器将支持DDR5内存,并在9月27日正式上市。AMD表示,该平台将不再支持DDR4,只支持DDR5产品...

关键字: DDR5 内存 三星

GRL通过与FuturePlus的合作伙伴关系,扩大了全球七个实验室所提供的DDR和LPDDR内存测试服务组合  加利福尼亚州圣克拉拉市2022年9月15日 /美...

关键字: DDR FUTURE SYSTEMS 内存

上海2022年9月1日 /美通社/ -- 澜起科技宣布在业界率先推出DDR5第一子代时钟驱动器(简称CKD或DDR5CK01)工程样片,并已送样给业界主流内存厂商,该产品将用于新一代台式机和笔记本电脑的内存。 澜起科技...

关键字: DDR 驱动器 时钟驱动 内存

(全球TMT2022年9月1日讯)IMAX中国宣布2022年暑期档IMAX总票房达到3.03亿元人民币,较去年同期大幅增长34%。与此同时,2022年全国暑期档票房达到92亿元,较去年增长24%。目前全国有680家IM...

关键字: 亚马逊 DDR 内存 安集科技

(全球TMT2022年8月23日讯)科大讯飞披露2022年半年度报告,上半年实现营业收入为80.23亿元,同比增长26.97%;归母净利润2.78亿元,同比下滑33.57%。 云米发布截至6月30日的20...

关键字: 科大讯飞 内存 VR AI

北京2022年8月22日 /美通社/ -- 前言: 在企业数字化转型的今天,数据已经成为企业赖以生存的基础。数据的丢失或者损坏将会给企业带来无法估量的损失。因此如何进行数据保护与保障数据一致性成为必须面对的挑战...

关键字: 内存 虚拟化 OPENSTACK OS

C语言与CPP编程

249 篇文章

关注

发布文章

编辑精选

技术子站

关闭