<div dir="ltr">This looks like ASan FAQ item #2:<div><a href="https://github.com/google/sanitizers/wiki/AddressSanitizer#faq">https://github.com/google/sanitizers/wiki/AddressSanitizer#faq</a><br></div><div><br></div><div>Q: Why didn't ASan report an obviously invalid memory access in my code?<br>A1: If your errors is too obvious, compiler might have already optimized it out by the time Asan runs.<br></div><div><br></div><div>I would have liked to find clear documentation on the tradeoffs of using optimizations in the main documentation here, but I only see a recommendation to use -O1:</div><div><a href="https://clang.llvm.org/docs/AddressSanitizer.html">https://clang.llvm.org/docs/AddressSanitizer.html</a><br></div><div><br></div><div>To answer your question, the behavior is expected. Also, Clang's default optimization level is -O0.</div><div><br></div><div>I think the consensus among most ASan users is that optimizing before instrumentation is the right tradeoff between accuracy and performance. You are welcome to test with -O0 to find these kinds of trivial issues, but many users find that running tests under -O0+ASan is too slow to be feasible.</div><div><br></div><div>Another way of looking at it is that the compiler has optimized away the OOB store here, and if you ship an optimized build, ASan is correctly telling you that there is no OOB write in the shipping build. Godbolt shows your example optimizes main to just return 0, so the program doesn't do an OOB write at runtime:</div><div><a href="https://gcc.godbolt.org/z/cTsdb4Thz">https://gcc.godbolt.org/z/cTsdb4Thz</a><br></div><div><br></div><div>Hope that helps.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Dec 1, 2021 at 7:10 AM Bharadwaj, Ritanya B via llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org">llvm-dev@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-GB" style="overflow-wrap: break-word;">
<div class="gmail-m_8299833959543691865WordSection1">
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have been using Sanitizers/Archer for testing purposes on C,C++ and Fortran test suites. I notice some change in sanitizer behaviour when I add any kind of optimization to it ( O1, O2, Ofast etc). For example, in the following test case:<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">#include <alloca.h><u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">void foo(int index, int len) {<u></u><u></u></p>
<p class="MsoNormal"> volatile char *str = (volatile char*)alloca(len);<u></u><u></u></p>
<p class="MsoNormal"> str[index] = '1'; // Boom!<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">}<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">int main(int argc, char **argv) {<u></u><u></u></p>
<p class="MsoNormal"> foo(-1, 10);<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">}<u></u><u></u></p>
<p class="MsoNormal">Compiling it with : clang -g -fsanitize=address <i>Test_case.c</i>
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Gives me ASan report : <u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">==80838==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdd959ac3f at pc 0x00000050ea21 bp 0x7ffdd959ac10 sp 0x7ffdd959ac08<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">WRITE of size 1 at 0x7ffdd959ac3f thread T0<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">………..<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">Address 0x7ffdd959ac3f is located in stack of thread T0<u></u><u></u></p>
<p class="MsoNormal" style="text-indent:0.5in">SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow (/ptmp1/bhararit/new_petest/petest/<a href="http://cc_address_sanitizer.ar/diffs/a.out+0x50ea20" target="_blank">cc_address_sanitizer.ar/diffs/a.out+0x50ea20</a>)<br>
……….<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">But when I compile it with optimization: clang -g -fsanitize=address -O1
<i>Test_case.c</i><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt">I do not see any Sanitizer report.<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt">Is this an expected behaviour? If yes, should we be disabling optimizations before using sanitizers although the clang document states that O2 or higher level of optimizations can be used to enhance the performance.
Lastly, what is the default optimization in clang ( is it -O0?)? <u></u><u></u></p>
<p class="MsoNormal">It would be very helpful if you could give me more insights on this. Hope to hear from you. Thanks in advance.<br>
<br>
Best Regards,<u></u><u></u></p>
<p class="MsoNormal">Ritanya.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
LLVM Developers mailing list<br>
<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a><br>
</blockquote></div>