sanitizer
All about LeakSanitizer
Clang and GCC 4.9 implemented LeakSanitizer in 2013.
LeakSanitizer (LSan) is a memory leak detector.
It intercepts memory allocation functions and by default detects memory leaks at atexit time.
The implementation is purely in the runtime (compiler-rt/lib/lsan) and no instrumentation is needed.
LSan has very little architecture-specific code and supports many 64-bit targets. Some 32-bit targets (e.g. Linux arm/x86-32) are supported as well, but there may be high false negatives because pointers with fewer bits are more easily confused with integers/floating points/other data of a similar pattern. Every supported operating system needs to provide some way to "stop the world".
…All about UndefinedBehaviorSanitizer
Updated in 2025-01.
UndefinedBehaviorSanitizer (UBSan) is an undefined behavior detector for C/C++. It consists of code instrumentation and a runtime. Both components have multiple independent implementations.
Clang implemented the first few checks in 2009-12, initially named -fcatch-undefined-behavior.
In 2012 -fsanitize=undefined was added and -fcatch-undefined-behavior was removed.
GCC 4.9 implemented -fsanitize=undefined in 2013-08.
The runtime used by Clang lives in llvm-project/compiler-rt/lib/ubsan.
GCC from time to time syncs its downstream fork of the sanitizers part of compiler-rt (libsanitizer).
The end of the article lists some alternative runtime implementations.
All about sanitizer interceptors
Updated in 2025-08.
Many sanitizers want to know every function in the program. User functions are instrumented and therefore known by the sanitizer runtime. For library functions, some (e.g. mmap, munmap, memory allocation/deallocation functions, longjmp, vfork) need special treatment. Sanitizers leverage symbol interposition to redirect such function calls to its own implementation: interceptors. Other library functions can be treated as normal user code. Either instrumenting the function or providing an interceptor is fine.
In some cases instrumenting is infeasible:
- Assembly source files usually do not (or are inconvenient to) call sanitizer callbacks
- Many libc implementations cannot be instrumented. When can glibc be built with Clang?
- Some functions have performance issues if instrumented instead of intercepted (mostly
mem*andstr*)
And interceptors may be the practical choice.
This article talks about how interceptors work and the requirements of sanitizer interceptors.
…