[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSM9BZWRD8XAS2V3V5FXS6":3,"skill-same:01M6DSM9BZWRD8XAS2V3V5FXS6":53},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":26,"linkOnly":27,"markdownContent":28,"markdownBody":29,"frontMatter":30,"refName":32,"commitSha":33,"skillDirectory":34,"forksCount":35,"repositoryHtmlUrl":36,"repositoryHomepageUrl":6,"ownerHtmlUrl":37,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":38,"install":39,"resources":52},"01M6DSM9BZWRD8XAS2V3V5FXS6","address-sanitizer",null,"AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Faddress-sanitizer\u002FSKILL.md",[],[18,19,20,21,22,23,24,25],"address sanitizer","memory","fuzzing","code","find","use","c++","free","2026-11-10 10:12:30",false,"---\nname: address-sanitizer\ntype: technique\ndescription: >\n  AddressSanitizer detects memory errors during fuzzing.\n  Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n---\n\n# AddressSanitizer (ASan)\n\nAddressSanitizer (ASan) is a widely adopted memory error detection tool used extensively during software testing, particularly fuzzing. It helps detect memory corruption bugs that might otherwise go unnoticed, such as buffer overflows, use-after-free errors, and other memory safety violations.\n\n## Overview\n\nASan is a standard practice in fuzzing due to its effectiveness in identifying memory vulnerabilities. It instruments code at compile time to track memory allocations and accesses, detecting illegal operations at runtime.\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Instrumentation | ASan adds runtime checks to memory operations during compilation |\n| Shadow Memory | Maps 20TB of virtual memory to track allocation state |\n| Performance Cost | Approximately 2-4x slowdown compared to non-instrumented code |\n| Detection Scope | Finds buffer overflows, use-after-free, double-free, and memory leaks |\n\n## When to Apply\n\n**Apply this technique when:**\n- Fuzzing C\u002FC++ code for memory safety vulnerabilities\n- Testing Rust code with unsafe blocks\n- Debugging crashes related to memory corruption\n- Running unit tests where memory errors are suspected\n\n**Skip this technique when:**\n- Running production code (ASan can reduce security)\n- Platform is Windows or macOS (limited ASan support)\n- Performance overhead is unacceptable for your use case\n- Fuzzing pure safe languages without FFI (e.g., pure Go, pure Java)\n\n## Quick Reference\n\n| Task | Command\u002FPattern |\n|------|-----------------|\n| Enable ASan (Clang\u002FGCC) | `-fsanitize=address` |\n| Enable verbosity | `ASAN_OPTIONS=verbosity=1` |\n| Disable leak detection | `ASAN_OPTIONS=detect_leaks=0` |\n| Force abort on error | `ASAN_OPTIONS=abort_on_error=1` |\n| Multiple options | `ASAN_OPTIONS=verbosity=1:abort_on_error=1` |\n\n## Step-by-Step\n\n### Step 1: Compile with ASan\n\nCompile and link your code with the `-fsanitize=address` flag:\n\n```bash\nclang -fsanitize=address -g -o my_program my_program.c\n```\n\nThe `-g` flag is recommended to get better stack traces when ASan detects errors.\n\n### Step 2: Configure ASan Options\n\nSet the `ASAN_OPTIONS` environment variable to configure ASan behavior:\n\n```bash\nexport ASAN_OPTIONS=verbosity=1:abort_on_error=1:detect_leaks=0\n```\n\n### Step 3: Run Your Program\n\nExecute the ASan-instrumented binary. When memory errors are detected, ASan will print detailed reports:\n\n```bash\n.\u002Fmy_program\n```\n\n### Step 4: Adjust Fuzzer Memory Limits\n\nASan requires approximately 20TB of virtual memory. Disable fuzzer memory restrictions:\n\n- libFuzzer: `-rss_limit_mb=0`\n- AFL++: `-m none`\n\n## Common Patterns\n\n### Pattern: Basic ASan Integration\n\n**Use Case:** Standard fuzzing setup with ASan\n\n**Before:**\n```bash\nclang -o fuzz_target fuzz_target.c\n.\u002Ffuzz_target\n```\n\n**After:**\n```bash\nclang -fsanitize=address -g -o fuzz_target fuzz_target.c\nASAN_OPTIONS=verbosity=1:abort_on_error=1 .\u002Ffuzz_target\n```\n\n### Pattern: ASan with Unit Tests\n\n**Use Case:** Enable ASan for unit test suite\n\n**Before:**\n```bash\ngcc -o test_suite test_suite.c -lcheck\n.\u002Ftest_suite\n```\n\n**After:**\n```bash\ngcc -fsanitize=address -g -o test_suite test_suite.c -lcheck\nASAN_OPTIONS=detect_leaks=1 .\u002Ftest_suite\n```\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Use `-g` flag | Provides detailed stack traces for debugging |\n| Set `verbosity=1` | Confirms ASan is enabled before program starts |\n| Disable leaks during fuzzing | Leak detection doesn't cause immediate crashes, clutters output |\n| Enable `abort_on_error=1` | Some fuzzers require `abort()` instead of `_exit()` |\n\n### Understanding ASan Reports\n\nWhen ASan detects a memory error, it prints a detailed report including:\n\n- **Error type**: Buffer overflow, use-after-free, etc.\n- **Stack trace**: Where the error occurred\n- **Allocation\u002Fdeallocation traces**: Where memory was allocated\u002Ffreed\n- **Memory map**: Shadow memory state around the error\n\nExample ASan report:\n```\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000eff4 at pc 0x00000048e6a3\nREAD of size 4 at 0x60300000eff4 thread T0\n    #0 0x48e6a2 in main \u002Fpath\u002Fto\u002Ffile.c:42\n```\n\n### Combining Sanitizers\n\nASan can be combined with other sanitizers for comprehensive detection:\n\n```bash\nclang -fsanitize=address,undefined -g -o fuzz_target fuzz_target.c\n```\n\n### Platform-Specific Considerations\n\n**Linux**: Full ASan support with best performance\n**macOS**: Limited support, some features may not work\n**Windows**: Experimental support, not recommended for production fuzzing\n\n## Anti-Patterns\n\n| Anti-Pattern | Problem | Correct Approach |\n|--------------|---------|------------------|\n| Using ASan in production | Can make applications less secure | Use ASan only for testing |\n| Not disabling memory limits | Fuzzer may kill process due to 20TB virtual memory | Set `-rss_limit_mb=0` or `-m none` |\n| Ignoring leak reports | Memory leaks indicate resource management issues | Review leak reports at end of fuzzing campaign |\n\n## Tool-Specific Guidance\n\n### libFuzzer\n\nCompile with both fuzzer and address sanitizer:\n\n```bash\nclang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz\n```\n\nRun with unlimited RSS:\n\n```bash\n.\u002Ffuzz -rss_limit_mb=0\n```\n\n**Integration tips:**\n- Always combine `-fsanitize=fuzzer` with `-fsanitize=address`\n- Use `-g` for detailed stack traces in crash reports\n- Consider `ASAN_OPTIONS=abort_on_error=1` for better crash handling\n\nSee: [libFuzzer: AddressSanitizer](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fgood-fuzz-target.md#memory-error-detection)\n\n### AFL++\n\nUse the `AFL_USE_ASAN` environment variable:\n\n```bash\nAFL_USE_ASAN=1 afl-clang-fast++ -g harness.cc -o fuzz\n```\n\nRun with unlimited memory:\n\n```bash\nafl-fuzz -m none -i input_dir -o output_dir .\u002Ffuzz\n```\n\n**Integration tips:**\n- `AFL_USE_ASAN=1` automatically adds proper compilation flags\n- Use `-m none` to disable AFL++'s memory limit\n- Consider `AFL_MAP_SIZE` for programs with large coverage maps\n\nSee: [AFL++: AddressSanitizer](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Fblob\u002Fstable\u002Fdocs\u002Ffuzzing_in_depth.md#a-using-sanitizers)\n\n### cargo-fuzz (Rust)\n\nUse the `--sanitizer=address` flag:\n\n```bash\ncargo fuzz run fuzz_target --sanitizer=address\n```\n\nOr configure in `fuzz\u002FCargo.toml`:\n\n```toml\n[profile.release]\nopt-level = 3\ndebug = true\n```\n\n**Integration tips:**\n- ASan is useful for fuzzing unsafe Rust code or FFI boundaries\n- Safe Rust code may not benefit as much (compiler already prevents many errors)\n- Focus on unsafe blocks, raw pointers, and C library bindings\n\nSee: [cargo-fuzz: AddressSanitizer](https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz\u002Ftutorial.html#sanitizers)\n\n### honggfuzz\n\nCompile with ASan and link with honggfuzz:\n\n```bash\nhonggfuzz -i input_dir -o output_dir -- .\u002Ffuzz_target_asan\n```\n\nCompile the target:\n\n```bash\nhfuzz-clang -fsanitize=address -g target.c -o fuzz_target_asan\n```\n\n**Integration tips:**\n- honggfuzz works well with ASan out of the box\n- Use feedback-driven mode for better coverage with sanitizers\n- Monitor memory usage, as ASan increases memory footprint\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Fuzzer kills process immediately | Memory limit too low for ASan's 20TB virtual memory | Use `-rss_limit_mb=0` (libFuzzer) or `-m none` (AFL++) |\n| \"ASan runtime not initialized\" | Wrong linking order or missing runtime | Ensure `-fsanitize=address` used in both compile and link |\n| Leak reports clutter output | LeakSanitizer enabled by default | Set `ASAN_OPTIONS=detect_leaks=0` |\n| Poor performance (>4x slowdown) | Debug mode or unoptimized build | Compile with `-O2` or `-O3` alongside `-fsanitize=address` |\n| ASan not detecting obvious bugs | Binary not instrumented | Check with `ASAN_OPTIONS=verbosity=1` that ASan prints startup info |\n| False positives | Interceptor conflicts | Check ASan FAQ for known issues with specific libraries |\n\n## Related Skills\n\n### Tools That Use This Technique\n\n| Skill | How It Applies |\n|-------|----------------|\n| **libfuzzer** | Compile with `-fsanitize=fuzzer,address` for integrated fuzzing with memory error detection |\n| **aflpp** | Use `AFL_USE_ASAN=1` environment variable during compilation |\n| **cargo-fuzz** | Use `--sanitizer=address` flag to enable ASan for Rust fuzz targets |\n| **honggfuzz** | Compile target with `-fsanitize=address` for ASan-instrumented fuzzing |\n\n### Related Techniques\n\n| Skill | Relationship |\n|-------|--------------|\n| **undefined-behavior-sanitizer** | Often used together with ASan for comprehensive bug detection (undefined behavior + memory errors) |\n| **fuzz-harness-writing** | Harnesses must be designed to handle ASan-detected crashes and avoid false positives |\n| **coverage-analysis** | Coverage-guided fuzzing helps trigger code paths where ASan can detect memory errors |\n\n## Resources\n\n### Key External Resources\n\n**[AddressSanitizer on Google Sanitizers Wiki](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanitizer)**\n\nThe official ASan documentation covers:\n- Algorithm and implementation details\n- Complete list of detected error types\n- Performance characteristics and overhead\n- Platform-specific behavior\n- Known limitations and incompatibilities\n\n**[SanitizerCommonFlags](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FSanitizerCommonFlags)**\n\nCommon configuration flags shared across all sanitizers:\n- `verbosity`: Control diagnostic output level\n- `log_path`: Redirect sanitizer output to files\n- `symbolize`: Enable\u002Fdisable symbol resolution in reports\n- `external_symbolizer_path`: Use custom symbolizer\n\n**[AddressSanitizerFlags](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanizerFlags)**\n\nASan-specific configuration options:\n- `detect_leaks`: Control memory leak detection\n- `abort_on_error`: Call `abort()` vs `_exit()` on error\n- `detect_stack_use_after_return`: Detect stack use-after-return bugs\n- `check_initialization_order`: Find initialization order bugs\n\n**[AddressSanitizer FAQ](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanitizer#faq)**\n\nCommon pitfalls and solutions:\n- Linking order issues\n- Conflicts with other tools\n- Platform-specific problems\n- Performance tuning tips\n\n**[Clang AddressSanitizer Documentation](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FAddressSanitizer.html)**\n\nClang-specific guidance:\n- Compilation flags and options\n- Interaction with other Clang features\n- Supported platforms and architectures\n\n**[GCC Instrumentation Options](https:\u002F\u002Fgcc.gnu.org\u002Fonlinedocs\u002Fgcc\u002FInstrumentation-Options.html#index-fsanitize_003daddress)**\n\nGCC-specific ASan documentation:\n- GCC-specific flags and behavior\n- Differences from Clang implementation\n- Platform support in GCC\n\n**[AddressSanitizer: A Fast Address Sanity Checker (USENIX Paper)](https:\u002F\u002Fwww.usenix.org\u002Fsites\u002Fdefault\u002Ffiles\u002Fconference\u002Fprotected-files\u002Fserebryany_atc12_slides.pdf)**\n\nOriginal research paper with technical details:\n- Shadow memory algorithm\n- Virtual memory requirements (historically 16TB, now ~20TB)\n- Performance benchmarks\n- Design decisions and tradeoffs\n","# AddressSanitizer (ASan)\n\nAddressSanitizer (ASan) is a widely adopted memory error detection tool used extensively during software testing, particularly fuzzing. It helps detect memory corruption bugs that might otherwise go unnoticed, such as buffer overflows, use-after-free errors, and other memory safety violations.\n\n## Overview\n\nASan is a standard practice in fuzzing due to its effectiveness in identifying memory vulnerabilities. It instruments code at compile time to track memory allocations and accesses, detecting illegal operations at runtime.\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Instrumentation | ASan adds runtime checks to memory operations during compilation |\n| Shadow Memory | Maps 20TB of virtual memory to track allocation state |\n| Performance Cost | Approximately 2-4x slowdown compared to non-instrumented code |\n| Detection Scope | Finds buffer overflows, use-after-free, double-free, and memory leaks |\n\n## When to Apply\n\n**Apply this technique when:**\n- Fuzzing C\u002FC++ code for memory safety vulnerabilities\n- Testing Rust code with unsafe blocks\n- Debugging crashes related to memory corruption\n- Running unit tests where memory errors are suspected\n\n**Skip this technique when:**\n- Running production code (ASan can reduce security)\n- Platform is Windows or macOS (limited ASan support)\n- Performance overhead is unacceptable for your use case\n- Fuzzing pure safe languages without FFI (e.g., pure Go, pure Java)\n\n## Quick Reference\n\n| Task | Command\u002FPattern |\n|------|-----------------|\n| Enable ASan (Clang\u002FGCC) | `-fsanitize=address` |\n| Enable verbosity | `ASAN_OPTIONS=verbosity=1` |\n| Disable leak detection | `ASAN_OPTIONS=detect_leaks=0` |\n| Force abort on error | `ASAN_OPTIONS=abort_on_error=1` |\n| Multiple options | `ASAN_OPTIONS=verbosity=1:abort_on_error=1` |\n\n## Step-by-Step\n\n### Step 1: Compile with ASan\n\nCompile and link your code with the `-fsanitize=address` flag:\n\n```bash\nclang -fsanitize=address -g -o my_program my_program.c\n```\n\nThe `-g` flag is recommended to get better stack traces when ASan detects errors.\n\n### Step 2: Configure ASan Options\n\nSet the `ASAN_OPTIONS` environment variable to configure ASan behavior:\n\n```bash\nexport ASAN_OPTIONS=verbosity=1:abort_on_error=1:detect_leaks=0\n```\n\n### Step 3: Run Your Program\n\nExecute the ASan-instrumented binary. When memory errors are detected, ASan will print detailed reports:\n\n```bash\n.\u002Fmy_program\n```\n\n### Step 4: Adjust Fuzzer Memory Limits\n\nASan requires approximately 20TB of virtual memory. Disable fuzzer memory restrictions:\n\n- libFuzzer: `-rss_limit_mb=0`\n- AFL++: `-m none`\n\n## Common Patterns\n\n### Pattern: Basic ASan Integration\n\n**Use Case:** Standard fuzzing setup with ASan\n\n**Before:**\n```bash\nclang -o fuzz_target fuzz_target.c\n.\u002Ffuzz_target\n```\n\n**After:**\n```bash\nclang -fsanitize=address -g -o fuzz_target fuzz_target.c\nASAN_OPTIONS=verbosity=1:abort_on_error=1 .\u002Ffuzz_target\n```\n\n### Pattern: ASan with Unit Tests\n\n**Use Case:** Enable ASan for unit test suite\n\n**Before:**\n```bash\ngcc -o test_suite test_suite.c -lcheck\n.\u002Ftest_suite\n```\n\n**After:**\n```bash\ngcc -fsanitize=address -g -o test_suite test_suite.c -lcheck\nASAN_OPTIONS=detect_leaks=1 .\u002Ftest_suite\n```\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Use `-g` flag | Provides detailed stack traces for debugging |\n| Set `verbosity=1` | Confirms ASan is enabled before program starts |\n| Disable leaks during fuzzing | Leak detection doesn't cause immediate crashes, clutters output |\n| Enable `abort_on_error=1` | Some fuzzers require `abort()` instead of `_exit()` |\n\n### Understanding ASan Reports\n\nWhen ASan detects a memory error, it prints a detailed report including:\n\n- **Error type**: Buffer overflow, use-after-free, etc.\n- **Stack trace**: Where the error occurred\n- **Allocation\u002Fdeallocation traces**: Where memory was allocated\u002Ffreed\n- **Memory map**: Shadow memory state around the error\n\nExample ASan report:\n```\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000eff4 at pc 0x00000048e6a3\nREAD of size 4 at 0x60300000eff4 thread T0\n    #0 0x48e6a2 in main \u002Fpath\u002Fto\u002Ffile.c:42\n```\n\n### Combining Sanitizers\n\nASan can be combined with other sanitizers for comprehensive detection:\n\n```bash\nclang -fsanitize=address,undefined -g -o fuzz_target fuzz_target.c\n```\n\n### Platform-Specific Considerations\n\n**Linux**: Full ASan support with best performance\n**macOS**: Limited support, some features may not work\n**Windows**: Experimental support, not recommended for production fuzzing\n\n## Anti-Patterns\n\n| Anti-Pattern | Problem | Correct Approach |\n|--------------|---------|------------------|\n| Using ASan in production | Can make applications less secure | Use ASan only for testing |\n| Not disabling memory limits | Fuzzer may kill process due to 20TB virtual memory | Set `-rss_limit_mb=0` or `-m none` |\n| Ignoring leak reports | Memory leaks indicate resource management issues | Review leak reports at end of fuzzing campaign |\n\n## Tool-Specific Guidance\n\n### libFuzzer\n\nCompile with both fuzzer and address sanitizer:\n\n```bash\nclang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz\n```\n\nRun with unlimited RSS:\n\n```bash\n.\u002Ffuzz -rss_limit_mb=0\n```\n\n**Integration tips:**\n- Always combine `-fsanitize=fuzzer` with `-fsanitize=address`\n- Use `-g` for detailed stack traces in crash reports\n- Consider `ASAN_OPTIONS=abort_on_error=1` for better crash handling\n\nSee: [libFuzzer: AddressSanitizer](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fgood-fuzz-target.md#memory-error-detection)\n\n### AFL++\n\nUse the `AFL_USE_ASAN` environment variable:\n\n```bash\nAFL_USE_ASAN=1 afl-clang-fast++ -g harness.cc -o fuzz\n```\n\nRun with unlimited memory:\n\n```bash\nafl-fuzz -m none -i input_dir -o output_dir .\u002Ffuzz\n```\n\n**Integration tips:**\n- `AFL_USE_ASAN=1` automatically adds proper compilation flags\n- Use `-m none` to disable AFL++'s memory limit\n- Consider `AFL_MAP_SIZE` for programs with large coverage maps\n\nSee: [AFL++: AddressSanitizer](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Fblob\u002Fstable\u002Fdocs\u002Ffuzzing_in_depth.md#a-using-sanitizers)\n\n### cargo-fuzz (Rust)\n\nUse the `--sanitizer=address` flag:\n\n```bash\ncargo fuzz run fuzz_target --sanitizer=address\n```\n\nOr configure in `fuzz\u002FCargo.toml`:\n\n```toml\n[profile.release]\nopt-level = 3\ndebug = true\n```\n\n**Integration tips:**\n- ASan is useful for fuzzing unsafe Rust code or FFI boundaries\n- Safe Rust code may not benefit as much (compiler already prevents many errors)\n- Focus on unsafe blocks, raw pointers, and C library bindings\n\nSee: [cargo-fuzz: AddressSanitizer](https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz\u002Ftutorial.html#sanitizers)\n\n### honggfuzz\n\nCompile with ASan and link with honggfuzz:\n\n```bash\nhonggfuzz -i input_dir -o output_dir -- .\u002Ffuzz_target_asan\n```\n\nCompile the target:\n\n```bash\nhfuzz-clang -fsanitize=address -g target.c -o fuzz_target_asan\n```\n\n**Integration tips:**\n- honggfuzz works well with ASan out of the box\n- Use feedback-driven mode for better coverage with sanitizers\n- Monitor memory usage, as ASan increases memory footprint\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Fuzzer kills process immediately | Memory limit too low for ASan's 20TB virtual memory | Use `-rss_limit_mb=0` (libFuzzer) or `-m none` (AFL++) |\n| \"ASan runtime not initialized\" | Wrong linking order or missing runtime | Ensure `-fsanitize=address` used in both compile and link |\n| Leak reports clutter output | LeakSanitizer enabled by default | Set `ASAN_OPTIONS=detect_leaks=0` |\n| Poor performance (>4x slowdown) | Debug mode or unoptimized build | Compile with `-O2` or `-O3` alongside `-fsanitize=address` |\n| ASan not detecting obvious bugs | Binary not instrumented | Check with `ASAN_OPTIONS=verbosity=1` that ASan prints startup info |\n| False positives | Interceptor conflicts | Check ASan FAQ for known issues with specific libraries |\n\n## Related Skills\n\n### Tools That Use This Technique\n\n| Skill | How It Applies |\n|-------|----------------|\n| **libfuzzer** | Compile with `-fsanitize=fuzzer,address` for integrated fuzzing with memory error detection |\n| **aflpp** | Use `AFL_USE_ASAN=1` environment variable during compilation |\n| **cargo-fuzz** | Use `--sanitizer=address` flag to enable ASan for Rust fuzz targets |\n| **honggfuzz** | Compile target with `-fsanitize=address` for ASan-instrumented fuzzing |\n\n### Related Techniques\n\n| Skill | Relationship |\n|-------|--------------|\n| **undefined-behavior-sanitizer** | Often used together with ASan for comprehensive bug detection (undefined behavior + memory errors) |\n| **fuzz-harness-writing** | Harnesses must be designed to handle ASan-detected crashes and avoid false positives |\n| **coverage-analysis** | Coverage-guided fuzzing helps trigger code paths where ASan can detect memory errors |\n\n## Resources\n\n### Key External Resources\n\n**[AddressSanitizer on Google Sanitizers Wiki](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanitizer)**\n\nThe official ASan documentation covers:\n- Algorithm and implementation details\n- Complete list of detected error types\n- Performance characteristics and overhead\n- Platform-specific behavior\n- Known limitations and incompatibilities\n\n**[SanitizerCommonFlags](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FSanitizerCommonFlags)**\n\nCommon configuration flags shared across all sanitizers:\n- `verbosity`: Control diagnostic output level\n- `log_path`: Redirect sanitizer output to files\n- `symbolize`: Enable\u002Fdisable symbol resolution in reports\n- `external_symbolizer_path`: Use custom symbolizer\n\n**[AddressSanitizerFlags](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanizerFlags)**\n\nASan-specific configuration options:\n- `detect_leaks`: Control memory leak detection\n- `abort_on_error`: Call `abort()` vs `_exit()` on error\n- `detect_stack_use_after_return`: Detect stack use-after-return bugs\n- `check_initialization_order`: Find initialization order bugs\n\n**[AddressSanitizer FAQ](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsanitizers\u002Fwiki\u002FAddressSanitizer#faq)**\n\nCommon pitfalls and solutions:\n- Linking order issues\n- Conflicts with other tools\n- Platform-specific problems\n- Performance tuning tips\n\n**[Clang AddressSanitizer Documentation](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FAddressSanitizer.html)**\n\nClang-specific guidance:\n- Compilation flags and options\n- Interaction with other Clang features\n- Supported platforms and architectures\n\n**[GCC Instrumentation Options](https:\u002F\u002Fgcc.gnu.org\u002Fonlinedocs\u002Fgcc\u002FInstrumentation-Options.html#index-fsanitize_003daddress)**\n\nGCC-specific ASan documentation:\n- GCC-specific flags and behavior\n- Differences from Clang implementation\n- Platform support in GCC\n\n**[AddressSanitizer: A Fast Address Sanity Checker (USENIX Paper)](https:\u002F\u002Fwww.usenix.org\u002Fsites\u002Fdefault\u002Ffiles\u002Fconference\u002Fprotected-files\u002Fserebryany_atc12_slides.pdf)**\n\nOriginal research paper with technical details:\n- Shadow memory algorithm\n- Virtual memory requirements (historically 16TB, now ~20TB)\n- Performance benchmarks\n- Design decisions and tradeoffs\n",{"name":5,"type":31,"description":7},"technique","master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Faddress-sanitizer",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":40,"prompt":50,"zipAvailable":51},[41,44,47],{"tool":42,"command":43},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill address-sanitizer",{"tool":45,"command":46},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill address-sanitizer",{"tool":48,"command":49},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill address-sanitizer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Faddress-sanitizer\u002FSKILL.md",true,[],[54,79,93,108,121,134],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":73,"publishedAt":26},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[60,65,68],{"categoryNo":61,"categoryName":62,"taxonomyType":63,"taxonomyTypeDesc":64},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":66,"categoryName":67,"taxonomyType":63,"taxonomyTypeDesc":64},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[74,75,23,76,77,78],"writing skills","writing","editing","work","deployment",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":87,"publishedAt":26},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[85,86],{"categoryNo":66,"categoryName":67,"taxonomyType":63,"taxonomyTypeDesc":64},{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},[88,89,75,90,91,23,21,92],"plans","writing plans","requirements","task","spec",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":101,"publishedAt":26},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[99,100],{"categoryNo":66,"categoryName":67,"taxonomyType":63,"taxonomyTypeDesc":64},{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},[102,103,104,105,106,107,75],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":26},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[110,115,116,117,118,119,120],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":26},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[128,129,130,131,21,132,133],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":26},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[141,129,142,77,23,143,144,145],"verification before completion","commands","evidence","claim","complete"]