# Code sanitizer

A code sanitizer is a programming tool that detects bugs in the form of undefined or suspicious behavior by a compiler inserting instrumentation code at runtime. The class of tools was first introduced by Google's AddressSanitizer (or ASan) of 2012, which uses directly mapped shadow memory to detect memory corruption such as buffer overflows or accesses to a dangling pointer (use-after-free).

## AddressSanitizer

Google's ASan, introduced in 2012, uses a shadow memory scheme to detect memory bugs. It is available in:
* Clang (starting from version 3.1)
* GCC (starting from version 4.8)
* Xcode (starting from version 7.0)
* MSVC (widely available starting from version 16.9).
On average, the instrumentation increases processing time by about 73% and memory usage by 240%. There is a hardware-accelerated ASan called HWAsan available for AArch64 and (in a limited fashion) x86_64.
AddressSanitizer does not detect any uninitialized memory reads (but this is detected by MemorySanitizer), and only detects some use-after-return bugs. It is also not capable of detecting all arbitrary memory corruption bugs, nor all arbitrary write bugs due to integer underflow/overflows (when the integer with undefined behavior is used to calculate memory address offsets). Adjacent buffers in structs and classes are not protected from overflow, in part to prevent breaking backwards compatibility.

### KernelAddressSanitizer

The KernelAddressSanitizer (KASan) detects dynamic memory errors in the Linux kernel. Kernel instrumentation requires a special feature in the compiler supplying the -fsanitize=kernel-address command line option, since kernels do not use the same address space as normal programs.
KASan is also available for use with Windows kernel drivers beginning in Windows 11 22H2 and above. Similarly to Linux, compiling a Windows driver with KASAN requires passing the /fsanitize=kernel-address command line option to the MSVC compiler.

## Other sanitizers

Google also produced LeakSanitizer (LSan, memory leaks), ThreadSanitizer (TSan, data races and deadlocks), MemorySanitizer (MSan, uninitialized memory), and UndefinedBehaviorSanitizer (UBSan, undefined behaviors, with fine-grained control). These tools are generally available in Clang/LLVM and GCC. Similar to KASan, there are kernel-specific versions of LSan, MSan, TSan, as well as completely original kernel sanitizers such as KFENCE and KCSan.
Additional sanitizer tools (grouped by compilers under -fsanitize or a similar flag) include:
* LLVM control-flow integrity and its kernel counterpart, which checks virtual tables and type casts for forward-edge CFI
* MemTagSanitizer, an ASan-like tool that uses Armv8.5-A features for very low overhead
* ShadowCallStack, an AArch64 tool that provides a shadow stack protection
* Scudo Hardened Allocator, an alternative memory allocator that includes GWP-ASan, a probabilistic ASan analogue with low overhead
* libFuzzer, an LLVM tool that adds code coverage to fuzzing

## Usage

A code sanitizer detects suspicious behavior as the program runs. One common way to use a sanitizer is to combine it with fuzzing, which generates inputs likely to trigger bugs.

## Users

Chromium and Firefox developers are active users of AddressSanitizer; the tool has found hundreds of bugs in these web browsers. A number of bugs were found in FFmpeg and FreeType. The Linux kernel has enabled the AddressSanitizer for the x86-64 architecture as of Linux version 4.0.