Sanitizer suboptions are enabled by default?

Question

LLVM's Sanitizer documentation says:

Use clang++ to compile and link your program with -fsanitize=undefined flag. Make sure to use clang++ (not ld) as a linker, so that your executable is linked with proper UBSan runtime libraries. You can use clang instead of clang++ if you’re compiling/linking C code. ... You can enable only a subset of checks offered by UBSan, and define the desired behavior for each kind of check: ...

Does it mean that the subset of checks are by default included?

For example, is -fsanitize=undefined,alignment redundant by having alignment?

I have the same question about -fsanitize=address and also about GCC sanitizer.

I would like to enable as much sanitizers simultaneously as possible but I don't want to have unnecessary options in the command line or CMake line. That is, I don't want to have -fsanitize=address,pointer-compare,pointer-subtract,leak,shift,integer-divide-by-zero,unreachable,null,return,signed-integer-overflow just in case.

How such command line look like?

The documentation is also not clear for the ASAN_OPTIONS runtime variable, it is not clear if things need to be activated or not. For example, I have ASAN_OPTIONS="handle_ioctl=true:check_initialization_order=true:detect_container_overflow=1:detect_stack_use_after_return=false:detect_odr_violation=1:allow_addr2line=true:strict_init_order=true" but perhaps the on/true options are not really necessary.

Answer 1

Sanitizers let you check for individual errors (alignment, signed-integer-overflow, etc.) and groups of errors:

• address - buffer overflows
• leak - memory leaks (implied by address)
• undefined - mostly integer Undefined Behavior errors
• integer - other suspicious integer behavior

(there are also thread and memory but let's not touch those as they are incompatible with Asan and UBsan and have to be run separately).

Contents of groups is documented in Clang documentation:

• https://clang.llvm.org/docs/AddressSanitizer.html
• https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html

GCC generally tries to be compatible to Clang (for a noticeable exception of not supporting checking for integer errors).

In general I would suggest to use

-fsanitize=address,undefined,float-divide-by-zero,nullability \
-fno-sanitize-recover \
-fno-common \
-U_FORTIFY_SOURCE

(the -fno-sanitize-recover part is needed so that sanitizers abort your program whenever any check fails instead of continuing execution, the -fno-common improves buffer overflow detection for global arrays and -U_FORTIFY_SOURCE disables source fortification which prevents Asan from detecting some bugs). You could extend this by

• adding integer to -fsanitize option (may report false positives for perfectly valid code in your program and libraries but this can worked around by using ignorelists)
• adding -fsanitize-address-use-after-scope (may be too slow in your case)
• adding pointer-compare,pointer-subtract to -fsanitize option (tend be too slow for practical use)

For ASAN_OPTIONS you could check the default values in

• https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
• https://github.com/google/sanitizers/wiki/SanitizerCommonFlags

I recommend to use the following set of options which enables some complex checks that are disabled by default:

export ASAN_OPTIONS='check_initialization_order=true:strict_init_order=true:detect_stack_use_after_return=true:strict_string_checks=true'

Now to your questions.

For example, is -fsanitize=undefined,alignment redundant by having alignment?

Yes, it's redundant because alignment is included into undefined.

That is, I don't want to have -fsanitize=address,pointer-compare,pointer-subtract,leak,shift,integer-divide-by-zero,unreachable,null,return,signed-integer-overflow just in case.

According to documentation your command line could be reduced to

-fsanitize=address,undefined,integer,pointer-compare,pointer-subtract

For example, I have ASAN_OPTIONS="handle_ioctl=true:check_initialization_order=true:detect_container_overflow=1:detect_stack_use_after_return=false:detect_odr_violation=1:allow_addr2line=true:strict_init_order=true" but perhaps the on/true options are not really necessary.

According to docs your options could be reduced to

ASAN_OPTIONS='handle_ioctl=true:check_initialization_order=true:allow_addr2line=true:strict_init_order=true'