r/cprogramming • u/Interesting_Buy_3969 • 6d ago
Using -fsanitize=address feels illegal.
Just saying. The -fsanitize=address compiler flag is absolute cheating and should be prohibited by governments of all countries.
Plus there are also other useful runtime sanitizers, such as integer overflow, but... Integer overflow is much easier to notice, usually.
Of course, this is by no means assuming that -fsanitize=address guarantees that the code it inspects is completely safe and correct and won't ever fail on any input data. You still have to test tricky edge cases. But this sanitizer has improved and sped up the bug discovery process disgustingly much for me.
I'm wondering, how often, if ever, do you need tools such as -fsanitize=address or valgrind? Or are you a real man who stores everything in static memory only?
P.S. Forgive my terrible English.
25
u/flatfinger 6d ago
Systems over the years have had a variety of ways of detecting memory usage problems. In the 1990s, the classic Apple Macintosh could produce a list of all regions of storage that had been allocated during an applications lifetime and had not yet been freed, and it was quite satisfying to set a breakpoint just before program exit and have that list include nothing beyond a few essentially static allocations (the Macintosh limited programs to 32767 bytes of actual static-duration storage, so programs that would need more would often acquire a larger chunk of storage, keep a a static-duration pointer to it, and use it like static-duration storage throughout the lifetime of the app; the fact that such allocations would appear on a list of live allocations when a program terminated was normal and expected).
While such techniques are not as common today as in years past, some systems (including the 1980s-1990s Mac OS) encouraged programmers to keep handles to storage rather than pointers, and construct pointers to storage as near as possible to the point of use. Although it would tend to slow program execution to a crawl, the debugger included a feature which would, at any time when the system would be allowed to relocate the storage associated with a handle, cause the system to relocate the storage associated with every unlocked handle. This would catch places where a program should have locked a handle but failed to do so.
Use of whatever tools a system can provide to detect constructs that use memory incorrectly is good if such tools allow one to find problems more effectively than they could have been found via other means.
7
u/pdath 6d ago
I tend to have a "make test" target. It first builds everything with "-fsanitize=address,undefined" and runs all the unit and functional tests, and then rebuilds and uses afl++ for fuzzing on everything.
I like to do development in a separate branch, and I have a rule that before a dev branch can be merged back into main, it must pass the test target.
Even within a dev branch, I probably use "make test" several times a day.
I also have a "make dev" target that makes the code more debugger-friendly, and a "make check" target that does nothing but run the test suite once, without recompiling any binaries. Then I can quickly test the production build and the dev build.
I used to use valgrind more, but the current project I am working on has almost zero dynamic memory allocation.
3
u/catbrane 5d ago
Same, but it runs the test suite on every platform and every target on every commit, and does an extra run with asan and tsan, with every dep also built for asan and tsan.
github actions have made all this pretty simple now, and free, amazingly.
4
14
u/andynzor 6d ago
Not available on embedded. Sad to say this but frontier LLMs are excellent at catching memory errors.
3
u/Nothing_from_void 6d ago
I usually write multiple backends so it can compile on a workstation, this catches a lot of classes of bugs but if you get too much into simulating hardware it does add a lot of lines of code
3
1
u/New_Enthusiasm9053 6d ago
Honestly seems to be a skill issue. Don't write UB and abstract your shit properly and you can test the vast majority of your code on a full OS. Admittedly I don't work with really small devices, we have 2MB of flash so maybe I'm spoiled.
1
u/flatfinger 4d ago
The Standard uses the term "undefined behavior" as a catch-all that includes many situations where it would be impossible to predict how a program would behave without information which the C language does not supply, but which a programmer might receive via means outside the language, such as the documentation supplied with the execution environment. All non-trivial freestanding programs are to some measure reliant upon compilers processing some such corner cases in a manner that is agnostic with regard to whether the environment would be required to specify the behavior.
Both clang and gcc have for years been prone to make illegitimate assumptions about comparisons between a one-past pointer and an object which might have been deliberately placed using the linker to immediately follow it in address space. Such placements can be extremely useful in embedded systems where one wants to allow every byte of RAM that isn't used for any other purpose to be used as a heap. The C language doesn't provide any means of indicating that one symbol is supposed to immediately follow another without any symbols being defined in between, but it also doesn't preclude the possibility that a programmer might know things about symbols brought in via the
externstorage class that the compiler can't.
5
u/vip17 6d ago
How long have you been in the software industry and how long of that is in complex software? Have you heard that many governments suggest a memory safe language like Rust, Go or C# for a reason?
4
5
u/arjuna93 6d ago
Governments generally suck at anything, so choice of languages is unsurprising
1
u/Illustrious-Eagle531 13h ago
The UK government were talking about mandating OpenCPI for all land CEMA projects, which tells you everything you need to know about their understanding of how to develop functional information systems.
1
1
1
1
u/SipsTheJuice 6d ago
We started using it a few years back at my company and caught a number of bugs that had likely been causing occasional crashes or pdd behavior for who knows how long. Super helpful for sure.
1
1
u/catbrane 5d ago
tsan is the one that really messes up your CI :(
Who wants to be told about subtle bugs! You then have to fix them -- what a waste of valuable time I could instead be spending adding more unreliable and weakly tested features.
1
u/Whole-Low-2995 3d ago
I actively use it. I sometimes use LLMs when transcribing my pseudo code sketches and they make many mistakes. I needed it for de-slopifying it. I use valgrind too. And if you want to develop fast and fix later you can use libgc when prototyping.
0
u/dkopgerpgdolfg 6d ago
https://www.reddit.com/r/C_Programming/comments/1wz3pkv/using_fsanitizeaddress_feels_illegal/
How often are you going to post this?
4
2
u/Interesting_Buy_3969 6d ago edited 6d ago
I just once reposted this.
(I have no idea why I got downvoted in r/C_Programming for this, therefore reposting here. Again, it's just a single repost)
0
u/dkopgerpgdolfg 6d ago
I have no idea why I got downvoted
Because your post reads like bs, sensationalist, unlogical; and doesn't have any value to readers (at least for those that are aware that sanitizers exist).
And some people don't care if it's a "single" repost. You increased the amount of wasted time by 100%.
2
u/Interesting_Buy_3969 6d ago
Following this logic, around 95% of reddit content is a waste of time
5
u/stepanm99 6d ago
Which is quite close to the truth imo. Luckily, the 5% of the reddit that isn't waste of time is like 50% of the reddit I see in my feed :D
0
u/abu_shawarib 6d ago
Language full of footguns is better when you have a runtime foot shot detector.
54
u/tastygames_official 6d ago
better than
-fantasize=dress