Address Sanitizer with Visual C++：忽略读取缓冲区溢出，同时仍捕获写入缓冲区溢出

Question

Consider the following example:

int main()
{
    char* p = new char[10];
    
    srand(p[11]); // heap buffer overflow - read

    p[11] = rand(); // heap buffer overflow - write
}

I want ASan not to flag heap buffer overflow - read for now, while still flagging heap buffer overflow - write .

The reason I want this is to concentrate on more dangerous errors for now. Read overflow either crash immediately or don't have consequences, whereas write overflow may cause corruption that would trigger elsewhere later. For some small overflows, even immediate crash is excluded. So sure I'd look into read overflows too, but later.

Is there a way to accomplish this?

Answer 1

理论上，向 CL 包装器提供-mllvm -asan-instrument-reads=false应该禁用读取检测。

Answer 2

Apparently this is impossible with MSVC currently.

To continue after an error, -fsanitize-recover=address option should be used. From FAQ :

Q: Can AddressSanitizer continue running after reporting first error?

A: Yes it can, AddressSanitizer has recently got continue-after-error mode. This is somewhat experimental so may not yet be as reliable as default setting (and not as timely supported). Also keep in mind that errors after the first one may actually be spurious. To enable continue-after-error, compile with -fsanitize-recover=address and then run your code with ASAN_OPTIONS=halt_on_error=0 .

This option is not yet suppored by MSVC. There's an issue to add it.