AD2046: EnableAddressSanitizerPE¶

Summary¶

Description¶

PE binaries used for testing should consider enabling AddressSanitizer (ASAN) to detect memory safety issues like buffer overflows and use-after-free.

Note: This is an informational rule. ASAN is typically used in testing, not production.

How It Works¶

The rule checks for ASAN runtime symbols:

1. __asan_* function family
2. ASAN shadow memory setup
3. Runtime library linkage

Why This Matters¶

Memory safety bugs account for approximately 70% of security vulnerabilities in large C/C++ codebases.

What ASAN Detects¶

ASAN on Windows¶

Performance Overhead¶

Acceptable for testing, not production.

Performance Considerations¶

ASAN has significant overhead—it is designed for testing, not production:

Test infrastructure planning:

When to use ASAN: - Development builds - CI/CD test runs - Fuzzing campaigns - Pre-release security testing

When NOT to use ASAN: - Production deployments - Performance benchmarking - Customer-facing builds

Example Detection¶

char buf[10];
buf[10] = 'x';  // Out-of-bounds write

// ASAN output:
// ERROR: AddressSanitizer: stack-buffer-overflow
// WRITE of size 1 at 0x7fff5e9c6c5a
// #0 main test.c:3

Resolution¶

Enable ASAN in test builds:

# MSVC
cl /fsanitize=address /Zi program.c

# Clang-CL
clang-cl -fsanitize=address -g program.c

CMake Configuration¶

if(MSVC AND ENABLE_ASAN)
    add_compile_options(/fsanitize=address)
endif()