Beyond Sanitizers...
summary
Portfolio of runtime tools (AddressSanitizer, ThreadSanitizer, MemorySanitizer, UBSan) pairs with coverage‑guided fuzzing to find real bugs; libFuzzer runs in‑process with LLVM coverage and quickly finds issues (demo finds Heartbleed in seconds on decent hardware, distributed run finds many bugs over three days, including 17 GB RAM from 1KB input). LLVM implements hardening via -fsanitize=cfi,safe_stack; CFI restricts indirect/virtual calls, safe_stack separates locals from return addresses, Chrome builds with CFI show ~7–8% code growth and near‑zero CPU overhead.
AI-written summary · about
chapters (10)
- 0:00Introduction to sanitizers
- 6:57Limitations of sanitizers
- 7:19Improving test quality with fuzzing
- 16:17AFL and LibFuzzer overview
- 22:38Fuzzing demos and results
- 30:08Advanced fuzzing techniques
- 31:57Q&A on fuzzing and sanitizers
- 37:22Code hardening with CFI
- 44:30Safe stack for stack protection
- 49:52Summary and final Q&A
related talks
01h 02mSanitize your C++ code
01h 15mMake your programs more reliable with Fuzzing
25mHow fuzzing helps to find bugs
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++
50mC++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...
50mAddressSanitizer/ThreadSanitizer for Linux Kernel
24mWhy you should be using automated fuzzing to test for security issues in your code
52mStructure aware fuzzing