C++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...
summary
Microsoft compilers gain AddressSanitizer support and an enhanced open-source runtime that hooks malloc/new/memcpy, produces shadow bytes, and reports zero false positives; teams compile Office and ISV code, find a longstanding compiler allocation-size bug, and run fuzzing on 40-cloud cores via Azure-powered fuzzing directly from Visual Studio. The service executes ~25M inputs per job, surfaces ~7K unique exceptions into reproducible snapshot files, lets developers RDP into the failing VM to debug, and costs about 2x runtime overhead for instrumented runs.
AI-written summary · about
chapters (23)
- 0:00Introduction to talk
- 1:58Address Sanitizer background
- 3:45Why correctness is hard
- 7:43Address Sanitizer explained
- 12:43Memory corruption example
- 16:38Shadow memory mechanism
- 18:47Microsoft's legacy code demo
- 20:34Fuzzing overview
- 24:14Microsoft Security Risk Detection
- 27:23Compiling plus fuzzing benefits
- 28:07Development workflow
- 31:20Snapshot files explained
- 33:18Live demo setup
- 37:09Cloud failure handling
- 40:11Remote debugging session
- 44:16Demo results summary
- 44:57Availability and next steps
- 45:19Performance overhead Q&A
- 46:22Other sanitizers Q&A
- 47:48Fuzzing seeds Q&A
- 48:31Source control Q&A
- 49:15Visual Studio integration Q&A
- 49:55Testing challenges Q&A
related talks
01h 29mAddressSanitizer on Windows
36mCode Analysis: Empowering developers to write performant, reliable, and safe C++
52mIntroducing Microsoft’s New Open Source Fuzzing Platform
59mBeyond Sanitizers...
01h 02mSanitize your C++ code
24mWhy you should be using automated fuzzing to test for security issues in your code
01h 06mmemory-safe C++
29mSecuring C code that seems to work just fine