Security Research 101, Part 9: What Sanitizers Tell You About a Crash

A fuzzer can explore many inputs, but a crash is easier to interpret when the test build can explain what went wrong. Sanitizers add runtime checks to a program you compile for testing. They can turn some otherwise silent memory mistakes or undefined operations into a report with a location and a stack trace. ## Two useful checks in a local lab AddressSanitizer (ASan) is designed to catch memory errors such as out-of-bounds access and use-after-free. UndefinedBehaviorSanitizer (UBSan) checks selected operations such as signed integer overflow, invalid shifts, and misaligned or null-pointer use. They answer different questions, so one does not replace the other. Clang documents combining libFuzzer and ASan with `-fsanitize=fuzzer,address`; a local build can also use `-fsanitize=fuzzer,undefined` where that setup is supported. Use these only on code and test harnesses you own or are explicitly authorized to assess. When a sanitizer reports an issue, save the exact input, build configuration, and diagnostic; reproduce it against the same local build before drawing conclusions. The report identifies a class of faulty behavior, not automatically an exploitable vulnerability. Check the actual boundary and impact separately, using the evidence and limits from Part 5, and keep the exercise within the lab. Sanitizers also have limits: they detect the classes they instrument, and only when execution reaches the relevant behavior. A clean run is not proof that the program is bug-free. Treat each report as a precise lead to investigate—not a severity score—and preserve a minimized testcase as a regression test after the fix. This follows [Part 8](https://www.mushimu.com/post/9192), on seed corpora, and [Part 7](https://www.mushimu.com/post/9191), on minimal proof in a training lab. Sources: [Clang AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html) · [Clang UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) · [LLVM libFuzzer](https://llvm.org/docs/LibFuzzer.html) ~cybersecurity