skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

address-sanitizer

Detect memory errors in C/C++ and Rust code during fuzzing with AddressSanitizer instrumentation.

Updated Apr 5, 2026
Search Tags:#memory safety#vulnerability detection#C/C++#AddressSanitizer#fuzzing#sanitizer#buffer overflow
One-click install
npx skills add https://github.com/marumo333/atrox --skill address-sanitizer-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: address-sanitizer
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/testing-handbook-skills/skills/address-sanitizer
Command: npx skills add https://github.com/marumo333/atrox --skill address-sanitizer-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Memory corruption bugs like buffer overflows and use-after-free errors often go unnoticed during testing and fuzzing, leading to undetected vulnerabilities in C/C++ and unsafe Rust code. ## Core Features & Use Cases - Compile-Time Instrumentation: Guides enabling ASan with -fsanitize=address in Clang/GCC to track memory allocations and detect illegal accesses at runtime. - Fuzzer Integration: Provides tool-specific setup for libFuzzer, AFL++, cargo-fuzz, and honggfuzz, including memory limit adjustments for ASan's 20TB virtual memory requirement. - Use Case: When fuzzing a C library with libFuzzer, compile the harness with -fsanitize=fuzzer,address and run with -rss_limit_mb=0 to catch heap-buffer-overflows that would otherwise crash silently. ## Quick Start Compile my fuzz target with AddressSanitizer enabled and configure the right ASAN_OPTIONS and memory limits for my fuzzer.

Frequently Asked Questions about address-sanitizer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable AddressSanitizer when fuzzing C code?▼

Compile and link with the -fsanitize=address flag using Clang or GCC, adding -g for better stack traces. For libFuzzer use -fsanitize=fuzzer,address, and for AFL++ set AFL_USE_ASAN=1 during compilation.

Why does my fuzzer kill the ASan-instrumented process immediately?▼

AddressSanitizer requires approximately 20TB of virtual memory for shadow memory, which exceeds default fuzzer memory limits. Disable restrictions with -rss_limit_mb=0 for libFuzzer or -m none for AFL++.

Can I use AddressSanitizer with Rust fuzz targets?▼

Yes, cargo-fuzz supports ASan via the --sanitizer=address flag. It is most useful for unsafe Rust code, raw pointers, and C library FFI boundaries, since safe Rust already prevents many memory errors.

Should AddressSanitizer be used in production builds?▼

No, ASan should only be used for testing and fuzzing because it can reduce application security and adds 2-4x performance overhead. It also has limited support on Windows and macOS compared to Linux.

How do I disable leak detection in AddressSanitizer output?▼

Set ASAN_OPTIONS=detect_leaks=0 to disable LeakSanitizer reports. This is recommended during fuzzing since leaks do not cause immediate crashes and clutter the output, though they should be reviewed at campaign end.

Related Skills

Explore More Software Engineering Skills→
TECH-HYTECH-HY

libfuzzer

Fuzz C/C++ code with LLVM's coverage-guided in-process fuzzer and Clang sanitizers.

Official
Advanced
karenrebecagkarenrebecag

crash-analysis

Analyzes crash dumps and assesses exploitability using WinDbg, GDB, and sanitizers.

Community
Advanced
Ramprasad4121Ramprasad4121
1

ruzzy

Fuzz pure Ruby code and C extensions with coverage-guided libFuzzer.

Community
Advanced
multicammulticam

valgrind

Interpret Valgrind memcheck output to identify memory errors in C/C++ programs.

Community
Intermediate