Awesome Sanitizer

A curated list of sanitizer resources.

Sanitizers are dynamic tools that detect software bugs through compiler instrumentation, inserting runtime checks into the code during compilation. They are often paired with fuzzing, which uses random inputs to thoroughly test the instrumented code.

Contents

• C/C++
  • Address Sanity
  • Undefined Behavior
  • Data Races
  • Uninitialized Reads
  • Type Confusion
  • Dataflow Analysis
  • Sanitizer Unification
• Rust
  • Address Sanity
  • Undefined Behavior
  • Data Races
  • Uninitialized Reads
• GPU
  • Sanitizers by Vendors
  • Data Races
• Miscellaneous

---

C/C++

Address Sanity

• AddressSanitizer (Paper) - A fast address sanity checker.

  • AddressSanitizer (Clang Documentation) - Official Clang (LLVM) docs for Address Sanitizer.
  • wiki/AddressSanitizer - Address Sanitizer page in Google sanitizers wiki.
  • HOWTO: Use Address Sanitizer - Basic usage tutorial for Address Sanitizer.

• ASAN-- - Debloating Address Sanitizer.

• FuZZan - Efficient sanitizer metadata design for fuzzing.

• SANRAZOR - Reducing redundant sanitizer checks in C/C++ programs.

• RetroWrite - Statically instrumenting COTS binaries for fuzzing and sanitization.

• SafePM - A sanitizer for persistent memory.

• BoKASAN - Binary-only Kernel Address Sanitizer for effective kernel fuzzing.

• OBSan - An out-of-bound sanitizer to harden DNN executables.

• ASanity - On bug shadowing by early ASan exits.

• GWP-ASan - Sampling-Based Detection of Memory-Safety Bugs in Production.

• GIANTSAN - Efficient memory sanitization with segment folding.

• Top of the Heap - Efficient memory error protection of safe heap objects.

• ShadowBound - Efficient heap memory protection through advanced shadow metadata management and customized compiler optimization.

• CAMP - Compiler and allocator-based heap memory protection using boundary-checking instrumentation and escape tracking.

• IPEA-San - Pointer capability-based sanitizer for resource-constrained IoT firmware with stateless instrumentation.

• Sticky Tags - Efficient and deterministic spatial memory error mitigation using ARM MTE with persistent memory tags.

• CMASan - Custom Memory Allocator-aware Address Sanitizer.

• DFirmSan - DFirmSan: A lightweight dynamic memory sanitizer for Linux-based firmware

• RangeSanitizer - Detecting Memory Errors with Efficient Range Checks

• OLASan - Practical Object-Level Sanitizer with Aggregated Memory Access and Custom Allocator

• Beyond Tag Collision - Cluster-based memory management for tag-based sanitizers.

• PSan - Hybrid metadata scheme for efficient pointer checking combining fat pointers and shadow memory.

• NanoTag - Systems support for efficient byte-granular overflow detection on ARM MTE.

• FPN - Compiler-instrumented use-after-free prevention via fast pointer nullification at region-level metadata.

• QuickSafe: Targeted Hardening Against Memory Corruption - Targeted memory-corruption hardening with an ASan extension that traces faulting accesses to their originating allocations.

• PTSan - A practical memory safety sanitizer for C/C++ with pointer-object authority.

Undefined Behavior

• UndefinedBehaviorSanitizer (Clang Documentation) - Official Clang (LLVM) docs for Undefined Behavior Sanitizer.
  • Improving Application Security with UndefinedBehaviorSanitizer and GCC - Basic usage tutorial for Undefined Behavior Sanitizer in Oracle blog.
  • A Guide to Undefined Behavior in C and C++ - Basic usage tutorial for Undefined Behavior Sanitizer in John Regehr's blog.

Data Races

• ThreadSanitizer (Paper) - Data race detection in practice.

  • ThreadSanitizer (Clang Documentation) - Official Clang (LLVM) docs for Thread Sanitizer.
  • wiki/ThreadSanitizer - Thread Sanitizer page in Google sanitizers wiki.

• BINTSAN - A Binary-level Thread Sanitizer or Why Sanitizing on the Binary Level is Hard.

• DMARacer - Dynamic detection of vulnerable DMA race conditions in Linux kernel drivers.

• HawkSet - Automatic and efficient concurrent persistent memory bug detection via lockset analysis.

Uninitialized Reads

• MemorySanitizer (Paper) - Fast detector of uninitialized memory use in C++.

  • MemorySanitizer (Clang Documentation) - Official Clang docs.
  • wiki/MemorySanitizer - Google sanitizers wiki.

• MTSan - A feasible and practical memory sanitizer for fuzzing COTS binaries.

• FloatZone - Accelerating memory error detection using the floating point unit.

• MSET - Evaluating the effectiveness of memory safety sanitizers

• QMSan - QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing

• Janitizer - Rethinking Binary Tools for Practical and Comprehensive Security

• BSan - A Non-Intrusive and Comprehensive Binary-Level Memory Sanitizer

Type Confusion

• TypeSan - Practical type confusion detection.

• HexType - Efficient detection of type confusion errors for C++.

• CastSan - Efficient detection of polymorphic C++ object type confusions with LLVM.

• EffectiveSan - Type and memory error detection using dynamically typed C/C++.

• TCD - Statically detecting type confusion errors in C++ programs.

• T-PRUNIFY - Pruning redundant sanitizer checks by developer-implemented type checks.

• Type++ - Prohibiting type confusion with inline type information.

• Sourcerer - Channeling the void: precise type confusion detection covering void* casts.

Dataflow Analysis

• DataFlowSanitizer (Clang Documentation) - A general data flow analysis framework.

Sanitizer Unification

• CombiSan - Unifying Software Sanitizers for Comprehensive Fuzzing

---

Rust

Address Sanity

• AddressSanitizer (Rust Documentation) - Address Sanitizer for Rust.

• HWAddressSanitizer (Rust Documentation) - Hardware-assisted Address Sanitizer for Rust.

• ERASan - Efficient Rust Address Sanitizer.

• RustSan - Retrofitting AddressSanitizer for efficient sanitization of Rust.

• LiteRSan - Lightweight Memory Safety Via Rust-specific Program Analysis and Selective Instrumentation

• SafeFFI - Efficient sanitization at the boundary between safe and unsafe code in Rust and mixed-language applications.

Undefined Behavior

• Miri - Practical undefined behavior detection for Rust.

Data Races

• ThreadSanitizer (Rust Documentation) - Thread Sanitizer for Rust.

Uninitialized Reads

• MemorySanitizer (Rust Documentation) - Memory Sanitizer for Rust.
• MemTagSanitizer (Rust Documentation) - Memory tagging for Rust.

---

GPU

Sanitizers by Vendors

• NVIDIA: cuCatch - A debugging tool for efficiently catching memory safety violations in CUDA applications.
• AMD: Using the AddressSanitizer on a GPU - Document for AMD's GPU sanitizer.

Data Races and Others

• iGUARD - In-GPU advanced race detection.

• HiRace - Accurate and fast data race checking for GPU programs using source-code instrumentation.

• GPUArmor - Hardware-software co-design for efficient and scalable memory safety on GPUs.

• RedSan - A Redundant Memory Instruction Sanitizer for GPU Programs

• SafeRace - Assessing and addressing WebGPU memory safety in the presence of data races.

• TritonSan - Toward Precise Debugging of Triton Kernels via LLVM Sanitizers

• Triton-Sanitizer - A Fast and Device-Agnostic Memory Sanitizer for Triton with Rich Diagnostic Context

• SuperCollider - Scalable and effective data race detection for CUDA programs.

• CuSafe - Fast detection of memory safety vulnerabilities in CUDA programs.

---

Miscellaneous

• SoK: Sanitizing for security

• DySan - Dynamically sanitizing motion sensor data through adversarial networks.

• NeuralSanitizer - Detecting backdoors in neural networks.

• UBfuzz - Finding bugs in sanitizer implementations.

• WBSan - WebAssembly Bug Detection for Sanitization and Binary-Only Fuzzing

• MileSan: Detecting Exploitable Microarchitectural Leakage via Differential Hardware-Software Taint Tracking - RTL sanitizer for detecting exploitable microarchitectural information leakage using differential hardware-software taint tracking.

• Practical TFHE Ciphertext Sanitization for Oblivious Circuit Evaluation - Sanitizing homomorphic ciphertexts to protect circuit privacy during oblivious evaluation.

• Optimal String Sanitization Against Strategic Attackers

• ProSan - Utility-Based Prompt Privacy Sanitizer

• Resolution Without Dissent - In-path per-query DNS sanitization to defeat surreptitious communication.

• OS-Sanitizer - System-wide latent defect inference in Linux applications using eBPF.

• Anota - Annotation-based sanitizer framework for detecting business logic vulnerabilities.

• Prεεmpt - Sanitizing sensitive LLM prompts with format-preserving encryption and metric differential privacy.

---

Contributing

Please refer to the guidelines at contributing.md for details.