Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Sanitizing 
All* The Things

Avatar for Greg Heo Greg Heo
September 12, 2017
Technology
0
60

Sanitizing 
All* The Things

Address sanitizer and thread sanitizer. What, why, how?
Avatar for Greg Heo

Greg Heo

September 12, 2017
Tweet

More Decks by Greg Heo

See All by Greg Heo
Concurrency From the Ground Up
Avatar for Greg Heo gregheo
0
210
The least you need to know about hashing in Swift
Avatar for Greg Heo gregheo
0
140
Shared Mutable State
Avatar for Greg Heo gregheo
0
470
Promises, Futures, and the Shape of Your Code
Avatar for Greg Heo gregheo
0
63
Shared, Exclusive, Mutable, Immutable
Avatar for Greg Heo gregheo
0
140
Getting Under Swift’s Skin
Avatar for Greg Heo gregheo
0
530
Sanitizing Threads for Fun & Profit
Avatar for Greg Heo gregheo
0
130
Thirteen Ways of Looking at a View Controller
Avatar for Greg Heo gregheo
0
130
Five Unbelievable Secrets of Reactive Programming the Experts Don't Want You to Know!
Avatar for Greg Heo gregheo
3
400

Other Decks in Technology

See All in Technology
ひとり情シスなCTOがLLMと始めるオペレーション最適化 / CTO's LLM-Powered Ops
Avatar for Mitsuki Ogasahara yamitzky
0
440
Javaで作る RAGを活用した Q＆Aアプリケーション
Avatar for Recruit recruitengineers
PRO
1
110
フィンテック養成勉強会#54
Avatar for フィンテック養成コミュニティ finengine
0
180
AIのAIによるAIのための出力評価と改善
Avatar for たまねぎ chocoyama
2
550
“社内”だけで完結していた私が、AWS Community Builder になるまで
Avatar for nagisa_53 nagisa53
1
390
Абьюзим random_bytes(). Фёдор Кулаков, разработчик Lamoda Tech
Avatar for Lamoda Tech lamodatech
0
340
セキュリティの民主化は何故必要なのか_AWS WAF 運用の 10 の苦悩から学ぶ
Avatar for Yoichi Satake (Yoh) yoh
1
150
「Chatwork」の認証基盤の移行とログ活用によるプロダクト改善
Avatar for kubell kubell_hr
1
160
解析の定理証明実践＠Lean 4
Avatar for H Segawa dec9ue
0
180
AIの最新技術＆テーマをつまんで紹介＆フリートークするシリーズ #1 量子機械学習の入門
Avatar for Takahiro Esaki tkhresk
0
140
Amazon S3標準/ S3 Tables/S3 Express One Zoneを使ったログ分析
Avatar for ShigeruOda shigeruoda
4
520
地図も、未来も、オープンに。 〜OSGeo.JPとFOSS4Gのご紹介〜
Avatar for wata909 wata909
0
110

Featured

See All Featured
Intergalactic Javascript Robots from Outer Space
Avatar for Vicent Martí tanoku
271
27k
JavaScript: Past, Present, and Future - NDC Porto 2020
Avatar for David Neal reverentgeek
48
5.4k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
229
22k
Faster Mobile Websites
Avatar for Dean Hume deanohume
307
31k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
231
18k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
346
40k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
30
5.8k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
134
9.3k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
273
40k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
28
5.4k

Transcript

  1. Sanitizing
 All* The Things tacow / September 2017 / @gregheo

  2. ❓ ✋

  3. None

  4. ✅

  5. None

  6. ‣ ASAN ‣ TSAN

  7. ‣ What? ‣ So what? ‣ How? ‣ Show me?

  8. Address Sanitizer allocated buffer unallocated!

  9. ‣ Buffer overflows ‣ Subtle bugs ‣ Security vulnerabilities

  10. None

  11. allocated buffer padding shadow memory poisoned poisoned OK

  12. asan_malloc malloc asan_free free Shadow memory check Pointer access

  13. Live Coding!

  14. Address Sanitizer Memory corruption & errors Security & crashes Custom

    malloc & free

  15. Thread Sanitizer memory buffer read write

  16. ‣ Race conditions ‣ Very subtle and
 difficult-to-reproduce bugs ‣

    Thread mismatch errors
  17. None

  18. ‣ Thread ID ‣ Timestamp ‣ Read or write? ‣

    Bytes accessed
  19. None

  20. Live Coding!

  21. Thread Sanitizer Data race detector Find race conditions & thread

    issues Thread IDs & timestamps

  22. Address Sanitizer Memory corruption & errors Security & crashes Custom

    malloc & free
  23. None

  24. @gregheo