ASAN: turn on more not-enabled-by-default options

fanquake commented at 9:48 am on August 13, 2025: member

strict_string_checks=1:

If true, check that string arguments are properly null-terminated.

detect_invalid_pointer_pairs=2:

If non-zero, try to detect operations like <, <=, >, >= and - on invalid pointer pairs (e.g. when pointers belong to different objects).

See https://github.com/google/sanitizers/wiki/AddressSanitizerFlags.

test: add strict_string_checks to ASAN options

https://github.com/google/sanitizers/wiki/AddressSanitizerFlags

> If true, check that string arguments are properly null-terminated.

4c946e5452

test: add detect_invalid_pointer_pairs to ASAN options

https://github.com/google/sanitizers/wiki/AddressSanitizerFlags

> If non-zero, try to detect operations like <, <=, >, >=
> and - on invalid pointer pairs (e.g. when pointers belong to
> different objects).

9445aff6b6

DrahtBot commented at 9:48 am on August 13, 2025: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33180.

Reviews

See the guideline for information on the review process. A summary of reviews will appear here.

in ci/test/03_test_script.sh:11 in 9445aff6b6

 7@@ -8,7 +8,7 @@ export LC_ALL=C.UTF-8
 8 
 9 set -ex
10 
11-export ASAN_OPTIONS="strict_string_checks=1:detect_leaks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
12+export ASAN_OPTIONS="strict_string_checks=1:detect_invalid_pointer_pairs=2:detect_leaks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"

stickies-v commented at 1:39 pm on August 13, 2025:

in 9445aff6b6f4f64c1b63bf9ffe77789f4a65aa0e:

It doesn’t look like we’re currently instrumenting with pointer-compare and pointer-subtract sanitizers, so I’m not sure this will actually catch anything until that’s changed?

When I instrument with -DSANITIZERS=address,pointer-compare,pointer-subtract, I get an ASan failure with ASAN_OPTIONS="detect_invalid_pointer_pairs=2". I can’t quite make sense of what’s triggering it, though.

 0=================================================================
 1==41213==ERROR: AddressSanitizer: invalid-pointer-pair: 0x6020000000d2 0x6020000000d0
 2    [#0](/bitcoin-bitcoin/0/) 0x000104fb35b4 in _GLOBAL__sub_I_bitcoind.cpp bitcoind.cpp
 3    [#1](/bitcoin-bitcoin/1/) 0x00019b27eef8  (<unknown module>)
 4    [#2](/bitcoin-bitcoin/2/) 0x00019b2bb898 in invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x140 (dyld:arm64e+0xfffffffffff93898)
 5    [#3](/bitcoin-bitcoin/3/) 0x00019b2db5c8 in invocation function for block in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0xec (dyld:arm64e+0xfffffffffffb35c8)
 6    [#4](/bitcoin-bitcoin/4/) 0x00019b2d8354 in mach_o::Header::forEachLoadCommand(void (load_command const*, bool&) block_pointer) const+0xcc (dyld:arm64e+0xfffffffffffb0354)
 7    [#5](/bitcoin-bitcoin/5/) 0x00019b2d9a94 in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0x78 (dyld:arm64e+0xfffffffffffb1a94)
 8    [#6](/bitcoin-bitcoin/6/) 0x00019b2bb368 in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x200 (dyld:arm64e+0xfffffffffff93368)
 9    [#7](/bitcoin-bitcoin/7/) 0x00019b27ecb0  (<unknown module>)
10    [#8](/bitcoin-bitcoin/8/) 0x00019b28666c  (<unknown module>)
11    [#9](/bitcoin-bitcoin/9/) 0x00019b27f45c  (<unknown module>)
12    [#10](/bitcoin-bitcoin/10/) 0x00019b283bec  (<unknown module>)
13    [#11](/bitcoin-bitcoin/11/) 0x00019b27f778  (<unknown module>)
14    [#12](/bitcoin-bitcoin/12/) 0x00019b2a0a1c  (<unknown module>)
15    [#13](/bitcoin-bitcoin/13/) 0x00019b263dfc  (<unknown module>)
16    [#14](/bitcoin-bitcoin/14/) 0x00019b2631d4 in dyld4::start(dyld4::KernelArgs*, void*, void*)::$_0::operator()() const+0xe8 (dyld:arm64e+0xfffffffffff3b1d4)
17    [#15](/bitcoin-bitcoin/15/) 0x00019b262b48 in start+0x176c (dyld:arm64e+0xfffffffffff3ab48)
18
190x6020000000d2 is located 0 bytes after 2-byte region [0x6020000000d0,0x6020000000d2)
20allocated by thread T0 here:
21    [#0](/bitcoin-bitcoin/0/) 0x0001071a36e4 in _Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4b6e4)
22    [#1](/bitcoin-bitcoin/1/) 0x000104fb350c in _GLOBAL__sub_I_bitcoind.cpp bitcoind.cpp
23    [#2](/bitcoin-bitcoin/2/) 0x00019b27eef8  (<unknown module>)
24    [#3](/bitcoin-bitcoin/3/) 0x00019b2bb898 in invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x140 (dyld:arm64e+0xfffffffffff93898)
25    [#4](/bitcoin-bitcoin/4/) 0x00019b2db5c8 in invocation function for block in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0xec (dyld:arm64e+0xfffffffffffb35c8)
26    [#5](/bitcoin-bitcoin/5/) 0x00019b2d8354 in mach_o::Header::forEachLoadCommand(void (load_command const*, bool&) block_pointer) const+0xcc (dyld:arm64e+0xfffffffffffb0354)
27    [#6](/bitcoin-bitcoin/6/) 0x00019b2d9a94 in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0x78 (dyld:arm64e+0xfffffffffffb1a94)
28    [#7](/bitcoin-bitcoin/7/) 0x00019b2bb368 in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x200 (dyld:arm64e+0xfffffffffff93368)
29    [#8](/bitcoin-bitcoin/8/) 0x00019b27ecb0  (<unknown module>)
30    [#9](/bitcoin-bitcoin/9/) 0x00019b28666c  (<unknown module>)
31    [#10](/bitcoin-bitcoin/10/) 0x00019b27f45c  (<unknown module>)
32    [#11](/bitcoin-bitcoin/11/) 0x00019b283bec  (<unknown module>)
33    [#12](/bitcoin-bitcoin/12/) 0x00019b27f778  (<unknown module>)
34    [#13](/bitcoin-bitcoin/13/) 0x00019b2a0a1c  (<unknown module>)
35    [#14](/bitcoin-bitcoin/14/) 0x00019b263dfc  (<unknown module>)
36    [#15](/bitcoin-bitcoin/15/) 0x00019b2631d4 in dyld4::start(dyld4::KernelArgs*, void*, void*)::$_0::operator()() const+0xe8 (dyld:arm64e+0xfffffffffff3b1d4)
37    [#16](/bitcoin-bitcoin/16/) 0x00019b262b48 in start+0x176c (dyld:arm64e+0xfffffffffff3ab48)
38
390x6020000000d0 is located 0 bytes inside of 2-byte region [0x6020000000d0,0x6020000000d2)
40allocated by thread T0 here:
41    [#0](/bitcoin-bitcoin/0/) 0x0001071a36e4 in _Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4b6e4)
42    [#1](/bitcoin-bitcoin/1/) 0x000104fb350c in _GLOBAL__sub_I_bitcoind.cpp bitcoind.cpp
43    [#2](/bitcoin-bitcoin/2/) 0x00019b27eef8  (<unknown module>)
44    [#3](/bitcoin-bitcoin/3/) 0x00019b2bb898 in invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x140 (dyld:arm64e+0xfffffffffff93898)
45    [#4](/bitcoin-bitcoin/4/) 0x00019b2db5c8 in invocation function for block in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0xec (dyld:arm64e+0xfffffffffffb35c8)
46    [#5](/bitcoin-bitcoin/5/) 0x00019b2d8354 in mach_o::Header::forEachLoadCommand(void (load_command const*, bool&) block_pointer) const+0xcc (dyld:arm64e+0xfffffffffffb0354)
47    [#6](/bitcoin-bitcoin/6/) 0x00019b2d9a94 in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const+0x78 (dyld:arm64e+0xfffffffffffb1a94)
48    [#7](/bitcoin-bitcoin/7/) 0x00019b2bb368 in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const+0x200 (dyld:arm64e+0xfffffffffff93368)
49    [#8](/bitcoin-bitcoin/8/) 0x00019b27ecb0  (<unknown module>)
50    [#9](/bitcoin-bitcoin/9/) 0x00019b28666c  (<unknown module>)
51    [#10](/bitcoin-bitcoin/10/) 0x00019b27f45c  (<unknown module>)
52    [#11](/bitcoin-bitcoin/11/) 0x00019b283bec  (<unknown module>)
53    [#12](/bitcoin-bitcoin/12/) 0x00019b27f778  (<unknown module>)
54    [#13](/bitcoin-bitcoin/13/) 0x00019b2a0a1c  (<unknown module>)
55    [#14](/bitcoin-bitcoin/14/) 0x00019b263dfc  (<unknown module>)
56    [#15](/bitcoin-bitcoin/15/) 0x00019b2631d4 in dyld4::start(dyld4::KernelArgs*, void*, void*)::$_0::operator()() const+0xe8 (dyld:arm64e+0xfffffffffff3b1d4)
57    [#16](/bitcoin-bitcoin/16/) 0x00019b262b48 in start+0x176c (dyld:arm64e+0xfffffffffff3ab48)
58
59SUMMARY: AddressSanitizer: invalid-pointer-pair bitcoind.cpp in _GLOBAL__sub_I_bitcoind.cpp
60==41213==ABORTING

ASAN: turn on more not-enabled-by-default options #33180

Code Coverage & Benchmarks

Reviews