Summary
This RFC proposes adding a new compiler flag -fsanitize-address-disable-container-overflow to AddressSanitizer that allows library developers to support disabling container overflow detection at compile time.
Motivation
AddressSanitizer’s container overflow detection can produce false positives in environments where all of the following are true:
- Application code is compiled with AddressSanitizer enabled
- Libraries/frameworks cannot be recompiled with sanitizers (e.g., system libraries, closed-source dependencies)
- Containers are accessed in sanitized and non-sanitized code
Currently, container overflow detection can be disabled at runtime via ASAN_OPTIONS=detect_container_overflow=0.
We’ve had feedback from users that it is not always possible to reliably control the runtime environment to set environment variables.
Previously it was possible to use a define on the command-line to control an #ifdef check used inside the libcxx container headers to disable the container overflow checks.
This was at best a hack as:
- it used an internal-only
__prefixed preprocessor variable (which has now been removed from libcxx). - it was tied to a specific implementation of the containers and was not portable.
In order to make this a portable feature we need a compiler option that can be checked via __has_feature or some other mechanism at compile time to indicate that the end user wants to disable the container overflow check.
Proposed Solution
Compiler Flag
Add -fsanitize-address-disable-container-overflow flag that:
- Only applies when
-fsanitize=addressor-fsanitize=kernel-addressis enabled - Provides compile-time control over container overflow detection
- Is marked as experimental since no standard library currently supports it
Feature Test Macro
Add __has_feature(sanitize_address_disable_container_overflow) that evaluates to:
- true when the flag is enabled
- false when the flag is disabled or is unimplemented
Recommended Usage Pattern
Library developers should use the pattern:
// In some container implementation
template<typename T>
void mycontainer<T>::resize(size_t new_size) {
// ... actual resize logic
// ... calculate beg, end, old_mid, new_mid
#if __has_feature(address_sanitizer) &&
!__has_feature(sanitize_address_disable_container_overflow)
__sanitizer_annotate_contiguous_container(beg, end, old_mid, new_mid);
#endif
// ... any additional resize logic
}
This pattern ensures:
- Annotations only included when AddressSanitizer is enabled
- Backward compatibility with compilers that don’t support the new feature test
- Users can disable container overflow checks when needed
User Compilation
Default: container overflow enabled
clang++ -fsanitize=address myapp.cpp
Disable container overflow to avoid false positives
clang++ -fsanitize=address -fsanitize-address-disable-container-overflow myapp.cpp
Backward Compatibility
The feature test pattern __has_feature(address_sanitizer) && !__has_feature(sanitize_address_disable_container_overflow) ensures:
- Existing behaviour is preserved with or without a compiler that implements the flag
- Libraries can adopt the pattern without breaking compatibility
Alternative Approaches Considered
- Runtime-only control: Current
ASAN_OPTIONS=detect_container_overflow=0approach has environment controllability limitations - Providing a default implementation of
const char* __asan_default_options()in a linkable object: This is complex to get correct and is very error prone.
Questions for Discussion
- Is this a good approach to support users who cannot recompile everything in their processes and cannot control the runtime environment?
- Should this be supported under
-fsanitize=kernel-address?
Timeline
This feature is implemented and ready for review: [clang] Add flag to disable container overflow checks at compile time. by padriff · Pull Request #159662 · llvm/llvm-project · GitHub
Looking forward to community feedback on this approach to improving AddressSanitizer’s usability in heterogeneous environments.