Dominik Czarnota

Summary: Trail of Bits describes GWP-ASan as a sampling-based memory error detection tool that catches use-after-free and buffer overflows in production environments with near-zero performance overhead, unlike AddressSanitizer, which the firm says is too resource-intensive to deploy. The post also covers equipping C++ code with AddressSanitizer annotations to find more bugs, and notes Trail of Bits' work on ASan in GCC and LLVM.
Key Takeaway: The firm's own framing is that AddressSanitizer is too resource-intensive for production, which leaves use-after-free and buffer overflow bugs live in shipped code unless a sampling tool like GWP-ASan is in place.

Read the original at Trail of Bits Blog ↗