Sanitize your C++ containers: ASan annotations step-by-step

Summary: Trail of Bits added AddressSanitizer annotations to libc++'s std::string and std::deque containers, enabled custom allocators for container annotations, and fixed bugs in libc++ along the way. The work extended the compiler-rt ASan API in LLVM16 with the __sanitizer_annotate_double_ended_contiguous_container function, upstreamed std::deque annotations in LLVM17, and added long string annotations in LLVM18, with short string annotations landing in the git main branch.
Why it matters: A libc++ ABI function bug that gave std::basic_string an incorrect size was overlooked until annotations exposed it, and it will stay in libc++ ABIv1 forever despite a replacement; per vitalybuka's pre-LLVM17 evaluation cited in the post, the deque annotations detect roughly 10% more bugs than libc++ buffer hardening.

Read the original at Trail of Bits Blog ↗