Tech-ASan: Two-stage check for Address Sanitizer

2025-06-05

AI Summary

AddressSanitizer (ASan) incurs high runtime overhead due to frequent shadow memory accesses, limiting its practicality in large-scale software testing. To address this, we propose a two-stage lightweight checking mechanism that significantly accelerates ASan without compromising detection capability. First, we design a fast pre-checking algorithm based on magic-number comparison to avoid redundant shadow memory accesses. Second, we develop an optimizer that jointly eliminates loop-invariant checks and verifies red-zone consistency, enabling complete removal of statically decidable checks. Implemented in LLVM, our approach reduces average runtime overhead by 33.70% and 17.89% over native ASan and ASan--, respectively, on SPEC CPU2006. Furthermore, on the Juliet Test Suite, it reduces false negatives by 56 cases, demonstrating improved both efficiency and security assurance.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability
• Machine Learning: Hardware-aware ML
• Search and Optimization: Heuristic Search

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Address Sanitizer (ASan) is a sharp weapon for detecting memory safety violations, including temporal and spatial errors hidden in C/C++ programs during execution. However, ASan incurs significant runtime overhead, which limits its efficiency in testing large software. The overhead mainly comes from sanitizer checks due to the frequent and expensive shadow memory access. Over the past decade, many methods have been developed to speed up ASan by eliminating and accelerating sanitizer checks, however, they either fail to adequately eliminate redundant checks or compromise detection capabilities. To address this issue, this paper presents Tech-ASan, a two-stage check based technique to accelerate ASan with safety assurance. First, we propose a novel two-stage check algorithm for ASan, which leverages magic value comparison to reduce most of the costly shadow memory accesses. Second, we design an efficient optimizer to eliminate redundant checks, which integrates a novel algorithm for removing checks in loops. Third, we implement Tech-ASan as a memory safety tool based on the LLVM compiler infrastructure. Our evaluation using the SPEC CPU2006 benchmark shows that Tech-ASan outperforms the state-of-the-art methods with 33.70% and 17.89% less runtime overhead than ASan and ASan--, respectively. Moreover, Tech-ASan detects 56 fewer false negative cases than ASan and ASan-- when testing on the Juliet Test Suite under the same redzone setting.

Problem

• Reduces ASan runtime overhead via two-stage checks
• Eliminates redundant sanitizer checks without compromising safety
• Improves memory error detection efficiency in C/C++ programs

Innovation

• Two-stage check algorithm reduces shadow memory access
• Efficient optimizer eliminates redundant loop checks
• Implemented in LLVM for memory safety assurance