https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126768
Bug ID: 126768
Summary: ASAN -fsanitize-address-use-after-scope incomplete
Product: gcc
Version: 16.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: cs at aibiot dot de
Target Milestone: ---
This code:
#include <stdio.h>
#include <stdlib.h>
void * test () {
void * ret = alloca (1024);
snprintf (ret, 1024, "use after free");
return ret;
}
int main () {
void * ret = test ();
puts (ret);
}
When compiled with
-g -std=c23 -D _DEFAULT_SOURCE -Og -Wall -Werror -Wextra -Wpedantic -Wshadow
-pipe -flto=auto -fPIC -fsanitize=address -fsanitize-address-use-after-scope -c
-o test.o test.c
linked with
-g -std=c23 -D _DEFAULT_SOURCE -Og -Wall -Werror -Wextra -Wpedantic -Wshadow
-pipe -flto=auto -fPIC -fsanitize=address -fsanitize-address-use-after-scope
-static-libasan -o test test.o
and run with
ASAN_OPTIONS =
strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1
./test
(unexpectedly) works with gcc 16.2.0, but (expectedly) fails with clang 22.1.8:
=================================================================
==1690372==ERROR: AddressSanitizer: stack-use-after-scope on address
0x7b1ebedf0020 at pc 0x55a2b3c51fd7 bp 0x7ffd1d9ff2d0 sp 0x7ffd1d9feaa0
It however works with a static allocation:
void * test () {
char buf[1024];
void * ret = buf;
snprintf (ret, 1024, "use after free");
return ret;
}
=================================================================
==1693457==ERROR: AddressSanitizer: stack-use-after-return on address
0x7bde0b3f0020 at pc 0x55ce02b88b82 bp 0x7ffefa83c770 sp 0x7ffefa83bf18
I understand that the use of alloca() is discouraged, but neither does gcc
detect the use-after-free during static analysis as it does with a
malloc()/free() pair, nor does its ASAN implementation catch the use.
