PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Sanitize your C++ containers: ASan annotations step-by-step

blog.trailofbits.com | blog | #memory-safety | #llvm | #cpp | #trail-of-bits | #asan | #gcc | #container-overflow
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A step-by-step guide to ASan container annotations for detecting container-overflow bugs in C++ std::vector, std::string, and std::deque, plus Trail of Bits' contributions to libc++ and GCC.
Published
Collected

Related coverage

blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
blog · osec.io
Compiler bug causes compiler bug: how a 12-year-old g++ bug took down Solidity
OtterSec explains how a 12-year-old G++ overload-resolution bug, C++20 comparison rewrites and legacy Boost code crash Solidity's compiler (solc) on valid code — and how to fix it.
research · blog.quarkslab.com
Back from CppCon 2016
Trip report from CppCon 2016: the C++ Costless Abstractions talk, SCM challenge puzzles, a uftrace poster and sessions on undefined behavior, plus the takeaway that there is always more C++ to learn.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
Back