My parser read past the input. AddressSanitizer stayed quiet.
I gave a deliberately broken parser three bytes. It read byte four. AddressSanitizer said nothing. Then I changed the allocation around the input. Same parser, same three bytes, same compiler flags: heap-buffer-overflow . There it was. 🧪 The bug hadn't appeared between runs. My first test had given it somewhere comfortable to hide. What I Built I made a small C reproducer for a fuzz-harness…
A deliberately flawed parser was tested with three bytes of input, but it read the fourth byte. AddressSanitizer, a tool that detects memory errors, remained silent. The issue only appeared when the allocation around the input was changed. The programmer created a small C program to reproduce the bug, where the input length can be smaller than the allocated memory.
Chris Wellons explains this issue in his AFL++ guide, which is gaining attention again in the fuzzing community. The problem occurs when a reusable input buffer is passed directly into a target program. AddressSanitizer can't automatically understand the meaning of length arguments in an API, so it needs to be explicitly informed.
The demonstration shows a program that writes beyond the input's boundaries, but only when the larger buffer is used. The fix is to allocate space for the terminating zero in the input length, ensuring the allocation boundary matches the intended logical input length. This prevents AddressSanitizer from missing the heap-buffer-overflow error.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.