{
  "id": 17787778,
  "title": "My parser read past the input. AddressSanitizer stayed quiet.",
  "url": "https://urgent.news/2026/11/02/my-parser-read-past-the-input-addresssanitizer-stayed-quiet",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T11:35:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/panditshivam/my-parser-read-past-the-input-addresssanitizer-stayed-quiet-4mbi"
  },
  "original_language": "en",
  "account": "A deliberately flawed parser was tested with three bytes of input, but it read the fourth byte. AddressSanitizer, a tool that detects memory errors, remained silent. The issue only appeared when the allocation around the input was changed. The programmer created a small C program to reproduce the bug, where the input length can be smaller than the allocated memory. Chris Wellons explains this issue in his AFL++ guide, which is gaining attention again in the fuzzing community. The problem occurs when a reusable input buffer is passed directly into a target program. AddressSanitizer can't automatically understand the meaning of length arguments in an API, so it needs to be explicitly informed. The demonstration shows a program that writes beyond the input's boundaries, but only when the larger buffer is used. The fix is to allocate space for the terminating zero in the input length, ensuring the allocation boundary matches the intended logical input length. This prevents AddressSanitizer from missing the heap-buffer-overflow error.",
  "summary": "I gave a deliberately broken parser three bytes. It read byte four. AddressSanitizer said nothing. Then I changed the allocation around the input. Same parser, same three bytes, same compiler flags: heap-buffer-overflow . There it was. 🧪 The bug hadn't appeared between runs. My first test had given it somewhere comfortable to hide. What I Built I made a small C reproducer for a fuzz-harness…",
  "key_points": [
    "Parser read beyond input's fourth byte",
    "AddressSanitizer failed to detect error",
    "Fix involves allocating space for zero"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}