[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: OK, great, let's see what happens! -- resolution: -> fixed stage: -> resolved status: open -> closed ___ Python tracker ___ _

[issue21037] add an AddressSanitizer build option

Stefan Krah added the comment: The VM is set up. It's on an external unreliable host though. :) -- ___ Python tracker ___ ___ Python-b

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: I just pushed the patch. Stefan, did you have time to setup a buildbot? -- ___ Python tracker ___

[issue21037] add an AddressSanitizer build option

Roundup Robot added the comment: New changeset 17689e43839a by Charles-François Natali in branch 'default': Issue #21037: Add a build option to enable AddressSanitizer support. http://hg.python.org/cpython/rev/17689e43839a -- nosy: +python-dev ___ Pyt

[issue21037] add an AddressSanitizer build option

Stefan Krah added the comment: Antoine, if you send me the buildbot credentials, we can get started. Environment vars: CC=clang ASAN_OPTIONS="allocator_may_return_null=1,handle_segv=0" I suggest to compile the release build, just --with-address-sanitizer. -- ___

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: > Being a correctness tool hipster, of course I already have the latest toy. :) > The patch works on Debian 64-bit + clang. Thanks for testing it. I'll leave a few days more in case anyone has a comment, and I'll commit. > I can set up a VM. That wo

[issue21037] add an AddressSanitizer build option

Stefan Krah added the comment: > Hmm... perhaps Stefan would like to set something up? Being a correctness tool hipster, of course I already have the latest toy. :) The patch works on Debian 64-bit + clang. I can set up a VM. We may have to react quickly to some of the issues. Then again, an

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: > How do we spot any ASAN issues, though? Does ASAN change the process' return > code on errors? It aborts: $ cat /tmp/test.c int main(int argc, char *argv[]) { int bar[16] = {0}; /* oops */ return bar[16]; } $ gcc -Wall -fsanitize=address

[issue21037] add an AddressSanitizer build option

Antoine Pitrou added the comment: How do we spot any ASAN issues, though? Does ASAN change the process' return code on errors? -- ___ Python tracker ___

[issue21037] add an AddressSanitizer build option

Antoine Pitrou added the comment: > I guess we could go for any non-stable buildbot meeting the following > > criteria: > - Linux 64-bit > - clang >= 3.1 or gcc >= 4.8 Hmm... perhaps Stefan would like to set something up? -- nosy: +skrah ___ Python

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: > That said, it would be better if you first check said options work locally. I wasn't clear, but I did test it, and it works: the only problem I encountered is address space exhaustion: I have a 32-bit box, and ASAN uses a lot of virtual address space

[issue21037] add an AddressSanitizer build option

Antoine Pitrou added the comment: > But I'm not really familiar with the buildbot support, so if anyone > has a clue... I can add environment variables and configure options specific to a buildbot. Just tell me which ones (and which buildbot (preferably yours ? :-)). That said, it would be bet

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: I'd like to move this forward: it could IMO be a great way to proactively detect potential security defects, and nasty stack/heap/memory corruption in general. The remaining - missing - part is buildbot integration: AFAICT the only specific thing to

[issue21037] add an AddressSanitizer build option

Charles-François Natali added the comment: Note that ASAN will interfere with the faulthandler's module (since it sets up its own signal handlers), so if we were to incorporate it into the test suite, that's something we should look after. -- ___ Py

[issue21037] add an AddressSanitizer build option

New submission from Charles-François Natali: Adding a compile option to build with ASAN (https://code.google.com/p/address-sanitizer) could allow us to catch many memory-related errors (stack/buffer overflows, etc). Of course, the second step would be to setup buildbots to use this flag.