Android Sanitizer is a powerful toolset to debug (Part I)

When it comes to native development, it’s important to have a proper toolset to debug. In 2012 Google introduces a class of tools called code sanitizer to detect program bugs. The first tool was the address sanitizer enabled memory corruption detection by using shadow memory. Though some sanitizers are available out of the Android scope, our focus will be on Android sanitizer. In continuation, I will try to cover the available sanitizers in Android and give you a big picture of what they do.

Address Sanitizer (ASan)

ASan is a compile-based tool introduced with Android O (API level 27) running on both ARM and X86 architecture (32-bit & 64-bit) to detect memory bugs such as:

1. Stack and heap buffer overflow/underflow
2. Heap use after free
3. Stack use outside scope
4. Double free/wild free

Just notice that it does not support Java/Kotlin applications but can be enabled in the JNI libraries. But then it will have an overhead that does not work on devices with only 2GB memory.

Enabling ASan leads to having an overhead on code size, memory usage and performance. The code size can be increased between 50% to 2X, the CPU overhead will be about 2X and memory usage is at least 2X based on your memory allocation pattern.

Android.bp

cc_binary{
...
    sanitize: ["address"],
...
}

Android.mk

...
LOCAL_SANITIZE := address
...

There some parameters can be sent to Android Adress Sanitizer through sanitize_extra_flags :

1. detect_leaks
2. halt_on_error
3. alloc_dealloc_mismatch
4. check_initialization_order
5. coverage
6. fast_unwind_on_fatal

example

cc_binary {
...
    sanitize: ["address"],
    sanitize_extra_flags: [
        "detect_leaks=1",
        "fast_unwind_on_fatal=1",
    ],
...
}

HWAddress Sanitizer (HWASan)

HWAsan is introduced in Android 10 (API 29) and NDKr21 which only supports ARM 64-bit. In favour of that ASan os is deprecated for ARM 64-bit in Android 11. HWAsan supports similar detection tools/features with some exceptions:

1. Much smaller memory overhead (10% – 35%) compared to ASan.
2. Stack use after return. (The extra detection)

Android.bp

cc_binary {
...
    sanitize: ["hwaddress"],
...
}

or

cc_binary {
...
    sanitize: {
        hwaddress: true,
    },
...
}

Android.mk

...
LOCAL_SANITIZE := hwaddress
...

There are some flags that can be used with HWAsan:

1. detect_container_overflow
2. detect_stack_use_after_return
3. fast_unwind_on_fatal
4. log_path
5. max_history_size
6. report_globals
7. verbosity

example

... 
   sanitize: {
        hwaddress: true,
        extra_flags: [
            "detect_container_overflow=0",
            "detect_stack_use_after_return=1",
        ],
    },
...