Overview
This series examines CombiSan, a fuzzing-oriented sanitizer that combines ASan-class addressability checks, MSan-class initialization tracking, and selected UBSan checks in one execution. It moves from sanitizer state and early-stop behavior to shared shadow bits, candidate confirmation, and campaign evidence. The reported gains are conditional on target selection, dependency visibility, harness concurrency, replay, and workload; unified observation complements rather than replaces other detectors.
Learning outcomes
- Separate sanitizer jobs observe different stochastic input streams, so their reports are not equivalent to multi-detector observation of every input.
- CombiSan uses two shadow bits per program byte to preserve addressability and initialization as independent states.
- Deferred collection and selective confirmation can expose more signals without treating every uninitialized load as a confirmed UUM.
- Evidence supports conditional feasibility and campaign savings, not universal superiority or complete software assurance.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What problem does CombiSan solve?
CombiSan addresses the loss and cost created when ASan, MSan, and UBSan observe separate fuzzing executions or stop at the first report. It coordinates their observations on one input within its stated scope.
How does CombiSan combine ASan and MSan state?
CombiSan stores addressability and initialization as separate shadow bits for each program byte, so a valid but uninitialized byte remains distinct from an inaccessible one. This avoids incompatible ASan/MSan shadow layouts.
Is CombiSan faster than running sanitizers separately?
In the paper's tested fuzzing comparison, CombiSan's 4.68x geometric-mean slowdown with UB detection compared with 7.89x for sequential ASan-plus-UBSan and MSan, a reported 1.7x campaign-level advantage. The result is workload-specific.
Does CombiSan provide comprehensive software security coverage?
No. CombiSan covers the selected ASan-, MSan-, and UBSan-class conditions in its design, but not every memory defect, race, type confusion, logic error, kernel condition, or production security concern. Uninstrumented dependencies can remain partly invisible.