Why C++ Memory Bugs Are Killing Your Software and How Sanitizers Can Save You

Challenge

C/C++ provides powerful direct memory manipulation, but misuse leads to many problems; the Google Chromium team reports that around 70% of high‑severity security bugs are memory‑unsafety issues, half of which are use‑after‑free.

Why NetEase Cloud IM Faces Greater Challenges

As a provider of IM and RTC SDKs built with C/C++, NetEase Cloud IM must support many operating systems and development frameworks, making memory‑related bugs harder to locate.

Introduction to Sanitizers

Sanitizers are a set of tools developed by Google to detect common C/C++ memory errors. Their source code and algorithms are publicly available at https://github.com/google/sanitizers and they are implemented in LLVM clang, used by projects such as Chromium and Firefox.

The following image summarizes the individual sanitizers and their purposes:

In addition to memory errors, Sanitizers can detect other common bugs.

Advantages of Sanitizers

Integrated with compilers; major IDEs provide support, making them easy to use.

Supported by mainstream OS compilers, offering strong cross‑platform capability.

Higher usability and lower cost compared with similar tools.

Detect a wide range of error types with accurate diagnostics, speeding up problem localisation.

Compiler Support

Major compilers support Sanitizers to varying degrees:

LLVM clang : Full support; see official documentation.

Apple clang : Based on LLVM clang but lacks lsan; Instruments provides leak detection.

MSVC : Currently only supports asan; does not detect use‑after‑return errors.

GCC : Supports all sanitizers except msan.

What Every Programmer Should Know About Memory

A brief review of virtual memory, process address space, and memory‑error classification.

Virtual memory concepts are illustrated above.

Process memory layout is shown in the image.

Memory‑error classification according to sanitizer capabilities is illustrated.

C++ Language Standard’s View of Memory

C++ defines storage‑duration categories: dynamic (heap), automatic (stack), static (global), and thread‑local (since C++11). See cppreference for details.

Typical storage‑duration mapping:

Dynamic storage duration – heap object

Automatic storage duration – stack object

Static storage duration – global object

Thread storage duration – thread‑local object

The standard also defines object lifetime; accessing an object outside its lifetime is undefined behavior. See cppreference .

Future articles in this series will dive into specific error types for heap, stack, and global objects.

References

Memory safety: https://www.chromium.org/Home/chromium-security/memory-safety/

Introduction to Memory Unsafety for VPs of Engineering: https://alexgaynor.net/2019/aug/12/introduction-to-memory-unsafety-for-vps-of-engineering/

AddressSanitizerComparisonOfMemoryTools: https://github.com/google/sanitizers/wiki/AddressSanitizerComparisonOfMemoryTools

C++ object lifetime: https://en.cppreference.com/w/cpp/language/lifetime