fsanitizememorytrackorigins

MemorySanitizer, accessible via the compiler flag -fsanitize=memory, is a runtime error detector in the LLVM Sanitizers suite designed to find uses of uninitialized memory in C and C++ programs. It instruments code so that every memory access consults a shadow memory that tracks whether each byte is defined or undefined. Before a memory read occurs, the sanitizer checks the corresponding shadow bytes; if any part of the read uses undefined data, it reports an error with a stack trace and the location of the offending read.

How it works: during compilation, each memory location is assigned a corresponding shadow location. The compiler inserts checks on loads to verify that the memory being read has been initialized. Stores mark memory as defined; memcpy, memset, and other aliasing operations are also accounted for. The result is detection of undefined reads rather than undefined writes, which MSan cannot always distinguish without additional instrumentation.

Usage: compile the program with -fsanitize=memory and link with the sanitizers runtime. Running the instrumented program yields error reports when an uninitialized read occurs, often with a detailed stack trace and source location. Debug builds with debug information and reduced optimization improve report quality. Limitations include performance and memory overhead, incomplete coverage for some library code or inline assembly, and potential false positives in certain edge cases (such as memory initialized by memset with non-deterministic patterns). It is most effective when combined with other sanitizers and thorough test suites.

History: MemorySanitizer was introduced as part of LLVM's sanitizers to address a long-standing class of defects: uninitialized reads, complementing AddressSanitizer and others.