# 启用 Sanitizer
gcc -fsanitize=address -g -o hello main.c     # ASan
gcc -fsanitize=thread -g -o hello main.c      # TSan
gcc -fsanitize=undefined -g -o hello main.c   # UBSan

# 可以组合使用
gcc -fsanitize=address,undefined -g -o hello main.c

// asan_heap.c
#include <stdlib.h>
#include <stdio.h>

int main(void) {
    int *arr = (int *)malloc(5 * sizeof(int));
    arr[5] = 42;    // 堆缓冲区溢出！索引 5 超出 [0,4] 范围
    free(arr);
    return 0;
}

gcc -fsanitize=address -g -o asan_heap asan_heap.c
./asan_heap

==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000014
WRITE of size 4 at 0x602000000014 thread T0
    #0 0x55... in main asan_heap.c:6

0x602000000014 is located 0 bytes to the right of 20-byte region [0x602000000000,0x602000000014)
allocated by thread T0 here:
    #0 0x7f... in malloc
    #1 0x55... in main asan_heap.c:5

// asan_uaf.c
#include <stdlib.h>

int main(void) {
    int *p = (int *)malloc(sizeof(int));
    *p = 42;
    free(p);
    return *p;   // Use-After-Free！
}

gcc -fsanitize=address -g -o asan_uaf asan_uaf.c
./asan_uaf
# ==12345==ERROR: AddressSanitizer: heap-use-after-free on address ...

// asan_stack.c
#include <stdio.h>

int main(void) {
    int arr[5];
    arr[5] = 42;    // 栈缓冲区溢出！
    return 0;
}

// asan_leak.c
#include <stdlib.h>

void leak(void) {
    int *p = (int *)malloc(100);
    // 忘记 free(p)
}

int main(void) {
    for (int i = 0; i < 3; i++) {
        leak();
    }
    return 0;
}

gcc -fsanitize=address -g -o asan_leak asan_leak.c
./asan_leak
# ==12345==ERROR: LeakSanitizer: detected memory leaks
# Direct leak of 300 byte(s) in 3 object(s) allocated from:
#     #0 ... in malloc
#     #1 ... in leak asan_leak.c:4

# 通过环境变量控制 ASan
ASAN_OPTIONS="detect_leaks=1:halt_on_error=0:print_stats=1" ./program

# 常用选项
ASAN_OPTIONS="detect_leaks=1"            # 启用泄漏检测（默认开启）
ASAN_OPTIONS="detect_leaks=0"            # 禁用泄漏检测
ASAN_OPTIONS="halt_on_error=1"           # 遇到错误立即终止
ASAN_OPTIONS="print_stats=1"             # 打印统计信息
ASAN_OPTIONS="detect_stack_use_after_return=1"  # 检测栈 Use-After-Return
ASAN_OPTIONS="allocator_may_return_null=1"      # malloc 可能返回 NULL

# 输出格式
ASAN_OPTIONS="log_path=/tmp/asan_log"    # 输出到文件

// tsan_race.c
#include <pthread.h>
#include <stdio.h>

int shared = 0;

void *thread_func(void *arg) {
    (void)arg;
    for (int i = 0; i < 100000; i++) {
        shared++;    // 数据竞争！没有同步保护
    }
    return NULL;
}

int main(void) {
    pthread_t t1, t2;
    pthread_create(&t1, NULL, thread_func, NULL);
    pthread_create(&t2, NULL, thread_func, NULL);
    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    printf("shared = %d\n", shared);
    return 0;
}

gcc -fsanitize=thread -g -pthread -o tsan_race tsan_race.c
./tsan_race

==================
WARNING: ThreadSanitizer: data race (pid=12345)
  Write of size 4 at 0x... by thread T1:
    #0 thread_func tsan_race.c:8

  Previous write of size 4 at 0x... by thread T2:
    #0 thread_func tsan_race.c:8

  Location is global 'shared' at 0x...
==================

// tsan_deadlock.c
#include <pthread.h>

pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER;
pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER;

void *thread1(void *arg) {
    (void)arg;
    pthread_mutex_lock(&lock_a);
    pthread_mutex_lock(&lock_b);  // 等待 thread2 持有的 lock_b
    pthread_mutex_unlock(&lock_b);
    pthread_mutex_unlock(&lock_a);
    return NULL;
}

void *thread2(void *arg) {
    (void)arg;
    pthread_mutex_lock(&lock_b);
    pthread_mutex_lock(&lock_a);  // 等待 thread1 持有的 lock_a → 死锁！
    pthread_mutex_unlock(&lock_a);
    pthread_mutex_unlock(&lock_b);
    return NULL;
}

gcc -fsanitize=thread -g -pthread -o tsan_deadlock tsan_deadlock.c
./tsan_deadlock

// ubsan_test.c
#include <stdio.h>
#include <limits.h>

int main(void) {
    // 整数溢出
    int a = INT_MAX;
    int b = a + 1;   // 有符号整数溢出！
    printf("b = %d\n", b);

    // 除以零
    int c = 1;
    int d = 0;
    int e = c / d;   // 除以零！
    printf("e = %d\n", e);

    // 移位错误
    int f = 1;
    int g = f << 32;  // 移位量超出类型宽度（int 是 32-bit）

    return 0;
}

gcc -fsanitize=undefined -g -o ubsan_test ubsan_test.c
./ubsan_test

ubsan_test.c:7:15: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
ubsan_test.c:12:15: runtime error: division by zero
ubsan_test.c:17:17: runtime error: shift exponent 32 is too large for 32-bit type 'int'

# 启用特定检查
gcc -fsanitize=signed-integer-overflow    # 有符号整数溢出
gcc -fsanitize=shift                      # 移位错误
gcc -fsanitize=divide-by-zero             # 除以零
gcc -fsanitize=null                       # 空指针解引用
gcc -fsanitize=alignment                  # 对齐错误
gcc -fsanitize=bool                       # bool 类型错误
gcc -fsanitize=enum                       # 枚举值超出范围
gcc -fsanitize=bounds                     # 数组越界

# 启用所有 UBSan 检查
gcc -fsanitize=undefined -g -o test test.c

UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=1" ./test

# 检测到错误时继续运行（默认）
UBSAN_OPTIONS="halt_on_error=0" ./test

# ASan + UBSan（推荐开发使用）
gcc -fsanitize=address,undefined -g -fno-omit-frame-pointer -o test test.c

# TSan + UBSan（多线程项目）
gcc -fsanitize=thread,undefined -g -pthread -o test test.c

# 注意：ASan 和 TSan 不能同时使用！
# gcc -fsanitize=address,thread  # 错误：不兼容

CC = gcc
CFLAGS_COMMON = -Wall -Wextra -std=c17

# Debug 构建：启用 Sanitizers
ifdef ASAN
    CFLAGS_COMMON += -fsanitize=address
    LDFLAGS += -fsanitize=address
endif

ifdef TSAN
    CFLAGS_COMMON += -fsanitize=thread
    LDFLAGS += -fsanitize=thread
endif

ifdef UBSAN
    CFLAGS_COMMON += -fsanitize=undefined
    LDFLAGS += -fsanitize=undefined
endif

# 通用 Debug 标志
CFLAGS_DEBUG = -g3 -O0 -fno-omit-frame-pointer
CFLAGS_DEBUG += -fsanitize=address,undefined

# Release 标志
CFLAGS_RELEASE = -O2 -DNDEBUG

.PHONY: debug release test-asan test-tsan

debug:
	$(CC) $(CFLAGS_COMMON) $(CFLAGS_DEBUG) -o hello main.c

release:
	$(CC) $(CFLAGS_COMMON) $(CFLAGS_RELEASE) -o hello main.c

test-asan:
	$(CC) $(CFLAGS_COMMON) -fsanitize=address -g -o test test.c
	./test

test-tsan:
	$(CC) $(CFLAGS_COMMON) -fsanitize=thread -g -pthread -o test test.c
	./test

# 创建抑制文件
cat > suppress.txt << 'EOF'
# 忽略已知的第三方库问题
interceptor_via_fun:third_party_function
race:known_benign_race_function
EOF

# 使用抑制文件
ASAN_OPTIONS="suppressions=suppress.txt" ./test
TSAN_OPTIONS="suppressions=suppress.txt" ./test

// GCC 14+ 支持属性标记
__attribute__((no_sanitize("address")))
void known_unsafe_function(void) {
    // ASan 不检查此函数
}

__attribute__((no_sanitize("undefined")))
void suppress_ubsan(void) {
    // UBSan 不检查此函数
}

__attribute__((no_sanitize("thread")))
void suppress_tsan(void) {
    // TSan 不检查此函数
}