retoorandClaude Opus 4.8
79ae6f27da
Response to incident WA-2026-10-27 (the std::vector max_size() crash). Deep research archived under research/safe-cpp-practices (8 Tier 1, 37 Tier 2, 2 conclusions) on production-safe C++ that keeps development speed: OpenSSF compiler hardening, the C++ Core Guidelines bounds profile, integer-overflow practice, libFuzzer/sanitizer CI, the sanitizer overhead ladder, clang-tidy ratchets. The research prescribed an ASan+UBSan+_GLIBCXX_ASSERTIONS build of the parsers. Standing it up immediately caught a second, independent undefined-behavior bug that two manual reviews had missed: a protobuf varint loop that shifted by up to 70 bits (shift >= 64 is UB) on malformed input. Fixed and guarded by a deterministic test and the sanitizer net. - src/whatsapp/wa_proto.cpp: guard the wire-0 varint shift (the UB). - tests/whatsapp_test.cpp: add an overlong-varint hostile case. - tools/san-whatsapp.sh: the standing sanitizer net for detz::wa parsers. - WaClient frame capture: a frame that fails to decode/dispatch has its exact bytes recorded to <home>/whatsapp/last-error.log (bounded), so the still unreproduced live <iq> failure becomes a one-paste deterministic fix. Wired from the wizard and the whatsapp_send tool. - docs/cpp-safety.md: the project-wide playbook and design decisions (four layers: overflow-safe checked-reader parsing, cheap release hardening, the sanitizer test net, capture). docs/whatsapp.md section 13.6 records the follow-up and the honest open item. AGENTS.md makes it a standing rule; cap.md and mcp.md inherit it for their wire parsers. Verified: build, whatsapp_test (incl. hostile+fuzz), make lint, and tools/san-whatsapp.sh all green; research audit PASS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Sanitizer overhead and the debug/test/release maturity ladder
|
|
|
|
## Metadata
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Institute | Molodetz Institute — Research & Retrieval Division |
|
|
| Subject | safe-cpp-practices |
|
|
| Document type | Source Dossier |
|
|
| Tier | 1 |
|
|
| Source title | Sanitizer overhead and the debug/test/release maturity ladder |
|
|
| Source URL | https://microblink.com/be-wise-sanitize-keeping-your-c-code-free-from-bugs/ |
|
|
| Source publisher / author | Microblink; Meeting C++ 2025 (Bloomberg); Sanitizers Handbook |
|
|
| Source type | blog post |
|
|
| Source date (published) | Unknown — not stated |
|
|
| Date researched | 2026-10-27 |
|
|
| Researched by | tai (agent), model: Claude Opus 4.8, on behalf of retoor |
|
|
| Research method | web search synthesis |
|
|
| Confidence | Medium |
|
|
| Status | Active |
|
|
|
|
## Summary
|
|
|
|
Sanitizers are a debug/test/fuzz tool, not a release one, because of their cost; cheap hardening flags stay on in release. Measured overheads: ASan ~2-3x, TSan ~5-15x, UBSan ~1.25x.
|
|
|
|
## Key findings
|
|
|
|
- ASan roughly 2-3x slowdown; TSan 5-15x; UBSan about 1.25x CPU and no memory overhead.
|
|
- Sanitizers are too expensive for release; they belong in debug, test and fuzz builds.
|
|
- Cheap hardening (fast hardening mode, stack-protector-strong) stays on in release.
|
|
- A maturity ladder: local developer runs -> sanitizer CI -> nightly sanitizer suites -> fuzzing sanitizer jobs.
|
|
- RAII and the rule of zero cost nothing at runtime and shrink the bug surface sanitizers must cover.
|
|
|
|
## Pros / strengths
|
|
|
|
Gives the numbers needed to decide what gates release vs test; the ladder is a clear adoption plan.
|
|
|
|
## Cons / limitations / caveats
|
|
|
|
Overhead figures vary by workload; blog/conference sourcing, not measured on detz.
|
|
|
|
## Relevance to tai
|
|
|
|
Justifies detz's split: release gets the overflow-safe checks plus cheap libstdc++ assertions; the sanitizer net (ASan+UBSan) runs in the test suite, where it already caught a real UB varint bug.
|
|
|
|
## Changelog
|
|
|
|
| Date | Change |
|
|
|---|---|
|
|
| 2026-10-27 | Initial dossier created (web search synthesis). |
|