You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The **`/fsanitize-coverage`** compiler options instruct the compiler to add various instrumentation points where user-defined functions are called. These options are primarily useful for fuzzing scenarios with **`/fsanitize=fuzzer`**. See the OneFuzz [documentation page](https://www.microsoft.com/en-us/research/project/project-onefuzz/) and [GitHub project](https://github.com/microsoft/onefuzz) for more information.
11
-
12
-
As of Visual Studio 2022 17.0, the follow options have experimental support: **`/fsanitize-coverage=edge`**, **`/fsanitize-coverage=inline-8bit-counters`**, **`/fsanitize-coverage=trace-cmp`**, **`/fsanitize-coverage=trace-div`**.
10
+
The **`/fsanitize-coverage`** compiler options instruct the compiler to add various kinds of instrumentation points where user-defined functions are called. These options are useful for fuzzing scenarios that use **`/fsanitize=fuzzer`**. For more information, see the [OneFuzz documentation](https://www.microsoft.com/en-us/research/project/project-onefuzz/) and [OneFuzz GitHub project](https://github.com/microsoft/onefuzz).
13
11
14
12
## Syntax
15
13
@@ -24,13 +22,31 @@ As of Visual Studio 2022 17.0, the follow options have experimental support: **`
24
22
25
23
## Remarks
26
24
27
-
The **`/fsanitize-coverage`** compiler options offer code coverage support and various options to modify which compiler-provided instrumentation is generated. Currently, all the options available are also ones that are automatically set when using [**`/fsanitize=fuzzer`**](fsanitize.md), which requires the instrumentation points and callbacks mentioned in these options. You do not need to provide the callbacks mentioned below when using **`/fsanitize=fuzzer`**.
25
+
In Visual Studio 2022 version 17.0, the following options have experimental support:
26
+
27
+
-**`/fsanitize-coverage=edge`**,
28
+
-**`/fsanitize-coverage=inline-8bit-counters`**,
29
+
-**`/fsanitize-coverage=trace-cmp`**,
30
+
-**`/fsanitize-coverage=trace-div`**.
31
+
32
+
The **`/fsanitize-coverage`** compiler options offer code coverage support and various options to modify which compiler-provided instrumentation is generated. All these options are automatically set when [`/fsanitize=fuzzer`](fsanitize.md) is specified. The **`/fsanitize=fuzzer`** option requires the same instrumentation points and callbacks mentioned in these options. You don't need to provide the callbacks mentioned below when using **`/fsanitize=fuzzer`**.
33
+
34
+
The **`/fsanitize-coverage`** option doesn't allow comma-separated syntax, for example: **`/fsanitize-coverage=edge,inline-8bit-counters,trace-cmp,trace-div`**. Specify these options individually.
35
+
36
+
The **`/fsanitize-coverage`** options are available beginning in Visual Studio 2022 version 17.0.
37
+
38
+
### Code coverage
39
+
40
+
The **`/fsanitize-coverage=edge`** compiler option enables code coverage instrumentation along all non-redundant edges. Use **`/fno-sanitize-coverage=edge`** to disable this option if it's already provided or implied by another option.
28
41
29
-
The **`/fsanitize-coverage=edge`** compiler option enables code coverage instrumentation along all non-redundant edges. Use **`/fno-sanitize-coverage=edge`** to disable this option if it has already been provided or implied by another option.
42
+
### Inline counters
30
43
31
-
The **`/fsanitize-coverage=inline-8bit-counters`** compiler option instructs the compiler to add an inline counter increment on every relevant edge. This option will also add a call to `extern "C" void __sanitizer_cov_8bit_counters_init(uint8_t *start, uint8_t *stop)` that will need to be implemented. The arguments correspond to the start and end of an array containing all the 8-bit counters created. Use **`/fno-sanitize-coverage=inline-8bit-counters`** to disable this option if it has been already provided or implied by another option.
44
+
The **`/fsanitize-coverage=inline-8bit-counters`** compiler option instructs the compiler to add an inline counter increment on every relevant edge. This option also adds a call to `extern "C" void __sanitizer_cov_8bit_counters_init(uint8_t *start, uint8_t *stop)` that you must implement. The arguments correspond to the start and end of an array that contains all the 8-bit counters created. Use **`/fno-sanitize-coverage=inline-8bit-counters`** to disable this option if it's already provided or implied by another option.
45
+
46
+
### Trace comparisons
32
47
33
48
The **`/fsanitize-coverage=trace-cmp`** compiler option instructs the compiler to insert calls to the following functions:
49
+
34
50
```C
35
51
// Before each comparison instruction of the stated size.
Use **`/fno-sanitize-coverage=trace-cmp`** to disable this option if it has been already provided or implied by another option.
63
+
64
+
Use **`/fno-sanitize-coverage=trace-cmp`** to disable this option if it's already provided or implied by another option.
65
+
66
+
### Trace divisions
48
67
49
68
The **`/fsanitize-coverage=trace-div`** compiler option instructs the compiler to insert calls to the following functions:
69
+
50
70
```C
51
71
// Before a division instruction of the stated size.
52
72
void __sanitizer_cov_trace_div4(uint32_t Val);
53
73
void __sanitizer_cov_trace_div8(uint64_t Val);
54
74
```
55
-
Use **`/fno-sanitize-coverage=trace-div`** to disable this option if it has been already provided or implied by another option.
56
-
57
-
Currently, **`/fsanitize-coverage=`** does not allow comma-separated syntax, for example: **`/fsanitize-coverage=edge,inline-8bit-counters,trace-cmp,trace-div`**. These options must be provided individually.
58
75
59
-
The**`/fsanitize-coverage`**options are available beginning in Visual Studio 2022.
76
+
Use**`/fno-sanitize-coverage=trace-div`**to disable this option if it's already provided or implied by another option.
60
77
61
78
### To set the advanced compiler options
62
79
63
80
1. Open your project's **Property Pages** dialog box.
Use the **`/fsanitize`** compiler options to enable sanitizers. As of Visual Studio 2019 16.9, the only supported sanitizer is [AddressSanitizer](../../sanitizers/asan.md). As of Visual Studio 2022 17.0, LibFuzzer has experimental support.
10
+
Use the **`/fsanitize`** compiler options to enable sanitizers.
11
11
12
12
## Syntax
13
13
@@ -18,16 +18,14 @@ Use the **`/fsanitize`** compiler options to enable sanitizers. As of Visual Stu
18
18
19
19
## Remarks
20
20
21
-
The **`/fsanitize=address`** compiler option enables [AddressSanitizer](../../sanitizers/asan.md), a powerful compiler and runtime technology to light up [hard-to-find bugs](../../sanitizers/asan.md#error-types).
21
+
The **`/fsanitize=address`** compiler option enables [AddressSanitizer](../../sanitizers/asan.md), a powerful compiler and runtime technology to uncover [hard-to-find bugs](../../sanitizers/asan.md#error-types). The option is available starting in Visual Studio 2019 version 16.9.
22
22
23
-
The **`/fsanitize=fuzzer`** compiler option enables LibFuzzer (experimental), a coverage-guided fuzzing library that can be used to find bugs and crashes caused by user-provided input. It is recommended to use **`/fsanitize=address`**alongside LibFuzzer. See the OneFuzz [documentation page](https://www.microsoft.com/en-us/research/project/project-onefuzz/) and [GitHub project](https://github.com/microsoft/onefuzz)for more information.
23
+
The **`/fsanitize=fuzzer`** compiler option enables experimental support for LibFuzzer. LibFuzzer is a coverage-guided fuzzing library that can be used to find bugs and crashes caused by user-provided input. We recommended you use **`/fsanitize=address`**with LibFuzzer. For more information, see the [OneFuzz documentation](https://www.microsoft.com/en-us/research/project/project-onefuzz/) and [OneFuzz GitHub project](https://github.com/microsoft/onefuzz). Support for the **`/fsanitize=fuzzer`** option is available starting in Visual Studio 2022 version 17.0.
24
24
25
-
Currently,**`/fsanitize=`**does not allow comma-separated syntax, for example: **`/fsanitize=address,fuzzer`**. These options must be provided individually.
25
+
The**`/fsanitize`**option doesn't allow comma-separated syntax, for example: **`/fsanitize=address,fuzzer`**. These options must be specified individually.
26
26
27
27
The **`/fsanitize-address-use-after-return`** and **`/fno-sanitize-address-vcasan-lib`** compiler options, and the [`/INFERASANLIBS` (Use inferred sanitizer libs)](./inferasanlibs.md) and **`/INFERASANLIBS:NO`** linker options offer support for advanced users. For more information, see [AddressSanitizer build and language reference](../../sanitizers/asan-building.md).
28
28
29
-
The **`/fsanitize`** options are available beginning in Visual Studio 2019 version 16.9.
30
-
31
29
### To set the **`/fsanitize=address`** compiler option in the Visual Studio development environment
32
30
33
31
1. Open your project's **Property Pages** dialog box.
@@ -67,7 +65,7 @@ The **`/fsanitize`** options are available beginning in Visual Studio 2019 versi
The [**`/fsanitize=address`**](../build/reference/fsanitize.md) compiler option instruments memory references in your code to catch memory safety errors at runtime. The instrumentation hooks loads, stores, scopes, alloca, and CRT functions. It can detect hidden bugs such as out-of-bounds, use-after-free, use-after-scope, and so on. For a non-exhaustive list of errors detected at runtime, see [AddressSanitizer error examples](./asan-error-examples.md).
59
+
The [**`/fsanitize=address`**](../build/reference/fsanitize.md) compiler option instruments memory references in your code to catch memory safety errors at runtime. The instrumentation hooks loads, stores, scopes, `alloca`, and CRT functions. It can detect hidden bugs such as out-of-bounds, use-after-free, use-after-scope, and so on. For a non-exhaustive list of errors detected at runtime, see [AddressSanitizer error examples](./asan-error-examples.md).
60
60
61
61
**`/fsanitize=address`** is compatible with all existing C++ or C optimization levels (for example, **`/Od`**, **`/O1`**, **`/O2`**, **`/O2 /GL`**, and profile guided optimization). The code produced with this option works with static and dynamic CRTs (for example, **`/MD`**, **`/MDd`**, **`/MT`**, and **`/MTd`**). This compiler option can be used to create an .EXE or .DLL targeting x86 or x64. Debug information is required for optimal formatting of call stacks.
62
62
63
63
For examples of code that demonstrates several kinds of error detection, see [AddressSanitizer error examples](asan-error-examples.md).
The [**`/fsanitize=fuzzer`**](../build/reference/fsanitize.md) compiler option will add LibFuzzer to the default library list, as well as also set the following sanitizer coverage options:[edge instrumentation points (**`/fsanitize-coverage=edge`**)](../build/reference/fsanitize-coverage.md), [inline 8-bit counters (**`/fsanitize-coverage=inline-8bit-counters`**)](../build/reference/fsanitize-coverage.md), and extra instrumentation around [comparisons (**`/fsanitize-coverage=trace-cmp`**)](../build/reference/fsanitize-coverage.md) and [integer divisions (**`/fsanitize-coverage=trace-div`**)](../build/reference/fsanitize-coverage.md). It is recommended to use **`/fsanitize=address`** alongside **`/fsanitize=fuzzer`**.
67
+
The [`/fsanitize=fuzzer`](../build/reference/fsanitize.md) compiler option adds LibFuzzer to the default library list. It also sets the following sanitizer coverage options:
68
68
69
-
Here are the libraries added to the default library list when specifying **`/fsanitize=fuzzer`**:
We recommend you use **`/fsanitize=address`** with **`/fsanitize=fuzzer`**.
75
+
76
+
These libraries are added to the default library list when you specify **`/fsanitize=fuzzer`**:
70
77
71
78
| Runtime option | LibFuzzer library |
72
79
|--|--|
@@ -75,7 +82,7 @@ Here are the libraries added to the default library list when specifying **`/fsa
75
82
|**`/MTd`**|*`clang_rt.fuzzer_MTd-{arch}`*|
76
83
|**`/MDd`**|*`clang_rt.fuzzer_MDd-{arch}`*|
77
84
78
-
There is also a version of the LibFuzzer libraries that omit the **`main`** function, leaving the responsibility to define **`main`** and call **`LLVMFuzzerInitialize`** and **`LLVMFuzzerTestOneInput`**to the user. You will need to use [**`/NODEFAULTLIB`**](../build/reference/nodefaultlib-ignore-libraries.md) to ensure the libraries listed above are not included and link with one of the libraries listed below instead:
85
+
LibFuzzer libraries that omit the **`main`** function are also available. It's your responsibility to define **`main`** and to call **`LLVMFuzzerInitialize`** and **`LLVMFuzzerTestOneInput`**when you use these libraries. Use [`/NODEFAULTLIB`](../build/reference/nodefaultlib-ignore-libraries.md) to link with one of the libraries listed below:
0 commit comments