Undefined Behavior Sanitizer (UBSan): Exercises

Before we start, one shared fact we will use again and again. Everything here assumes a 32-bit int. From Two's Complement Representation, the representable range is $[INT_MIN, INT_MAX] = [- 2^{31}, 2^{31} - 1] = [- 2147483648, 2147483647] .$ We write $sgnbit (x)$ for the top (most significant) bit of the machine word — it is $1$ when $x$ is negative, $0$ when $x$ is non-negative. Look at the figure below to see why one bit tells you the sign at all.

Figure — Undefined Behavior Sanitizer (UBSan)

The bar shows a 32-bit signed integer. The leftmost cell (orange) is the sign bit with weight $- 2^{31}$ ; the other 31 cells (blue) all add positive weights. So if you flip only the top bit you swing by exactly $2^{32}$ — that jump is what "wraparound" means (see Integer Overflow & Wraparound).

Level 1 — Recognition

Worked example L1·Q1 — Spot the UB

For each line, say UB or defined. All variables are 32-bit; u is unsigned, others are int.

int a = INT_MAX + 1;   // (a)
unsigned b = UINT_MAX + 1u;  // (b)
int c = 1 << 31;       // (c)
int d = -1 >> 1;       // (d)

Recall Solution L1·Q1

(a) UB. Signed overflow: true sum $2^{31} > INT_MAX$ . Not representable ⇒ UB.
(b) Defined. Unsigned overflow is not UB — it wraps modulo $2^{32}$ . Result is $0$ . (See the parent note's recall: signed = UB, unsigned = defined.)
(c) UB. 1 << 31 shifts a $1$ into the sign-bit position of a signed type. Since C++20 this is defined, but in C and pre-C++20 shifting into the sign bit is UB. UBSan flags it under the shift check.
(d) Defined (implementation-defined). -1 >> 1 is a right shift of a negative value — implementation-defined, not UB. UBSan does not flag it.

Level 2 — Application

Recall Solution L2·Q2

True sum $s = 2000000000 + 200000000 = 2200000000$ . $INT_MAX = 2147483647$ . Since $2200000000 > 2147483647$ , the sum is not representable ⇒ overflow (UB). Same-sign check: both operands are non-negative ( $sgnbit = 0$ ), and the wrapped result $2200000000 - 2^{32} = - 2094967296$ is negative ( $sgnbit = 1$ ). Sign flipped despite equal input signs ⇒ overflow flag set ⇒ UBSan fires.

Recall Solution L2·Q3

The standard requires the shift amount to satisfy $0 \leq k < width = 32$ , i.e. $k \in {0, 1, \dots, 31}$ . UBSan inserts, straight from that constraint:

if (k < 0 || k >= 32) __ubsan_handle_shift_out_of_bounds(...);

So $k = 32$ or $k = - 1$ both report. (On x86 the bare hardware would compute k & 31, silently giving x << 0 for k = 32 — a wrong answer with no crash, exactly why UBSan is needed.)

Level 3 — Analysis

Recall Solution L3·Q4

With $a \geq 0$ and $b < 0$ , the sum lies between the two operands: $b \leq a + b \leq a .$ Since $b \geq INT_MIN$ and $a \leq INT_MAX$ , we get $INT_MIN \leq a + b \leq INT_MAX$ . The result is squeezed inside the valid range, so it always fits — no overflow possible. Geometrically (figure below), adding a negative moves you left from $a$ but never past $b$ ; adding a positive to $b$ moves right but never past $a$ . You can never escape the interval $[INT_MIN, INT_MAX]$ from inside it by a step that stays inside it.

Recall Solution L3·Q5

INT_MIN / -1 $= - (- 2^{31}) = 2^{31}$ . But $INT_MAX = 2^{31} - 1$ , so $2^{31}$ is one past the top ⇒ not representable ⇒ UB (and on many CPUs a hardware divide trap).
INT_MIN * -1 $= 2^{31}$ — same value, same problem ⇒ UB.
INT_MAX / -1 $= - (2^{31} - 1) = - 2^{31} + 1$ , which is $\geq INT_MIN = - 2^{31}$ ⇒ representable ⇒ defined. The asymmetry is the whole story: two's complement has one more negative number than positive, so negating (or the equivalent divide/multiply) the single extreme negative has no positive twin.

Level 4 — Synthesis

Worked example L4·Q6 — Optimizer deletes your check

int f(int *p) {
    int v = *p;          // (1)
    if (p == NULL)       // (2)
        return -1;
    return v + 1;
}

Explain what an optimizer at -O2 may legally do to line (2), why, and how UBSan reveals the real bug. Distinguish which tool (ASan or UBSan) is best here.

Recall Solution L4·Q6

Line (1) dereferences p. Dereferencing NULL is UB, so the compiler is entitled to assume p is not NULL — because if it were, the program already had UB and the standard imposes no requirements. Under that assumption, the test p == NULL on line (2) is always false, so the optimizer may delete the entire if branch. Your safety check silently vanishes.

UBSan (-fsanitize=undefined) catches the null / invalid pointer dereference at line (1) with a null-pointer-use diagnostic.
ASan is the stronger tool for the general case (wild pointers, use-after-free, out-of-bounds), because it validates the actual memory address. For a plain NULL deref both catch it; for a garbage-but-non-null pointer, ASan is the one that flags the bad load. Real fix: reorder — check p == NULL before the dereference. Then the assumption never kicks in.

Recall Solution L4·Q7

clang -fsanitize=undefined,address -fno-sanitize-recover=all -g -O1 file.c -o prog

-fsanitize=undefined → UBSan (overflow, shifts). ,address → ASan for the heap-buffer-overflow (a memory error UBSan doesn't cover).
-fno-sanitize-recover=all → abort on the first violation, so the earliest (root-cause) error isn't buried by cascading later reports.
-g → embed debug info so reports show file:line:col instead of raw addresses.
-O1 (not -O0) → catches optimization-sensitive UB while keeping stack traces readable; both GCC and Clang support this combination.

Level 5 — Mastery

Worked example L5·Q8 — Predict the exact UBSan message

int8_t x = 100;
int8_t y = 50;
int8_t z = x + y;   // both promoted to int, then narrowed

Is there UB here? Give the precise reasoning about integer promotion, and state whether UBSan reports.

Recall Solution L8

No UB. In C, int8_t operands are promoted to int before +. So the addition is $100 + 50 = 150$ computed in int — no overflow (well within int range). The narrowing back to int8_t (range $[- 128, 127]$ ): $150$ doesn't fit, so it is implementation-defined conversion (typically wraps to $150 - 256 = - 106$ ), not UB. Default UBSan does not flag this; only the optional -fsanitize=implicit-conversion (implicit-integer-truncation) sublevel would warn. So the base -fsanitize=undefined build stays silent.

Worked example L5·Q9 — Full trace, all cases

Classify each as UB / defined, and for the overflow cases give the wrapped value a non-UBSan build would produce. 32-bit int unless noted.

int a = INT_MIN - 1;        // (a)
int b = -INT_MIN;           // (b)
unsigned c = 0u - 1u;       // (c)
int d = INT_MAX + INT_MAX;  // (d)
int e = (INT_MIN >> 1);     // (e)

Recall Solution L5·Q9

(a) UB. $- 2^{31} - 1 = - 2147483649 < INT_MIN$ ⇒ underflow. Wrapped value: $- 2147483649 + 2^{32} = 2147483647 = INT_MAX$ .
(b) UB. $- (- 2^{31}) = 2^{31}$ , one past INT_MAX. Wrapped value: $2^{31} - 2^{32} = - 2^{31} = INT_MIN$ (negating INT_MIN gives INT_MIN back — the famous fixed point).
(c) Defined. Unsigned: $0 - 1 mod 2^{32} = 4294967295 = UINT_MAX$ .
(d) UB. $2 \times (2^{31} - 1) = 2^{32} - 2 = 4294967294 > INT_MAX$ . Wrapped: $4294967294 - 2^{32} = - 2$ .
(e) Defined (implementation-defined). Right-shifting a negative is implementation-defined, not UB. Arithmetic shift typically gives $- 2^{31} /2 = - 1073741824$ .

Recall Solution L5·Q10

Let $s = a + b$ (true math). We show: ( $s \in / [INT_MIN, INT_MAX]$ ) $⟺$ (same sign in, flipped sign out).

Opposite signs ( $a \geq 0, b < 0$ or vice versa): by L3·Q4 the sum stays in range, so $s$ never leaves range and the sign-bit can't flip past a limit (result lies between operands). Both rules say "no overflow." ✓
Both non-negative ( $sgnbit = 0$ ): $s \geq 0$ . Overflow (range rule) $⟺ s > INT_MAX = 2^{31} - 1 ⟺$ the true sum needs bit $2^{31}$ , i.e. the wrapped machine result has $sgnbit = 1$ (flipped). Same condition. ✓
Both negative ( $sgnbit = 1$ ): $s < 0$ . Overflow $⟺ s < INT_MIN = - 2^{31} ⟺$ the wrapped result's top bit becomes $0$ (flipped to non-negative). Same condition. ✓ Every case matches, so the two rules are equivalent — and the sign-bit version is what the hardware OF flag computes in one step.

Wrap-up recall

Recall Which of these are UB? (cover the answers)

INT_MAX + 1 ::: UB (signed overflow)
UINT_MAX + 1u ::: defined (wraps to 0)
INT_MIN / -1 ::: UB (result $2^{31}$ not representable)
1 << 32 ::: UB (shift ≥ width)
-1 >> 1 ::: defined (implementation-defined, not UB)
deref p then check p == NULL ::: the check may be deleted by the optimizer; deref of possibly-null is UB

Parent: Undefined Behavior Sanitizer (UBSan) · Hinglish: 5.3.13 Undefined Behavior Sanitizer (UBSan) (Hinglish)