Undefined Behavior Sanitizer (UBSan) — Hinglish notes

5.3.13 · Coding › Build Systems & Toolchain

WHAT is Undefined Behavior?

UB exist kyun karta hai? Taaki compilers har jagah defensive checks daale bina fast code generate kar sakein. Standard kehta hai "agar programmer X likhta hai, toh hum assume karte hain ki woh kabhi bad case trigger nahi karega, isliye hum optimize karne ke liye free hain." Woh freedom speed ke liye great hai — aur jab tum actually trigger karte ho toh correctness ke liye nightmare.

WHAT is UBSan (the mechanism)?

Tum ise kaise use karte ho:

clang -fsanitize=undefined -fno-sanitize-recover=all -g file.c -o prog
./prog
# Pehle UB par: print karta hai e.g.
# file.c:12:9: runtime error: signed integer overflow:
#   2147483647 + 1 cannot be represented in type 'int'

-g → debug info rakho taaki line numbers print ho sakein.
-fno-sanitize-recover=all → pehli error par abort karo (warna UBSan report karta hai aur continue karta hai, jo "pehla" cause hide kar sakta hai).
Aksar combine kiya jaata hai: -fsanitize=undefined,address UB + memory errors ke liye.

Intuition Compiler actually kya insert karta hai

Signed ints par a + b ke liye, bare add instruction ki jagah, UBSan roughly yeh emit karta hai:

tmp = a + b            // wider math / overflow flag ke saath kiya jaata hai
if (overflow happened) __ubsan_handle_add_overflow(loc, a, b);
use tmp

Isliye UBSan sasta hai (arithmetic ke paas branches) ASan ke comparison mein (jo saari memory reroute karta hai). Typical slowdown ~1.2–2×.

WHY ek check possible hai: overflow test ko first principles se derive karna

Signed integer overflow lo 32-bit int ke liye. Representable range hai $[- 2^{31}, 2^{31} - 1] .$

Yeh bounds kyun? $n = 32$ bits ke saath Two's complement: most significant bit ka weight $- 2^{n - 1}$ hota hai, baaki positive weights add karte hain up to $2^{n - 1} - 1$ . Toh: $INT_MIN = - 2^{31}, INT_MAX = 2^{31} - 1.$

Addition-overflow condition derive karna. True mathematical sum $s = a + b$ compute karo (unbounded integers mein). Overflow = " $s$ representable nahi hai": $overflow (a, b) ⟺ s < - 2^{31} \lor s > 2^{31} - 1.$

Yeh step kyun? UBSan unbounded integers mein cheaply compute nahi kar sakta, isliye yeh ek hardware fact use karta hai: do same-sign numbers ko add karna sirf usi sign ki taraf overflow kar sakta hai. Formally, overflow tab hota hai jab a aur b ka same sign ho aur result ka sign alag ho:

Worked examples

Worked example 1 — Signed overflow pakda gaya

int x = INT_MAX;   // 2147483647
int y = x + 1;     // UB!

Trace: $a = 2^{31} - 1, b = 1$ , same sign (dono non-negative), true sum $= 2^{31}$ jo $> 2^{31} - 1$ hai. Yeh step kyun? Same sign + result INT_MAX se zyada ⇒ overflow flag set ⇒ UBSan handler fires. Output: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'.

Worked example 2 — Shift zyada door

int n = 1;
int r = n << 32;   // UB: shift >= width

UB kyun? Standard require karta hai shift amount $\in [0, width) = [0, 32)$ . 32 range se bahar hai, toh result undefined hai (x86 par hardware bhi & 31 mask karta hai, deta hai n<<0 = 1 — ek silently galat answer!). UBSan check derivation: if (shift < 0 || shift >= 32) report(); insert karo — directly standard ke constraint se. Output: shift exponent 32 is too large for 32-bit type 'int'.

Worked example 3 — Null / misaligned pointer

struct S { int a; };
struct S *p = (struct S*)1;   // odd, misaligned address
int v = p->a;                  // UB: misaligned + likely invalid

Yeh step kyun? int ko 4-byte alignment chahiye; address 1 4 ka multiple nahi hai. UBSan ka alignment check addr % alignof(int) == 0 compute karta hai. Output: member access within misaligned address 0x1 for type 'struct S', which requires 4 byte alignment.

Worked example 4 — "Impossible" INT_MIN / -1

int r = INT_MIN / -1;   // UB: overflows! result 2^31 not representable

Yeh step kyun? $- (- 2^{31}) = 2^{31} > 2^{31} - 1$ . Division exactly yahan overflow kar sakta hai. Kuch CPUs par yeh hardware trap raise karta hai. UBSan ise cleanly report karta hai.

Figure — Undefined Behavior Sanitizer (UBSan)

UBSan vs its siblings

Active recall

Recall Pehle forecast karo phir verify karo (answers cover karo!)

UBSan kaunsa flag enable karta hai? ⇒ -fsanitize=undefined
-fno-sanitize-recover=all kyun add karo? ⇒ pehli error par abort karo taaki true root cause dikhe
-g kyun add karo? ⇒ taaki reports file:line dikhayein
Kya signed overflow UB hai? Kya unsigned overflow UB hai? ⇒ signed = UB; unsigned = well-defined (wraps mod $2^{32}$ )
n << 32 "kaam" kaise kar sakta hai phir bhi UB kyun hai? ⇒ x86 shift ko & 31 se mask karta hai, deta hai galat-lekin-crash-na-karne-wala result

Recall Feynman: ek 12-saal ke bachche ko explain karo

Socho language mein kuch "forbidden moves" hain — jaise apne calculator pe dikhayi dene wale sabse bade number se aage count karna. Agar tum ek forbidden move karo, toh rulebook kehta hai "kuch bhi ho sakta hai" aur machine shayad ek weird answer de, ya crash kar jaaye, ya theek lagta rahe aur baad mein betray kare. UBSan ek referee ki tarah hai jo game dekh raha hai aur jaise hi tum forbidden move karo, usi waqt whistle bajata hai, exact line point karta hai: "Yahan! Tumne maximum se zyada add karne ki koshish ki!" Toh ek spooky bug jo randomly agle mahine dikhe uski jagah, tum immediately pakde jaate ho.

Flashcards

UBSan ka full form kya hai aur yeh kya detect karta hai?

Undefined Behavior Sanitizer; ek compiler runtime checker jo undefined behavior ke liye hai (signed overflow, bad shifts, null/misaligned pointers, INT_MIN/-1, etc.).

UBSan enable karne wala compiler flag kaunsa hai?

-fsanitize=undefined.

UBSan ke saath -fno-sanitize-recover=all kyun combine karo?

Taaki program pehle violation par abort kare report karke continue karne ki jagah, true root cause reveal ho.

Kya C mein unsigned integer overflow UB hai?

Nahi — unsigned arithmetic modulo

2^{n}

wrap karne ke liye defined hai. Sirf signed overflow UB hai.

32-bit int ki two's-complement range kya hai aur kyun?

[- 2^{31}, 2^{31} - 1]

; top bit ka weight

- 2^{31}

hota hai, baaki bits

2^{31} - 1

tak add hoti hain.

Signed addition overflow kab hota hai (single-bit test)?

Jab dono operands sign bit share karein lekin wrapped result ka sign bit alag ho — exactly CPU overflow flag.

INT_MIN / -1 undefined kyun hai?

Result

2^{31}

hai jo INT_MAX (

2^{31} - 1

) se zyada hai; division overflow karta hai aur trap bhi ho sakta hai.

n << 32 x86 par silently galat answer kyun de sakta hai?

Hardware shift count ko & 31 se mask karta hai, toh n << 0 compute hota hai; standard phir bhi ise UB kehta hai.

Kya clean UBSan run prove karta hai ki program UB-free hai?

Nahi — yeh sirf executed paths check karta hai aur har UB category cover nahi karta; ASan/MSan/TSan aur static analysis ke saath pair karo.

UBSan vs ASan — ek line each.

UBSan = logic/arithmetic/pointer UB (sasta); ASan = memory errors jaise buffer overflow aur use-after-free (~2× slower).

Standard mein UB exist kyun karta hai?

Taaki compilers aggressively optimize kar sakein bina defensive checks daale, assume karke ki programmers kabhi bad cases trigger nahi karte.

Connections

AddressSanitizer (ASan) — memory-error counterpart
Compiler Optimization Levels — kyun UB -O2/-O3 par zyada kaata hai
Two's Complement Representation — overflow test ka basis
Integer Overflow & Wraparound
Static Analysis vs Dynamic Analysis
GCC and Clang Toolchains
Debugging with -g and Debug Info