14 DAY TRIAL // Google and security researchers alike have been using AddressSanitizer to find memory bugs in Chrome, bugs which lead to crashes or which can be exploited by attackers to get out of the Chrome sandbox and take over the system.
In the two years it's been around, AddressSanitizer (ASAN) has become an irreplaceable tool and is responsible for a large amount of the memory usage bugs discovered in Chrome this time.
But ASAN only works on Linux and Mac OS, as it's built with Clang for LLVM which fully supports only these platforms.
Now though, there's a tool for Windows as well, and Google is calling it SyzyASAN since it's built on top of the Syzygy toolchain. It functions very much like the standard ASAN and produces similar results.
It can be integrated with the Microsoft Visual Studio tools, meaning it can be easily attached to existing projects to track down memory bugs.
Google has been using the new tool for a while now, and it discovered 150 bugs in the last three weeks alone, bugs that could have potentially been exploited in attacks.
But to test the tool it has to run it in the wild, and that's exactly what it's been doing. Every once in a while, Google builds a Chrome Canary release with SyzyASAN enabled.
It doesn't do this with all builds, since there are some significant performance penalties. But one day every week, Canary will come with SyzyASAN enabled, giving Google plenty of data to spot bugs.
"Although Chrome with SyzyASAN is very usable, the penalties in speed - 4.7x on CPU intensive operations - and memory - a 25% increase plus a fixed 256MB increase in each process - are noticeable so we'll confine these releases to our Canary channel for now," Google explained.
"We've been releasing SyzyASAN-instrumented builds to the Windows Canary channel one day each week recently. One day with a little slowdown on the Canary channel gives us plenty of great data," it added.