Quy trình phân tích hoàn chỉnh

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* TANG 1 - trinh bien dich: sai kieu dinh dang */
static void loi_1(void) {
    long long v = 42;
    printf("loi_1: %d\n", v);          /* %d cho long long */
}

/* TANG 2 - phan tich tinh: ro ri tren nhanh loi */
char *loi_2(int co_loi) {
    char *p = malloc(64);
    if (!p) return NULL;
    if (co_loi) return NULL;           /* quen free(p) */
    strcpy(p, "ok");
    return p;
}

/* TANG 3 - ve sinh luc chay: tran bo dem tren dong */
static void loi_3(void) {
    char *p = malloc(8);
    memset(p, 'x', 9);                 /* ghi 9 byte vao 8 */
    printf("loi_3: %c\n", p[0]);
    free(p);
}

/* TANG 4 - UBSan: tran so nguyen co dau */
static int loi_4(int a, int b) {
    return a * b;                      /* 100000 * 100000 tran int */
}

/* TANG 5 - kiem thu: ket qua SAI nhung khong co UB nao */
int loi_5(int diem) {
    if (diem > 90) return 'A';         /* dung: >= 90 */
    return 'B';
}

int main(void) {
    loi_1();
    char *p = loi_2(1);
    free(p);
    loi_3();
    printf("loi_4: %d\n", loi_4(100000, 100000));
    printf("loi_5: %c (mong doi A)\n", (char)loi_5(90));
    return 0;
}

gcc -std=c11 -g -O1 -fsanitize=address -fno-omit-frame-pointer nam.c -o nam_asan
./nam_asan

=================================================================
==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000000018 at pc 0x7f3a1c thread T0
WRITE of size 9 at 0x602000000018 thread T0
    #0 0x7f3a1c in memset
    #1 0x401186 in loi_3 nam.c:24
    #2 0x4011f8 in main nam.c:42

0x602000000018 is located 0 bytes to the right of 8-byte region
[0x602000000010,0x602000000018) allocated by thread T0 here:
    #0 0x7f2b40 in malloc
    #1 0x401171 in loi_3 nam.c:23

SUMMARY: AddressSanitizer: heap-buffer-overflow nam.c:24 in loi_3

gcc -std=c11 -g -O1 -fsanitize=undefined \
    -fno-sanitize-recover=all nam.c -o nam_ubsan
./nam_ubsan

nam.c:30:14: runtime error: signed integer overflow:
100000 * 100000 cannot be represented in type 'int'

/* -fno-sanitize-recover=all la BAT BUOC trong CI.
   Mac dinh, UBSan IN ra loi roi CHAY TIEP, va ma thoat van la 0.
   Nghia la CI cua ban xanh du co loi. Voi co nay, no dung ngay
   va tra ve ma thoat khac 0. */

int loi_5(int diem) {
    if (diem > 90) return 'A';         /* dung: >= 90 */
    return 'B';
}

/* Ham nay:
     - khong co canh bao bien dich nao
     - khong co canh bao phan tich tinh nao
     - khong dung bo nho sai, nen ASan im
     - khong co hanh vi khong xac dinh nao, nen UBSan im
     - chay nhanh, tra ve mot gia tri hop le

   No chi don gian TRA VE SAI. Va khong mot cong cu tu dong nao
   biet duoc y dinh cua ban la  >=  chu khong phai  >.

   Chi co MOT thu bat duoc no: mot bai kiem thu noi ro
   ket qua mong doi. */

static void thu_loi_5(void) {
    KT_NHOM("loi_5: gia tri bien 90");
    KT_BANG_INT(loi_5(89), 'B');
    KT_BANG_INT(loi_5(90), 'A');       /* <- bai nay do */
    KT_BANG_INT(loi_5(91), 'A');
}

CC       := gcc
SRC      := $(wildcard src/*.c)
KT_SRC   := $(wildcard kiem-thu/kt_*.c)
INC      := -Iinclude -Ikiem-thu

CANH_BAO := -Wall -Wextra -Wpedantic -Wconversion -Wsign-conversion \
            -Wshadow -Wstrict-prototypes -Wmissing-prototypes \
            -Wold-style-definition -Wcast-qual -Wcast-align \
            -Wwrite-strings -Wundef -Wdouble-promotion -Wformat=2 \
            -Wnull-dereference -Wswitch-enum

CFLAGS   := -std=c11 $(CANH_BAO) $(INC) -g

.PHONY: kiem-tra t1 t2 t3 t4 t5 sach

kiem-tra: t1 t2 t5 t3 t4
	@echo "ca nam tang deu sach"

## Tang 1: canh bao trinh bien dich, la loi
t1:
	$(CC) $(CFLAGS) -Werror -fsyntax-only $(SRC) $(KT_SRC)

## Tang 2: phan tich tinh
t2:
	clang-tidy $(SRC) -- $(CFLAGS)
	cppcheck --enable=warning,style,portability --std=c11 \
	         --inline-suppr --error-exitcode=1 $(INC) src/

## Tang 3: ve sinh bo nho
t3:
	$(CC) $(CFLAGS) -O1 -fsanitize=address -fno-omit-frame-pointer \
	      $(KT_SRC) $(SRC) -o kt-asan
	ASAN_OPTIONS=detect_leaks=1:halt_on_error=1 ./kt-asan

## Tang 4: ve sinh hanh vi khong xac dinh
t4:
	$(CC) $(CFLAGS) -O1 -fsanitize=undefined \
	      -fno-sanitize-recover=all $(KT_SRC) $(SRC) -o kt-ubsan
	UBSAN_OPTIONS=print_stacktrace=1 ./kt-ubsan

## Tang 5: kiem thu, ban thuong
t5:
	$(CC) $(CFLAGS) -O2 $(KT_SRC) $(SRC) -o kt
	./kt

sach:
	rm -f kt kt-asan kt-ubsan *.gcda *.gcno *.gcov