catchorg / catchorg/Catch2

MSVC /fsanitize-address-use-after-return: stack-buffer-underflow in makeTestInvoker during static test registration

Open
#3,195 1 comment 0 reactions 0 assignees View on GitHub
3rd party bug
Dominant language
C++
Stars
21.5k
Forks
3.5k
Avg merge
3d 16h
Merged PRs (30d)
2

Description

**Describe the bug**
When Catch2 and a test executable are both compiled with MSVC AddressSanitizer plus the experimental /fsanitize-address-use-after-return flag, the test binary aborts during static test registration (before main()), with ASan reporting a stack-buffer-underflow in the Catch::Detail::unique_ptr move constructor. The identical build with /fsanitize=address alone (no use-after-return) runs correctly.
A clear and concise description of what the bug is.

**Expected behavior**
No warnings. Catch interacts with AddressSanitizer correctly.

**Reproduction steps**
repro.cpp:
#include
TEST_CASE("minimal", "[repro]") { REQUIRE(1 + 1 == 2); }

Build (Catch2 v3.15.3, amalgamated) + repro, all with the flag, then run:
cl /EHsc -std:c++latest /MDd /Od /utf-8 /fsanitize=address /fno-sanitize-address-vcasan-lib /fsanitize-address-use-after-return /I extras /c extras/catch_amalgamated.cpp
cl /EHsc -std:c++latest /MDd /Od /utf-8 /fsanitize=address /fno-sanitize-address-vcasan-lib /fsanitize-address-use-after-return /I extras repro.cpp catch_amalgamated.obj
.\repro.exe --list-tests

Result (with the flag):
==16880==ERROR: AddressSanitizer: stack-buffer-underflow
WRITE of size 8 thread T0
#0 Catch::Detail::unique_ptr::unique_ptr catch_amalgamated.hpp:949
#1 Catch::Detail::make_unique catch_amalgamated.hpp:1029
#2 Catch::makeTestInvoker(void(*)()) catch_amalgamated.cpp:7700
#3 dynamic initializer for 'autoRegistrar1'
frame has 1 object: [32, 40) 'compiler temporary'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism

Result (without /fsanitize-address-use-after-return) — lists and runs normally.

**Platform information:**
OS: Windows 11
Compiler: MSVC 19.51 / VS 2026 (14.51.36231)
Catch2: v3.15.3 (also reproduced on devel via the non-amalgamated catch_test_registry.cpp / catch_unique_ptr.hpp)

**Additional context**
I can't tell if this is a problem in Catch2 or in AddressSanitizer. Filing here first, if you determine that catch is behaving correctly I'll move it to Microsofts ASan.

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with MSVC, AddressSanitizer, and /fsanitize-address-use-after-return using the supplied repro.cpp and build commands. Compare the non-amalgamated paths in catch_test_registry.cpp and catch_unique_ptr.hpp with the reported catch_amalgamated.cpp and catch_amalgamated.hpp locations. Done means determining whether the failure is in Catch2 or MSVC AddressSanitizer, with a regression test or a clearly documented external compiler issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.