AddressSanitizer

AddressSanitizer (or ASan) is an open source programming tool that detects memory corruption bugs such as buffer overflows or accesses to a dangling pointer (use-after-free). AddressSanitizer is based on compiler instrumentation and directly-mapped shadow memory. 
AddressSanitizer is currently implemented in Clang (starting from version 3.1) , GCC (starting from version 4.8), Xcode (starting from version 7.0) and MSVC (widely available starting from version 16.9) . On average, the instrumentation increases processing time by about 73% and memory usage by 240%.
Users.
Chromium and Firefox developers are active users of AddressSanitizer; the tool has found hundreds of bugs in these web browsers.
A number of bugs were found in FFmpeg
and FreeType. The Linux kernel has enabled the AddressSanitizer for the x86-64 architecture as of Linux version 4.0.
KernelAddressSanitizer.
The KernelAddressSanitizer (KASAN) detects dynamic memory errors in the Linux kernel. Kernel instrumentation requires a special feature in the compiler supplying the -fsanitize=kernel-address command line option, since kernels do not use the same address space as normal programs.
Examples.
Heap-use-after-free.
// To compile: g++ -O -g -fsanitize=address heap-use-after-free.cc
int main(int argc, char **argv) {
 int *array = new int[100];
 delete [] array;
 return array[argc]; // BOOM
Heap-buffer-overflow.
// RUN: clang++ -O -g -fsanitize=address %t && ./a.out
int main(int argc, char **argv) {
 int *array = new int[100];
 array[0] = 0;
 int res = array[argc + 100]; // BOOM
 delete [] array;
 return res;
Stack-buffer-overflow.
// RUN: clang -O -g -fsanitize=address %t && ./a.out
int main(int argc, char **argv) {
 int stack_array[100];
 stack_array[1] = 0;
 return stack_array[argc + 100]; // BOOM
Global-buffer-overflow.
// RUN: clang -O -g -fsanitize=address %t && ./a.out
int global_array[100] = {-1};
int main(int argc, char **argv) {
 return global_array[argc + 100]; // BOOM
Limitations.
AddressSanitizer does not detect any uninitialized memory reads (but this is detected by MemorySanitizer), and only detects some use-after-return bugs. It is also not capable of detecting all arbitrary memory corruption bugs, nor all arbitrary write bugs due to integer underflow/overflows (when the integer with undefined behavior is used to calculate memory address offsets). Adjacent buffers in structs and classes are not protected from overflow, in part to prevent breaking backwards compatibility.