http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55309
--- Comment #53 from Kostya Serebryany <kcc at gcc dot gnu.org> 2013-02-22 15:06:25 UTC --- The interceptor we have is conservative: INTERCEPTOR(int, memcmp, const void *a1, const void *a2, uptr size) { if (!asan_inited) return internal_memcmp(a1, a2, size); ENSURE_ASAN_INITED(); unsigned char c1 = 0, c2 = 0; const unsigned char *s1 = (const unsigned char*)a1; const unsigned char *s2 = (const unsigned char*)a2; uptr i; for (i = 0; i < size; i++) { c1 = s1[i]; c2 = s2[i]; if (c1 != c2) break; } ASAN_READ_RANGE(s1, Min(i + 1, size)); ASAN_READ_RANGE(s2, Min(i + 1, size)); return CharCmp(c1, c2); } looks like gcc partially inlines memcmp and bypasses out conservative interceptor. We could make the interceptor more strict (ASAN_READ_RANGE(s2, size);). I am trying to remember why we didn't do this...