  Sanitizers provide robust test oracles for various software vulnerabilities.
Fuzzing on sanitizer-enabled programs has been the best practice to find
software bugs. Since sanitizers need to heavily instrument a target program to
insert run-time checks, sanitizer-enabled programs have much higher overhead
compared to normally built programs. In this paper, we present SAND, a new
fuzzing framework that decouples sanitization from the fuzzing loop. SAND
performs fuzzing on a normally built program and only invokes sanitizer-enabled
programs when input is shown to be interesting. Since most of the generated
inputs are not interesting, i.e., not bug-triggering, SAND allows most of the
fuzzing time to be spent on the normally built program. To identify interesting
inputs, we introduce execution pattern for a practical execution analysis on
the normally built program. We realize SAND on top of AFL++ and evaluate it on
12 real-world programs. Our extensive evaluation highlights its effectiveness:
on a period of 24 hours, compared to fuzzing on ASan/UBSan-enabled and
MSan-enabled programs, SAND respectively achieves 2.6x and 15x throughput and
detects 51% and 242% more bugs.
