From dd639ed52caac254340280f6a431689cc186e19d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20Br=C3=BCbach?= <Bruebach.Lukas@bdosecurity.de>
Date: Mon, 5 Oct 2026 09:50:09 +0200
Subject: [PATCH] [CI] Run the suite once under ASan and UBSan

Adds --sanitize to .ci/compile.sh, mirroring --test, and turns it on for one entry of
the existing Linux Docker matrix: Ubuntu 26.04, which already had a test-enabled leg.
That reuses the image, the ccache layer and the existing step shape, so the CI diff is a
matrix key plus the argument plumbing. Debian 13 and Fedora 44 keep covering the
uninstrumented suite, so nothing is lost by instrumenting one leg.

Sanitizers stay off the release and package legs, which build with --release for
packaging: instrumenting those would change the shipped binaries' optimization profile
and build time for no benefit. macOS and Windows stay uninstrumented too, since ASan is
unreliable against the Qt build there and MSVC has no equivalent without /fsanitize=address.

--sanitize does not imply --test, so an instrumented build can be produced locally
without paying for ctest. When both are given, ctest runs with detect_leaks=0 because Qt
and the sanitizer runtimes both leak at exit by design and LeakSanitizer's default buries
real findings under hundreds of process-teardown reports, and with UBSan halt_on_error=0 so
one run collects many findings instead of stopping at the first. ASan keeps
abort_on_error=1, since a bad access leaves the process unusable and continuing only
produces a second, more confusing report from the wreckage.
---
 .ci/compile.sh                      | 20 ++++++++++++++++++++
 .github/workflows/desktop-build.yml | 12 +++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/.ci/compile.sh b/.ci/compile.sh
index d76d32bcc..fd8aa1680 100755
--- a/.ci/compile.sh
+++ b/.ci/compile.sh
@@ -8,6 +8,7 @@
 # --suffix <suffix> renames package with this suffix, requires arg
 # --server compiles servatrice
 # --test runs tests
+# --sanitize builds with AddressSanitizer and UndefinedBehaviorSanitizer, gcc/clang only
 # --debug or --release sets the build type ie CMAKE_BUILD_TYPE
 # --ccache [<size>] uses ccache and shows stats, optionally provide size
 # --evict-ccache <age> runs ccache eviction based on given age after build
@@ -57,6 +58,10 @@ while [[ $# != 0 ]]; do
       MAKE_TEST=1
       shift
       ;;
+    '--sanitize')
+      MAKE_SANITIZE=1
+      shift
+      ;;
     '--debug')
       BUILDTYPE="Debug"
       shift
@@ -147,6 +152,9 @@ fi
 if [[ $MAKE_TEST ]]; then
   flags+=("-DTEST=1")
 fi
+if [[ $MAKE_SANITIZE ]]; then
+  flags+=("-DENABLE_SANITIZERS=ON")
+fi
 if [[ $USE_CCACHE ]]; then
   flags+=("-DUSE_CCACHE=1")
   # PCH-aware caching is required or ccache refuses to cache any TU that
@@ -306,6 +314,18 @@ fi
 
 if [[ $MAKE_TEST ]]; then
   echo "::group::Run tests"
+  if [[ $MAKE_SANITIZE ]]; then
+    # detect_leaks=0: Qt and the sanitizers' own runtimes both leak at exit by design, and
+    # LeakSanitizer's default is aggressive enough to bury our real findings under hundreds
+    # of process-teardown reports. Malloc/free misuse and use-after-free are what ASan is for
+    # and they stay fully on.
+    # abort_on_error=1: a bad access leaves the process in an unusable state, so continuing
+    # only produces a second, more confusing report from the wreckage.
+    # UBSAN halt_on_error=0: report and keep going, so one run collects many findings instead
+    # of stopping at the first one.
+    export ASAN_OPTIONS="detect_leaks=0:abort_on_error=1:print_stacktrace=1:symbolize=1"
+    export UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=0:symbolize=1"
+  fi
   # Every TEST() is its own CTest entry, so the suite is process-spawn bound rather than CPU
   # bound and -j recovers nearly all of the per-process overhead. The test binaries are safe to
   # run concurrently: the only one that claims a fixed resource is single_instance_manager_test,
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 17c42b07d..57c2993f6 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -144,6 +144,11 @@ jobs:
 
             package: DEB
 
+            # The one leg that runs the suite under AddressSanitizer and
+            # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
+            # uninstrumented suite, so nothing is lost by instrumenting this one.
+            sanitize: yes
+
     name: ${{ matrix.distro }} ${{ matrix.version }}
     needs: configure
     runs-on: ubuntu-latest    # https://github.com/actions/runner-images
@@ -174,6 +179,8 @@ jobs:
       - name: "Build debug and test"
         if: matrix.test != 'skip'
         shell: bash
+        env:
+          sanitize: '${{ matrix.sanitize }}'
         run: |
           source .ci/docker.sh
           args=()
@@ -181,7 +188,10 @@ jobs:
           args+=(--ccache "$CCACHE_SIZE")
           args+=(--cmake-generator "$CMAKE_GENERATOR")
 
-          RUN --server --debug --test "${args[@]}"
+          extra=()
+          [[ $sanitize == yes ]] && extra+=(--sanitize)
+
+          RUN --server --debug --test "${extra[@]}" "${args[@]}"
 
       - name: "Build release package"
         id: build