Add sanitizers to CI builds

.github/actions/build-deps/action.yml

@@ -21,6 +21,10 @@ inputs:
     description: "The logging verbosity."
     required: false
     default: "verbose"
+  sanitizers:
+    description: "The sanitizers to enable ('None', 'Address', 'Thread')."
+    required: false
+    default: "None"
 
 runs:
   using: composite
@@ -33,11 +37,13 @@ runs:
         BUILD_OPTION: ${{ inputs.force_build == 'true' && '*' || 'missing' }}
         BUILD_TYPE: ${{ inputs.build_type }}
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
+        SANITIZERS: ${{ inputs.sanitizers }}
       run: |
         echo 'Installing dependencies.'
         mkdir -p "${BUILD_DIR}"
         cd "${BUILD_DIR}"
         conan install \
+          --profile ci \
           --output-folder . \
           --build="${BUILD_OPTION}" \
           --options:host='&:tests=True' \

.github/actions/setup-conan/action.yml

@@ -28,7 +28,7 @@ runs:
       shell: bash
       run: |
         echo 'Installing profile.'
-        conan config install conan/profiles/default -tf $(conan config home)/profiles/
+        conan config install conan/profiles/ -tf $(conan config home)/profiles/
 
         echo 'Conan profile:'
         conan profile show

.github/scripts/strategy-matrix/generate.py

@@ -57,18 +57,18 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             if os['distro_name'] == 'debian':
                 skip = True
                 if os['distro_version'] == 'bookworm':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-13' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-13' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
                         cmake_args = f'-DUNIT_TEST_REFERENCE_FEE=500 {cmake_args}'
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-15' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-15' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-16' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-16' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
                         cmake_args = f'-Dvoidstar=ON {cmake_args}'
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-17' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-17' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
                         cmake_args = f'-DUNIT_TEST_REFERENCE_FEE=1000 {cmake_args}'
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-20' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-20' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
                 if skip:
                     continue
@@ -79,10 +79,10 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             if os['distro_name'] == 'rhel':
                 skip = True
                 if os['distro_version'] == '9':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
                 elif os['distro_version'] == '10':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-any' and build_type == 'Release' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-any' and build_type == 'Release' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
                 if skip:
                     continue
@@ -95,14 +95,14 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             if os['distro_name'] == 'ubuntu':
                 skip = True
                 if os['distro_version'] == 'jammy':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
                         skip = False
                 elif os['distro_version'] == 'noble':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-14' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-14' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-18' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-18' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-19' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/arm64':
+                    if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'clang-19' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/arm64':
                         skip = False
                 if skip:
                     continue
@@ -117,10 +117,9 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             if os['distro_name'] == 'windows' and not (build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'windows/amd64'):
                 continue
 
-
         # Additional CMake arguments.
         cmake_args = f'{cmake_args} -Dtests=ON -Dwerr=ON -Dxrpld=ON'
-        if not f'{os['compiler_name']}-{os['compiler_version']}' in ['gcc-12', 'clang-16']:
+        if not f'{os["compiler_name"]}-{os["compiler_version"]}' in ['gcc-12', 'clang-16']:
             cmake_args = f'{cmake_args} -Dwextra=ON'
         if build_type == 'Release':
             cmake_args = f'{cmake_args} -Dassert=ON'
@@ -131,13 +130,15 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             continue
 
         # We skip all clang 20+ on arm64 due to Boost build error.
-        if f'{os['compiler_name']}-{os['compiler_version']}' in ['clang-20', 'clang-21'] and architecture['platform'] == 'linux/arm64':
+        if f'{os["compiler_name"]}-{os["compiler_version"]}' in ['clang-20', 'clang-21'] and architecture['platform'] == 'linux/arm64':
             continue
 
-        # Enable code coverage for Debian Bookworm using GCC 15 in Debug and no
+        cxx_flags = '-g'
+        # Enable code coverage for Debian Bookworm using GCC 14 in Debug and no
         # Unity on linux/amd64
-        if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-15' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
-            cmake_args = f'-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0 {cmake_args}'
+        if f'{os["compiler_name"]}-{os["compiler_version"]}' == 'gcc-14' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+            cmake_args = f'-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 {cmake_args}'
+            cxx_flags = f'-O0 {cxx_flags}'
 
         # Generate a unique name for the configuration, e.g. macos-arm64-debug
         # or debian-bookworm-gcc-12-amd64-release-unity.
@@ -148,23 +149,114 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             config_name += f'-{n}'
         if (n := os['compiler_version']) != '':
             config_name += f'-{n}'
-        config_name += f'-{architecture['platform'][architecture['platform'].find('/')+1:]}'
+        config_name += f'-{architecture["platform"][architecture["platform"].find("/")+1:]}'
         config_name += f'-{build_type.lower()}'
         if '-Dunity=ON' in cmake_args:
             config_name += '-unity'
 
         # Add the configuration to the list, with the most unique fields first,
         # so that they are easier to identify in the GitHub Actions UI, as long
         # names get truncated.
-        configurations.append({
-            'config_name': config_name,
-            'cmake_args': cmake_args,
-            'cmake_target': cmake_target,
-            'build_only': build_only,
-            'build_type': build_type,
-            'os': os,
-            'architecture': architecture,
-        })
+        # Add Address and Thread (both coupled with UB) sanitizers when the distro is bookworm.
+        if os['distro_version'] == 'bookworm' and f'{os["compiler_name"]}-{os["compiler_version"]}' in {'gcc-15', 'clang-20'}:
+            extra_warning_flags = ''
+            linker_relocation_flags = ''
+            linker_flags = ''
+
+            # Use large code model to avoid relocation errors with large binaries
+            # Only for x86-64 (amd64) - ARM64 doesn't support -mcmodel=large
+            if architecture['platform'] == 'linux/amd64' and os['compiler_name'] == 'gcc':
+                # Add -mcmodel=large and -fPIC to both compiler AND linker flags
+                # This is needed because sanitizers create very large binaries
+                # -fPIC enables position independent code to avoid relocation range issues
+                # large model removes the 2GB limitation that medium model has
+                cxx_flags += ' -mcmodel=large -fPIC -pie'
+                linker_relocation_flags+=' -mcmodel=large -fPIC -pie'
+
+            # Create default sanitizer flags
+            sanitizers_flags = 'undefined,float-divide-by-zero'
+
+            if os['compiler_name'] == 'gcc':
+                sanitizers_flags = f'{sanitizers_flags},signed-integer-overflow'
+                # Suppress false positive warnings in GCC with stringop-overflow
+                extra_warning_flags += ' -Wno-stringop-overflow'
+                # Disable mold, gold and lld linkers.
+                # Use default linker (bfd/ld) which is more lenient with mixed code models
+                cmake_args += ' -Duse_mold=OFF -Duse_gold=OFF -Duse_lld=OFF'
+                # Add linker flags for Sanitizers
+                linker_flags += f' -DCMAKE_EXE_LINKER_FLAGS="{linker_relocation_flags} -fsanitize=address,{sanitizers_flags}"'
+                linker_flags += f' -DCMAKE_SHARED_LINKER_FLAGS="{linker_relocation_flags} -fsanitize=address,{sanitizers_flags}"'
+            elif os['compiler_name'] == 'clang':
+                sanitizers_flags = f'{sanitizers_flags},signed-integer-overflow,unsigned-integer-overflow'
+                linker_flags += f' -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,{sanitizers_flags}"'
+                linker_flags += f' -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address,{sanitizers_flags}"'
+
+            # Sanitizers recommend minimum of -O1 for reasonable performance
+            if "-O0" in cxx_flags:
+                cxx_flags = cxx_flags.replace("-O0", "-O1")
+            else:
+                cxx_flags += " -O1"
+
+            # First create config for asan
+            cmake_args_flags = f'{cmake_args} -DCMAKE_CXX_FLAGS="-fsanitize=address,{sanitizers_flags} -fno-omit-frame-pointer {cxx_flags} {extra_warning_flags}" {linker_flags}'
+
+            # Add config with asan
+            configurations.append({
+                'config_name': config_name + "_asan",
+                'cmake_args': cmake_args_flags,
+                'cmake_target': cmake_target,
+                'build_only': build_only,
+                'build_type': build_type,
+                'os': os,
+                'architecture': architecture,
+                'sanitizers': 'Address'
+            })
+
+            linker_flags = ''
+            # Update configs for tsan
+            # gcc doesn't supports atomic_thread_fence with tsan. Suppress warnings.
+            # Also tsan doesn't work well with mcmode=large and bfd linker
+            if os['compiler_name'] == 'gcc':
+                extra_warning_flags += ' -Wno-tsan'
+                cxx_flags = cxx_flags.replace('-mcmodel=large', '-mcmodel=medium')
+                linker_relocation_flags = linker_relocation_flags.replace('-mcmodel=large', '-mcmodel=medium')
+                # Add linker flags for Sanitizers
+                linker_flags += f' -DCMAKE_EXE_LINKER_FLAGS="{linker_relocation_flags} -fsanitize=thread,{sanitizers_flags}"'
+                linker_flags += f' -DCMAKE_SHARED_LINKER_FLAGS="{linker_relocation_flags} -fsanitize=thread,{sanitizers_flags}"'
+            elif os['compiler_name'] == 'clang':
+                cxx_flags += ' -fsanitize-blacklist=$GITHUB_WORKSPACE/external/sanitizer-blacklist.txt'
+                linker_flags += f' -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread,{sanitizers_flags}"'
+                linker_flags += f' -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=thread,{sanitizers_flags}"'
+
+            # Note: We use $GITHUB_WORKSPACE environment variable which will be expanded by the shell
+            # before CMake processes it. This ensures the compiler receives an absolute path.
+            # CMAKE_SOURCE_DIR won't work here because it's inside CMAKE_CXX_FLAGS string.
+            cmake_args_flags = f'{cmake_args} -DCMAKE_CXX_FLAGS="-fsanitize=thread,{sanitizers_flags} -fno-omit-frame-pointer {cxx_flags} {extra_warning_flags}" {linker_flags}'
+
+            configurations.append({
+                'config_name': config_name+ "_tsan",
+                'cmake_args': cmake_args_flags,
+                'cmake_target': cmake_target,
+                'build_only': build_only,
+                'build_type': build_type,
+                'os': os,
+                'architecture': architecture,
+                'sanitizers': 'Thread'
+            })
+        else:
+            if cxx_flags:
+                cmake_args_flags = f'{cmake_args} -DCMAKE_CXX_FLAGS={cxx_flags}'
+            else:
+                cmake_args_flags = f'{cmake_args}'
+            configurations.append({
+                'config_name': config_name,
+                'cmake_args': cmake_args_flags,
+                'cmake_target': cmake_target,
+                'build_only': build_only,
+                'build_type': build_type,
+                'os': os,
+                'architecture': architecture
+            })
 
     return configurations
 

.github/workflows/reusable-build-test-config.yml

@@ -50,6 +50,12 @@ on:
         type: number
         default: 2
 
+      sanitizers:
+        description: "The sanitizers to enable ('Address+UndefinedBehaviour' or 'Thread+UndefinedBehaviour')."
+        required: false
+        type: string
+        default: "None"
+
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -68,6 +74,7 @@ jobs:
     env:
       ENABLED_VOIDSTAR: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
       ENABLED_COVERAGE: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
+      ENABLED_SANITIZERS: ${{ contains(inputs.cmake_args, '-fsanitize') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
@@ -102,19 +109,18 @@ jobs:
           # Set the verbosity to "quiet" for Windows to avoid an excessive
           # amount of logs. For other OSes, the "verbose" logs are more useful.
           log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
+          sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
         working-directory: ${{ inputs.build_dir }}
         env:
           BUILD_TYPE: ${{ inputs.build_type }}
-          CMAKE_ARGS: ${{ inputs.cmake_args }}
         run: |
-          cmake \
+          cmake .. \
             -G '${{ runner.os == 'Windows' && 'Visual Studio 17 2022' || 'Ninja' }}' \
             -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
             -DCMAKE_BUILD_TYPE="${BUILD_TYPE}" \
-            ${CMAKE_ARGS} \
-            ..
+            ${{ inputs.cmake_args }}
 
       - name: Build the binary
         working-directory: ${{ inputs.build_dir }}
@@ -141,7 +147,7 @@ jobs:
           if-no-files-found: error
 
       - name: Check linking (Linux)
-        if: ${{ runner.os == 'Linux' }}
+        if: ${{ runner.os == 'Linux' && env.ENABLED_SANITIZERS == 'false' }}
         working-directory: ${{ inputs.build_dir }}
         run: |
           ldd ./rippled
@@ -166,6 +172,10 @@ jobs:
           BUILD_TYPE: ${{ inputs.build_type }}
           PARALLELISM: ${{ runner.os == 'Windows' && '1' || steps.nproc.outputs.nproc }}
         run: |
+          export ASAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/asan.supp"
+          export TSAN_OPTIONS="second_deadlock_stack=1 suppressions=$GITHUB_WORKSPACE/external/tsan.supp"
+          export UBSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/ubsan.supp"
+          export LSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/lsan.supp"
           ctest \
             --output-on-failure \
             -C "${BUILD_TYPE}" \
@@ -177,6 +187,10 @@ jobs:
         env:
           BUILD_NPROC: ${{ steps.nproc.outputs.nproc }}
         run: |
+          export ASAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/asan.supp"
+          export TSAN_OPTIONS="second_deadlock_stack=1 suppressions=$GITHUB_WORKSPACE/external/tsan.supp"
+          export UBSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/ubsan.supp"
+          export LSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/external/lsan.supp"
           ./rippled --unittest --unittest-jobs "${BUILD_NPROC}"
 
       - name: Debug failure (Linux)

.github/workflows/reusable-build-test.yml

@@ -54,5 +54,6 @@ jobs:
       runs_on: ${{ toJSON(matrix.architecture.runner) }}
       image: ${{ contains(matrix.architecture.platform, 'linux') && format('ghcr.io/xrplf/ci/{0}-{1}:{2}-{3}-sha-{4}', matrix.os.distro_name, matrix.os.distro_version, matrix.os.compiler_name, matrix.os.compiler_version, matrix.os.image_sha) || '' }}
       config_name: ${{ matrix.config_name }}
+      sanitizers: ${{ matrix.sanitizers }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}