Enable LeakSanitizer (LSan) via -DSANITIZE=ON on Linux; add sanitized CI jobs

.circleci/config.yml

@@ -35,6 +35,15 @@ commands:
             -DCOVERAGE="${CMAKE_COVERAGE:='OFF'}" \
             .
       - run: make -j 16 VERBOSE=1
+  build-sanitized:
+    steps:
+      - run: >
+          cmake -DWITH_TESTS=ON \
+            -DWITH_EXAMPLES=ON \
+            -DCMAKE_BUILD_TYPE=Debug \
+            -DSANITIZE=ON \
+            .
+      - run: make -j 16 VERBOSE=1
   build-release:
     steps:
       - run: >
@@ -114,6 +123,23 @@ jobs:
       - build
       - test
 
+  build-and-test-sanitized:
+    machine:
+      <<: *default-machine
+    environment:
+      TOOLCHAIN_PACKAGES: clang
+      CC: clang
+      CXX: clang++
+    steps:
+      - checkout
+      - linux-setup
+      - build-sanitized
+      # Ubuntu 22.04 raises mmap_rnd_bits to 28, which conflicts with ASan's
+      # fixed shadow memory offsets and causes random startup crashes.
+      # https://github.com/google/sanitizers/issues/1716
+      - run: sudo sysctl -w kernel.randomize_va_space=0
+      - test
+
   build-and-test-32b:
     machine:
       <<: *default-machine
@@ -204,7 +230,7 @@ jobs:
       - checkout
       - run: bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
       - run: brew install cmocka cmake
-      - build
+      - build-sanitized
       - test
 
 
@@ -289,6 +315,7 @@ workflows:
       - static-test
       - build-and-test
       - build-and-test-clang
+      - build-and-test-sanitized
       - build-and-test-32b
       - build-and-test-release-clang
       - build-and-test-arm

CMakeLists.txt

@@ -103,6 +103,11 @@ else()
       "${CMAKE_C_FLAGS_DEBUG} \
             -fsanitize=undefined -fsanitize=address \
             -fsanitize=bounds -fsanitize=alignment")
+    # Note: LeakSanitizer (LSan) is automatically enabled by ASan on Linux
+    # x86_64/aarch64 (detect_leaks=1 by default). Adding -fsanitize=leak
+    # explicitly would link a second LSan runtime alongside ASan's bundled one
+    # and cause crashes. Apple's LLVM does not support LSan at all.
+    # https://clang.llvm.org/docs/LeakSanitizer.html
   endif()
 
   set(CMAKE_EXE_LINKER_FLAGS_DEBUG "-g")