Build with address sanitizer

.github/workflows/build.yml

@@ -17,6 +17,12 @@ jobs:
     strategy:
       matrix:
         configurations: [Debug, Release]
+        options: ['AddressSanitizer', 'NoSanitizer']
+        exclude:
+          - configurations: Release
+            options: AddressSanitizer
+
+
     runs-on: ubuntu-latest
     env:
       # Configuration type to build.  For documentation on how build matrices work, see
@@ -35,14 +41,23 @@ jobs:
 
       - name: Build
         run: |
+          if [ "${{matrix.options}}" = "AddressSanitizer" ]; then
+            export SANITIZER_FLAGS="-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all -fsanitize-coverage=inline-bool-flag -fsanitize-coverage=edge -fsanitize-coverage=trace-cmp -fsanitize-coverage=trace-div"
+            wget https://apt.llvm.org/llvm.sh
+            chmod +x llvm.sh
+            sudo ./llvm.sh 18
+            sudo update-alternatives --install /usr/bin/cc cc /usr/bin/clang-18 100
+            sudo update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang-18 100
+          fi
           mkdir build
-          cmake -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIGURATION}}
+          cmake -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIGURATION}} -DCMAKE_CXX_FLAGS="${SANITIZER_FLAGS}" -DCMAKE_C_FLAGS="${SANITIZER_FLAGS}"
           cmake --build build -j $(nproc)
 
       - name: Run unit tests
         run: ./tests -d yes
 
       - name: Test for memory leaks
+        if: matrix.options == 'NoSanitizer'
         # Any memory leaks will cause the test to fail
         # This BPF program was chosen because it is the largest one in the repo
         run: valgrind --leak-check=full --errors-for-leak-kinds=all  --show-leak-kinds=all --error-exitcode=1 ./check ebpf-samples/cilium/bpf_xdp_snat_linux_v1.o 2/1

src/crab/array_domain.cpp

@@ -7,6 +7,7 @@
 #include <unordered_map>
 #include <utility>
 #include <vector>
+#include <iostream>
 
 #include "radix_tree/radix_tree.hpp"
 #include "crab/array_domain.hpp"
@@ -65,7 +66,17 @@ offset_t radix_substr(const offset_t& key, int begin, int length)
         mask = ((index_t)1) << length;
 
     mask -= 1;
-    mask <<= offset_t::bitsize - length - begin;
+
+    size_t shift_count = offset_t::bitsize - length - begin;
+
+    // Workaround for undefined behavior when shifting by the width of the type.
+    // https://github.com/vbpf/ebpf-verifier/issues/602
+    if (shift_count < offset_t::bitsize) {
+        mask <<= offset_t::bitsize - length - begin;
+    }
+    else {
+        mask = 0;
+    }
 
     index_t value = (((index_t)key) & mask) << begin;
     return offset_t{value, length};