Sanitizer: Add in build environment support

.github/workflows/main.yml

@@ -42,6 +42,34 @@ jobs:
           libtool --mode=execute valgrind --track-origins=yes --leak-check=yes --show-reachable=yes --error-exitcode=123 --quiet tests/unit-tests/testdriver
           libtool --mode=execute valgrind --track-origins=yes --leak-check=yes --show-reachable=yes --error-exitcode=123 --quiet tests/ccm-test
 
+  build-linux-sanitizer:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        BITS: ["32", "64" ]
+    steps:
+      - uses: actions/checkout@v6
+      - name: setup
+        run: |
+          sudo dpkg --add-architecture i386
+          sudo apt-get update && sudo apt-get install -y libcunit1-dev libtool libtool-bin exuberant-ctags build-essential libc6-dev-i386 libcunit1-dev:i386
+          ./autogen.sh
+      - name: configure
+        run: |
+          $GITHUB_WORKSPACE/configure --enable-tests --enable-sanitizer
+      - name: compile-32
+        if: matrix.BITS == '32'
+        run: |
+          make EXTRA_CFLAGS="-Werror -m32"
+      - name: compile-64
+        if: matrix.BITS == '64'
+        run: |
+          make EXTRA_CFLAGS=-Werror
+      - name: tests
+        run: |
+          tests/unit-tests/testdriver
+          tests/ccm-test
+
   build-linux-cmake:
     name: Build for Linux using CMake
     runs-on: ubuntu-latest

CMakeLists.txt

@@ -1,6 +1,6 @@
 ###############################################################################
 #
-#  Copyright (c) 2022 Contributors to the Eclipse Foundation
+#  Copyright (c) 2022-2026 Contributors to the Eclipse Foundation
 #
 #  See the LICENSE file(s) distributed with this work for additional
 #  information regarding copyright ownership.
@@ -50,10 +50,34 @@ else()
    # provided by zephyr/CMakeLists.txt and zephyr/Kconfig
 endif()
 
+if(ENABLE_SANITIZER)
+  if(MSVC)
+    add_compile_options(/fsanitize=address,undefined)
+    add_link_options(/fsanitize=address,undefined)
+    set(SAN_CFLAGS "/fsanitize=address,undefined")
+    set(SAN_LIBS "/fsanitize=address,undefined")
+  else()
+    add_compile_options(-fsanitize=address,undefined -fno-omit-frame-pointer -fsanitize-address-use-after-scope)
+    add_link_options(-fsanitize=address,undefined)
+    set(SAN_CFLAGS "-fsanitize=address,undefined -fno-omit-frame-pointer -fsanitize-address-use-after-scope")
+    set(SAN_LIBS "-fsanitize=address,undefined")
+  endif()
+  message(STATUS "AddressSanitizer (ASan) and UndefinedBehaviorSanitizer (UBSan) enabled")
+endif()
+
 option(WARNING_TO_ERROR "force all compiler warnings to be errors" OFF)
 
 configure_file(dtls_config.h.cmake.in dtls_config.h )
 
+# Build the tinydtls.pc file
+set(prefix ${CMAKE_INSTALL_PREFIX})
+set(exec_prefix "\${prefix}")
+set(libdir "\${prefix}/lib")
+set(includedir "\${prefix}/include")
+
+configure_file(${CMAKE_CURRENT_LIST_DIR}/tinydtls.pc.in
+               ${CMAKE_CURRENT_BINARY_DIR}/tinydtls.pc @ONLY)
+
 add_library(tinydtls)
 
 target_sources(tinydtls PRIVATE

autogen.sh

@@ -6,7 +6,8 @@ GENERATED_FILES="aclocal.m4 ar-lib compile depcomp src/.dirstamp
                Makefile aes/Makefile doc/Makefile ecc/Makefile
                platform-specific/Makefile sha2/Makefile
                tests/Makefile tests/unit-tests/Makefile
-               config.status configure config.log tinydtls.pc"
+               config.status configure config.log tinydtls.pc
+               m4/libtool.m4 m4/lt~obsolete.m4 m4/ltoptions.m4 m4/ltsugar.m4 m4/ltversion.m4"
 
 GENERATED_DIRS="autom4te.cache src/.deps"
 

ccm.c

@@ -1,6 +1,6 @@
 /*******************************************************************************
  *
- * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others.
+ * Copyright (c) 2011-2026 Olaf Bergmann (TZI) and others.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * and Eclipse Distribution License v. 1.0 which accompanies this distribution.
@@ -28,7 +28,7 @@
 
 #define CCM_FLAGS(A,M,L) (((A > 0) << 6) | (((M - 2)/2) << 3) | (L - 1))
 
-#define MASK_L(_L) ((1 << 8 * _L) - 1)
+#define MASK_L(_L) (((uint64_t)1 << (8 * _L)) - 1)
 
 #define SET_COUNTER(A,L,cnt,C) {					\
     unsigned int i_;                                                    \

configure.ac

@@ -1,7 +1,7 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
 #
-# Copyright (c) 2011-2021 Olaf Bergmann (TZI) and others.
+# Copyright (c) 2011-2026 Olaf Bergmann (TZI) and others.
 # All rights reserved. This program and the accompanying materials
 # are made available under the terms of the Eclipse Public License v1.0
 # and Eclipse Distribution License v. 1.0 which accompanies this distribution.
@@ -30,6 +30,7 @@ test -e install-sh || touch install-sh
 AC_PROG_MAKE_SET
 AC_PROG_CC
 AC_PROG_RANLIB
+AC_CONFIG_MACRO_DIR([m4])
 m4_ifdef([AM_PROG_AR], [AM_PROG_AR], [AR=ar])
 
 AC_C_BIGENDIAN
@@ -108,6 +109,25 @@ if test "$enable_shared" = "yes" ; then
   ENABLE_SHARED=1
 fi
 
+AC_ARG_ENABLE([sanitizer],
+              [AS_HELP_STRING([--enable-sanitizer],
+                              [Enable building with sanitize=address,undefined coverage support [default=no]])],
+              [build_sanitizer="$enableval"],
+              [build_sanitizer="no"])
+
+SAN_CFLAGS=
+SAN_LIBS=
+if test "x$build_sanitizer" = "xyes"; then
+   AX_CHECK_COMPILE_FLAG([-fsanitize=address,undefined], [SAN_CFLAGS="-fsanitize=address,undefined"])
+   SAN_LIBS="$SAN_CFLAGS"
+   AX_CHECK_COMPILE_FLAG([-fno-omit-frame-pointer], [SAN_CFLAGS="$SAN_CFLAGS -fno-omit-frame-pointer"])
+   AX_CHECK_COMPILE_FLAG([-fsanitize-address-use-after-scope], [SAN_CFLAGS="$SAN_CFLAGS -fsanitize-address-use-after-scope"])
+   CFLAGS="$CFLAGS $SAN_CFLAGS"
+fi
+
+AC_SUBST(SAN_CFLAGS)
+AC_SUBST(SAN_LIBS)
+
 CPPFLAGS="${CPPFLAGS} -DDTLSv12 -DWITH_SHA256"
 OPT_OBJS="${OPT_OBJS} sha2/sha2.o"
 

dtls.c

@@ -1,6 +1,6 @@
 /*******************************************************************************
  *
- * Copyright (c) 2011-2022 Olaf Bergmann (TZI) and others.
+ * Copyright (c) 2011-2026 Olaf Bergmann (TZI) and others.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * and Eclipse Distribution License v. 1.0 which accompanies this distribution.
@@ -2151,7 +2151,7 @@ dtls_send_multi(dtls_context_t *ctx, dtls_peer_t *peer,
   return res <= 0 ? res : (int)(overall_len - (len - (unsigned int)res));
 }
 
-static inline int
+static int
 dtls_send_alert(dtls_context_t *ctx, dtls_peer_t *peer, dtls_alert_level_t level,
 		dtls_alert_t description) {
   uint8_t msg[] = { level, description };

hmac.c

@@ -1,6 +1,6 @@
 /*******************************************************************************
  *
- * Copyright (c) 2011-2020 Olaf Bergmann (TZI) and others.
+ * Copyright (c) 2011-2026 Olaf Bergmann (TZI) and others.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * and Eclipse Distribution License v. 1.0 which accompanies this distribution.
@@ -46,7 +46,7 @@ dtls_hmac_init(dtls_hmac_context_t *ctx, const unsigned char *key, size_t klen)
     dtls_hash_init(&ctx->data);
     dtls_hash_update(&ctx->data, key, klen);
     dtls_hash_finalize(ctx->pad, &ctx->data);
-  } else
+  } else if (key)
     memcpy(ctx->pad, key, klen);
 
   /* create ipad: */

m4/ax_check_compile_flag.m4

@@ -0,0 +1,53 @@
+# ===========================================================================
+#  https://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
+#
+# DESCRIPTION
+#
+#   Check whether the given FLAG works with the current language's compiler
+#   or gives an error.  (Warnings, however, are ignored)
+#
+#   ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
+#   success/failure.
+#
+#   If EXTRA-FLAGS is defined, it is added to the current language's default
+#   flags (e.g. CFLAGS) when the check is done.  The check is thus made with
+#   the flags: "CFLAGS EXTRA-FLAGS FLAG".  This can for example be used to
+#   force the compiler to issue an error when a bad flag is given.
+#
+#   INPUT gives an alternative input source to AC_COMPILE_IFELSE.
+#
+#   NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
+#   macro in sync with AX_CHECK_{PREPROC,LINK}_FLAG.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+#   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
+
+#serial 6
+
+AC_DEFUN([AX_CHECK_COMPILE_FLAG],
+[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
+AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl
+AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [
+  ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS
+  _AC_LANG_PREFIX[]FLAGS="$[]_AC_LANG_PREFIX[]FLAGS $4 $1"
+  AC_COMPILE_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
+    [AS_VAR_SET(CACHEVAR,[yes])],
+    [AS_VAR_SET(CACHEVAR,[no])])
+  _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags])
+AS_VAR_IF(CACHEVAR,yes,
+  [m4_default([$2], :)],
+  [m4_default([$3], :)])
+AS_VAR_POPDEF([CACHEVAR])dnl
+])dnl AX_CHECK_COMPILE_FLAGS

tests/ccm-test.c

@@ -43,6 +43,7 @@ int main(int argc, char **argv) {
 #endif /* WITH_CONTIKI */
   long int len;
   size_t n;
+  int ret = 0;
 
   rijndael_ctx ctx;
 
@@ -54,7 +55,7 @@ int main(int argc, char **argv) {
 
     if (rijndael_set_key_enc_only(&ctx, data[n].key, 8*sizeof(data[n].key)) < 0) {
       fprintf(stderr, "cannot set key\n");
-      return -1;
+      return 1;
     }
 
     len = dtls_ccm_encrypt_message(&ctx, data[n].M, data[n].L, data[n].nonce, 
@@ -63,11 +64,13 @@ int main(int argc, char **argv) {
 				   data[n].msg, data[n].la);
 
     len +=  + data[n].la;
-    printf("Packet Vector #%lu ", n+1);
-    if ((size_t)len != data[n].r_lm || memcmp(data[n].msg, data[n].result, len))
+    printf("Packet Vector #%zu ", n+1);
+    if ((size_t)len != data[n].r_lm || memcmp(data[n].msg, data[n].result, len)) {
       printf("FAILED, ");
-    else 
+      ret = 1;
+    } else {
       printf("OK, ");
+    }
 
     printf("result is (total length = %lu):\n\t", len);
     dump(data[n].msg, len);
@@ -76,15 +79,17 @@ int main(int argc, char **argv) {
 				   data[n].msg + data[n].la, len - data[n].la, 
 				   data[n].msg, data[n].la);
 
-    if (len < 0)
-      printf("Packet Vector #%lu: cannot decrypt message\n", n+1);
-    else 
+    if (len < 0) {
+      printf("Packet Vector #%zu: cannot decrypt message\n", n+1);
+      ret = 1;
+    } else {
       printf("\t*** MAC verified (total length = %lu) ***\n", len + data[n].la);
+    }
   }
 
 #ifdef WITH_CONTIKI
   PROCESS_END();
 #else /* WITH_CONTIKI */
-  return 0;
+  return ret;
 #endif /* WITH_CONTIKI */
 }

tinydtls.pc.in

@@ -1,7 +1,7 @@
 # pkg-config file for tinydtls
 #
 #
-# Copyright (c) 2011-2021 Olaf Bergmann (TZI) and others.
+# Copyright (c) 2011-2026 Olaf Bergmann (TZI) and others.
 # All rights reserved. This program and the accompanying materials
 # are made available under the terms of the Eclipse Public License v1.0
 # and Eclipse Distribution License v. 1.0 which accompanies this distribution.
@@ -22,5 +22,5 @@ Name: @PACKAGE_NAME@
 Description: A C library for Datagram Transport Layer Security (DTLS) supporting both client and server functionality.
 URL: @PACKAGE_URL@
 Version: @PACKAGE_VERSION@
-Libs: -L${libdir} -ltinydtls
-Cflags: -I${includedir}/tinydtls
+Libs: -L${libdir} -ltinydtls @SAN_LIBS@
+Cflags: -I${includedir}/tinydtls @SAN_CFLAGS@