Use gcc or clang -fsanitize with CI

[did-g]

Hi,

Valgrind is too slow but but what about -fsanitize=address and -fsanitize=undef?

There's a least one use after free in telemetry test code path, even if in this case coverity or clang scan should catch it.

==24571==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc 0x7fd21ba48be0 bp 0x7fff826c1870 sp 0x7fff826c1870 T0)
==24571==The signal is caused by a READ memory access.
==24571==Hint: address points to the zero page.
#0 0x7fd21ba48bdf in connection_get_and_clear_error src/net/conn.c:126
#1 0x7fd21ba41cfb in test_factory test/src/telemetry/test_telemetry.c:60

       if (connection_connect(conn, host, NULL, port) < 0)
        {
                connection_destroy(conn);
                elog(ERROR, "connection error: %s", connection_get_and_clear_error(conn));
 

[RobAtticus]

Hmm, I do see the use-after-free but neither using those flags with clang & gcc nor valgrind actually picked that up. How did you get it to warn about that? I will push a PR to fix the error though.

[did-g]

gcc (Ubuntu 7.3.0-16ubuntu3) 7.3.0

I compile and install postgresql configured with:

../postgresql/configure CFLAGS="-O2 -g -fno-omit-frame-pointer -fsanitize=undefined,address"

On Ubuntu 18.04 there's a linker error for a missing -ldl when linking postgresql executable with -fsanitize=address, have to execute ld command manually.

then compile timescaled, install

ASAN_OPTIONS="detect_leaks=0 exitcode=0 log_path=/tmp/pg_cmake" CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer" cmake .. -DCMAKE_BUILD_TYPE=Debug

ASAN_OPTIONS="detect_leaks=0 exitcode=0 log_path=/tmp/pg_make" make VERBOSE=1

and run

ASAN_OPTIONS="detect_leaks=1 exitcode=0 log_path=/tmp/pg_test" make installcheck

[mfreed]

This should be fixed in the 0.12.1 release: https://github.com/timescale/timescaledb/releases/tag/0.12.1

Please let us know if you continue to see any problems; otherwise, we'll close out this issue.

[did-g]

Hi,
Yes the use after free is fixed but does valgrind test pick it now?

[RobAtticus]

It does not, but we have put adding this to our CI testing on our roadmap. Definitely seems useful since both Coverity and valgrind missed these issues.

[svenklemm]

This has been added with #1050