ci: add ASAN to s2n-quic ci

.github/workflows/ci.yml

@@ -15,7 +15,10 @@ env:
   RUST_BACKTRACE: 1
   # Pin the nightly toolchain to prevent breakage.
   # This should be occasionally updated.
-  RUST_NIGHTLY_TOOLCHAIN: nightly-2024-10-09
+  RUST_NIGHTLY_TOOLCHAIN: nightly-2024-12-01
+  ROOT_PATH: .
+  RUSTDOCFLAGS: -Zsanitizer=address
+  RUSTFLAGS: -Zsanitizer=address
   CDN: https://dnglbrstg7yg.cloudfront.net
   # enable unstable features for testing
   S2N_UNSTABLE_CRYPTO_OPT_TX: 100
@@ -249,6 +252,16 @@ jobs:
         with:
           crate: cross
 
+      # asan expects a binary at /usr/bin/llvm-symbolizer but GHA runners include
+      # multiple versioned binaries, like /usr/bin/llvm-symbolizer-13. This step
+      # finds the latest symbolizer and use it as the "base" llvm-symbolizer binary.
+      #
+      # llvm-symbolizer is necessary to get nice stack traces from asan errors. 
+      # Otherwise the stack trace just contains a hex address like "0x55bc6a28a9b6"
+      - name: set llvm symbolizer
+        run: |
+          sudo ln -s $(find /usr/bin/ -maxdepth 1 -name "llvm-symbolizer-*" | sort -V | tail -n 1) /usr/bin/llvm-symbolizer
+
       - uses: camshaft/rust-cache@v1
         with:
           key: ${{ matrix.target }}
@@ -271,6 +284,13 @@ jobs:
         run: |
           ${{ matrix.target != 'native' && 'cross' || 'cargo' }} test --workspace ${{ matrix.exclude }} ${{ matrix.target != 'native' && format('--target {0}', matrix.target) || '' }} ${{ matrix.args }}
 
+      - name: Run Unit Tests under ASAN
+        run: |
+          cargo test \
+            -Zbuild-std \
+            --manifest-path ${{ env.ROOT_PATH}}/Cargo.toml \
+            --target x86_64-unknown-linux-gnu
+
   fips:
     runs-on: ubuntu-latest
     steps: