Detect undefined behavior

I suspect undefined behavior caused the crash on the payment path. Before I push a hotfix, run the failing scenario under UBSan and ASan on the same input that reproduces the crash, and add targeted checks or rewrite the expression to avoid implementation-defined casts and signed integer overflow. Confirm the crash no longer occurs and add the sanitizer job to CI for the release branch.

Before I hand this to QA, make it easy to evaluate undefined-behavior risk: annotate places where signed overflow, pointer arithmetic, or out-of-range indexing might occur, replace C-style casts with explicit static_cast or reinterpret_cast, and surface any use of uninitialized memory or strict-aliasing violations. Flag the lines that need runtime sanitizer coverage and suggest fixes that minimize performance impact in release builds.

I ran the failing trace under AddressSanitizer and it points to a heap-buffer-overflow inside the serialization routine. The code is called by Luke in networking and Sara owns the serializer. I don’t know which input produced the bad length and whether a prior write corrupted the buffer. Is this more likely an off-by-one copy, a wrong length field, or use-after-free, and what immediate tests or prints should I add to isolate the cause without bringing production down?

We repeatedly spend days chasing crashes that turn out to be undefined behavior: signed overflow, aliasing issues, uninitialized reads. The recurring pattern is quick fixes that silence one symptom but leave UB lurking. What development habits, code-review checklists, and CI safeguards should we adopt so UB is caught earlier and doesn’t erode our reliability over time?