Enable sanitizers globally

[PolarGoose]

My project adds 3rd party dependencies via FetchContent_Declare:

FetchContent_Declare(
  mbedtls
  GIT_REPOSITORY https://github.com/Mbed-TLS/mbedtls
  GIT_TAG v3.6.5)
FetchContent_MakeAvailable(mbedtls)

add_library(exampleProj main.cpp)
target_link_libraries(exampleProj PUBLIC mbedtls)

add_library(exampleProj_sanitizers INTERFACE)
myproject_enable_sanitizers(exampleProj_sanitizers ON ON ON OFF OFF)
target_link_libraries(exampleProj PUBLIC exampleProj_sanitizers)

As you can see, myproject_enable_sanitizers only allows me to enable sanitizers for my own code, not for 3rd-party dependencies.
I don't think this is entirely correct. Sanitizers should be used for all code.

[lefticus]

@leftibot can you comment on this issue?

[leftibot]

Thanks for raising this. You're right that the current design only applies sanitizer flags to targets that link against myproject_options (or your own equivalent INTERFACE library). The reason it doesn't propagate to mbedtls is target-graph direction: in your example exampleProj links to mbedtls, not the other way around, so the INTERFACE flags from exampleProj_sanitizers flow to consumers of exampleProj, never into mbedtls's own compilation.

Why the template is structured this way

It's a deliberate trade-off, not an oversight:

1. MSan requires the entire world (including libc++) to be instrumented or it produces false positives — see the warning in cmake/Sanitizers.cmake:34-37. Applying -fsanitize=memory globally to an uninstrumented mbedtls would just produce noise.
2. UBSan is famously noisy on third-party C code — older crypto libraries in particular hit "unaligned pointer", "implicit conversion", and signed-overflow checks that the upstream maintainers either don't consider bugs or won't fix on your timeline. You'd typically want a suppressions file before turning UBSan on globally.
3. TSan and ASan/MSan are mutually exclusive at link time, so a single "sanitize everything" switch still has to make per-build choices.
4. Build-time cost roughly doubles when sanitizing dependencies, and FetchContent rebuilds aren't cached the way system packages are.

How to enable sanitizers globally if you want to

Use directory-scoped add_compile_options / add_link_options before FetchContent_MakeAvailable:

add_compile_options(-fsanitize=address,undefined)
add_link_options(-fsanitize=address,undefined)

FetchContent_Declare(mbedtls ...)
FetchContent_MakeAvailable(mbedtls)

These propagate to every target created afterwards, including the ones FetchContent brings in. Equivalently, you can set CMAKE_CXX_FLAGS_INIT / CMAKE_EXE_LINKER_FLAGS_INIT from a toolchain file or CMakePresets.json, which is cleaner because it survives reconfigures and doesn't require editing CMakeLists.txt.

For ASan specifically the propagation matters less than people assume — the ASan runtime intercepts allocations from non-instrumented code too, so you'll still catch use-after-free and heap-buffer-overflow on memory that mbedtls hands to your code. What you lose without instrumenting mbedtls is coverage of bugs that live entirely inside mbedtls.

Should the template offer this as an option?

Possibly. A myproject_ENABLE_GLOBAL_SANITIZERS flag that emitted add_compile_options/add_link_options at the top level (mirroring how myproject_ENABLE_GLOBAL_HARDENING already works in ProjectOptions.cmake:63-68) would be a reasonable addition, with documentation about the MSan/UBSan caveats above. PRs welcome if you'd like to take a swing at it.