Fail on new UB in CI

.github/workflows/reusable-san.yml

@@ -61,7 +61,7 @@ jobs:
               || ''
             }}.txt handle_segv=0" >> "$GITHUB_ENV"
         else
-          echo "UBSAN_OPTIONS=${SAN_LOG_OPTION}" >> "$GITHUB_ENV"
+          echo "UBSAN_OPTIONS=${SAN_LOG_OPTION} halt_on_error=1 suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt" >> "$GITHUB_ENV"
         fi
         echo "CC=clang" >> "$GITHUB_ENV"
         echo "CXX=clang++" >> "$GITHUB_ENV"
@@ -75,7 +75,7 @@ jobs:
         ${{
           inputs.sanitizer == 'TSan'
           && '--with-thread-sanitizer'
-          || '--with-undefined-behavior-sanitizer'
+          || '--with-undefined-behavior-sanitizer --with-strict-overflow'
         }}
         --with-pydebug
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
@@ -87,6 +87,7 @@ jobs:
       run: >-
         ./python -m test
         ${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
+        ${{ inputs.sanitizer == 'UBSan' && '-x test_capi' || '' }}
         -j4
     - name: Parallel tests
       if: >-

Tools/ubsan/suppressions.txt

@@ -0,0 +1,24 @@
+# This file contains suppressions for the UndefinedBehaviour sanitizer.
+#
+# When adding a suppression, include a comment referencing a GitHub issue
+# that describes how to reproduce the race and includes the relevant UBSan
+# output.
+
+null:Objects/object.c
+bool:Objects/memoryobject.c
+
+# Modules/binascii.c:1243:42: runtime error: left shift of 128 by 24 places cannot be represented in type 'int'
+shift-base:Modules/binascii.c
+
+# Modules/_ctypes/cfield.c:644:1: runtime error: left shift of 1 by 63 places cannot be represented in type 'int64_t' (aka 'long')
+shift-base:Modules/_ctypes/cfield.c
+signed-integer-overflow:Modules/_ctypes/cfield.c
+
+# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
+pointer-overflow:Modules/_zstd/decompressor.c
+
+# Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
+pointer-overflow:Modules/_io/stringio.c
+
+# Objects/bytesobject.c:1190:25: runtime error: applying zero offset to null pointer
+pointer-overflow:Objects/bytesobject.c