Add ASAN target and clang to Docker image

LLVM AddressSanitizer can detect a different set of things
than valgrind, for example stack OOB access.

Fixed one issue caught with ASAN.