Repository: randombit/botan
Pull request #1892 (2019-04-12 15:38:37)

Proposal to silent, when wished, some "false positives" when using sa…
…nitizers.

To be improved overtime eventually.


Patch:
diff --git a/news.rst b/news.rst
index 5954b9923..040869e70 100644
--- a/news.rst
+++ b/news.rst
@@ -4,25 +4,6 @@ Release Notes
 Version 2.11.0, Not Yet Released
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-* Add a certificate store for Linux/Unix systems. (GH #1885)
-
-* Fix verification rooted in a v1 certificate which previously would fail.
-  (GH #1890)
-
-* It is now possible to create intermediate CA certificates using the
-  command line interface. (GH #1879 #1889)
-
-* Add a new build time option to set where the system stores trusted
-  certificates. (GH #1888)
-
-* When available use sysconf to detect the number of CPUs (GH #1877)
-
-* Fix a memory leak in the tests (GH #1886)
-
-* Fix an issue building with the new Boost 1.70 (GH #1881 #1880)
-
-* Fix the makefile .PHONY syntax (GH #1874)
-
 Version 2.10.0, 2019-03-30
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp b/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp
deleted file mode 100644
index cf0ca2d90..000000000
--- a/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
-* Certificate Store
-* (C) 1999-2019 Jack Lloyd
-* (C) 2019      Patrick Schmidt
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#include <botan/build.h>
-
-#include <botan/certstor_flatfile.h>
-#include <botan/data_src.h>
-#include <botan/pem.h>
-
-namespace Botan {
-namespace {
-std::vector<std::vector<uint8_t>> decode_all_certificates(DataSource& source)
-   {
-   std::vector<std::vector<uint8_t>> pems;
-
-   while(!source.end_of_data())
-      {
-      std::string label;
-      std::vector<uint8_t> cert;
-      try
-         {
-         cert = unlock(PEM_Code::decode(source, label));
-
-         if(label == "CERTIFICATE" || label == "X509 CERTIFICATE" || label == "TRUSTED CERTIFICATE")
-            {
-            pems.push_back(cert);
-            }
-         }
-      catch(const Decoding_Error&) {}
-      }
-
-   return pems;
-   }
-}
-
-Flatfile_Certificate_Store::Flatfile_Certificate_Store(const std::string& file)
-   {
-   if(file.empty())
-      {
-      throw Invalid_Argument("Flatfile_Certificate_Store::Flatfile_Certificate_Store invalid file path");
-      }
-
-   DataSource_Stream file_stream(file);
-
-   for(const std::vector<uint8_t> der : decode_all_certificates(file_stream))
-      {
-      std::shared_ptr<const X509_Certificate> cert = std::make_shared<const X509_Certificate>(der.data(), der.size());
-
-      if(!cert->is_self_signed() || !cert->is_CA_cert())
-         {
-         throw Invalid_Argument("Flatfile_Certificate_Store::Flatfile_Certificate_Store certificate is not self-signed CA");
-         }
-
-      m_all_subjects.push_back(cert->subject_dn());
-      m_dn_to_cert.emplace(cert->subject_dn(), cert);
-      m_pubkey_sha1_to_cert.emplace(cert->subject_public_key_bitstring_sha1(), cert);
-      m_subject_dn_sha256_to_cert.emplace(cert->raw_subject_dn_sha256(), cert);
-      }
-
-   if(m_all_subjects.empty())
-      {
-      throw Invalid_Argument("Flatfile_Certificate_Store::Flatfile_Certificate_Store cert file is empty");
-      }
-   }
-
-std::vector<X509_DN> Flatfile_Certificate_Store::all_subjects() const
-   {
-   return m_all_subjects;
-   }
-
-std::shared_ptr<const X509_Certificate>
-Flatfile_Certificate_Store::find_cert(const X509_DN& subject_dn,
-                                      const std::vector<uint8_t>& key_id) const
-   {
-   std::vector<std::shared_ptr<const X509_Certificate>> found_certs = find_all_certs(subject_dn, key_id);
-
-   return !found_certs.empty() ? found_certs.front() : nullptr;
-   }
-
-std::vector<std::shared_ptr<const X509_Certificate>> Flatfile_Certificate_Store::find_all_certs(
-         const X509_DN& subject_dn,
-         const std::vector<uint8_t>& key_id) const
-   {
-   const auto found_range = m_dn_to_cert.equal_range(subject_dn);
-
-   if(found_range.first == m_dn_to_cert.end())
-      {
-      return {};
-      }
-
-   std::vector<std::shared_ptr<const X509_Certificate>> found_certs;
-
-   for(auto i = found_range.first; i != found_range.second; ++i)
-      {
-      const std::shared_ptr<const X509_Certificate> cert = i->second;
-
-      if(key_id.empty() || key_id == cert->subject_key_id())
-         {
-         found_certs.push_back(cert);
-         }
-      }
-
-   return found_certs;
-   }
-
-std::shared_ptr<const X509_Certificate>
-Flatfile_Certificate_Store::find_cert_by_pubkey_sha1(const std::vector<uint8_t>& key_hash) const
-   {
-   if(key_hash.size() != 20)
-      {
-      throw Invalid_Argument("Flatfile_Certificate_Store::find_cert_by_pubkey_sha1 invalid hash");
-      }
-
-   auto found_cert = m_pubkey_sha1_to_cert.find(key_hash);
-
-   if(found_cert != m_pubkey_sha1_to_cert.end())
-      {
-      return found_cert->second;
-      }
-
-   return nullptr;
-   }
-
-std::shared_ptr<const X509_Certificate>
-Flatfile_Certificate_Store::find_cert_by_raw_subject_dn_sha256(const std::vector<uint8_t>& subject_hash) const
-   {
-   if(subject_hash.size() != 32)
-      { throw Invalid_Argument("Flatfile_Certificate_Store::find_cert_by_raw_subject_dn_sha256 invalid hash"); }
-
-   auto found_cert = m_subject_dn_sha256_to_cert.find(subject_hash);
-
-   if(found_cert != m_subject_dn_sha256_to_cert.end())
-      {
-      return found_cert->second;
-      }
-
-   return nullptr;
-   }
-
-std::shared_ptr<const X509_CRL> Flatfile_Certificate_Store::find_crl_for(const X509_Certificate& subject) const
-   {
-   BOTAN_UNUSED(subject);
-   return {};
-   }
-}
diff --git a/src/lib/x509/certstor_flatfile/certstor_flatfile.h b/src/lib/x509/certstor_flatfile/certstor_flatfile.h
deleted file mode 100644
index 611bd3895..000000000
--- a/src/lib/x509/certstor_flatfile/certstor_flatfile.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
-* Certificate Store
-* (C) 1999-2019 Jack Lloyd
-* (C) 2019      Patrick Schmidt
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#ifndef BOTAN_CERT_STORE_FLATFILE_H_
-#define BOTAN_CERT_STORE_FLATFILE_H_
-
-#include <botan/certstor.h>
-
-#include <vector>
-#include <memory>
-#include <map>
-
-namespace Botan {
-/**
-* Certificate Store that is backed by a file of PEMs of trusted CAs.
-*/
-class BOTAN_PUBLIC_API(2, 11) Flatfile_Certificate_Store final : public Certificate_Store
-   {
-   public:
-      /**
-      * Construct a new Certificate_Store given a file path to a file including
-      * PEMs of trusted self-signed CAs.
-      */
-      Flatfile_Certificate_Store(const std::string& file);
-
-      Flatfile_Certificate_Store(const Flatfile_Certificate_Store&) = default;
-      Flatfile_Certificate_Store(Flatfile_Certificate_Store&&) = default;
-      Flatfile_Certificate_Store& operator=(const Flatfile_Certificate_Store&) = default;
-      Flatfile_Certificate_Store& operator=(Flatfile_Certificate_Store&&) = default;
-
-      /**
-      * @return DNs for all certificates managed by the store
-      */
-      std::vector<X509_DN> all_subjects() const override;
-
-      /**
-      * Find a certificate by Subject DN and (optionally) key identifier
-      * @return the first certificate that matches
-      */
-      std::shared_ptr<const X509_Certificate> find_cert(
-         const X509_DN& subject_dn,
-         const std::vector<uint8_t>& key_id) const override;
-
-      /**
-      * Find all certificates with a given Subject DN.
-      * Subject DN and even the key identifier might not be unique.
-      */
-      std::vector<std::shared_ptr<const X509_Certificate>> find_all_certs(
-               const X509_DN& subject_dn, const std::vector<uint8_t>& key_id) const override;
-
-      /**
-      * Find a certificate by searching for one with a matching SHA-1 hash of
-      * public key.
-      * @return a matching certificate or nullptr otherwise
-      */
-      std::shared_ptr<const X509_Certificate>
-      find_cert_by_pubkey_sha1(const std::vector<uint8_t>& key_hash) const override;
-
-      std::shared_ptr<const X509_Certificate>
-      find_cert_by_raw_subject_dn_sha256(const std::vector<uint8_t>& subject_hash) const override;
-
-      /**
-       * Fetching CRLs is not supported by this certificate store. This will
-       * always return an empty list.
-       */
-      std::shared_ptr<const X509_CRL> find_crl_for(const X509_Certificate& subject) const override;
-
-   private:
-      std::vector<X509_DN> m_all_subjects;
-      std::multimap<X509_DN, std::shared_ptr<const X509_Certificate>> m_dn_to_cert;
-      std::map<std::vector<uint8_t>, std::shared_ptr<const X509_Certificate>> m_pubkey_sha1_to_cert;
-      std::map<std::vector<uint8_t>, std::shared_ptr<const X509_Certificate>> m_subject_dn_sha256_to_cert;
-   };
-}
-
-#endif
diff --git a/src/lib/x509/certstor_flatfile/info.txt b/src/lib/x509/certstor_flatfile/info.txt
deleted file mode 100644
index 902997be7..000000000
--- a/src/lib/x509/certstor_flatfile/info.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-<defines>
-CERTSTOR_FLATFILE -> 20190410
-</defines>
-
-<os_features>
-filesystem
-</os_features>
-
-<header:public>
-certstor_flatfile.h
-</header:public>
-


Test patch:
diff --git a/src/tests/data/x509/misc/certstor/ca_bundle_containing_non_ca.pem b/src/tests/data/x509/misc/certstor/ca_bundle_containing_non_ca.pem
deleted file mode 100644
index e6b723261..000000000
--- a/src/tests/data/x509/misc/certstor/ca_bundle_containing_non_ca.pem
+++ /dev/null
@@ -1,71 +0,0 @@
-
-> DST Root CA X3
-
------BEGIN CERTIFICATE-----
-MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
-MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
-DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
-PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
-Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
-rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
-OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
-xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
-7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
-aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
-HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
-SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
-ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
-AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
-R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
-JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
-Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
------END CERTIFICATE-----
-
-> rmeusel-eduroam@cern.ch
-> Note: this is NOT a CA
-
------BEGIN CERTIFICATE-----
-MIIHyjCCBbKgAwIBAgIKIx3D0gAAAAAbxDANBgkqhkiG9w0BAQsFADBRMRIwEAYK
-CZImiZPyLGQBGRYCY2gxFDASBgoJkiaJk/IsZAEZFgRjZXJuMSUwIwYDVQQDExxD
-RVJOIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MDQzMDA4MzQwMloXDTIw
-MDQyODA4MzQwMlowIjEgMB4GA1UEAwwXcm1ldXNlbC1lZHVyb2FtQGNlcm4uY2gw
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqPQ4XLqlywbOnHYNztq2Y
-kVh1krXncE1IlLozJS40gBk/wnya+MKfRT6vQF5a9FWSh9P33oLd7JSBasEOtqpG
-rNL8f2BvoRlNOFoFOxJb3lTmS3lCW8ve051B0Icayt5sQDwdVkoDTqpzBhvDAGF+
-uVmY1BB+Hu9TFK/e3h/eHCx1iDL7ldXjz72H2lu/+nEuozai2Pha0GpWtoUDzZMP
-yuhT0tGrXeCHG732/VXZJdEZS/bDIuHvOXDZwcpQIy6yVgpAwGiXRK0sbpUE1ix7
-hEj/vSa3DT2iIJMIjHp5vZrE9QnfJl4LmXgonu43RXu0R/pnP1vFRmEdo04gEi+p
-AgMBAAGjggPRMIIDzTA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDvdAJgu2N
-DYbtiyuB3vU3hYDQYh6CpsJKhqHpAAIBZAIBFTAdBgNVHQ4EFgQUKE5KOCt6b1mx
-Q+YgJhbZKVEoQeIwHwYDVR0jBBgwFoAUHZAZ6sjOzDyNFLFM2ewU4mFAA2EwggEq
-BgNVHR8EggEhMIIBHTCCARmgggEVoIIBEYZHaHR0cDovL2NhZmlsZXMuY2Vybi5j
-aC9jYWZpbGVzL2NybC9DRVJOJTIwQ2VydGlmaWNhdGlvbiUyMEF1dGhvcml0eS5j
-cmyGgcVsZGFwOi8vL0NOPUNFUk4lMjBDZXJ0aWZpY2F0aW9uJTIwQXV0aG9yaXR5
-LENOPUNFUk5QS0kwNyxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMs
-Q049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1jZXJuLERDPWNoP2NlcnRp
-ZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmli
-dXRpb25Qb2ludDCCAVQGCCsGAQUFBwEBBIIBRjCCAUIwXAYIKwYBBQUHMAKGUGh0
-dHA6Ly9jYWZpbGVzLmNlcm4uY2gvY2FmaWxlcy9jZXJ0aWZpY2F0ZXMvQ0VSTiUy
-MENlcnRpZmljYXRpb24lMjBBdXRob3JpdHkuY3J0MIG7BggrBgEFBQcwAoaBrmxk
-YXA6Ly8vQ049Q0VSTiUyMENlcnRpZmljYXRpb24lMjBBdXRob3JpdHksQ049QUlB
-LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
-Z3VyYXRpb24sREM9Y2VybixEQz1jaD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0
-Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAkBggrBgEFBQcwAYYYaHR0cDov
-L29jc3AuY2Vybi5jaC9vY3NwMA4GA1UdDwEB/wQEAwIGwDATBgNVHSUEDDAKBggr
-BgEFBQcDAjBkBgNVHSAEXTBbMFkGCisGAQQBYAoEAQEwSzBJBggrBgEFBQcCARY9
-aHR0cDovL2NhZmlsZXMuY2Vybi5jaC9jYWZpbGVzL2NwLWNwcy9jZXJuLWdyaWQt
-Y2EtY3AtY3BzLnBkZjAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMCMB4GA1Ud
-EQQXMBWBE3JlbmUubWV1c2VsQGNlcm4uY2gwDQYJKoZIhvcNAQELBQADggIBABzw
-A5GXuiLGOlIQcdmQM0VKAO0OYbqc+O/QzQgn6h5sH7X4FJCYkJE8OMuxIo59xIke
-2fKK3RVMgF7u7yeKeh2uVoPA+SN/Hwo4md0lIOiZYs78i6fsNW9d36/fPjh3dLRr
-1G8JitHeoBZyt66fnLjrO+/Jsrea5iYAXpLB4auQRUZ6Mr4oCKsm35ty7bQNA/Sj
-am2eOUMZ76PjS7ApMe3wJUxAgRAEmncL9uKyPRV4Yjr8g6a0pdKnHNRISquSwOBF
-QjJFmoD7jooLg3lYF14DMHoHYZq9CMpGZQRlhLl3eOz2aH4v/UZJaoPjxQ/8IwIJ
-mlHun8atlnUCjVpUURSO21YUxjYqwbwYxw4xGzEPOQI8k0ujBnVAPbwUdfhf3oeY
-sKtNvWcPEK2wC3Hx5lkFNFw3p4CLaGKH5r3Da6bWoOtepRznxKuND6rBEyEfCFaG
-+slSSdFjHbFxgTffweHoZq3JBd1A0hrutVgak4XA5TbbOsW1gugjfjUxJ2xbYAYl
-iA9xWRvuG2eXqhl5v2S/ZKI6moeocdg0gAz6nbvYu6qa2Cc4neLfXLqNV+8jqwAP
-lzXku1UKY0kRPiVWqcO7jRj/UoEv0y9Fh5o4fgp/vRXLIxrvc2qbc/nRoEjaV+vt
-m42lVMMeStmDqX/fM4XIzvP05Sl/wt/Z1B3ViXtl
------END CERTIFICATE-----
diff --git a/src/tests/data/x509/misc/certstor/valid_ca_bundle.pem b/src/tests/data/x509/misc/certstor/valid_ca_bundle.pem
deleted file mode 100644
index d1024179c..000000000
--- a/src/tests/data/x509/misc/certstor/valid_ca_bundle.pem
+++ /dev/null
@@ -1,79 +0,0 @@
-
-> D-TRUST Root Class 3 CA 2 EV 2009
-
------BEGIN CERTIFICATE-----
-MIIEQzCCAyugAwIBAgIDCYP0MA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkRF
-MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBD
-bGFzcyAzIENBIDIgRVYgMjAwOTAeFw0wOTExMDUwODUwNDZaFw0yOTExMDUwODUw
-NDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV
-BAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn
-ljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JUut8Mxk2og+KbgPCdM0
-3TP1YtHhzRnp7hhPTFiu4h7WDFsVWtg6uMQYZB7jM7K1iXdODL/ZlGsTl28So/6Z
-qQTMFexgaDbtCHu39b+T7WYxg4zGcTSHThfqr4uRjRxWQa4iN1438h3Z0S0NL2lR
-p75mpoo6Kr3HGrHhFPC+Oh25z1uxav60sUYgovseO3Dvk5h9jHOW8sXvhXCtKSb8
-HgQ+HKDYD8tSg2J87otTlZCpV6LqYQXY+U3EJ/pure3511H3a6UCAwEAAaOCASQw
-ggEgMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNOUikxiEyoZLsyvcop9Ntea
-HNxnMA4GA1UdDwEB/wQEAwIBBjCB3QYDVR0fBIHVMIHSMIGHoIGEoIGBhn9sZGFw
-Oi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xh
-c3MlMjAzJTIwQ0ElMjAyJTIwRVYlMjAyMDA5LE89RC1UcnVzdCUyMEdtYkgsQz1E
-RT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0MEagRKBChkBodHRwOi8vd3d3LmQt
-dHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2xhc3NfM19jYV8yX2V2XzIwMDku
-Y3JsMA0GCSqGSIb3DQEBCwUAA4IBAQA07XtaPKSUiO8aEXUHL7P+PPoeUSbrh/Yp
-3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05
-nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNF
-CSuGdXzfX2lXANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7na
-xpeG0ILD5EJt/rDiZE4OJudANCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqX
-KVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVvw9y4AyHqnxbxLFS1
------END CERTIFICATE-----
-
-> DST Root CA X3
-
------BEGIN CERTIFICATE-----
-MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
-MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
-DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
-PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
-Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
-rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
-OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
-xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
-7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
-aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
-HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
-SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
-ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
-AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
-R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
-JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
-Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
------END CERTIFICATE-----
-
-> VeriSign Class 3 Public Primary Certification Authority - G3
-> Note: this is a v1 style X.509 certificate
-
------BEGIN CERTIFICATE-----
-MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw
-CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
-cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
-LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
-aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
-dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
-VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
-aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
-bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
-IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b
-N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t
-KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu
-kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm
-CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ
-Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu
-imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te
-2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe
-DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC
-/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p
-F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt
-TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ==
------END CERTIFICATE-----
diff --git a/src/tests/main.cpp b/src/tests/main.cpp
index 3cf7526f0..fa158c6c5 100644
--- a/src/tests/main.cpp
+++ b/src/tests/main.cpp
@@ -96,8 +96,7 @@ int main(int argc, char* argv[])
          parser.flag_set("log-success"),
          parser.flag_set("run-online-tests"),
          parser.flag_set("run-long-tests"),
-         parser.flag_set("abort-on-first-fail"),
-         parser.flag_set("no-avoid-undefined"));
+         parser.flag_set("abort-on-first-fail"));
 
 #if defined(BOTAN_HAS_OPENSSL)
       if(opts.provider().empty() || opts.provider() == "openssl")
diff --git a/src/tests/test_certstor_flatfile.cpp b/src/tests/test_certstor_flatfile.cpp
deleted file mode 100644
index 2c24128c8..000000000
--- a/src/tests/test_certstor_flatfile.cpp
+++ /dev/null
@@ -1,278 +0,0 @@
-/*
-* (C) 1999-2019 Jack Lloyd
-* (C) 2019      René Meusel
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#include "tests.h"
-
-#if defined(BOTAN_HAS_CERTSTOR_FLATFILE)
-
-#include "test_certstor_utils.h"
-#include <botan/certstor_flatfile.h>
-#include <botan/ber_dec.h>
-#include <botan/der_enc.h>
-#include <botan/hex.h>
-
-namespace Botan_Tests {
-
-namespace {
-
-std::string get_valid_ca_bundle_path()
-   {
-   return Test::data_file("x509/misc/certstor/valid_ca_bundle.pem");
-   }
-
-std::string get_ca_bundle_containing_user_cert()
-   {
-   return Test::data_file("x509/misc/certstor/ca_bundle_containing_non_ca.pem");
-   }
-
-Test::Result open_certificate_store()
-   {
-   Test::Result result("Flatfile Certificate Store - Open Store");
-
-   try
-      {
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store unused(get_valid_ca_bundle_path());
-      result.end_timer();
-      result.test_gt("found some certificates", unused.all_subjects().size(), 0);
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   result.test_success();
-
-   return result;
-   }
-
-Test::Result find_certificate_by_pubkey_sha1()
-   {
-   Test::Result result("Flatfile Certificate Store - Find Certificate by SHA1(pubkey)");
-
-   try
-      {
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      auto cert = certstore.find_cert_by_pubkey_sha1(get_key_id());
-      result.end_timer();
-
-      if(result.test_not_null("found certificate", cert.get()))
-         {
-         auto cns = cert->subject_dn().get_attribute("CN");
-         result.test_int_eq("exactly one CN", cns.size(), 1);
-         result.test_eq("CN", cns.front(), "DST Root CA X3");
-         }
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   result.test_throws("on invalid SHA1 hash data", [&]
-      {
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      certstore.find_cert_by_pubkey_sha1({});
-      });
-
-   return result;
-   }
-
-Test::Result find_cert_by_subject_dn()
-   {
-   Test::Result result("Flatfile Certificate Store - Find Certificate by subject DN");
-
-   try
-      {
-      auto dn = get_dn();
-
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      auto cert = certstore.find_cert(dn, std::vector<uint8_t>());
-      result.end_timer();
-
-      if(result.test_not_null("found certificate", cert.get()))
-         {
-         auto cns = cert->subject_dn().get_attribute("CN");
-         result.test_int_eq("exactly one CN", cns.size(), 1);
-         result.test_eq("CN", cns.front(), "DST Root CA X3");
-         }
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   return result;
-   }
-
-Test::Result find_cert_by_subject_dn_and_key_id()
-   {
-   Test::Result result("Flatfile Certificate Store - Find Certificate by subject DN and key ID");
-
-   try
-      {
-      auto dn = get_dn();
-
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      auto cert = certstore.find_cert(dn, get_key_id());
-      result.end_timer();
-
-      if(result.test_not_null("found certificate", cert.get()))
-         {
-         auto cns = cert->subject_dn().get_attribute("CN");
-         result.test_int_eq("exactly one CN", cns.size(), 1);
-         result.test_eq("CN", cns.front(), "DST Root CA X3");
-         }
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   return result;
-   }
-
-Test::Result find_certs_by_subject_dn_and_key_id()
-   {
-   Test::Result result("Flatfile Certificate Store - Find Certificates by subject DN and key ID");
-
-   try
-      {
-      auto dn = get_dn();
-
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      auto certs = certstore.find_all_certs(dn, get_key_id());
-      result.end_timer();
-
-      if(result.confirm("result not empty", !certs.empty()) &&
-            result.test_eq("exactly one certificate", certs.size(), 1))
-         {
-         auto cns = certs.front()->subject_dn().get_attribute("CN");
-         result.test_int_eq("exactly one CN", cns.size(), 1);
-         result.test_eq("CN", cns.front(), "DST Root CA X3");
-         }
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   return result;
-   }
-
-Test::Result find_all_subjects()
-   {
-   Test::Result result("Flatfile Certificate Store - Find all Certificate Subjects");
-
-   try
-      {
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-      auto subjects = certstore.all_subjects();
-      result.end_timer();
-
-      if(result.confirm("result not empty", !subjects.empty()))
-         {
-         auto dn = get_dn();
-         auto needle = std::find_if(subjects.cbegin(),
-                                    subjects.cend(),
-                                    [=](const Botan::X509_DN &subject)
-            {
-            return subject == dn;
-            });
-
-         if(result.confirm("found expected certificate", needle != subjects.end()))
-            {
-            result.confirm("expected certificate", *needle == dn);
-            }
-         }
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   return result;
-   }
-
-Test::Result no_certificate_matches()
-   {
-   Test::Result result("Flatfile Certificate Store - can deal with no matches (regression test)");
-
-   try
-      {
-      auto dn  = get_unknown_dn();
-      auto kid = get_unknown_key_id();
-
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_valid_ca_bundle_path());
-
-      auto certs = certstore.find_all_certs(dn, kid);
-      auto cert = certstore.find_cert(dn, kid);
-      auto pubk_cert = certstore.find_cert_by_pubkey_sha1(kid);
-      result.end_timer();
-
-      result.confirm("find_all_certs did not find the dummy", certs.empty());
-      result.confirm("find_cert did not find the dummy", !cert);
-      result.confirm("find_cert_by_pubkey_sha1 did not find the dummy", !pubk_cert);
-      }
-   catch(std::exception& e)
-      {
-      result.test_failure(e.what());
-      }
-
-   return result;
-   }
-
-Test::Result certstore_contains_user_certificate()
-   {
-   Test::Result result("Flatfile Certificate Store - rejects bundles with non-CA certs");
-
-   try
-      {
-      result.start_timer();
-      Botan::Flatfile_Certificate_Store certstore(get_ca_bundle_containing_user_cert());
-      result.test_failure("CA bundle with non-CA certs should be rejected");
-      }
-   catch(Botan::Invalid_Argument&)
-      {
-      result.test_success();
-      }
-
-   return result;
-   }
-
-class Certstor_Flatfile_Tests final : public Test
-   {
-   public:
-      std::vector<Test::Result> run() override
-         {
-         std::vector<Test::Result> results;
-
-         results.push_back(open_certificate_store());
-         results.push_back(find_certificate_by_pubkey_sha1());
-         results.push_back(find_cert_by_subject_dn());
-         results.push_back(find_cert_by_subject_dn_and_key_id());
-         results.push_back(find_certs_by_subject_dn_and_key_id());
-         results.push_back(find_all_subjects());
-         results.push_back(no_certificate_matches());
-         results.push_back(certstore_contains_user_certificate());
-
-         return results;
-         }
-   };
-
-BOTAN_REGISTER_TEST("certstor_flatfile", Certstor_Flatfile_Tests);
-
-}
-
-}
-
-#endif
diff --git a/src/tests/test_certstor_macos.cpp b/src/tests/test_certstor_macos.cpp
index a21fd2a32..243a150da 100644
--- a/src/tests/test_certstor_macos.cpp
+++ b/src/tests/test_certstor_macos.cpp
@@ -9,7 +9,6 @@
 
 #if defined(BOTAN_HAS_CERTSTOR_MACOS)
 
-#include "test_certstor_utils.h"
 #include <botan/certstor_macos.h>
 #include <botan/ber_dec.h>
 #include <botan/der_enc.h>
@@ -19,6 +18,59 @@ namespace Botan_Tests {
 
 namespace {
 
+Botan::X509_DN read_dn(const std::string hex)
+   {
+   Botan::X509_DN dn;
+   Botan::BER_Decoder decoder(Botan::hex_decode(hex));
+   dn.decode_from(decoder);
+   return dn;
+   }
+
+Botan::X509_DN get_dn()
+   {
+   // Public key fingerprint of "DST Root CA X3"
+   // This certificate is in the standard "System Roots" of any macOS setup,
+   // serves as the trust root of botan.randombit.net and expires on
+   // Thursday, 30. September 2021 at 16:01:15 Central European Summer Time
+   return read_dn("303f31243022060355040a131b4469676974616c205369676e6174757265"
+                  "20547275737420436f2e311730150603550403130e44535420526f6f7420"
+                  "4341205833");
+   }
+
+std::vector<uint8_t> get_key_id()
+   {
+   // this is the same as the public key SHA1
+   return Botan::hex_decode("c4a7b1a47b2c71fadbe14b9075ffc41560858910");
+   }
+
+Botan::X509_DN get_unknown_dn()
+   {
+   // thats a D-Trust "Test Certificate". It should be fairly likely that
+   // _nobody_ will _ever_ have that in their system keychain
+   // CN: D-TRUST Limited Basic Test PU CA 1-4 2016
+   return read_dn("305b310b300906035504061302444531153013060355040a0c0c442d5472"
+                  "75737420476d62483135303306035504030c2c442d5452555354204c696d"
+                  "6974656420426173696320526f6f74205465737420505520434120312032"
+                  "303135");
+   }
+
+Botan::X509_DN get_skewed_dn()
+   {
+   // This DN contains ASN.1 PrintableString fields that are not 'normalized'
+   // according to Apple's idea of a normalized PrintableString field:
+   //   (1) It has leading and trailing white space
+   //   (2) It contains multiple spaces between 'words'
+   return read_dn("304b312a3028060355040a132120204469676974616c2020205369676e61"
+                  "7475726520547275737420436f2e2020311d301b06035504031314202044"
+                  "5354202020526f6f742043412058332020");
+   }
+
+std::vector<uint8_t> get_unknown_key_id()
+   {
+   // this is the same as the public key SHA1
+   return Botan::hex_decode("785c0b67b536eeacbb2b27cf9123301abe7ab09a");
+   }
+
 Test::Result open_certificate_store()
    {
    Test::Result result("macOS Certificate Store - Open Keychain");
diff --git a/src/tests/test_certstor_utils.cpp b/src/tests/test_certstor_utils.cpp
deleted file mode 100644
index 9a0a141d9..000000000
--- a/src/tests/test_certstor_utils.cpp
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
-* (C) 1999-2019 Jack Lloyd
-* (C) 2019      René Meusel
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#include "test_certstor_utils.h"
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-
-#include <botan/ber_dec.h>
-#include <botan/hex.h>
-
-namespace Botan_Tests {
-
-Botan::X509_DN read_dn(const std::string hex)
-   {
-   Botan::X509_DN dn;
-   Botan::BER_Decoder decoder(Botan::hex_decode(hex));
-   dn.decode_from(decoder);
-   return dn;
-   }
-
-Botan::X509_DN get_dn()
-   {
-   // Public key fingerprint of "DST Root CA X3"
-   // This certificate is in the standard "System Roots" of any macOS setup,
-   // serves as the trust root of botan.randombit.net and expires on
-   // Thursday, 30. September 2021 at 16:01:15 Central European Summer Time
-   return read_dn("303f31243022060355040a131b4469676974616c205369676e6174757265"
-                  "20547275737420436f2e311730150603550403130e44535420526f6f7420"
-                  "4341205833");
-   }
-
-std::vector<uint8_t> get_key_id()
-   {
-   // this is the same as the public key SHA1
-   return Botan::hex_decode("c4a7b1a47b2c71fadbe14b9075ffc41560858910");
-   }
-
-Botan::X509_DN get_unknown_dn()
-   {
-   // thats a D-Trust "Test Certificate". It should be fairly likely that
-   // _nobody_ will _ever_ have that in their system keychain
-   // CN: D-TRUST Limited Basic Test PU CA 1-4 2016
-   return read_dn("305b310b300906035504061302444531153013060355040a0c0c442d5472"
-                  "75737420476d62483135303306035504030c2c442d5452555354204c696d"
-                  "6974656420426173696320526f6f74205465737420505520434120312032"
-                  "303135");
-   }
-
-Botan::X509_DN get_skewed_dn()
-   {
-   // This DN contains ASN.1 PrintableString fields that are not 'normalized'
-   // according to Apple's idea of a normalized PrintableString field:
-   //   (1) It has leading and trailing white space
-   //   (2) It contains multiple spaces between 'words'
-   return read_dn("304b312a3028060355040a132120204469676974616c2020205369676e61"
-                  "7475726520547275737420436f2e2020311d301b06035504031314202044"
-                  "5354202020526f6f742043412058332020");
-   }
-
-std::vector<uint8_t> get_unknown_key_id()
-   {
-   // this is the same as the public key SHA1
-   return Botan::hex_decode("785c0b67b536eeacbb2b27cf9123301abe7ab09a");
-   }
-}
-
-#endif
diff --git a/src/tests/test_certstor_utils.h b/src/tests/test_certstor_utils.h
deleted file mode 100644
index f86e87596..000000000
--- a/src/tests/test_certstor_utils.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
-* (C) 1999-2019 Jack Lloyd
-* (C) 2019      René Meusel
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#ifndef BOTAN_TEST_CERT_STORE_UTILS_H_
-#define BOTAN_TEST_CERT_STORE_UTILS_H_
-
-#include <string>
-#include <vector>
-
-#include <botan/build.h>
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-
-#include <botan/x509_dn.h>
-
-namespace Botan_Tests {
-
-Botan::X509_DN read_dn(const std::string hex);
-
-Botan::X509_DN get_dn();
-
-std::vector<uint8_t> get_key_id();
-
-Botan::X509_DN get_unknown_dn();
-
-Botan::X509_DN get_skewed_dn();
-
-std::vector<uint8_t> get_unknown_key_id();
-}
-
-#endif
-
-#endif
diff --git a/src/tests/test_dl_group.cpp b/src/tests/test_dl_group.cpp
index 159454b3f..df5aaa8ce 100644
--- a/src/tests/test_dl_group.cpp
+++ b/src/tests/test_dl_group.cpp
@@ -44,15 +44,14 @@ class DL_Group_Tests final : public Test
                             "DL_Group uninitialized",
                             []() { Botan::DL_Group dl; dl.get_p(); });
 
-         if(Test::options().undefined_behavior_allowed())
-            {
-            result.test_throws("Bad generator param",
-                               "DL_Group unknown PrimeType",
-                               []() {
-                               auto invalid_type = static_cast<Botan::DL_Group::PrimeType>(9);
-                               Botan::DL_Group dl(Test::rng(), invalid_type, 1024);
-                               });
-            }
+#if !defined(BOTAN_HAS_SANITIZER_UNDEFINED)
+	 result.test_throws("Bad generator param",
+			 "DL_Group unknown PrimeType",
+			 []() {
+			 auto invalid_type = static_cast<Botan::DL_Group::PrimeType>(9);
+			 Botan::DL_Group dl(Test::rng(), invalid_type, 1024);
+			 });
+#endif
 
          return result;
          }
diff --git a/src/tests/test_ffi.cpp b/src/tests/test_ffi.cpp
index de429bde9..696a70377 100644
--- a/src/tests/test_ffi.cpp
+++ b/src/tests/test_ffi.cpp
@@ -1103,14 +1103,13 @@ class FFI_Unit_Tests final : public Test
          // delete of null is ok/ignored
          TEST_FFI_RC(0, botan_hash_destroy, (nullptr));
 
-         if(Test::options().undefined_behavior_allowed())
-            {
-            // Confirm that botan_x_destroy checks the argument type
-            botan_mp_t mp;
-            botan_mp_init(&mp);
-            TEST_FFI_RC(BOTAN_FFI_ERROR_INVALID_OBJECT, botan_hash_destroy, (reinterpret_cast<botan_hash_t>(mp)));
-            TEST_FFI_RC(0, botan_mp_destroy, (mp));
-            }
+#if !defined(BOTAN_HAS_SANITIZER_UNDEFINED)
+	 // Confirm that botan_x_destroy checks the argument type
+	 botan_mp_t mp;
+	 botan_mp_init(&mp);
+	 TEST_FFI_RC(BOTAN_FFI_ERROR_INVALID_OBJECT, botan_hash_destroy, (reinterpret_cast<botan_hash_t>(mp)));
+	 TEST_FFI_RC(0, botan_mp_destroy, (mp));
+#endif
 
          std::set<std::string> errors;
          for(int i = -100; i != 50; ++i)
diff --git a/src/tests/tests.h b/src/tests/tests.h
index 267026f35..f496c3cfb 100644
--- a/src/tests/tests.h
+++ b/src/tests/tests.h
@@ -65,8 +65,7 @@ class Test_Options
                    bool log_success,
                    bool run_online_tests,
                    bool run_long_tests,
-                   bool abort_on_first_fail,
-                   bool undefined_behavior_allowed) :
+                   bool abort_on_first_fail) :
          m_requested_tests(requested_tests),
          m_skip_tests(skip_tests.begin(), skip_tests.end()),
          m_data_dir(data_dir),
@@ -79,8 +78,7 @@ class Test_Options
          m_log_success(log_success),
          m_run_online_tests(run_online_tests),
          m_run_long_tests(run_long_tests),
-         m_abort_on_first_fail(abort_on_first_fail),
-         m_undefined_behavior_allowed(undefined_behavior_allowed)
+         m_abort_on_first_fail(abort_on_first_fail)
          {
          }
 
@@ -112,16 +110,6 @@ class Test_Options
 
       bool verbose() const { return m_verbose; }
 
-      bool undefined_behavior_allowed() const
-         {
-#if defined(BOTAN_HAS_SANITIZER_UNDEFINED)
-         return m_undefined_behavior_allowed;
-#else
-         BOTAN_UNUSED(m_undefined_behavior_allowed);
-         return true;
-#endif
-         }
-
    private:
       std::vector<std::string> m_requested_tests;
       std::set<std::string> m_skip_tests;
@@ -136,7 +124,6 @@ class Test_Options
       bool m_run_online_tests;
       bool m_run_long_tests;
       bool m_abort_on_first_fail;
-      bool m_undefined_behavior_allowed;
    };
 
 /*
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index 88c3a4d05..d87d54f5e 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -299,14 +299,13 @@ Test::Result test_encoding_options()
    result.test_eq("Hybrid point same size as uncompressed",
                   enc_uncompressed.size(), enc_hybrid.size());
 
-   if(Test::options().undefined_behavior_allowed())
-      {
-      auto invalid_format = static_cast<Botan::PointGFp::Compression_Type>(99);
+#if !defined(BOTAN_HAS_SANITIZER_UNDEFINED)
+   auto invalid_format = static_cast<Botan::PointGFp::Compression_Type>(99);
 
-      result.test_throws("Invalid point format throws",
-                         "Invalid point encoding for EC_PublicKey",
-                         [&] { key.set_point_encoding(invalid_format); });
-      }
+   result.test_throws("Invalid point format throws",
+		   "Invalid point encoding for EC_PublicKey",
+		   [&] { key.set_point_encoding(invalid_format); });
+#endif
 
    return result;
    }