Build Tor with clang's -fsanitize=pointer-overflow
There's a new pointer overflow detection feature that's just been merged into clang master (r304461 or later).
We should add it to ./configure --enable-fragile-hardening (after testing for it using autoconf), and see what it picks up.
Background is here: https://blog.regehr.org/archives/1518