diff --git a/buildtools/wafsamba/samba_autoconf.py b/buildtools/wafsamba/samba_autoconf.py
index 0dbfd54393f..be179d8b29b 100644
--- a/buildtools/wafsamba/samba_autoconf.py
+++ b/buildtools/wafsamba/samba_autoconf.py
@@ -793,10 +793,17 @@ int main(void) {
     if Options.options.pedantic:
         conf.ADD_CFLAGS('-W', testflags=True)
 
+    if (Options.options.address_sanitizer or
+        Options.options.undefined_sanitizer):
+        conf.ADD_CFLAGS('-fno-omit-frame-pointer -O1', testflags=True)
     if Options.options.address_sanitizer:
-        conf.ADD_CFLAGS('-fno-omit-frame-pointer -O1 -fsanitize=address', testflags=True)
+        conf.ADD_CFLAGS('-fsanitize=address', testflags=True)
         conf.ADD_LDFLAGS('-fsanitize=address', testflags=True)
         conf.env['ADDRESS_SANITIZER'] = True
+    if Options.options.undefined_sanitizer:
+        conf.ADD_CFLAGS('-fsanitize=undefined', testflags=True)
+        conf.ADD_LDFLAGS('-fsanitize=undefined', testflags=True)
+        conf.env['UNDEFINED_SANITIZER'] = True
 
 
     # Let people pass an additional ADDITIONAL_{CFLAGS,LDFLAGS}
diff --git a/buildtools/wafsamba/wscript b/buildtools/wafsamba/wscript
index 2e14a326cb8..8014716e64e 100644
--- a/buildtools/wafsamba/wscript
+++ b/buildtools/wafsamba/wscript
@@ -128,6 +128,11 @@ def options(opt):
     gr.add_option('--address-sanitizer',
                    help=("Enable address sanitizer compile and linker flags"),
                    action="store_true", dest='address_sanitizer', default=False)
+    gr.add_option('--undefined-sanitizer',
+        help=("Enable undefined behaviour sanitizer compile and linker flags"),
+        action="store_true",
+        dest='undefined_sanitizer',
+        default=False)
 
     gr.add_option('--abi-check',
 		   help=("Check ABI signatures for libraries"),
diff --git a/selftest/ubsan.supp b/selftest/ubsan.supp
new file mode 100644
index 00000000000..423e0838690
--- /dev/null
+++ b/selftest/ubsan.supp
@@ -0,0 +1,6 @@
+# Suppress the
+# "left shift of x by y places cannot be represented in type 'int'"
+# in the heimdal code for now.
+shift-base:../../source4/heimdal/lib/hcrypto/des.c
+shift-base:../../source4/heimdal/lib/krb5/crypto.c
+
diff --git a/selftest/wscript b/selftest/wscript
index 5116d7ee31b..5c864ebed96 100644
--- a/selftest/wscript
+++ b/selftest/wscript
@@ -265,8 +265,9 @@ def cmd_testonly(opt):
 
     if env.ADDRESS_SANITIZER:
         # We try to find the correct libasan automatically
-        libasan = Utils.cmd_output('ldd bin/texpect | grep libasan| cut -f 3 -d \ ',
-                                   silent=True).strip()
+        libasan = Utils.cmd_output(
+            'ldd bin/texpect | grep libasan| cut -f 3 -d \ ',
+            silent=True).strip()
         libasan = libasan.decode('utf8')
 
         # Have the selftest.pl LD_PRELOAD libasan in the right spot
@@ -290,6 +291,12 @@ def cmd_testonly(opt):
         env.FILTER_OPTIONS = asan_envs + env.FILTER_OPTIONS
         env.SUBUNIT_FORMATTER = asan_envs + env.SUBUNIT_FORMATTER
 
+    if env.UNDEFINED_SANITIZER:
+        # print a stack trace with the error.
+        print_stack_trace = "UBSAN_OPTIONS=print_stacktrace=1"
+        print_stack_trace += ",suppressions=${srcdir}/selftest/ubsan.supp"
+        env.CORE_COMMAND = print_stack_trace + " " + env.CORE_COMMAND
+
     if Options.options.LIST:
         cmd = '${CORE_COMMAND} --list'
     else: