Ok, --enable-asan did not have any effect. I had to set the CFLAGS to -fsanitize=address,undefined -Wformat -Werror=format-security -Werror=array-bounds -g -O0.
With that, the address sanitizer now complaints about a heap buffer overflow. But indeed in one of our added code for base64 converting and dumping the first few bytes of http request and response headers.
Thus, even if this is not solved in the narrow sense, I will mark the topic as solved.
But thanks anyway for pointing me at the ASAN feature of gcc.