You need to add -fsanitize=address to compiler flags (both CFLAGS and CXXFLAGS) and linker flags (LDFLAGS). You’ve probably added it to your compiler flags only.
Note that using explicit -lasan option has been widely discouraged by ASan developers (e.g. here) as it misses some other important linker flags. The only recommended way to link is to use -fsanitize=address.
As a side note, for more aggressive verification flags check Asan FAQ (look for “more aggressive diagnostics”).