There are a lot of ports that are vulnerable to strict aliasing optimalization rules that are enabled by default with -O2 or -O3 optimization mode in gcc. They can easly be found by enabling error on warning -Werror=strict-aliasing If some port is compiled with deafult -O2 optimization and compiler founds( no all cases can be found by compiler) it will fail with compilation, this will require from port autor for such port to disable explicitly strict-aliasing with -fno-strict-aliasing explicit compilation flag for gcc. Using such vulnerable apilications compiled with -O2/-O3 with strict-aliasing enabled by default will lead to UB in that applications and most of them will simply crash when used. Thise are ports I have found until now that are vulnerable to strict-aliasing sys-libs/libcxx dev-db/pgadmin3 x11-libs/wxGTK app-arch/unrar media-libs/smpeg dev-libs/libev sys-libs/db x11-libs/gtk+ net-misc/modemmanager net-fs/samba gnome-base/gnome-vfs dev-libs/nss media-libs/exempi media-libs/alsa-lib media-video/cinelerra media-libs/xine-lib app-cdr/k3b dev-libs/DirectFB net-libs/webkit-gtk sys-fs/reiser4progs www-client/firefox sci-libs/gdal media-libs/avidemux-plugins media-libs/libmtp net-misc/openssh sys-devel/gcc (java part up to 4.9) app-text/texlive-core dev-lang/R media-gfx/graphviz media-libs/lcms media-libs/libdvb x11-misc/x11vnc
We call them ebuilds, not ports. Also, undefined behaviour does not imply any kind of vulnerability. Please file this kind of bug reports upstream, because as you might have noticed, the build logs print something like this: * Please do not file a Gentoo bug and instead report the above QA * issues directly to the upstream developers of this software. * Homepage: ...
