Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 847145 - dev-qt/qtcore: *** buffer overflow detected ***: terminated with FORTIFY_SOURCE=3 in /usr/lib64/qt5/bin/qmlplugindump via qmake (e.g. when building net-libs/accounts-qml)
Summary: dev-qt/qtcore: *** buffer overflow detected ***: terminated with FORTIFY_SOUR...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Qt Bug Alias
URL:
Whiteboard:
Keywords: PATCH
Depends on:
Blocks: 847148
  Show dependency tree
 
Reported: 2022-05-23 22:25 UTC by Sam James
Modified: 2023-10-08 15:20 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
build.log (file_847145.txt,33.60 KB, text/plain)
2022-05-23 22:26 UTC, Sam James 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:25:34 UTC 
Note: FORTIFY_SOURCE=3 needs GCC 12 (or Clang 9+).

I'd hoped this had gone away but I've hit it again now. It doesn't seem to happen every time:
```
>>> Install net-libs/accounts-qml-0.7-r1 into /var/tmp/portage/net-libs/accounts-qml-0.7-r1/image
make -j32 INSTALL_ROOT=/var/tmp/portage/net-libs/accounts-qml-0.7-r1/image install_subtargets
Makefile:549: warning: overriding recipe for target 'dist'
Makefile:522: warning: ignoring old recipe for target 'dist'
cd src/ && ( test -e Makefile || /usr/lib64/qt5/bin/qmake -o Makefile /var/tmp/portage/net-libs/accounts-qml-0.7-r1/work/accounts-qml-module-VERSION_0.7/src/src.pro 'QMAKE_AR="x86_64-pc-linux-gnu-ar cqs"' 'QMAKE_CC="x86_64-pc-linux-gnu-gcc"' 'QMAKE_LINK_C="x86_64-pc-linux-gnu-gcc"' 'QMAKE_LINK_C_SHLIB="x86_64-pc-linux-gnu-gcc"' 'QMAKE_CXX="x86_64-pc-linux-gnu-g++"' 'QMAKE_LINK="x86_64-pc-linux-gnu-g++"' 'QMAKE_LINK_SHLIB="x86_64-pc-linux-gnu-g++"' 'QMAKE_OBJCOPY="x86_64-pc-linux-gnu-objcopy"' QMAKE_RANLIB= QMAKE_STRIP= 'QMAKE_CFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches"' QMAKE_CFLAGS_RELEASE= QMAKE_CFLAGS_DEBUG= 'QMAKE_CXXFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches -D_GLIBCXX_ASSERTIONS"' QMAKE_CXXFLAGS_RELEASE= QMAKE_CXXFLAGS_DEBUG= 'QMAKE_LFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--defsym=__gentoo_check_ldflags__=0"' QMAKE_LFLAGS_RELEASE= QMAKE_LFLAGS_DEBUG= PREFIX=/usr ) && make -f Makefile install
make[1]: Entering directory '/var/tmp/portage/net-libs/accounts-qml-0.7-r1/work/accounts-qml-module-VERSION_0.7/src'
export LD_PRELOAD=Ubuntu/OnlineAccounts/libAccounts.so; /usr/lib64/qt5/bin/qmlplugindump -notrelocatable Ubuntu.OnlineAccounts 0.1 . > Ubuntu/OnlineAccounts/plugin.qmltypes
/usr/lib64/qt5/bin/qmake -install qinstall /var/tmp/portage/net-libs/accounts-qml-0.7-r1/work/accounts-qml-module-VERSION_0.7/src/Ubuntu/OnlineAccounts/qmldir /var/tmp/portage/net-libs/accounts-qml-0.7-r1/image/usr/lib64/qt5/qml/Ubuntu/OnlineAccounts/qmldir
/usr/lib64/qt5/bin/qmake -install qinstall -exe Ubuntu/OnlineAccounts/libAccounts.so /var/tmp/portage/net-libs/accounts-qml-0.7-r1/image/usr/lib64/qt5/qml/Ubuntu/OnlineAccounts/libAccounts.so
*** buffer overflow detected ***: terminated
make[1]: *** [Makefile:818: Ubuntu/OnlineAccounts/plugin.qmltypes] Aborted (core dumped)
make[1]: *** Deleting file 'Ubuntu/OnlineAccounts/plugin.qmltypes'
make[1]: Leaving directory '/var/tmp/portage/net-libs/accounts-qml-0.7-r1/work/accounts-qml-module-VERSION_0.7/src'
make: *** [Makefile:71: sub-src-install_subtargets-ordered] Error 2
 * ERROR: net-libs/accounts-qml-0.7-r1::gentoo failed (install phase):
 *   emake failed
```
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:26:18 UTC 
Created attachment 780449 [details]
build.log
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:26:28 UTC 
Error during set creation: Could not import 'smartliverebuild.sets.SmartLiveRebuildSet' for section 'smart-live-rebuild'
Portage 3.0.30 (python 3.11.0-beta-1, default/linux/amd64/17.1/hardened, gcc-12.1.1, glibc-2.35-r5, 5.15.40-gentoo-dist-hardened x86_64)
=================================================================
System uname: Linux-5.15.40-gentoo-dist-hardened-x86_64-AMD_Ryzen_9_3950X_16-Core_Processor-with-glibc2.35
KiB Mem:    65831164 total,   8455520 free
KiB Swap:   25067512 total,  23918072 free
Timestamp of repository gentoo: Mon, 23 May 2022 21:32:59 +0000
Head commit of repository gentoo: 8f6d45781fdd9585ce732526a5025836c53d70ae

Timestamp of repository kde: Wed, 18 May 2022 12:47:53 +0000
Head commit of repository kde: db3a6d11f3516e4a0d7b675ece4c746bbaef5b86

Timestamp of repository qt: Fri, 20 May 2022 19:48:17 +0000
Head commit of repository qt: 7a50fd9809b2ec7b0f8cc8dcb78b01edc98e1264

Timestamp of repository sam_c: Thu, 19 May 2022 04:32:58 +0000
Head commit of repository sam_c: 1ffb82265b993e2816c583f06299a77de27aa6b6

Timestamp of repository steam-overlay: Sun, 22 May 2022 13:08:27 +0000
Head commit of repository steam-overlay: ee8335c18481d2f553de3f4ee3320d76cc8905fb

sh dash 0.5.11.5
ld GNU ld (Gentoo 2.38 p4) 2.38
ccache version 4.6.1 [disabled]
app-misc/pax-utils:        1.3.4::gentoo
app-shells/bash:           5.1_p16::gentoo
dev-java/java-config:      2.3.1::gentoo
dev-lang/perl:             5.34.1-r3::gentoo
dev-lang/python:           2.7.18_p15::gentoo, 3.8.13_p2::gentoo, 3.9.13::gentoo, 3.10.4_p1::gentoo, 3.11.0_beta1-r2::gentoo
dev-lang/rust-bin:         1.60.0::gentoo
dev-util/ccache:           4.6.1::gentoo
dev-util/cmake:            3.23.1::gentoo
dev-util/meson:            0.62.1::gentoo
sys-apps/baselayout:       2.8::gentoo
sys-apps/sandbox:          2.29::gentoo
sys-apps/systemd:          251::gentoo
sys-devel/autoconf:        2.13-r1::gentoo, 2.71-r1::gentoo
sys-devel/automake:        1.16.5::gentoo
sys-devel/binutils:        2.38-r2::gentoo
sys-devel/binutils-config: 5.4.1::gentoo
sys-devel/clang:           13.0.1::gentoo, 14.0.3::gentoo
sys-devel/gcc:             9.4.0::gentoo, 10.3.1_p20211126::gentoo, 11.3.0::gentoo, 12.1.1_p20220521::gentoo
sys-devel/gcc-config:      2.5-r1::gentoo
sys-devel/libtool:         2.4.7::gentoo
sys-devel/lld:             14.0.3::gentoo
sys-devel/llvm:            13.0.1::gentoo, 14.0.3::gentoo
sys-devel/make:            4.3::gentoo
sys-kernel/linux-headers:  5.17-r1::gentoo (virtual/os-headers)
sys-libs/glibc:            2.35-r5::gentoo
Repositories:

gentoo
    location: /var/db/repos/gentoo
    sync-type: git
    sync-uri: https://github.com/gentoo-mirror/gentoo.git
    priority: -1000
    sync-git-verify-commit-signature: yes
    sync-git-clone-extra-opts: -b stable -c gc.reflogExpire=0 -c gc.reflogExpireUnreachable=0 -c gc.rerereresolved=0 -c gc.rerereunresolved=0 -c gc.pruneExpire=now

crossdev
    location: /var/db/repos/crossdev
    masters: gentoo

kde
    location: /var/db/repos/kde
    sync-type: git
    sync-uri: https://github.com/gentoo-mirror/kde.git
    masters: gentoo

qt
    location: /var/db/repos/qt
    sync-type: git
    sync-uri: https://github.com/gentoo-mirror/qt.git
    masters: gentoo

sam_c
    location: /var/db/repos/sam_c
    sync-type: git
    sync-uri: https://github.com/gentoo-mirror/sam_c.git
    masters: gentoo

steam-overlay
    location: /var/db/repos/steam-overlay
    sync-type: git
    sync-uri: https://github.com/gentoo-mirror/steam-overlay.git
    masters: gentoo

test
    location: /var/db/repos/test
    masters: gentoo

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches -D_GLIBCXX_ASSERTIONS"
DISTDIR="/var/cache/distfiles"
EMERGE_DEFAULT_OPTS="--keep-going --with-bdeps=y --complete-graph --deep --dynamic-deps=n --changed-deps=n --usepkg-exclude sys-fs/zfs --usepkg-exclude sys-fs/zfs-kmod --usepkg=y --implicit-system-deps=n --jobs=2 --load-average 32"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR"
FCFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg-live cgroup clean-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox mount-sandbox multilib-strict network-sandbox news parallel-fetch parallel-install pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms split-log strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches"
GENTOO_MIRRORS="http://mirror.bytemark.co.uk/gentoo/ http://www.mirrorservice.org/sites/distfiles.gentoo.org/ http://mirrors.soeasyto.com/distfiles.gentoo.org/"
LANG="en_GB.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--defsym=__gentoo_check_ldflags__=0"
LINGUAS="en en_GB"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
SHELL="/bin/bash"
USE="PIC X a52 aac acl acpi activities aes alsa amd64 avx avx2 bash-completion bluetooth branding bzip2 cairo caps cdda cdr clang crypt dbus declarative dist-kernel dri dts dvd dvdr emacs encode exif f16c filecaps firewalld flac fma3 freetype gif gmp gpm graphite gtk gui hardened harfbuzz hunspell iconv icu ipv6 jit jpeg kde kdesu kwallet lcms libglvnd libnotify libtirpc llvm-libunwind mad mmx mmxext mng mp3 mp4 mpeg multilib ncurses nftables nls nptl ogg opengl openmp pam pango pclmul pcre pdf pgo pie pipewire plasma png policykit popcnt ppds pulseaudio qml qt5 rdrand readline screencast sdl seccomp semantic-desktop sha spell sse sse2 sse3 sse4_1 sse4_2 sse4a ssl ssp ssse3 startup-notification svg system-av1 system-binutils system-boost system-bootstrap system-cairo system-clang system-digest system-ffmpeg system-harfbuzz system-heimdal system-icu system-jpeg system-leveldb system-libevent system-libs system-libvpx system-libyaml system-lz4 system-mitkrb5 system-sqlite system-ssl system-tbb system-uulib system-webp system-zlib systemd threads tiff truetype udev udisks unicode upower usb verify-sig vorbis vulkan wayland widgets x264 xattr xcb xml xtpax xv xvid zfs zlib zsh-completion" ABI_X86="32 64" ADA_TARGET="gnat_2020" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput" KERNEL="linux" L10N="en en-GB" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LLVM_TARGETS="AArch64 AMDGPU ARM AVR BPF Hexagon Lanai MSP430 Mips NVPTX PowerPC RISCV Sparc SystemZ WebAssembly X86 XCore" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-4 php8-0" POSTGRES_TARGETS="postgres12 postgres13" PYTHON_SINGLE_TARGET="python3_10" PYTHON_TARGETS="python3_9 pypy3 python3_10 python3_11 python3_8" QEMU_USER_TARGETS="aarch64 hppa ppc64le sparc64" RUBY_TARGETS="ruby30" USERLAND="GNU" VIDEO_CARDS="amdgpu radeonsi radeon" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LEX, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, MAKEOPTS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:32:33 UTC Comment hidden (obsolete)
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:51:00 UTC 
Needed to meddle a bit to actually have it coredump (https://stackoverflow.com/questions/29667243/dropping-root-privileges-and-still-generate-coredumps):

```
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
Core was generated by `/usr/lib64/qt5/bin/qmlplugindump -notrelocatable Ubuntu.OnlineAccounts 0.1 .'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f06afee44ec in ?? () from /usr/lib64/libc.so.6
[Current thread is 1 (Thread 0x7f06ac1c31c0 (LWP 37))]
gef➤  bt
#0  0x00007f06afee44ec in  () at /usr/lib64/libc.so.6
#1  0x00007f06afe935e2 in raise () at /usr/lib64/libc.so.6
#2  0x00007f06afe7d46c in abort () at /usr/lib64/libc.so.6
#3  0x00007f06afed8126 in  () at /usr/lib64/libc.so.6
#4  0x00007f06aff77ce2 in __fortify_fail () at /usr/lib64/libc.so.6
#5  0x00007f06aff766c2 in  () at /usr/lib64/libc.so.6
#6  0x00007f06aff76ba0 in __readlinkat_chk () at /usr/lib64/libc.so.6
#7  0x00007f06b05607ce in readlink (__len=0x100, __buf=<optimized out>, __path=0x55955442aab8 "/etc/localtime") at /usr/include/bits/unistd.h:119
#8  qt_readlink(char const*) (path=0x55955442aab8 "/etc/localtime") at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/kernel/qcore_unix.cpp:68
#9  0x00007f06b04b8c2a in QFileSystemEngine::getLinkTarget(QFileSystemEntry const&, QFileSystemMetaData&) (link=..., data=...) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/io/qfilesystemengine_unix.cpp:628
#10 0x00007f06b045ce50 in QFileInfoPrivate::getFileName(QAbstractFileEngine::FileName) const (this=0x559554417310, name=QAbstractFileEngine::LinkName) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/io/qfileinfo.cpp:71
#11 0x00007f06b045edca in QFileInfo::symLinkTarget() const (this=this@entry=0x7fff00632520) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/io/qfileinfo.cpp:1237
#12 0x00007f06b045884f in QFile::symLinkTarget(QString const&) (fileName=...) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/io/qfile.cpp:492
#13 0x00007f06b0438140 in (anonymous namespace)::ZoneNameReader::etcLocalTime () at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezoneprivate_tz.cpp:1255
#14 (anonymous namespace)::ZoneNameReader::name (this=<optimized out>) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezoneprivate_tz.cpp:1205
#15 QTzTimeZonePrivate::systemTimeZoneId() const (this=<optimized out>) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezoneprivate_tz.cpp:1314
#16 0x00007f06b04387ce in QTzTimeZonePrivate::QTzTimeZonePrivate() (this=this@entry=0x55955442aa20) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezoneprivate_tz.cpp:663
#17 0x00007f06b042a50c in newBackendTimeZone () at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezone.cpp:68
#18 QTimeZoneSingleton::QTimeZoneSingleton() (this=0x7f06b07eb6a8 <(anonymous namespace)::Q_QGS_global_tz::innerFunction()::holder>) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezone.cpp:109
#19 Holder::Holder (this=0x7f06b07eb6a8 <(anonymous namespace)::Q_QGS_global_tz::innerFunction()::holder>) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezone.cpp:118
#20 (anonymous namespace)::Q_QGS_global_tz::innerFunction () at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezone.cpp:118
#21 QGlobalStatic<QTimeZoneSingleton, (anonymous namespace)::Q_QGS_global_tz::innerFunction, (anonymous namespace)::Q_QGS_global_tz::guard>::operator-> (this=<optimized out>) at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/include/QtCore/../../src/corelib/global/qglobalstatic.h:140
#22 QTimeZone::systemTimeZone() () at /usr/src/debug/dev-qt/qtcore-5.15.4/qtbase-everywhere-src-5.15.4/src/corelib/time/qtimezone.cpp:819
#23 0x00007f06b15ee3b3 in getLocalTZA () at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/src/qml/jsruntime/qv4dateobject.cpp:723
#24 QV4::DatePrototype::init(QV4::ExecutionEngine*, QV4::Object*) (this=0x7f06ab16d068, engine=engine@entry=0x559554421360, ctor=0x7f06ab16d198) at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/src/qml/jsruntime/qv4dateobject.cpp:848
#25 0x00007f06b15b777d in QV4::ExecutionEngine::ExecutionEngine(QJSEngine*) (this=this@entry=0x559554421360, jsEngine=jsEngine@entry=0x7fff00632a50) at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/src/qml/jsruntime/qv4engine.cpp:630
#26 0x00007f06b15abdd4 in QJSEngine::QJSEngine(QJSEnginePrivate&, QObject*) (this=this@entry=0x7fff00632a50, dd=..., parent=parent@entry=0x0) at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/src/qml/jsapi/qjsengine.cpp:355
#27 0x00007f06b1713be0 in QQmlEngine::QQmlEngine(QObject*) (this=0x7fff00632a50, parent=0x0) at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/src/qml/qml/qqmlengine.cpp:982
#28 0x0000559552a57598 in main(int, char**) (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dev-qt/qtdeclarative-5.15.4/qtdeclarative-everywhere-src-5.15.4/tools/qmlplugindump/main.cpp:1185
```
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-23 22:51:20 UTC 
```
# ls -al /etc/localtime
lrwxrwxrwx 1 root root 35 May 19 19:21 /etc/localtime -> ../usr/share/zoneinfo/Europe/London
```
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-24 00:16:44 UTC Comment hidden (obsolete)
Comment 7 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-24 02:34:37 UTC 
I reported it to GCC at https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105709, but this ended up being a Qt bug. Thanks to Siddhesh for explaining on the GCC bug (and explaining why trying with Clang worked).

Reported at https://bugreports.qt.io/browse/QTBUG-103782.
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-24 03:51:20 UTC 
(In reply to Sam James from comment #7)
> I reported it to GCC at https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105709,
> but this ended up being a Qt bug. Thanks to Siddhesh for explaining on the
> GCC bug (and explaining why trying with Clang worked).
> 
> Reported at https://bugreports.qt.io/browse/QTBUG-103782.

It's fixed in Qt 6 and likely unfixable for Qt 5 without a fair bit of work. But let's see what the Qt 5 maintainer says upstream.

We'll likely have to force F_S=2 for Qt 5.
Comment 9 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-05-24 23:37:43 UTC 
opensuse's patch: https://build.opensuse.org/package/view_file/KDE:Qt:5.15/libqt5-qtbase/mitigate-FORTIFY_SOURCE-3.patch?expand=1.

Note that Qt are working on their own fix for this. It is not yet clear if the fix will be published once complete or if we'll need to wait a year for the official one.
Comment 10 Larry the Git Cow gentoo-dev 2022-05-25 23:11:48 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3c4656a189e254231b94cef558530c42ea8db690

commit 3c4656a189e254231b94cef558530c42ea8db690
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-05-25 23:10:33 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-05-25 23:11:28 +0000

    dev-qt/qtcore: add FORTIFY_SOURCE=3 workaround (force back to =2)
    
    As discussed with asturm until we know what's happening with
    the upstream bug. We can consider the opensuse patch once
    that's resolved, if the upstream fix isn't made public, almost
    certainly via KDE Qt5PatchCollection. But we'll see.
    
    Closes: https://bugs.gentoo.org/847145
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-qt/qtcore/qtcore-5.15.4-r1.ebuild | 121 ++++++++++++++++++++++++++++++++++
 1 file changed, 121 insertions(+)
Comment 11 Larry the Git Cow gentoo-dev 2022-06-18 14:27:26 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/qt.git/commit/?id=bce861717d5120f95d17eec6ce9d672ae791e80c

commit bce861717d5120f95d17eec6ce9d672ae791e80c
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-05-25 23:10:33 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2022-06-18 14:21:22 +0000

    dev-qt/qtcore: add FORTIFY_SOURCE=3 workaround (force back to =2)
    
    As discussed with asturm until we know what's happening with
    the upstream bug. We can consider the opensuse patch once
    that's resolved, if the upstream fix isn't made public, almost
    certainly via KDE Qt5PatchCollection. But we'll see.
    
    Bug: https://bugs.gentoo.org/847145
    Signed-off-by: Sam James <sam@gentoo.org>
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 dev-qt/qtcore/qtcore-5.15.5.9999.ebuild | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)
Comment 12 Larry the Git Cow gentoo-dev 2022-06-26 08:25:20 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cb10b0356e62b2521c0d4592a35b5dfb6e5cd2ca

commit cb10b0356e62b2521c0d4592a35b5dfb6e5cd2ca
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-06-26 08:22:31 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-06-26 08:25:13 +0000

    dev-qt/qtcore: backport FORTIFY_SOURCE=3 patch
    
    GCC 12 is now in ~arch and we're likely to get more people trying
    out F_S=3 as a result. This patch is now in Qt5PatchCollection
    and given the previous workaround ended up being insufficient
    (it's not enough to force F_S=2 in qtcore, as reverse deps
    end up being broken if _they_ are built with F_S=3, even
    though the cause is in qtcore), let's backport the fix now.
    
    Bug: https://bugs.gentoo.org/847145
    Closes: https://bugs.gentoo.org/852974
    Signed-off-by: Sam James <sam@gentoo.org>

 .../files/qtcore-5.15.5-fortify-source-3.patch     |  61 ++++++++++++
 dev-qt/qtcore/qtcore-5.15.5-r1.ebuild              | 102 +++++++++++++++++++++
 2 files changed, 163 insertions(+)
Comment 13 Larry the Git Cow gentoo-dev 2023-08-06 11:49:02 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5a84e57a1963e12919d9b843324d70b12e992bc7

commit 5a84e57a1963e12919d9b843324d70b12e992bc7
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-08-06 11:41:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-08-06 11:47:53 +0000

    dev-qt/qtcore: use tc-enables-fortify-source
    
    Better than fragile optimisation level checking.
    
    Bug: https://bugs.gentoo.org/841770
    Bug: https://bugs.gentoo.org/847145
    Bug: https://bugs.gentoo.org/852974
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-qt/qtcore/qtcore-5.15.10-r1.ebuild | 5 +++--
 dev-qt/qtcore/qtcore-5.15.10.ebuild    | 7 +++----
 2 files changed, 6 insertions(+), 6 deletions(-)
Comment 14 Larry the Git Cow gentoo-dev 2023-10-08 15:20:59 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/qt.git/commit/?id=ec1cae0ebc814755c9cf1dd5b5a70d1777d422b8

commit ec1cae0ebc814755c9cf1dd5b5a70d1777d422b8
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-08-06 11:41:48 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2023-10-08 15:20:41 +0000

    dev-qt/qtcore: use tc-enables-fortify-source
    
    Better than fragile optimisation level checking.
    
    Bug: https://bugs.gentoo.org/841770
    Bug: https://bugs.gentoo.org/847145
    Bug: https://bugs.gentoo.org/852974
    Signed-off-by: Sam James <sam@gentoo.org>
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 dev-qt/qtcore/qtcore-5.15.11.9999.ebuild | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)