Bug 533698 – Ports strict aliasing vulnerability

• Product: Gentoo Linux
• Status: RESOLVED INVALID

[Description Artur Bać 2014-12-27 17:59:49 UTC]

There are a lot of ports that are vulnerable to strict aliasing optimalization rules that are enabled by default with -O2 or -O3 optimization mode in gcc.
They can easly be found by enabling error on warning -Werror=strict-aliasing
If some port is compiled with deafult -O2 optimization and compiler founds( no all cases can be found by compiler) it will fail with compilation, this will require from port autor for such port to disable explicitly strict-aliasing with -fno-strict-aliasing explicit compilation flag for gcc.
Using such vulnerable apilications compiled with -O2/-O3 with strict-aliasing enabled by default will lead to UB in that applications and most of them will simply crash when used.

Thise are ports I have found until now that are vulnerable to strict-aliasing
sys-libs/libcxx
dev-db/pgadmin3
x11-libs/wxGTK
app-arch/unrar
media-libs/smpeg
dev-libs/libev
sys-libs/db
x11-libs/gtk+
net-misc/modemmanager
net-fs/samba
gnome-base/gnome-vfs
dev-libs/nss
media-libs/exempi
media-libs/alsa-lib
media-video/cinelerra
media-libs/xine-lib
app-cdr/k3b 
dev-libs/DirectFB
net-libs/webkit-gtk
sys-fs/reiser4progs
www-client/firefox
sci-libs/gdal
media-libs/avidemux-plugins
media-libs/libmtp
net-misc/openssh
sys-devel/gcc (java part up to 4.9)
app-text/texlive-core
dev-lang/R
media-gfx/graphviz
media-libs/lcms
media-libs/libdvb 
x11-misc/x11vnc

[Comment 1 Jeroen Roovers (RETIRED) 2014-12-28 07:25:29 UTC]

We call them ebuilds, not ports.
Also, undefined behaviour does not imply any kind of vulnerability.

Please file this kind of bug reports upstream, because as you might have noticed, the build logs print something like this:

 * Please do not file a Gentoo bug and instead report the above QA
 * issues directly to the upstream developers of this software.
 * Homepage: ...