security-related gcc bug