Debian Bug report logs - #846385
imagemagick: Potential ABI break upstream (without SONAME change)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nishanth Aravamudan <nish.aravamudan@canonical.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Wed, 30 Nov 2016 12:34:24 -0800

Package: imagemagick
Version: 6.9.9.6+dfsg-1
Severity: normal

Dear Maintainer,

We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
we see autopkgtest failures in ruby-rmagick and php-imagick with this
version (note that Debian is seeing similar failures).

At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
change without bumping the SONAME for libmagickcore, and ruby-rmagick
ends up pulling in the wrong dependency
(https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).

More specifically, we are building against imagemagick
8:6.9.6.6+dfsg-1ubuntu2:
https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.

During the build, the tests pass succesfully (using the above version of
imagemagick), but you can see that the the resulting binary package has
dependencies that are more relaxed than that specific version:

 Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)

Therefore, when the autopkgtest runs:
https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.

Thanks to Marc Deslauriers' research, it seems like there might have
been at least one ABI breakage upsream in libmagickcore:
https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
which might be related.

What is your opinion on this as the Debian maintainer? Should the SONAME
be bumped and symbols files be updated?

Thanks for your time!

-Nish

-- 
Nishanth Aravamudan
Ubuntu Server
Canonical Ltd

Message #10 received at 846385-done@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Nishanth Aravamudan <nish.aravamudan@canonical.com>, 846385-done@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Thu, 1 Dec 2016 00:22:09 +0100

reason: does not affect debian

On Wed, Nov 30, 2016 at 9:34 PM, Nishanth Aravamudan
<nish.aravamudan@canonical.com> wrote:
> Package: imagemagick
> Version: 6.9.9.6+dfsg-1
> Severity: normal
>
> Dear Maintainer,
>
> We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
> we see autopkgtest failures in ruby-rmagick and php-imagick with this
> version (note that Debian is seeing similar failures).
>
> At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
> change without bumping the SONAME for libmagickcore, and ruby-rmagick
> ends up pulling in the wrong dependency
> (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).
>
> More specifically, we are building against imagemagick
> 8:6.9.6.6+dfsg-1ubuntu2:
> https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.
>
> During the build, the tests pass succesfully (using the above version of
> imagemagick), but you can see that the the resulting binary package has
> dependencies that are more relaxed than that specific version:
>
>  Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)
>
> Therefore, when the autopkgtest runs:
> https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
> imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.
>
> Thanks to Marc Deslauriers' research, it seems like there might have
> been at least one ABI breakage upsream in libmagickcore:
> https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
> which might be related.
>
> What is your opinion on this as the Debian maintainer? Should the SONAME
> be bumped and symbols files be updated?
>
> Thanks for your time!

Debian do a so bump for 6.9.5-8. I think it is safer to do the same on ubuntu

Bastien

>
> -Nish
>
> --
> Nishanth Aravamudan
> Ubuntu Server
> Canonical Ltd
>
> _______________________________________________
> Pkg-gmagick-im-team mailing list
> Pkg-gmagick-im-team@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-gmagick-im-team

Message #11 received at 846385-done@bugs.debian.org (full text, mbox, reply):

From: Nish Aravamudan <nish.aravamudan@canonical.com>

To: roucaries bastien <roucaries.bastien+debian@gmail.com>

Cc: 846385-done@bugs.debian.org, Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Wed, 30 Nov 2016 15:49:02 -0800

On 01.12.2016 [00:22:09 +0100], roucaries bastien wrote:
> reason: does not affect debian
> 
> On Wed, Nov 30, 2016 at 9:34 PM, Nishanth Aravamudan
> <nish.aravamudan@canonical.com> wrote:
> > Package: imagemagick
> > Version: 6.9.9.6+dfsg-1
> > Severity: normal
> >
> > Dear Maintainer,
> >
> > We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
> > we see autopkgtest failures in ruby-rmagick and php-imagick with this
> > version (note that Debian is seeing similar failures).
> >
> > At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
> > change without bumping the SONAME for libmagickcore, and ruby-rmagick
> > ends up pulling in the wrong dependency
> > (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).
> >
> > More specifically, we are building against imagemagick
> > 8:6.9.6.6+dfsg-1ubuntu2:
> > https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.
> >
> > During the build, the tests pass succesfully (using the above version of
> > imagemagick), but you can see that the the resulting binary package has
> > dependencies that are more relaxed than that specific version:
> >
> >  Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)
> >
> > Therefore, when the autopkgtest runs:
> > https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
> > imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.
> >
> > Thanks to Marc Deslauriers' research, it seems like there might have
> > been at least one ABI breakage upsream in libmagickcore:
> > https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
> > which might be related.
> >
> > What is your opinion on this as the Debian maintainer? Should the SONAME
> > be bumped and symbols files be updated?
> >
> > Thanks for your time!
> 
> Debian do a so bump for 6.9.5-8. I think it is safer to do the same on ubuntu

CMIIW, but this only bumped the so for libmagick++ not libmagickcore?

-Nish

Message #16 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Nishanth Aravamudan <nish.aravamudan@canonical.com>, 846385@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Thu, 1 Dec 2016 15:55:02 +0100

On Wed, Nov 30, 2016 at 9:34 PM, Nishanth Aravamudan
<nish.aravamudan@canonical.com> wrote:
> Package: imagemagick
> Version: 6.9.9.6+dfsg-1
> Severity: normal
>
> Dear Maintainer,
>
> We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
> we see autopkgtest failures in ruby-rmagick and php-imagick with this
> version (note that Debian is seeing similar failures).
>
> At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
> change without bumping the SONAME for libmagickcore, and ruby-rmagick
> ends up pulling in the wrong dependency
> (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).
>
> More specifically, we are building against imagemagick
> 8:6.9.6.6+dfsg-1ubuntu2:
> https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.
>
> During the build, the tests pass succesfully (using the above version of
> imagemagick), but you can see that the the resulting binary package has
> dependencies that are more relaxed than that specific version:
>
>  Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)
>
> Therefore, when the autopkgtest runs:
> https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
> imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.
>
> Thanks to Marc Deslauriers' research, it seems like there might have
> been at least one ABI breakage upsream in libmagickcore:
> https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
> which might be related.
>
> What is your opinion on this as the Debian maintainer? Should the SONAME
> be bumped and symbols files be updated?

Some detail:
*  GetDefaultOpenCLEnv is not a problem because opencl is disable on debian
* struct _DrawInfo (1) is not a problem from a C point of view because
it should be set and destry by API function. It is a opaque object. So
no need to so bump for this
*  _ElementReference (1) is part of _Drawinfo so not a problem
* _GradientInfo (3) is the same
* For _image is an opaque type so it is the same

Now for interpreted language you may need the size of this kind of
structure and thus need stricter dependencies or use at
innitialisation a runtime check of imagesize returned by

AcquireImage() function.

Bastien





> Thanks for your time!
>
> -Nish
>
> --
> Nishanth Aravamudan
> Ubuntu Server
> Canonical Ltd
>
> _______________________________________________
> Pkg-gmagick-im-team mailing list
> Pkg-gmagick-im-team@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-gmagick-im-team

Message #21 received at 846385@bugs.debian.org (full text, mbox, reply):

From: Antonio Terceiro <terceiro@debian.org>

To: roucaries bastien <roucaries.bastien+debian@gmail.com>

Cc: Nishanth Aravamudan <nish.aravamudan@canonical.com>, 846385@bugs.debian.org

Subject: Re: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Sat, 3 Dec 2016 22:08:09 -0200

[Message part 1 (text/plain, inline)]

On Thu, Dec 01, 2016 at 03:55:02PM +0100, roucaries bastien wrote:
> On Wed, Nov 30, 2016 at 9:34 PM, Nishanth Aravamudan
> <nish.aravamudan@canonical.com> wrote:
> > Package: imagemagick
> > Version: 6.9.9.6+dfsg-1
> > Severity: normal
> >
> > Dear Maintainer,
> >
> > We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
> > we see autopkgtest failures in ruby-rmagick and php-imagick with this
> > version (note that Debian is seeing similar failures).
> >
> > At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
> > change without bumping the SONAME for libmagickcore, and ruby-rmagick
> > ends up pulling in the wrong dependency
> > (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).
> >
> > More specifically, we are building against imagemagick
> > 8:6.9.6.6+dfsg-1ubuntu2:
> > https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.
> >
> > During the build, the tests pass succesfully (using the above version of
> > imagemagick), but you can see that the the resulting binary package has
> > dependencies that are more relaxed than that specific version:
> >
> >  Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)
> >
> > Therefore, when the autopkgtest runs:
> > https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
> > imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.
> >
> > Thanks to Marc Deslauriers' research, it seems like there might have
> > been at least one ABI breakage upsream in libmagickcore:
> > https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
> > which might be related.
> >
> > What is your opinion on this as the Debian maintainer? Should the SONAME
> > be bumped and symbols files be updated?
> 
> Some detail:
> *  GetDefaultOpenCLEnv is not a problem because opencl is disable on debian
> * struct _DrawInfo (1) is not a problem from a C point of view because
> it should be set and destry by API function. It is a opaque object. So
> no need to so bump for this

I don't think that is the case.

After initializing a _Drawinfo struct, ruby-rmagick needs to operate on
it, by assigning values to its fields. So unless I am missing some API
in imagemagick to set fields of _Drawinfo, it is *not* opaque for API
users. If the structure size changes without a proper SONAME bump, this
*will* cause segfaults.

Please reconsider this, and do SONAME bumps when there are ABI
changes.

> *  _ElementReference (1) is part of _Drawinfo so not a problem
> * _GradientInfo (3) is the same
> * For _image is an opaque type so it is the same
> 
> Now for interpreted language you may need the size of this kind of
> structure and thus need stricter dependencies or use at
> innitialisation a runtime check of imagesize returned by
> AcquireImage() function.

See above.

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Debian Release <debian-release@lists.debian.org>

Cc: Niels Thykier <nthykier@debian.org>, terceiro@debian.org, 846385@bugs.debian.org

Subject: Fwd: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Mon, 5 Dec 2016 21:29:34 +0100

[Message part 1 (text/plain, inline)]

Dear release team,

Could you get a glimpse at this bug?

I had supposed that this change was safe because these structure could
be only allocated using API call (no malloc) and size of structure was
expanded.

Do you think we need for safety a so bump ?

Sorry for this late mail

Bastien


---------- Forwarded message ----------
From: Antonio Terceiro <terceiro@debian.org>
Date: Sun, Dec 4, 2016 at 1:08 AM
Subject: Re: [Pkg-gmagick-im-team] Bug#846385: imagemagick: Potential
ABI break upstream (without SONAME change)
To: roucaries bastien <roucaries.bastien+debian@gmail.com>
Cc: Nishanth Aravamudan <nish.aravamudan@canonical.com>, 846385@bugs.debian.org


On Thu, Dec 01, 2016 at 03:55:02PM +0100, roucaries bastien wrote:
> On Wed, Nov 30, 2016 at 9:34 PM, Nishanth Aravamudan
> <nish.aravamudan@canonical.com> wrote:
> > Package: imagemagick
> > Version: 6.9.9.6+dfsg-1
> > Severity: normal
> >
> > Dear Maintainer,
> >
> > We recently merged imagemagick 6.9.9.6+dfsg-1 in Ubuntu 17.04; however
> > we see autopkgtest failures in ruby-rmagick and php-imagick with this
> > version (note that Debian is seeing similar failures).
> >
> > At least for ruby-rmagick, it seems like (possibly) upstream made an ABI
> > change without bumping the SONAME for libmagickcore, and ruby-rmagick
> > ends up pulling in the wrong dependency
> > (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz).
> >
> > More specifically, we are building against imagemagick
> > 8:6.9.6.6+dfsg-1ubuntu2:
> > https://launchpadlibrarian.net/295470626/buildlog_ubuntu-zesty-arm64.ruby-rmagick_2.15.4+dfsg-2build1_BUILDING.txt.gz.
> >
> > During the build, the tests pass succesfully (using the above version of
> > imagemagick), but you can see that the the resulting binary package has
> > dependencies that are more relaxed than that specific version:
> >
> >  Depends: ruby (>= 1:2.3~0), libc6 (>= 2.17), libmagickcore-6.q16-2 (>= 8:6.8.8.9), libruby2.3 (>= 2.3.0~preview2)
> >
> > Therefore, when the autopkgtest runs:
> > https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty/zesty/armhf/r/ruby-rmagick/20161130_032804_d2177@/log.gz,
> > imagemagick 8:6.8.9.9-7ubuntu9 is used, and a segmentation fault occurs.
> >
> > Thanks to Marc Deslauriers' research, it seems like there might have
> > been at least one ABI breakage upsream in libmagickcore:
> > https://abi-laboratory.pro/tracker/compat_report/imagemagick/6.9.1-10/6.9.2-10/67f2f/abi_compat_report.html,
> > which might be related.
> >
> > What is your opinion on this as the Debian maintainer? Should the SONAME
> > be bumped and symbols files be updated?
>
> Some detail:
> *  GetDefaultOpenCLEnv is not a problem because opencl is disable on debian
> * struct _DrawInfo (1) is not a problem from a C point of view because
> it should be set and destry by API function. It is a opaque object. So
> no need to so bump for this

I don't think that is the case.

After initializing a _Drawinfo struct, ruby-rmagick needs to operate on
it, by assigning values to its fields. So unless I am missing some API
in imagemagick to set fields of _Drawinfo, it is *not* opaque for API
users. If the structure size changes without a proper SONAME bump, this
*will* cause segfaults.

Please reconsider this, and do SONAME bumps when there are ABI
changes.

> *  _ElementReference (1) is part of _Drawinfo so not a problem
> * _GradientInfo (3) is the same
> * For _image is an opaque type so it is the same
>
> Now for interpreted language you may need the size of this kind of
> structure and thus need stricter dependencies or use at
> innitialisation a runtime check of imagesize returned by
> AcquireImage() function.

See above.

[signature.asc (application/pgp-signature, attachment)]

Message #31 received at 846385@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: roucaries bastien <roucaries.bastien+debian@gmail.com>, 846385@bugs.debian.org

Cc: Nishanth Aravamudan <nish.aravamudan@canonical.com>, debian-release@lists.debian.org

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Tue, 6 Dec 2016 19:23:26 +0000

Control: reopen 846385
Control: severity 846385 serious

tl;dr: yes, this is clearly an ABI break.

On Thu, 01 Dec 2016 at 15:55:02 +0100, roucaries bastien wrote:
> * struct _DrawInfo (1) is not a problem from a C point of view because
> it should be set and destry by API function. It is a opaque object. So
> no need to so bump for this
> *  _ElementReference (1) is part of _Drawinfo so not a problem
> * _GradientInfo (3) is the same
> * For _image is an opaque type so it is the same

Unfortunately this is not true: none of these types are opaque. I think
you have misunderstood what it means to say a struct type is opaque.
For example, DrawInfo (aka struct _DrawInfo) has its layout visible to
library users in the installed header <magick/draw.h> (in
libmagickcore-6-headers), so any change to its size is an ABI break, and
so is any semantic change to its contents.

You are right to think that if library users were expected to allocate
a DrawInfo on the stack, it would certainly be an ABI break to change
its size. However, even if a structure is only ever allocated by
library code, reading its fields directly is part of the library ABI too.

For DrawInfo to be an opaque object, its layout would have to be
in a .c or .h file used only internally by ImageMagick (and not installed
in libmagickcore-6-headers), and library users would have to access its
fields via accessor functions like DrawInfoGetGravity() and
DrawInfoSetGravity(). For example, GRegex in GLib's glib/gregex.[ch]
is a good example of an opaque object:
https://sources.debian.net/src/glib2.0/2.50.2-2/glib/gregex.h/
https://sources.debian.net/src/glib2.0/2.50.2-2/glib/gregex.c/

The definition of an ABI break is that previously-correct code, compiled
against version A, no longer works correctly when linked at runtime with
version B. Consider what would happen if some program that uses ImageMagick
is compiled against ImageMagick 6.9.1-10, and it wants to set the stroke
opacity (which happens to be the last field in the struct):

    DrawInfo *draw_info = AcquireDrawInfo();

    draw_info->stroke_opacity = 0.5;

In ImageMagick 6.9.1-10 on x86_64, according to the ABI Compliance Checker,
the DrawInfo is a 720 byte struct. A double is 8 bytes, and stroke_opacity
is the last thing in the struct, so that assignment results in an 8-byte
write 712 bytes after the draw_info pointer, overwriting the bytes from
712 to 719 bytes after the pointer. In other words, on x86_64, it's the
same machine code that you would get by compiling this:

    DrawInfo *draw_info = AcquireDrawInfo();

    *((double *) (((char *) draw_info) + 712)) = 0.5;

Now suppose we install that program on a machine that has ImageMagick
6.9.2-10, in which DrawInfo has grown by 32 bytes. The program still
writes at an offset of 712 bytes into the struct (remember that
machine code doesn't know anything about structs or names, only
pointers and offsets), but now the larger GradientInfo and
ElementReference have pushed all the later struct fields further
away from offset 0. If my arithmetic is correct, the field 712 bytes
into the data structure is now draw_info->interword_spacing, which is
not what was intended.

Conversely, if you compile against 6.9.2-10 but use 6.9.1-10 at runtime,
it's worse: the program writes at an offset of 724 bytes (overwriting
bytes 724 to 731 inclusive); but since ImageMagick 6.9.1-10 only allocated
a 720 byte struct, that write is outside the struct, and could be anything
(in particular, it could be corrupting glibc malloc data structures).

Regards,
    S

Message #48 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Simon McVittie <smcv@debian.org>

Cc: 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Fri, 9 Dec 2016 22:37:14 +0100

control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320

Dear realease team,

What is the next step?

Thank you

On Tue, Dec 6, 2016 at 8:23 PM, Simon McVittie <smcv@debian.org> wrote:
> Control: reopen 846385
> Control: severity 846385 serious
>
> tl;dr: yes, this is clearly an ABI break.
>
> On Thu, 01 Dec 2016 at 15:55:02 +0100, roucaries bastien wrote:
>> * struct _DrawInfo (1) is not a problem from a C point of view because
>> it should be set and destry by API function. It is a opaque object. So
>> no need to so bump for this
>> *  _ElementReference (1) is part of _Drawinfo so not a problem
>> * _GradientInfo (3) is the same
>> * For _image is an opaque type so it is the same
>
> Unfortunately this is not true: none of these types are opaque. I think
> you have misunderstood what it means to say a struct type is opaque.
> For example, DrawInfo (aka struct _DrawInfo) has its layout visible to
> library users in the installed header <magick/draw.h> (in
> libmagickcore-6-headers), so any change to its size is an ABI break, and
> so is any semantic change to its contents.
>
> You are right to think that if library users were expected to allocate
> a DrawInfo on the stack, it would certainly be an ABI break to change
> its size. However, even if a structure is only ever allocated by
> library code, reading its fields directly is part of the library ABI too.
>
> For DrawInfo to be an opaque object, its layout would have to be
> in a .c or .h file used only internally by ImageMagick (and not installed
> in libmagickcore-6-headers), and library users would have to access its
> fields via accessor functions like DrawInfoGetGravity() and
> DrawInfoSetGravity(). For example, GRegex in GLib's glib/gregex.[ch]
> is a good example of an opaque object:
> https://sources.debian.net/src/glib2.0/2.50.2-2/glib/gregex.h/
> https://sources.debian.net/src/glib2.0/2.50.2-2/glib/gregex.c/
>
> The definition of an ABI break is that previously-correct code, compiled
> against version A, no longer works correctly when linked at runtime with
> version B. Consider what would happen if some program that uses ImageMagick
> is compiled against ImageMagick 6.9.1-10, and it wants to set the stroke
> opacity (which happens to be the last field in the struct):
>
>     DrawInfo *draw_info = AcquireDrawInfo();
>
>     draw_info->stroke_opacity = 0.5;
>
> In ImageMagick 6.9.1-10 on x86_64, according to the ABI Compliance Checker,
> the DrawInfo is a 720 byte struct. A double is 8 bytes, and stroke_opacity
> is the last thing in the struct, so that assignment results in an 8-byte
> write 712 bytes after the draw_info pointer, overwriting the bytes from
> 712 to 719 bytes after the pointer. In other words, on x86_64, it's the
> same machine code that you would get by compiling this:
>
>     DrawInfo *draw_info = AcquireDrawInfo();
>
>     *((double *) (((char *) draw_info) + 712)) = 0.5;
>
> Now suppose we install that program on a machine that has ImageMagick
> 6.9.2-10, in which DrawInfo has grown by 32 bytes. The program still
> writes at an offset of 712 bytes into the struct (remember that
> machine code doesn't know anything about structs or names, only
> pointers and offsets), but now the larger GradientInfo and
> ElementReference have pushed all the later struct fields further
> away from offset 0. If my arithmetic is correct, the field 712 bytes
> into the data structure is now draw_info->interword_spacing, which is
> not what was intended.
>
> Conversely, if you compile against 6.9.2-10 but use 6.9.1-10 at runtime,
> it's worse: the program writes at an offset of 724 bytes (overwriting
> bytes 724 to 731 inclusive); but since ImageMagick 6.9.1-10 only allocated
> a 720 byte struct, that write is outside the struct, and could be anything
> (in particular, it could be corrupting glibc malloc data structures).
>
> Regards,
>     S

Message #55 received at 846385@bugs.debian.org (full text, mbox, reply):

From: Emilio Pozuelo Monfort <pochu@debian.org>

To: roucaries bastien <roucaries.bastien+debian@gmail.com>, Simon McVittie <smcv@debian.org>

Cc: 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Tue, 13 Dec 2016 00:21:53 +0100

On 09/12/16 22:37, roucaries bastien wrote:
> control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320
> 
> Dear realease team,
> 
> What is the next step?

In which version was the ABI break introduced?

In general I would prefer the change to be reverted, but depending on how long
this has been in the archive, and in order to stay up to date for security
fixes, it may be best to do the soname bump.

Can you check if your rdeps build fine against a new imagemagick?

Emilio

Message #60 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Emilio Pozuelo Monfort <pochu@debian.org>

Cc: Simon McVittie <smcv@debian.org>, 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Wed, 14 Dec 2016 13:28:49 +0100

On Tue, Dec 13, 2016 at 12:21 AM, Emilio Pozuelo Monfort
<pochu@debian.org> wrote:
> On 09/12/16 22:37, roucaries bastien wrote:
>> control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320
>>
>> Dear realease team,
>>
>> What is the next step?
>
> In which version was the ABI break introduced?

It was introduced more than 2 years ago ( 6.9.2-10). One version after
jessie what lie in unstable before jessie release.
>
> In general I would prefer the change to be reverted, but depending on how long
> this has been in the archive, and in order to stay up to date for security
> fixes, it may be best to do the soname bump.

From a security point of view, I prefer recent version. I do not want
to keep jessie version with huge patch queue for
>
> Can you check if your rdeps build fine against a new imagemagick?

What i will do i will set on unstable the newer version with so dump
and will begin to rebuilt on pbuilder. Normally it will be fine.

I wish to have abi checker on the debian side

Bastien
>
> Emilio

Message #65 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Emilio Pozuelo Monfort <pochu@debian.org>

Cc: Simon McVittie <smcv@debian.org>, 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Wed, 14 Dec 2016 13:29:17 +0100

On Wed, Dec 14, 2016 at 1:28 PM, roucaries bastien
<roucaries.bastien+debian@gmail.com> wrote:
> On Tue, Dec 13, 2016 at 12:21 AM, Emilio Pozuelo Monfort
> <pochu@debian.org> wrote:
>> On 09/12/16 22:37, roucaries bastien wrote:
>>> control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320
>>>
>>> Dear realease team,
>>>
>>> What is the next step?
>>
>> In which version was the ABI break introduced?
>
> It was introduced more than 2 years ago ( 6.9.2-10). One version after
> jessie what lie in unstable before jessie release.
>>
>> In general I would prefer the change to be reverted, but depending on how long
>> this has been in the archive, and in order to stay up to date for security
>> fixes, it may be best to do the soname bump.
>
> From a security point of view, I prefer recent version. I do not want
> to keep jessie version with huge patch queue for
>>
>> Can you check if your rdeps build fine against a new imagemagick?
>
> What i will do i will set on unstable the newer version with so dump
> and will begin to rebuilt on pbuilder. Normally it will be fine.

s/unstable/experimental/g
>
> I wish to have abi checker on the debian side
>
> Bastien
>>
>> Emilio

Message #74 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Emilio Pozuelo Monfort <pochu@debian.org>

Cc: Simon McVittie <smcv@debian.org>, 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Tue, 20 Dec 2016 16:22:06 +0100

On Wed, Dec 14, 2016 at 1:29 PM, roucaries bastien
<roucaries.bastien+debian@gmail.com> wrote:
> On Wed, Dec 14, 2016 at 1:28 PM, roucaries bastien
> <roucaries.bastien+debian@gmail.com> wrote:
>> On Tue, Dec 13, 2016 at 12:21 AM, Emilio Pozuelo Monfort
>> <pochu@debian.org> wrote:
>>> On 09/12/16 22:37, roucaries bastien wrote:
>>>> control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320
>>>>
>>>> Dear realease team,
>>>>
>>>> What is the next step?
>>>
>>> In which version was the ABI break introduced?
>>
>> It was introduced more than 2 years ago ( 6.9.2-10). One version after
>> jessie what lie in unstable before jessie release.
>>>
>>> In general I would prefer the change to be reverted, but depending on how long
>>> this has been in the archive, and in order to stay up to date for security
>>> fixes, it may be best to do the soname bump.
>>
>> From a security point of view, I prefer recent version. I do not want
>> to keep jessie version with huge patch queue for
>>>
>>> Can you check if your rdeps build fine against a new imagemagick?

libmagick++ rdeps build fine except traficserver due to a sphinx error
(unreleated to imagemagick)
libmagickwand rdeps build fine except rss-glx due to unreleated build
conflict (#838800)
libmagickcore rdeps build fine except dx due to missing .mak file
(unlikely imagemagick)

Will rebuild traficserver and dx under sid chroot and report FTBFS.

Seems it is ok

Bastien
>>
>> What i will do i will set on unstable the newer version with so dump
>> and will begin to rebuilt on pbuilder. Normally it will be fine.
>
> s/unstable/experimental/g
>>
>> I wish to have abi checker on the debian side
>>
>> Bastien
>>>
>>> Emilio

Message #79 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Emilio Pozuelo Monfort <pochu@debian.org>

Cc: Simon McVittie <smcv@debian.org>, 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Tue, 20 Dec 2016 16:45:47 +0100

On Tue, Dec 20, 2016 at 4:22 PM, roucaries bastien
<roucaries.bastien+debian@gmail.com> wrote:
> On Wed, Dec 14, 2016 at 1:29 PM, roucaries bastien
> <roucaries.bastien+debian@gmail.com> wrote:
>> On Wed, Dec 14, 2016 at 1:28 PM, roucaries bastien
>> <roucaries.bastien+debian@gmail.com> wrote:
>>> On Tue, Dec 13, 2016 at 12:21 AM, Emilio Pozuelo Monfort
>>> <pochu@debian.org> wrote:
>>>> On 09/12/16 22:37, roucaries bastien wrote:
>>>>> control: forwarded -1 https://github.com/ImageMagick/ImageMagick/issues/320
>>>>>
>>>>> Dear realease team,
>>>>>
>>>>> What is the next step?
>>>>
>>>> In which version was the ABI break introduced?
>>>
>>> It was introduced more than 2 years ago ( 6.9.2-10). One version after
>>> jessie what lie in unstable before jessie release.
>>>>
>>>> In general I would prefer the change to be reverted, but depending on how long
>>>> this has been in the archive, and in order to stay up to date for security
>>>> fixes, it may be best to do the soname bump.
>>>
>>> From a security point of view, I prefer recent version. I do not want
>>> to keep jessie version with huge patch queue for
>>>>
>>>> Can you check if your rdeps build fine against a new imagemagick?
>
> libmagick++ rdeps build fine except traficserver due to a sphinx error
> (unreleated to imagemagick)
> libmagickwand rdeps build fine except rss-glx due to unreleated build
> conflict (#838800)
> libmagickcore rdeps build fine except dx due to missing .mak file
> (unlikely imagemagick)

trafficserver is - #848800
dx #848894

>
> Will rebuild traficserver and dx under sid chroot and report FTBFS.
>
> Seems it is ok
>
> Bastien
>>>
>>> What i will do i will set on unstable the newer version with so dump
>>> and will begin to rebuilt on pbuilder. Normally it will be fine.
>>
>> s/unstable/experimental/g
>>>
>>> I wish to have abi checker on the debian side
>>>
>>> Bastien
>>>>
>>>> Emilio

Message #84 received at 846385@bugs.debian.org (full text, mbox, reply):

From: roucaries bastien <roucaries.bastien+debian@gmail.com>

To: Emilio Pozuelo Monfort <pochu@debian.org>

Cc: Simon McVittie <smcv@debian.org>, 846385@bugs.debian.org, Nishanth Aravamudan <nish.aravamudan@canonical.com>, Debian Release <debian-release@lists.debian.org>

Subject: Re: Bug#846385: imagemagick: Potential ABI break upstream (without SONAME change)

Date: Tue, 20 Dec 2016 16:59:12 +0100

BTW feel free to NMU imagemagick during a short break I take in the
next two days.

Bastien

Message #89 received at 846385-close@bugs.debian.org (full text, mbox, reply):

From: Bastien Roucariès <roucaries.bastien+debian@gmail.com>

To: 846385-close@bugs.debian.org

Subject: Bug#846385: fixed in imagemagick 8:6.9.7.0+dfsg-1

Date: Thu, 22 Dec 2016 16:00:19 +0000

Source: imagemagick
Source-Version: 8:6.9.7.0+dfsg-1

We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 846385@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastien Roucariès <roucaries.bastien+debian@gmail.com> (supplier of updated imagemagick package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 19 Dec 2016 11:13:39 +0100
Source: imagemagick
Binary: imagemagick-6-common imagemagick-6-doc libmagickcore-6-headers libmagickwand-6-headers libmagick++-6-headers libimage-magick-perl libmagickcore-6-arch-config imagemagick-6.q16 libmagickcore-6.q16-3 libmagickcore-6.q16-3-extra libmagickcore-6.q16-dev libmagickwand-6.q16-3 libmagickwand-6.q16-dev libmagick++-6.q16-7 libmagick++-6.q16-dev libimage-magick-q16-perl imagemagick-6.q16hdri libmagickcore-6.q16hdri-3 libmagickcore-6.q16hdri-3-extra libmagickcore-6.q16hdri-dev libmagickwand-6.q16hdri-3 libmagickwand-6.q16hdri-dev libmagick++-6.q16hdri-7 libmagick++-6.q16hdri-dev libimage-magick-q16hdri-perl imagemagick-common imagemagick-doc perlmagick libmagickcore-dev libmagickwand-dev libmagick++-dev imagemagick
Architecture: source all amd64
Version: 8:6.9.7.0+dfsg-1
Distribution: experimental
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <roucaries.bastien+debian@gmail.com>
Description:
 imagemagick - image manipulation programs -- binaries
 imagemagick-6-common - image manipulation programs -- infrastructure
 imagemagick-6-doc - document files of ImageMagick
 imagemagick-6.q16 - image manipulation programs -- quantum depth Q16
 imagemagick-6.q16hdri - image manipulation programs -- quantum depth Q16HDRI
 imagemagick-common - image manipulation programs -- infrastructure dummy package
 imagemagick-doc - document files of ImageMagick -- dummy package
 libimage-magick-perl - Perl interface to the ImageMagick graphics routines
 libimage-magick-q16-perl - Perl interface to the ImageMagick graphics routines -- Q16 versio
 libimage-magick-q16hdri-perl - Perl interface to the ImageMagick graphics routines -- Q16HDRI ve
 libmagick++-6-headers - object-oriented C++ interface to ImageMagick - header files
 libmagick++-6.q16-7 - C++ interface to ImageMagick -- quantum depth Q16
 libmagick++-6.q16-dev - C++ interface to ImageMagick - development files (Q16)
 libmagick++-6.q16hdri-7 - C++ interface to ImageMagick -- quantum depth Q16HDRI
 libmagick++-6.q16hdri-dev - C++ interface to ImageMagick - development files (Q16HDRI)
 libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package
 libmagickcore-6-arch-config - low-level image manipulation library - architecture header files
 libmagickcore-6-headers - low-level image manipulation library - header files
 libmagickcore-6.q16-3 - low-level image manipulation library -- quantum depth Q16
 libmagickcore-6.q16-3-extra - low-level image manipulation library - extra codecs (Q16)
 libmagickcore-6.q16-dev - low-level image manipulation library - development files (Q16)
 libmagickcore-6.q16hdri-3 - low-level image manipulation library -- quantum depth Q16HDRI
 libmagickcore-6.q16hdri-3-extra - low-level image manipulation library - extra codecs (Q16HDRI)
 libmagickcore-6.q16hdri-dev - low-level image manipulation library - development files (Q16HDRI
 libmagickcore-dev - low-level image manipulation library -- dummy package
 libmagickwand-6-headers - image manipulation library - headers files
 libmagickwand-6.q16-3 - image manipulation library -- quantum depth Q16
 libmagickwand-6.q16-dev - image manipulation library - development files (Q16)
 libmagickwand-6.q16hdri-3 - image manipulation library -- quantum depth Q16HDRI
 libmagickwand-6.q16hdri-dev - image manipulation library - development files (Q16HDRI)
 libmagickwand-dev - image manipulation library -- dummy package
 perlmagick - Perl interface to ImageMagick -- dummy package
Closes: 846385 847282 848139
Changes:
 imagemagick (8:6.9.7.0+dfsg-1) experimental; urgency=high
 .
   * Bump so version due to structure change
     thanks to Nishanth Aravamudan (Closes: #846385).
   * Fix CVE-2016-8707  ImageMagick Convert Tiff Adobe Deflate
     Code Execution Vulnerability (Closes: #848139)
   * Bug fix: "fails to upgrade wheezy -> jessie -> stretch", thanks
     to Andreas Beckmann (Closes: #847282).
Checksums-Sha1:
 dfb1fc09239a3db199e0367cd6ca9e9a072327fc 5137 imagemagick_6.9.7.0+dfsg-1.dsc
 0b7b8610da6d0cbd2eb5a1b788d855e2a600c4b5 8928320 imagemagick_6.9.7.0+dfsg.orig.tar.xz
 b51783474dc4a42f14cca417bc5e486f5b7e3841 200500 imagemagick_6.9.7.0+dfsg-1.debian.tar.xz
 38a8636d56e036ae3775bad9c39b88dbe1ac15ff 179814 imagemagick-6-common_6.9.7.0+dfsg-1_all.deb
 182ba961a602aefd7e1b8de10592da423e0172bd 7508842 imagemagick-6-doc_6.9.7.0+dfsg-1_all.deb
 7c7d66fe7e374aab92006db96b63a53d5a53fa44 90864 imagemagick-6.q16-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 2f1bb3a08181658935e7e7bbc6ad4a4ed856985b 557904 imagemagick-6.q16_6.9.7.0+dfsg-1_amd64.deb
 4bc1fce98672f9d3b836a84d61d90e2840a06837 91462 imagemagick-6.q16hdri-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 266ed634a235b0884c80666184985b532e61ff17 558106 imagemagick-6.q16hdri_6.9.7.0+dfsg-1_amd64.deb
 e60850ed08860f3fadd1b51ffaac59839752b4f1 1398 imagemagick-common_6.9.7.0+dfsg-1_all.deb
 e34940bd648c0446fb972d1cf43ac172181f055d 1224 imagemagick-doc_6.9.7.0+dfsg-1_all.deb
 76cc88ff6947970a2e3976682458a2a97ecedff7 26789 imagemagick_6.9.7.0+dfsg-1_amd64.buildinfo
 653d45f533518fac3de1ae3554c62e5220499e2e 136730 imagemagick_6.9.7.0+dfsg-1_amd64.deb
 f0af56c014357f09232593c2300ba8e12611432b 53280 libimage-magick-perl_6.9.7.0+dfsg-1_all.deb
 9b6557efe355e3195917f680bbf1649b4267ad87 189022 libimage-magick-q16-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 becf8295e1603e058d7a723e389f88afdb2aaaa9 219870 libimage-magick-q16-perl_6.9.7.0+dfsg-1_amd64.deb
 acb7c91c9414cd5b2f68546f07415d03562adbb1 187864 libimage-magick-q16hdri-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 f55681a9d8a0bf2dafef342232ce20a4a6f02549 220104 libimage-magick-q16hdri-perl_6.9.7.0+dfsg-1_amd64.deb
 246b307e66fb27a7bee3e257aa1d7f15231d035d 47090 libmagick++-6-headers_6.9.7.0+dfsg-1_all.deb
 5652be2dd8188fb24d96718745689d1c32542972 984880 libmagick++-6.q16-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 798e44ff6b65e2636af00a3703075e1972174df1 267696 libmagick++-6.q16-7_6.9.7.0+dfsg-1_amd64.deb
 bf32d30b75938ed1b4b853748a1aa80b91796367 241406 libmagick++-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 ebaef068963a2a59ede294a47f80ca997b9b1773 984252 libmagick++-6.q16hdri-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 2f98c96d7ec7a4fda7f6aac4ffd20bf59ec840c3 252698 libmagick++-6.q16hdri-7_6.9.7.0+dfsg-1_amd64.deb
 188280e232365a4f3f5bbf99d2e95168689b8675 241550 libmagick++-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 a75dd9d1f9db064780a87c9b94777425a5fa9924 1288 libmagick++-dev_6.9.7.0+dfsg-1_all.deb
 b1c12821069e94200a4d6f2fff1111dc8828ec4a 144164 libmagickcore-6-arch-config_6.9.7.0+dfsg-1_amd64.deb
 a29572a1cf66674831781f30da87515d5953d2ea 46938 libmagickcore-6-headers_6.9.7.0+dfsg-1_all.deb
 ad89622cc1845c8ccc4ab28b051c16d418284439 4434728 libmagickcore-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 502f47d373d9bb0334b90d155287d2bbbf458598 174384 libmagickcore-6.q16-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 5626ac111dc860bf4efa9ead0f96efb9e8714590 185476 libmagickcore-6.q16-3-extra_6.9.7.0+dfsg-1_amd64.deb
 a8ac83d616fef9ec73fcbcc0b8eafadf1964a1e0 1728822 libmagickcore-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 edc89103ee96c163e7adc09b191e93abd9ed26f7 1084856 libmagickcore-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 06784140644cad3c95cddf1d6ab8a87bd1569590 4416384 libmagickcore-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 6052dd4052ace205edc29be71c6c8df8b1d05716 173992 libmagickcore-6.q16hdri-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 55739fb3b9179efea28f61f85796063b55fc04f1 185480 libmagickcore-6.q16hdri-3-extra_6.9.7.0+dfsg-1_amd64.deb
 87e12787fe65fd4e9472b37e8e85daa2f3331c7b 1729634 libmagickcore-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 573b51ea44eec296825fe20db12edd916cdc57d7 1079828 libmagickcore-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 a1e9fa14dd0891d84b8350d3539b0e90575ef280 1254 libmagickcore-dev_6.9.7.0+dfsg-1_all.deb
 a6132811358b969899fcb2a39fea5d7d4f43f9df 10454 libmagickwand-6-headers_6.9.7.0+dfsg-1_all.deb
 3ebec715a4f2a58eacabf881aa13128a76de29d2 672134 libmagickwand-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 0b99c318cf8fa080c894713583902756331ec058 418062 libmagickwand-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 4fb7592530cd077edd8f11ab2eca918bbf0e87c2 413668 libmagickwand-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 15bd6253d4d50b516e03146ca8793809dd346e56 667944 libmagickwand-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 60353c31c9590420df9a2c9e52aaa73e024b221f 412700 libmagickwand-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 6449cb5c4d23aefe46637444a9cc061aa3130145 413252 libmagickwand-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 79f1e4be4f522f3f798a0220cbb8bb96afafec9d 1244 libmagickwand-dev_6.9.7.0+dfsg-1_all.deb
 722ebd757ca8aeb79f7e2e949319f376bc8f4106 1260 perlmagick_6.9.7.0+dfsg-1_all.deb
Checksums-Sha256:
 c008ee0131400d8d73f8bb949de8ddcd2f198c36c78eb5534fbb5f488383f92b 5137 imagemagick_6.9.7.0+dfsg-1.dsc
 d1e4f64bd367c1e708ada0c0df7c2b68a2c29212ac75f43c6aa4678874305200 8928320 imagemagick_6.9.7.0+dfsg.orig.tar.xz
 61a456f44c735527edc3207d74d0646de5eece8e70c9e6907dd7a8957cf50463 200500 imagemagick_6.9.7.0+dfsg-1.debian.tar.xz
 82f5691d7757ca3e0772b1e2ccad97fe1c28ea0b1decb30a9816e2723f728c40 179814 imagemagick-6-common_6.9.7.0+dfsg-1_all.deb
 0412399274dc52fcf7f02cb59040aa1dcad90538da27d907277a8068a67f4da4 7508842 imagemagick-6-doc_6.9.7.0+dfsg-1_all.deb
 84c70c167ae82b9ef53734d9db359fc67f2183a118d275a7e8b19ffdbfe452fe 90864 imagemagick-6.q16-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 cffd5a40a065caa338c5f0f30a73af6c3b8f5d3209589973a00e6fe5464c9dc8 557904 imagemagick-6.q16_6.9.7.0+dfsg-1_amd64.deb
 9ee1d5e3cb83954224e271ed6cfdb24bc15b52a0a8e71ef384d572a8f99838be 91462 imagemagick-6.q16hdri-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 957280b63c1f6243e9b8bf5a33515a6446f37d26af146d67076df6c8decfca6e 558106 imagemagick-6.q16hdri_6.9.7.0+dfsg-1_amd64.deb
 a4a6d6832eb3937b769c110273a209c8b0d5a482b05057d31e39b34863248ade 1398 imagemagick-common_6.9.7.0+dfsg-1_all.deb
 f978b0bb09ac36d5053e7e54567de2a7e88a59602d17366726a2b381facd5382 1224 imagemagick-doc_6.9.7.0+dfsg-1_all.deb
 dacef861f0f0b3881d94826d31a298dc80a814668c509de9148fce09d16c205e 26789 imagemagick_6.9.7.0+dfsg-1_amd64.buildinfo
 8527a7172a0491d8c12aeeb91ef465fa3985e9a34fb87532ea26d7dd21936ad6 136730 imagemagick_6.9.7.0+dfsg-1_amd64.deb
 8804ef93e6fceae72e74b53981c02e97b5ede1658b9c56143d469d69146b5d1d 53280 libimage-magick-perl_6.9.7.0+dfsg-1_all.deb
 55e13733ea7a67184966d83629246e5ab359a93600e94eb4e8fd321fb43d4b69 189022 libimage-magick-q16-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 83ba50f8a429fe4cd8afae6fb0f2d5a3d9f8dd5248138f28ac6da4ee1ce6bbad 219870 libimage-magick-q16-perl_6.9.7.0+dfsg-1_amd64.deb
 a0862c1ed65c023b8cd3d43a75dbe7e83c3c9924faed9d43d556ebfabe83bcef 187864 libimage-magick-q16hdri-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 e4d7563dd78dfb515f701014bcffa2e654bc944d835cf88c53f5533fa638b581 220104 libimage-magick-q16hdri-perl_6.9.7.0+dfsg-1_amd64.deb
 132a1993b535eb918a276db1a497624f5bfc6975e72169b377cf06b57789c524 47090 libmagick++-6-headers_6.9.7.0+dfsg-1_all.deb
 d824d23db70fda01d069fb78c1625115e9af1db6f439414b4089cac2eeb57912 984880 libmagick++-6.q16-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 ed718505a57a79b7f32e577734458847b91e249dcfef4a5de1fc6f039c58068a 267696 libmagick++-6.q16-7_6.9.7.0+dfsg-1_amd64.deb
 a56366c9f5cb963f723dcb5895b762f39b2e7b2990ba037fb2b7da6e5d6a29b1 241406 libmagick++-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 d5e4f31ac9661e21939ee43691ab0eebf53a5cb7d3f112a1acfa8aad0f01ee58 984252 libmagick++-6.q16hdri-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 de1933cf5f20c494f618c97d433026e3db71b4359c9a7847ff1dc7d34b11fcdf 252698 libmagick++-6.q16hdri-7_6.9.7.0+dfsg-1_amd64.deb
 71c9d4e3406a4015e812712915734c8ced20d3fb5439f81e9b4961e14bbedf1e 241550 libmagick++-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 6060dc8522748fdb6ac0728969d756154c1fe61c0c64f705d5a52ca83049061d 1288 libmagick++-dev_6.9.7.0+dfsg-1_all.deb
 0a60dbf92d275d4801f628aeddf36368a5e7fd6008f60e6103d0a7a97b05b661 144164 libmagickcore-6-arch-config_6.9.7.0+dfsg-1_amd64.deb
 6ccc8c365c98297778e4c3c9eba56e60ec60d55d1de2dc052af8d845f43f021a 46938 libmagickcore-6-headers_6.9.7.0+dfsg-1_all.deb
 7dbe55a0f50974ab6f31017e1927e3180bb82918d21533a24ecdc5e9e81ca410 4434728 libmagickcore-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 76ab4d01ba2168c61721ebe744613c19c68e748eaef6763a5966b3d4e9860c9b 174384 libmagickcore-6.q16-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 5be42cd9ba1841e9808a8b2a73dc6620385725df0e4c4754aa7213d3824d3af0 185476 libmagickcore-6.q16-3-extra_6.9.7.0+dfsg-1_amd64.deb
 0eb9c392f7c47e83692db40c113587406eeac70e705d1aad20682b8142b57e80 1728822 libmagickcore-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 6652da2983a949c99cde4a435631258253e2e449ff84d43a6afdd281ff284ef3 1084856 libmagickcore-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 f729657616146e5da86ef39e4c5948f7ca7e4d08be27bcba6e0dbe3c68c9418b 4416384 libmagickcore-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 7dacc926ae45e44f8501b112fd6240d16919b8189f58a4d3da78ae288d8e7da0 173992 libmagickcore-6.q16hdri-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 3bdab5643719f11ab059d43a0392f0ac3c4cc12fe141b6ce4efe1886eedef98c 185480 libmagickcore-6.q16hdri-3-extra_6.9.7.0+dfsg-1_amd64.deb
 73802cc808ce731b43567271af66cc2028bd90ac4490152f6405e21b6a60a4a0 1729634 libmagickcore-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 dca993d2bf0d636bd9775b5c0438dd18c711f4614cb9045cc042765e79528718 1079828 libmagickcore-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 fe56abe36e086afbbedda4fe9c39744aa1dc48bab49814336226749be1b53f9c 1254 libmagickcore-dev_6.9.7.0+dfsg-1_all.deb
 498cc778d680f5b0f5f6636355b7221d86e23891dae68fcce11de8b7a7d62b43 10454 libmagickwand-6-headers_6.9.7.0+dfsg-1_all.deb
 4ce5712305ce5fa5ddffc3a48200ddfc0a20d27c69e51c7e5161240e9c472a7a 672134 libmagickwand-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 f92bbb0ef81967ac586d9daf36210a2a83171eb0d942ae98e0cbad02dd9a7cd6 418062 libmagickwand-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 388a3ea730a32a940191cfb074bd062700a669c038f16e0d1abd57434311c339 413668 libmagickwand-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 10fff1c24e3c8f5988cd5811a43b176180ad4d5349e7b91d0bfd6474f7af507f 667944 libmagickwand-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 d3cb9d23aaab5c3733c5528483a27a9d4f0625ab81d776cf646fc774f298aa20 412700 libmagickwand-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 fae0011ba174762e06fc80e711c386a8bf348b2b8bc289fcfb8177148de66982 413252 libmagickwand-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 ed446fd80a4ea02b3d62f2516e430b70b65a364adf7bd1b7db7d704c5463ff0d 1244 libmagickwand-dev_6.9.7.0+dfsg-1_all.deb
 4ece038a50ed76fa947c9ec88fddf40fe0dc47a6531e81615d70c22ef9340d2b 1260 perlmagick_6.9.7.0+dfsg-1_all.deb
Files:
 fc3ce82b1c52d5b889bc7f21f19dcfb9 5137 graphics optional imagemagick_6.9.7.0+dfsg-1.dsc
 fa393be5508e49c821f533de0263f04f 8928320 graphics optional imagemagick_6.9.7.0+dfsg.orig.tar.xz
 f804ce6a7378ca838fa0bead29c18995 200500 graphics optional imagemagick_6.9.7.0+dfsg-1.debian.tar.xz
 130ca130f1d153c4abf7f26029fe7622 179814 graphics optional imagemagick-6-common_6.9.7.0+dfsg-1_all.deb
 ba6d3c18ab784c735d64002797bba612 7508842 doc optional imagemagick-6-doc_6.9.7.0+dfsg-1_all.deb
 158f2b7c9c2048d2c5a664eb16552d16 90864 debug extra imagemagick-6.q16-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 e904c3ee4e8156bacc0cc26c6d4d6f33 557904 graphics optional imagemagick-6.q16_6.9.7.0+dfsg-1_amd64.deb
 271fface97de15e91cbf0e8ca535d675 91462 debug extra imagemagick-6.q16hdri-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 c75e1e8ab8f33f72a88668bd878cddba 558106 graphics optional imagemagick-6.q16hdri_6.9.7.0+dfsg-1_amd64.deb
 eb2aa19388f000e14c150425e32a0a3c 1398 oldlibs extra imagemagick-common_6.9.7.0+dfsg-1_all.deb
 518b8aea223060e5e11565704edf64f0 1224 oldlibs extra imagemagick-doc_6.9.7.0+dfsg-1_all.deb
 b07d66b50c5e527dc8d53423c276cd81 26789 graphics optional imagemagick_6.9.7.0+dfsg-1_amd64.buildinfo
 95404932d67ddd753b437db9536843e6 136730 oldlibs extra imagemagick_6.9.7.0+dfsg-1_amd64.deb
 9900f8b1e0da9477297564d89f0db89d 53280 perl optional libimage-magick-perl_6.9.7.0+dfsg-1_all.deb
 783997437f409912d095a98cbb513e5a 189022 debug extra libimage-magick-q16-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 3db22185cc1609238c8a990372ab6359 219870 perl optional libimage-magick-q16-perl_6.9.7.0+dfsg-1_amd64.deb
 ac1ef6260cc99b95cb1f1dc442152d79 187864 debug extra libimage-magick-q16hdri-perl-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 9aa6d31ffe3bfb0966b5e7fe5eff9cdd 220104 perl optional libimage-magick-q16hdri-perl_6.9.7.0+dfsg-1_amd64.deb
 8796460f9613ba96f0d9d8bf3e4ca2a4 47090 libdevel optional libmagick++-6-headers_6.9.7.0+dfsg-1_all.deb
 46cd4692d5fdff3777bf8135be78b01c 984880 debug extra libmagick++-6.q16-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 257dd603f1c4da4bcdee75aee453ce7b 267696 libs optional libmagick++-6.q16-7_6.9.7.0+dfsg-1_amd64.deb
 9797b040871a562e5b7c72a1d3a202ad 241406 libdevel optional libmagick++-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 0e61427ac03b5b25fc91e4a913b14482 984252 debug extra libmagick++-6.q16hdri-7-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 b9a295a7c75380f2dfaeada94badad65 252698 libs optional libmagick++-6.q16hdri-7_6.9.7.0+dfsg-1_amd64.deb
 ea31dcc07c78957cd984d0e3ec15f4fd 241550 libdevel optional libmagick++-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 ee2511d4d2ffac56edfc9687d4bc7d2b 1288 oldlibs extra libmagick++-dev_6.9.7.0+dfsg-1_all.deb
 f2431b90581355e7c3a2d67f029d8229 144164 libdevel optional libmagickcore-6-arch-config_6.9.7.0+dfsg-1_amd64.deb
 7e28314c43818bb63f3a25e40ba45652 46938 libdevel optional libmagickcore-6-headers_6.9.7.0+dfsg-1_all.deb
 a23d91ce7d9b94d956529744657eb514 4434728 debug extra libmagickcore-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 89dc2d5297bb2e6f96e6d1963d2a5489 174384 debug extra libmagickcore-6.q16-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 0908a4589b394f2f30e656c4ed5511fb 185476 libs optional libmagickcore-6.q16-3-extra_6.9.7.0+dfsg-1_amd64.deb
 8734aa6ef6ee34ac8d7e42a8f0fcda79 1728822 libs optional libmagickcore-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 4b19e37cc13e2ae2afa6a7097f8bfaab 1084856 libdevel optional libmagickcore-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 2be6247ed58d7fb2a9172bd2f81b0f7a 4416384 debug extra libmagickcore-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 2f62c8554eedef6093469432037b1acf 173992 debug extra libmagickcore-6.q16hdri-3-extra-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 74402a4d6965684c66b8a0d0834c1afc 185480 libs optional libmagickcore-6.q16hdri-3-extra_6.9.7.0+dfsg-1_amd64.deb
 bfc2bfb3ca23c762b945061ada703936 1729634 libs optional libmagickcore-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 1f66b0f9fbedb28cf0bb451ebb8c10a2 1079828 libdevel optional libmagickcore-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 859a70d10d5bc5cb2c2cdb463630fc82 1254 oldlibs extra libmagickcore-dev_6.9.7.0+dfsg-1_all.deb
 82840d2fa73ed6eac840a77f26c28e6e 10454 libdevel optional libmagickwand-6-headers_6.9.7.0+dfsg-1_all.deb
 742c4f8d7f64856055b759a48addc432 672134 debug extra libmagickwand-6.q16-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 54e6c049348318a9a27b31af17a6df96 418062 libs optional libmagickwand-6.q16-3_6.9.7.0+dfsg-1_amd64.deb
 bd2ca72b05bae93921881136a7567c25 413668 libdevel optional libmagickwand-6.q16-dev_6.9.7.0+dfsg-1_amd64.deb
 2e5648c18dc2a7c25268eac93ec24045 667944 debug extra libmagickwand-6.q16hdri-3-dbgsym_6.9.7.0+dfsg-1_amd64.deb
 fef6757929c37c9a91bc63bc81c04ac9 412700 libs optional libmagickwand-6.q16hdri-3_6.9.7.0+dfsg-1_amd64.deb
 378936e0df9be63cd7b030b969a4a169 413252 libdevel optional libmagickwand-6.q16hdri-dev_6.9.7.0+dfsg-1_amd64.deb
 302333092419ececf66a4127d41abb83 1244 oldlibs extra libmagickwand-dev_6.9.7.0+dfsg-1_all.deb
 cc16fae4ab0504335fa395cefca29472 1260 oldlibs extra perlmagick_6.9.7.0+dfsg-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJYW7VxAAoJEPNPCXROn13ZUbUP/0d4xfJb+CAoq5TPKEEaIR/N
MCqnIPbETbWMQa9mICp+9CDa7gu5+9762la1CLbSAmrCO4Ovu5PBVWMcznZiCIQZ
yc2YQGJCBx7I/m/u26bC7juZDCcQh6r3In/SUeWTeLXsNMuUKdEUhzVONOUt58ix
d0E/UG1R4IZEMkSIpA5/sW8tAkOEo9XvinVr1dG/gbbO66vP0Gg7GtGJCq3Csq/h
9afG8J5q/1GPnYfTGFTrquI+O4fmDGiX6xrCkQ5jQZe2pM2yI3m060KRnnANVbvK
SGhVbx3sVlmBJepErlGbSHVVDR+fMJAL5dDttnlY1X4bjPKis+/eU/sG11qyfBQM
dquVnxu+XRgdYM00jbM/nl8c/pand2LFWeffyuHzj8Oip+ZMukoZX82xBFWkD5QH
RQBI6rmk4Re74QbOm7ARlpuEhMLmox1t3vZGXB1skmWsjMH5cJ7DMdD8Owv4TYef
SpiLw/xiFTmO7sklTk3xebV9zl+asQ1nHjBpdhzTDFGTlsV3SjxsG6nIFjgdCPHU
qPUZsTNu+gCrqo0luNalMo5ElOV2tSYm6HapqgGQvMlflzxfjtwnv0I7RPqG6YaE
XsGZs7w9gYHzG5PcHNW60jYN7IQ0snXNd0UHD5a4oEc//VLklmXPbKORA97Ove95
Vp+NncxbONA90OweEqmB
=MLnz
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.