Debian Bug report logs - #974616
nomacs uses internal libexiv2 functions to get the user comment

Reply or subscribe to this bug.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: nomacs: "charset=Ascii" appears before the comment of the image

Date: Fri, 13 Nov 2020 01:17:36 +0100

Package: nomacs
Version: 3.12.0+dfsg-3+b1
Severity: normal

After the upgrade to libexiv2-27 0.27.3-3, nomacs displays
"charset=Ascii" before the comment of the image, visible via
Panels → Metadata Info, then Exif → Photo.

This is due to the following change:

  https://github.com/Exiv2/exiv2/issues/1258

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.9.0-2-amd64 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_CPU_OUT_OF_SPEC, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=POSIX, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages nomacs depends on:
ii  libc6                      2.31-4
ii  libexiv2-27                0.27.3-3
ii  libgcc-s1                  10.2.0-17
ii  libopencv-core4.2          4.2.0+dfsg-6+b4
ii  libopencv-imgproc4.2       4.2.0+dfsg-6+b4
ii  libqt5concurrent5          5.15.1+dfsg-2
ii  libqt5core5a               5.15.1+dfsg-2
ii  libqt5gui5                 5.15.1+dfsg-2
ii  libqt5network5             5.15.1+dfsg-2
ii  libqt5printsupport5        5.15.1+dfsg-2
ii  libqt5svg5                 5.15.1-2
ii  libqt5widgets5             5.15.1+dfsg-2
ii  libquazip5-1               0.9.1-1
ii  libraw20                   0.20.2-1
ii  libstdc++6                 10.2.0-17
ii  libtiff5                   4.1.0+git191117-2
ii  qt5-image-formats-plugins  5.15.1-2

Versions of packages nomacs recommends:
ii  nomacs-l10n  3.12.0+dfsg-3

nomacs suggests no packages.

-- no debconf information

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message #10 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: 974616@bugs.debian.org

Subject: nomacs: "charset=Ascii" appears before the "User Comment" metadata of the image

Date: Fri, 13 Nov 2020 02:15:17 +0100

Control: retitle -1 nomacs: "charset=Ascii" appears before the "User Comment" metadata of the image
Control: severity -1 minor
Control: tags -1 upstream

On 2020-11-13 01:17:36 +0100, Vincent Lefevre wrote:
> After the upgrade to libexiv2-27 0.27.3-3, nomacs displays
> "charset=Ascii" before the comment of the image, visible via
> Panels → Metadata Info, then Exif → Photo.

However, the preferred "Image Description" has no issue, and nomacs
seems to primarily use "Image Description" rather than "User Comment"
(contrary to gthumb, for instance). So, a rather minor issue.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message #21 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: 974616@bugs.debian.org

Subject: Re: nomacs: "charset=Ascii" appears before the "User Comment" metadata of the image

Date: Fri, 13 Nov 2020 02:28:42 +0100

Control: tags -1 - upstream

Actually, not really an upstream bug since upstream ships with
exiv2 0.27.2, and it is Debian's choice to link against 0.27.3.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message #28 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: 974616@bugs.debian.org

Subject: Re: nomacs: "charset=Ascii" appears before the comment of the image

Date: Sat, 12 Dec 2020 21:59:38 +0100

[Message part 1 (text/plain, inline)]

Control: retitle -1 nomacs: "charset=Ascii" or "charset=Unicode" appears before the "User Comment" metadata of the image
Control: tags -1 patch

On 2020-11-13 01:17:36 +0100, Vincent Lefevre wrote:
> After the upgrade to libexiv2-27 0.27.3-3, nomacs displays
> "charset=Ascii" before the comment of the image, visible via
> Panels → Metadata Info, then Exif → Photo.

I'm attaching the patch I've written. There was already a function
that removes substrings of the form 'charset="ASCII"' case
insensitively. So I do the same thing with 'charset=ASCII'
(i.e. without the double-quotes) and 'charset=Unicode', which
appears when the string has non-ASCII characters.

Note that this function is a hack: it will remove real occurrences
of such strings, not just those added by libexiv2. However, there
is very little probability that such strings really appear in the
comment. And one cannot do much better to fix the issue.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[nomacs-exiv2-charset.patch (text/plain, attachment)]

Message #37 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: 974616@bugs.debian.org

Subject: Re: nomacs: "charset=Ascii" appears before the comment of the image

Date: Mon, 14 Dec 2020 23:45:06 +0100

Control: retitle -1 nomacs uses internal libexiv2 functions to get the user comment
Control: severity -1 serious
Control: tags -1 - patch

On 2020-12-12 21:59:38 +0100, Vincent Lefevre wrote:
> I'm attaching the patch I've written. There was already a function
> that removes substrings of the form 'charset="ASCII"' case
> insensitively. So I do the same thing with 'charset=ASCII'
> (i.e. without the double-quotes) and 'charset=Unicode', which
> appears when the string has non-ASCII characters.
> 
> Note that this function is a hack: it will remove real occurrences
> of such strings, not just those added by libexiv2. However, there
> is very little probability that such strings really appear in the
> comment. And one cannot do much better to fix the issue.

This is just a workaround that seems to work with the current
libexiv2 version, but according to the upstream libexiv2 maintainer,
nomacs uses some internal libexiv2 function, which means that an
update of libexiv2 can break it at any time, potentially introducing
security issues.

Note that a change of behavior could have already been seen with the
upgrade of libexiv2-27 to 0.27.3 with the appearance of spurious data
before the comment.

The correct way to get the comment with the public API is

  std::string comment = Exiv2::CommentValue(value().toString()).comment());

Note: The upstream nomacs version comes with a bundled libexiv2,
meaning that this may not be an issue to use internal libexiv2
features. Debian chose to use the shared library, thus it needs
to replace these internals by calls to the public API.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message #48 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: Vincent Lefevre <vincent@vinc17.net>, 974616@bugs.debian.org, 974616@bugs.debian.org

Subject: Re: Bug#974616: nomacs: "charset=Ascii" appears before the comment of the image

Date: Sun, 04 Apr 2021 13:47:01 -0400

On 2020-12-14 23:45:06, Vincent Lefevre wrote:
> Control: retitle -1 nomacs uses internal libexiv2 functions to get the user comment
> Control: severity -1 serious
> Control: tags -1 - patch
>
> On 2020-12-12 21:59:38 +0100, Vincent Lefevre wrote:
>> I'm attaching the patch I've written. There was already a function
>> that removes substrings of the form 'charset="ASCII"' case
>> insensitively. So I do the same thing with 'charset=ASCII'
>> (i.e. without the double-quotes) and 'charset=Unicode', which
>> appears when the string has non-ASCII characters.
>> 
>> Note that this function is a hack: it will remove real occurrences
>> of such strings, not just those added by libexiv2. However, there
>> is very little probability that such strings really appear in the
>> comment. And one cannot do much better to fix the issue.
>
> This is just a workaround that seems to work with the current
> libexiv2 version, but according to the upstream libexiv2 maintainer,
> nomacs uses some internal libexiv2 function, which means that an
> update of libexiv2 can break it at any time, potentially introducing
> security issues.
>
> Note that a change of behavior could have already been seen with the
> upgrade of libexiv2-27 to 0.27.3 with the appearance of spurious data
> before the comment.
>
> The correct way to get the comment with the public API is
>
>   std::string comment = Exiv2::CommentValue(value().toString()).comment());
>
> Note: The upstream nomacs version comes with a bundled libexiv2,
> meaning that this may not be an issue to use internal libexiv2
> features. Debian chose to use the shared library, thus it needs
> to replace these internals by calls to the public API.

Is this fixed upstream, in the latest 3.16 release?

I mean I understand that it *still* bundles exiv2 and friends:

https://github.com/nomacs/nomacs/tree/master/3rd-party

... but maybe their usage of the library improved?

There is #974617 for upgrading to 3.16...

a.

-- 
By now the computer has moved out of the den and into the rest of your
life. It will consume all of your spare time, and even your vacation,
if you let it. It will empty your wallet and tie up your thoughts. It
will drive away your family. Your friends will start to think of you
as a bore. And what for?
                       - The True Computerist by Tom Pittman

Message #53 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Sergio Gelato <sergio.gelato@astro.su.se>

To: "974616@bugs.debian.org" <974616@bugs.debian.org>

Subject: Re: Bug#974616: nomacs: "charset=Ascii" appears before the comment of the image

Date: Sun, 26 Dec 2021 21:00:13 +0000

Control: tags -1 + upstream

This *is* an upstream bug, as the upstream README.md has build instructions for Ubuntu that list libexiv2-dev (no version constraint given) as a required package.

As far as I can tell, it's unaddressed as of the current tip of the master branch. I don't see that anyone has reported it as an issue on GitHub either. (I don't want a GitHub account, so I won't report it myself.)

My only interest in this bug is that it has kept nomacs out of bullseye; I don't need its EXIF support. If this package isn't effectively orphaned, perhaps the maintainer can lower the bug's severity? (And/or forward the report upstream...)

Message #60 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: Sergio Gelato <sergio.gelato@astro.su.se>, 974616@bugs.debian.org

Subject: Re: Bug#974616: nomacs: "charset=Ascii" appears before the comment of the image

Date: Mon, 27 Dec 2021 01:56:17 +0100

On 2021-12-26 21:00:13 +0000, Sergio Gelato wrote:
> My only interest in this bug is that it has kept nomacs out of
> bullseye; I don't need its EXIF support.

EXIF information is very useful in general, but AFAIK, only the
comment is affected. A solution would be to either fix the comment
handling or remove it. (Nowadays, ImageDescription seems to be
preferred to Comment, so that removing Comment support would not
be a big loss.)

> If this package isn't effectively orphaned, perhaps the maintainer
> can lower the bug's severity?

Note that there is a potential security issue. Perhaps not currently
(I'm not sure), but potentially in the future: it suffices that the
exiv internals change (like in the past to fix a security bug) to
make Nomacs behave erratically, possibly with memory corruption.

> (And/or forward the report upstream...)

FYI, I haven't reported the bug upstream because Debian has a very
old version. The package should be upgraded to 3.16 first.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message #65 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.net>

To: 974616@bugs.debian.org

Subject: nomacs uses internal libexiv2 functions to get the user comment

Date: Fri, 6 Jan 2023 04:04:00 +0100

[Message part 1 (text/plain, inline)]

Control: found -1 3.17.2206+dfsg-1

Since charset=Ascii still appears before the "User Comment" metadata
of the image, this shows that nomacs still uses internal libexiv2
functions, which could silently yield erratic behavior (and possibly
security issues) in case such functions change.

Perhaps a workaround could be to have a versioned dependency on
libexiv2-27 to stick to the current version (a manual check would
be needed for any update of libexiv2-27, including a minor one,
without a soname change).

On 2020-12-12 21:59:38 +0100, Vincent Lefevre wrote:
> I'm attaching the patch I've written. There was already a function
> that removes substrings of the form 'charset="ASCII"' case
> insensitively. So I do the same thing with 'charset=ASCII'
> (i.e. without the double-quotes) and 'charset=Unicode', which
> appears when the string has non-ASCII characters.
> 
> Note that this function is a hack: it will remove real occurrences
> of such strings, not just those added by libexiv2. However, there
> is very little probability that such strings really appear in the
> comment. And one cannot do much better to fix the issue.

For those interested, I've attached an updated version of my patch
(but as with the current nomacs code, there is absolutely no guarantee
of the behavior in case the libexiv2 library is updated).

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[nomacs-317-exiv2-charset.patch (text/x-diff, attachment)]

Message #72 received at 974616@bugs.debian.org (full text, mbox, reply):

From: ChangZhuo Chen (陳昌倬) <czchen@debian.org>

To: Vincent Lefevre <vincent@vinc17.net>

Cc: 974616@bugs.debian.org

Subject: Re: nomacs uses internal libexiv2 functions to get the user comment

Date: Fri, 6 Jan 2023 13:11:02 +0800

[Message part 1 (text/plain, inline)]

Hi Vincent,

Since Debian has updated nomacs to 3.17.2206. Please help to report this
issue to upstream if it is still a problem in 3.17.2206, thanks.


-- 
ChangZhuo Chen (陳昌倬) czchen@{czchen,debian}.org
http://czchen.info/
Key fingerprint = BA04 346D C2E1 FE63 C790  8793 CC65 B0CD EC27 5D5B

[signature.asc (application/pgp-signature, inline)]

Message #81 received at 974616@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: ChangZhuo Chen <czchen@debian.org>, 974616@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Cc: 974616@bugs.debian.org

Subject: Re: Bug#974616: nomacs uses internal libexiv2 functions to get the user comment

Date: Sat, 17 Aug 2024 23:34:40 -0400

On 2023-01-06 13:11:02, ChangZhuo Chen (陳昌倬) wrote:
> Hi Vincent,
>
> Since Debian has updated nomacs to 3.17.2206. Please help to report this
> issue to upstream if it is still a problem in 3.17.2206, thanks.

Hi!

I'm a little confused: Vincent marked the bug as "found" in
"3.17.2206+dfsg-1" the day before you posted this comment, did you
notice that?

It seems to say that the bug is still present in Debian... Or did you
mean just that the bug needs to be filed upstream?

Then pino@ marked this bug as "fixed upstream" with:

https://github.com/nomacs/nomacs/pull/1049

... so perhaps the Debian package needs a kick here?

-- 
"Faith" means not wanting to know what is true.
                         - Friedrich Nietzshe

Send a report that this bug log contains spam.