gpicview not confirms to save images

Related Vulnerabilities: CVE-2008-3904   CVE-2008-3791  

Debian Bug report logs - #497005
gpicview not confirms to save images

version graph

Reported by: Wen-Yen Chuang <caleb@calno.com>

Date: Fri, 29 Aug 2008 06:18:01 UTC

Severity: normal

Merged with 497006

Found in version gpicview/0.1.9-1

Fixed in version gpicview/0.1.10-1

Done: Andrew Lee <andrew@linux.org.tw>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org:
Bug#497005; Package gpicview. (full text, mbox, link).


Acknowledgement sent to Wen-Yen Chuang <caleb@calno.com>:
New Bug report received and forwarded. (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Wen-Yen Chuang <caleb@calno.com>
To: submit@bugs.debian.org
Subject: gpicview ask_before_save is ignored with LIBJPEG
Date: Fri, 29 Aug 2008 14:12:52 +0800
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: gpicview
Version: 0.1.9-1
Severity: normal

This is upstream's bug #2019485 [1].
I have reported it in #495968 but now split it here.

Jeremy C. Reed wrote:
> gpicview ask_before_save is ignored with LIBJPEG
> The ask before save option in gpicview-0.1.9 is ignored when built
> with LIBJPEG.

> See src/main-win.c on_save() function where it does
> rotate_and_save_jpeg_lossless().

> Destroys data when specifically not allowed.

> The main_win_save() should be split up to do the "Do you want to
> overwrite existing file?" dialog to separate function -- and that
> should be used if pref.ask_before_save is TRUE.

[1]
http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAki3k2QACgkQdEpXpumNYVkLpACfVDRxndrprpTXvfrI6RVZVFnq
wtcAoIz9R2YYuq0+dX1x+y40kojaCcSc
=VNAv
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#497005; Package gpicview. (full text, mbox, link).


Acknowledgement sent to Wen-Yen Chuang <caleb@calno.com>:
Extra info received and forwarded to list. (full text, mbox, link).


Message #10 received at 497005@bugs.debian.org (full text, mbox, reply):

From: Wen-Yen Chuang <caleb@calno.com>
To: control@bugs.debian.org, 497005@bugs.debian.org, 497006@bugs.debian.org
Subject: gpicview should not be in Lenny
Date: Sun, 31 Aug 2008 15:44:49 +0800
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

severity 497005 grave
severity 497006 grave
quit

gpicview often causes data loss, so these two bugs should be set to
grave.

You can see my demo page [1] about how gpicview causes data loss.

How to reproduce the bug?
1. copy a new jpeg image for the test
2. use gpicview to open the test image
3. press "L" or "R" key twice (without the Shift key)
4. close gpicview
5. now you get a data loss image

I tried several different jpeg files, and no one can keep original
image.

Kind regards
 Wen-Yen Chuang (caleb)

[1] http://www.calno.com/moto/gpicviewbug/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAki6S/EACgkQdEpXpumNYVlzFwCeP4WKFvja4CZnRaf/6Cxk9UZO
vT0AnRyVeHee8e79RF8E+yDxwRwi/IY+
=pBjo
-----END PGP SIGNATURE-----




Severity set to `grave' from `normal' Request was from Wen-Yen Chuang <caleb@calno.com> to control@bugs.debian.org. (Sun, 31 Aug 2008 07:48:07 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Wen-Yen Chuang <caleb@calno.com>:
Bug#497005; Package gpicview. (full text, mbox, link).


Acknowledgement sent to Andrew Lee <andrew@linux.org.tw>:
Extra info received and forwarded to list. Copy sent to Wen-Yen Chuang <caleb@calno.com>. (full text, mbox, link).


Message #17 received at 497005@bugs.debian.org (full text, mbox, reply):

From: Andrew Lee <andrew@linux.org.tw>
To: 497005@bugs.debian.org
Subject: What do you mean a data loss?
Date: Tue, 02 Sep 2008 21:13:41 +0800
Hello caleb,

Do you mean the file changed after rotation is a data loss? Or any data
from the image are lost after rotation?

-Andrew




Severity set to `normal' from `grave' Request was from Andrew Lee <andrew@linux.org.tw> to control@bugs.debian.org. (Tue, 02 Sep 2008 13:30:04 GMT) (full text, mbox, link).


Merged 497005 497006. Request was from Andrew Lee <andrew@linux.org.tw> to control@bugs.debian.org. (Tue, 02 Sep 2008 13:30:05 GMT) (full text, mbox, link).


Severity set to `grave' from `normal' Request was from Wen-Yen Chuang <caleb@calno.com> to control@bugs.debian.org. (Wed, 03 Sep 2008 10:21:07 GMT) (full text, mbox, link).


Severity set to `grave' from `grave' Request was from Wen-Yen Chuang <caleb@calno.com> to control@bugs.debian.org. (Wed, 03 Sep 2008 10:21:09 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Wen-Yen Chuang <caleb@calno.com>:
Bug#497005; Package gpicview. (full text, mbox, link).


Acknowledgement sent to Andrew Lee <andrew@linux.org.tw>:
Extra info received and forwarded to list. Copy sent to Wen-Yen Chuang <caleb@calno.com>. (full text, mbox, link).


Message #30 received at 497005@bugs.debian.org (full text, mbox, reply):

From: Andrew Lee <andrew@linux.org.tw>
To: 497005@bugs.debian.org, control@bugs.debian.org
Subject: the data lose you mean is algorithm limitation in jpeg
Date: Sun, 07 Sep 2008 02:44:59 +0800
severity #497005 normal
retitle #497005 gpicview not confirms to save images
thanks

Hi caleb,

It's so confused. What exactly data loss you mean?

If what you mean is the jpeg has lossy rotation and compression, it's
documented in jpeg's faq. It's a limitation in jpeg algorithm. As it can
also reproduced in gqview, gimp and any other application which support
jpeg roataion, so that I won't considering this is a grave bug.

The autosave rotated image options also works fine now. So I think the only problem here is gpicview doesn't ask before saving an image even the "ask before saving images" is on.

-Andrew





Severity set to `normal' from `grave' Request was from Andrew Lee <andrew@linux.org.tw> to control@bugs.debian.org. (Sat, 06 Sep 2008 18:48:08 GMT) (full text, mbox, link).


Changed Bug title to `gpicview not confirms to save images' from `gpicview ask_before_save is ignored with LIBJPEG'. Request was from Andrew Lee <andrew@linux.org.tw> to control@bugs.debian.org. (Sat, 06 Sep 2008 18:48:10 GMT) (full text, mbox, link).


Reply sent to Andrew Lee <andrew@linux.org.tw>:
You have taken responsibility. (full text, mbox, link).


Notification sent to Wen-Yen Chuang <caleb@calno.com>:
Bug acknowledged by developer. (full text, mbox, link).


Message #39 received at 497005-close@bugs.debian.org (full text, mbox, reply):

From: Andrew Lee <andrew@linux.org.tw>
To: 497005-close@bugs.debian.org
Subject: Bug#497005: fixed in gpicview 0.1.10-1
Date: Fri, 12 Sep 2008 04:32:03 +0000
Source: gpicview
Source-Version: 0.1.10-1

We believe that the bug you reported is fixed in the latest version of
gpicview, which is due to be installed in the Debian FTP archive:

gpicview_0.1.10-1.diff.gz
  to pool/main/g/gpicview/gpicview_0.1.10-1.diff.gz
gpicview_0.1.10-1.dsc
  to pool/main/g/gpicview/gpicview_0.1.10-1.dsc
gpicview_0.1.10-1_i386.deb
  to pool/main/g/gpicview/gpicview_0.1.10-1_i386.deb
gpicview_0.1.10.orig.tar.gz
  to pool/main/g/gpicview/gpicview_0.1.10.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 497005@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrew Lee <andrew@linux.org.tw> (supplier of updated gpicview package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 12 Sep 2008 01:43:21 +0800
Source: gpicview
Binary: gpicview
Architecture: source i386
Version: 0.1.10-1
Distribution: unstable
Urgency: low
Maintainer: Andrew Lee <andrew@linux.org.tw>
Changed-By: Andrew Lee <andrew@linux.org.tw>
Description: 
 gpicview   - lightweight image viewer
Closes: 497005
Changes: 
 gpicview (0.1.10-1) unstable; urgency=low
 .
   * New upstream release
     - Solved assertion `GTK_IS_TOOLTIPS (tooltips)' failed problem
     - Added new translations
     - Fixed memory leaks
     - Fixed JPEG Rotation, rotation only in EXIF data
     - Fixed fullscreen toggles
     - Fixed order for file listing
     - Security fixes CVE-2008-3904, CVE-2008-3791
     - Solved empty file problem in unsupported format
   * Applied disable_ask_before_save.dpatch (Closes: #497005)
Checksums-Sha1: 
 345174de4adeb263b1162e96cba6d31e5aaf46b8 1042 gpicview_0.1.10-1.dsc
 07ed8b72e8b25d31b47568033c36ee1550aba650 429857 gpicview_0.1.10.orig.tar.gz
 1957edae319ae20dcec282023b0fa54a8682b282 4013 gpicview_0.1.10-1.diff.gz
 6d80daffe2d18cb4f05c7ebf0a2136502ddc37f4 60582 gpicview_0.1.10-1_i386.deb
Checksums-Sha256: 
 e7415c2e5a26e9affdabd36e11da7701f0167b14855b9277d1ee1f93438b86bf 1042 gpicview_0.1.10-1.dsc
 33005cb91ccd1ef4f74ebdab59dbc847d7425625140676fb440e1d28a06a95fb 429857 gpicview_0.1.10.orig.tar.gz
 c10a837954c751285ea1e2c39b23d1335aed90dcd3d8c8bd6716d09176d7f97e 4013 gpicview_0.1.10-1.diff.gz
 6845dc94707eb5746a0a5d543eaf5a4fd76acd92fdff8036af36305f00efa715 60582 gpicview_0.1.10-1_i386.deb
Files: 
 ad4a0b3eb98e0076283e6fbf8481965a 1042 graphics optional gpicview_0.1.10-1.dsc
 94a6966143b51d15b6493f6b2c5e71e6 429857 graphics optional gpicview_0.1.10.orig.tar.gz
 1e6eddac2a30ee054968c065d4006f9a 4013 graphics optional gpicview_0.1.10-1.diff.gz
 1bbdfc32511143ad222f02700ddd90e5 60582 graphics optional gpicview_0.1.10-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkjJ7dgACgkQnQYz4bYlCYWWOQCgxNpKJsItGS1OL4FEoxAesueg
KaEAn0txie0BJETmlidyJbbCkMCm1MPp
=GfO0
-----END PGP SIGNATURE-----





Reply sent to Andrew Lee <andrew@linux.org.tw>:
You have taken responsibility. (full text, mbox, link).


Notification sent to Wen-Yen Chuang <caleb@calno.com>:
Bug acknowledged by developer. (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 21 Apr 2012 07:34:06 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:58:21 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.