Bug 278565 - graphics/ufraw: segfaults in lensfun
Summary: graphics/ufraw: segfaults in lensfun
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Rodrigo Osorio
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-24 13:54 UTC by Josef 'Jeff' Sipek
Modified: 2024-11-18 14:00 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (rodrigo)


Attachments
Fix NULL pointer dereference in lensfun (1.20 KB, patch)
2024-11-01 16:19 UTC, Rodrigo Osorio
no flags Details | Diff
Fix NULL pointer dereference in lensfun (remove duplicate empty line) (1.20 KB, patch)
2024-11-01 16:23 UTC, Rodrigo Osorio
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Josef 'Jeff' Sipek 2024-04-24 13:54:08 UTC
ufraw & ufraw-batch segfault when trying to process any Nikon D750 NEF raw file.  I don't have other raw files to try with, but I suspect it isn't Nikon/NEF specific.  I'm using the binary package on 14.0-RELEASE-p6.

$ ufraw-batch _DSC7938.NEF --out-type=tiff
zsh: segmentation fault (core dumped)  ufraw-batch _DSC7938.NEF --out-type=tiff

$ gdb -q `which ufraw-batch` ufraw-batch.core 
Reading symbols from /usr/local/bin/ufraw-batch...
(No debugging symbols found in /usr/local/bin/ufraw-batch)
[New LWP 100654]
Core was generated by `ufraw-batch _DSC7879.NEF --out-type=tiff'.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  0x00000008252c2504 in lfLens::operator=(lfLens const&) () from /usr/local/lib/liblensfun.so.2
(gdb) bt
#0  0x00000008252c2504 in lfLens::operator=(lfLens const&) () from /usr/local/lib/liblensfun.so.2
#1  0x0000000000333aa2 in ?? ()
#2  0x0000000000333dc9 in ?? ()
#3  0x00000000002cdfcb in ?? ()
#4  0x00000000002cbfa8 in ?? ()
#5  0x000000082aa28afa in __libc_start1 (argc=3, argv=0x820722640, env=0x820722660, cleanup=<optimized out>, mainX=0x2cbe10) at /usr/src/lib/libc/csu/libc_start1.c:157
#6  0x00000000002cbda0 in ?? ()

$ pkg info ufraw
ufraw-0.22.20210424_10
Name           : ufraw
Version        : 0.22.20210424_10
Installed on   : Tue Apr 23 19:14:30 2024 EDT
Origin         : graphics/ufraw
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : graphics
Licenses       : GPLv2
Maintainer     : rodrigo@FreeBSD.org
WWW            : https://ufraw.sourceforge.net/
Comment     Options        :
	CONTRAST       : on
	DST            : off
	EXIV2          : on
	FITS           : off
	GIMP           : off
	GTK2           : on
	LENSFUN        : on
Shared Libs required:
	libtiff.so.5
	libpng16.so.16
	libpangoft2-1.0.so.0
	libpangocairo-1.0.so.0
	libpango-1.0.so.0
	liblensfun.so.2
	liblcms2_threaded.so.1
	liblcms2_fast_float.so.1
	liblcms2.so.2
	libjpeg.so.8
	libjasper.so.7
	libintl.so.8
	libharfbuzz.so.0
	libgtkimageview.so.0
	libgtk-x11-2.0.so.0
	libgthread-2.0.so.0
	libgobject-2.0.so.0
	libglib-2.0.so.0
	libgio-2.0.so.0
	libgdk_pixbuf-2.0.so.0
	libgdk-x11-2.0.so.0
	libfreetype.so.6
	libfontconfig.so.1
	libexiv2.so.28
	libcairo.so.2
	libatk-1.0.so.0
Annotations    :
	FreeBSD_version: 1400097
	build_timestamp: 2024-04-13T03:15:35+0000
	built_by       : poudriere-git-3.4.1-1-g1e9f97d6
	port_checkout_unclean: no
	port_git_hash  : b3aa1ea86
	ports_top_checkout_unclean: no
	ports_top_git_hash: fadd0843b
	repo_type      : binary
	repository     : FreeBSD
Flat size      : 3.96MiB
Description    :
The Unidentified Flying Raw (UFRaw) is a utility to read and manipulate raw
images from digital cameras.  It can be used on its own or as a Gimp plug-in.
It reads raw images using Dave Coffin's raw conversion utility -- DCRaw.
UFRaw supports basic color management using Little CMS, allowing the user to
apply color profiles.  For Nikon users UFRaw has the advantage that it can
read the camera's tone curves.  Even if you don't own a Nikon, you can still
apply a Nikon curve to your images.
   : Read and manipulate raw images from various digital cameras

$ pkg info lensfun   
lensfun-0.3.95_2
Name           : lensfun
Version        : 0.3.95_2
Installed on   : Thu Jan 18 21:51:20 2024 EST
Origin         : graphics/lensfun
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : graphics
Licenses       : PD and LGPL3 and GPLv3 and CC-BY-SA-3.0
Maintainer     : danfe@FreeBSD.org
WWW            : https://lensfun.github.io/
Comment        : Library for fixing lens geometry distortions
Options        :
	PYHELPERS      : on
	SIMD           : on
Shared Libs required:
	libpng16.so.16
	libintl.so.8
	libglib-2.0.so.0
Shared Libs provided:
	liblensfun.so.2
Annotations    :
	FreeBSD_version: 1400097
	build_timestamp: 2024-01-07T11:50:49+0000
	built_by       : poudriere-git-3.4.0
	port_checkout_unclean: no
	port_git_hash  : 756e18783
	ports_top_checkout_unclean: no
	ports_top_git_hash: 756e18783
	repo_type      : binary
	repository     : FreeBSD
Flat size      : 3.08MiB
Description    :
The goal of the lensfun library is to provide an open source database of
photographic lenses and their characteristics.  In the past there was an
effort in this direction (see http://www.epaperpress.com/ptlens/), but then
author decided to take the commercial route and the database froze at the
last public stage.  This database was used as the basement on which lensfun
database grew, thanks to PTLens author which gave his permission for this,
while the code was totally rewritten from scratch (and the database was
converted to a totally new, XML-based format).

The lensfun library not only provides a way to read the lens database and
search for specific things in it, but also offers a set of algorithms for
correcting images based on detailed knowledge of lens properties and
calibration data.  Right now lensfun is designed to correct distortion,
transversal (also known as lateral) chromatic aberrations, vignetting, and
colour contribution of the lens (e.g. when sometimes people says one lens
gives "yellowish" images and another, say, "bluish").
Comment 1 John F. Carr 2024-04-24 17:52:09 UTC
Using a locally built package I can reproduce the crash on amd64 13.3-STABLE with a Nikon D800 NEF file but not with a Canon 5DS CR2 file.  The Canon file results in warnings "ufraw_convert_prepare_transform: Camare check failed, skipping lens correction" so it may not exercise the failing code path.
Comment 2 John F. Carr 2024-04-24 18:07:14 UTC
Based on code inspection this is likely fixed in the git version of lensfun, https://github.com/lensfun/lensfun

In libs/lensfun/lens.cpp function lfLens::operator=(const lfLens &other) the new code tests for other.GetMountNames() being null.
Comment 3 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-01 16:19:21 UTC
Created attachment 254848 [details]
Fix NULL pointer dereference in lensfun

Hi,

So the issue is related to lensfun, not ufraw, but since lensfun
has no release since a year, I cherry-pick the commit who fix
the issue according to you.

I attach the lenfun patch for you to test it, and if it fixes the issue,
the changes can be submitted to danfe@ which is the lensfun maintainer.

I add danfe@to this PR.
Comment 4 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-01 16:20:42 UTC
(In reply to Rodrigo Osorio from comment #3)
ping @danfe :)
Comment 5 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-01 16:23:09 UTC
Created attachment 254849 [details]
Fix NULL pointer dereference in lensfun (remove duplicate empty line)
Comment 6 Alexey Dokuchaev freebsd_committer freebsd_triage 2024-11-02 16:32:04 UTC
(In reply to Rodrigo Osorio from comment #3)
> I attach the lenfun patch for you to test it, and if it fixes the issue,
> the changes can be submitted to danfe@ [...]
No need for extra bureaucracy; if Josef confirms it fixes the segfault for him, please commit suggested patch with removed #https://... comment and original TIMESTAMP of lensfun-0.3.95.tar.gz, thanks!

  $ stat -f %m /usr/ports/distfiles/lensfun-0.3.95.tar.gz 
  1530269580
Comment 7 Josef 'Jeff' Sipek 2024-11-02 23:35:25 UTC
It might take me a few days, but I'll try to give it a go.  Thanks for looking into this.
Comment 8 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-11 17:09:02 UTC
(In reply to Josef 'Jeff' Sipek from comment #7)

How does i goes with your tests ?
Comment 9 Josef 'Jeff' Sipek 2024-11-11 20:33:50 UTC
Sorry for the delay.  I upgraded to 14.1-RELEASE and then replaced lensfun with one built with your patch.  I just successfully converted about ~40 different .NEF files (including the one from the original post).  Thanks!
Comment 10 German Bednar 2024-11-18 09:01:33 UTC
https://forums.freebsd.org/threads/split-personality-14-0-release-p8-or-14-0-release-p6.94034/ https://blockblast2.com/

What are the implications of cherry-picking a commit from lensfun for the overall stability and maintenance of ufraw, especially considering that lensfun has not had a release in over a year?
Comment 11 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-18 10:18:58 UTC
(In reply to German Bednar from comment #10)
German Bednar is a spammer, the links has no relation with the bug.
Comment 12 commit-hook freebsd_committer freebsd_triage 2024-11-18 13:59:53 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f5a2b0b4dc52ccebe24f871f2debc1ccb614ffe2

commit f5a2b0b4dc52ccebe24f871f2debc1ccb614ffe2
Author:     Rodrigo Osorio <rodrigo@FreeBSD.org>
AuthorDate: 2024-11-18 12:14:40 +0000
Commit:     Rodrigo Osorio <rodrigo@FreeBSD.org>
CommitDate: 2024-11-18 13:57:27 +0000

    graphics/lensfun: Add patch to fix segfaults in lensfun

    Apply unreleased lensfun commit 6142618 as a patch to
    fix segfaults in lensfun when processing Nikon D750 NEF
    raw files with ufraw.

    PR:             278565
    Reported by:    Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
    Tested by:              Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
    Approved by:    danfe (maintainer)

 graphics/lensfun/Makefile | 5 ++++-
 graphics/lensfun/distinfo | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)
Comment 13 Rodrigo Osorio freebsd_committer freebsd_triage 2024-11-18 14:00:51 UTC
Committed, thanks