Description of problem: /usr/bin/perl: symbol lookup error: /usr/lib/perl5/vendor_perl/5.8.8/i386- linux-thread-multi/auto/Image/Magick/Magick.so: undefined symbol: InitializeMagick Version-Release number of selected component (if applicable): ImageMagick - 6.2.5.4-4.21.fc5.4.i386, ImageMagick-Perl - 6.2.5.4- 4.1.1.fc5.4.i386 fail with the above error. Backing down to version 6.2.5.4-4.2.1.fc5.3.i386 works fine. How reproducible: Every time I run a perl script that manipulates an image. These scripts used to work fine.
This is a serious bug since the update was for a security fix. So you can down rev and run with the security bug, or run with the ones that don't work at all :-( Stuart - you opened two bugs, you should close the other one, bug 203977.
*** Bug 203977 has been marked as a duplicate of this bug. ***
Hi folks, any progres here? This bug breaks a bunch of scripts and the older version is disappearing from the repos...
Just for reference, heres a one-liner that triggers the problem: perl -e ' use Image::Magick;'
*** Bug 203966 has been marked as a duplicate of this bug. ***
*** Bug 204201 has been marked as a duplicate of this bug. ***
I've got the problem reproduced and have tracked down that it seems to be a missing dependency where /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/Image/Magick/Magick.so in ImageMagick-6.2.5.4-4.2.1.fc5.4 has not picked up the dependency on /usr/lib64/libMagick.so.9 Working on figuring out why that has happened now.
Just in case someone's reading this thread and doesn't know what to do, here's what I've done/am doing: * Check what ImageMagick modules are on your machines: rpm -qa --queryformat='%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | grep ImageMagick I get the list: ImageMagick-perl-6.2.5.4-4.2.1.fc5.4.x86_64 ImageMagick-6.2.5.4-4.2.1.fc5.4.x86_64 ImageMagick-6.2.5.4-4.2.1.fc5.4.i386 * Download the older updates from http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/ (i386 or x86_64 as appropriate). You want the ones dated around May 25. You should have one for each of the modules installed on your machine. * Uninstall the existing ImageMagick stuff - rpm -e followed by each of the above. For instance: rpm -e ImageMagick-perl-6.2.5.4-4.2.1.fc5.4.x86_64 ImageMagick-6.2.5.4- 4.2.1.fc5.4.x86_64 ImageMagick-6.2.5.4-4.2.1.fc5.4.i386 * Install the newly downloaded RPMs (easiest to do all at once - you can do something like: rpm -i ImageMagick*6.2.5.4-4.2.1.fc5.3* * Until this issue is resolved, exclude ImageMagick from yum updates like so: yum update --exclude='ImageMagick*'
Could this bug get the severity raised to *urgent* please? (or *regression*, but that doesn't seem to be an option in the popup menu) Could this bug get the priority raised to *high* please? Thanks
Hi folks, I've upped the priority/severity since the perl functionality here is completely borked -- it completely breaks a lot of scripts. Also, I'd like to point out that you can download the older RPMs: ImageMagick*6.2.5.4-4.2.1.fc5.3* as described in comment #8 above and then install them immediately (without first removing them and any dependencies) using the rpm "--oldpackage" option. This makes it just a little easier to get rid of the broken .4 RPMs and replace with the working (but apparently with security flaw-ed?) .3 ones.
According to https://rhn.redhat.com/errata/RHSA-2006-0633.html, the security flaw is exploitable only if the attacker can convince you (or your code) to use ImageMagick to decode "XCF, SGI, and Sun bitmap graphic files." If you do not allow untrusted individuals to upload or process image files, my understanding is that the risk is mitigated. I don't know how ImageMagick handles image decoding, so it is conceivable that allowing untrusted individuals to upload (for instance) JPG files might allow them to upload a malicious XCF file that had a .jpg extension, but ImageMagick might still process it as an XCF file because the first few bytes look like an XCF file, and thus the vulnerability might be exploitable.
ldd and objdump show that Magick.so is not linked against libMagick.so, *none* of the ImageMagick symbols are defined. A quick fix, if you really need the security fixes (and who doesn't need security fixes?) is to create a new Magick.so that is linked against it: cd `find /usr/lib/perl5 -name "Magick.so" | xargs dirname` mv Magick.so Magick-0.so ld -shared -o Magick.so `pwd`/Magick-0.so /usr/lib/libMagick.so.9 Unfortunately, you can't just use -lMagick because for some reason /usr/lib/libMagick.so doesn't exist, just /usr/lib/libMagick.so.9. The resultant Magick.so is successfully loaded by perl and reads and generates images in scripts that worked fine with the 6.2.5.4-4.2.1.fc5.3 version. I have not tested it extensively, nor have I tested it against the buffer/integer overflow problems that .4 is supposed to fix. This is only a stop-gap measure -- this really needs to be properly fixed.
I have had the same problem on x86_64; solved it by rebuilding the update from the source package; the same solution worked on a i386 system; I guess the update was built on a machine that has some inofficial updates installed.
Norm, Any updates from you as per comment #7. There's a lot of chatter about this bug. Between it and all of its duplicates, it's kind of crazy that we haven't managed to fix it yet. What's blocking us from getting an update here? This is related to a security fix, right? It's kind of embarassing that it's taking this long. Set to block FC6. If this really is a security issue, I encourage wwoods not to certify FC6 unless it has fixed code. We shouldn't ship with a known security issue.
Just to explain the situation a bit Max. The last working packages of ImageMagick (6.2.5.4-4.2.1.fc5.3) have the security issue. The "updated" package that Matthias Clasen made on August 23 (6.2.5.4-4.2.1.fc5.4)... https://www.redhat.com/archives/fedora-package-announce/2006-August/msg00089.html ...do not have the security issue, but the packages simply don't work. You may already understand that, if so I apologize. To wit, your last sentence in comment #14 should read "We shouldn't ship with non-functioning software".
Has anyone here tried my solution from comment #13 yet? Just "rpmbuild --rebuild" the SRPM from http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/SRPMS/ImageMagick-6.2.5.4-4.2.1.fc5.4.src.rpm and install the resulting packages with "rpm --install --force" This worked on both (x86_64 and i386) of my fedory systems. If this turns out to work, everything the fedora people have to do is to bump up the version number and rebuild the packages on a CLEAN FC5 installation. Tom
(In reply to comment #16) > Has anyone here tried my solution from comment #13 yet? > > Just "rpmbuild --rebuild" the SRPM from > http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/SRPMS/ImageMagick-6.2.5.4-4.2.1.fc5.4.src.rpm > and install the resulting packages with "rpm --install --force" > > This worked on both (x86_64 and i386) of my fedory systems. If this turns out to > work, everything the fedora people have to do is to bump up the version number > and rebuild the packages on a CLEAN FC5 installation. > > Tom I tried to rebuild ImageMagick-6.2.5.4-4.2.1.fc5.4 with just release number incremented, and the answer was _NO_ . To be more precise, rebuilding this srpm by normal rpmbuild seems okay, however, rebuilding this srpm IN MOCK leaves this problem unsolved. This means that the compilation of ImageMagick-6.2.5.4-4.2.1.fc5.4 needs ImageMagick itself pre-installed. Note: I don't see any problem in rawhide ImageMagick rpms. Now I am trying to rebuild rawhide ImageMagick (this version is 6.2.8) in FC5 mock envorinment to see if this problem disappears.
Created attachment 136831 [details] rebuild log of fc5 ImageMagick by normal rpmbuild rebuild log of ImageMagick-6.2.5.4-4.2.1.fc5.4 by normal ImageMagick (under the envoronment that ImageMagick itself is already installed).
Created attachment 136833 [details] rebuild log of fc5 ImageMagick IN MOCK Rebuild log of ImageMagick-6.2.5.4-4.2.1.fc5.4 in fc5 mock environment. You can see the important difference: @@ -1363,14 +1761,15 @@ /usr/bin/install -c 'magick/Magick-config' '/var/tmp/ImageMagick-6.2.5.4-root/usr/bin/Magick-config' /usr/bin/install -c 'Magick++/bin/Magick++-config' '/var/tmp/ImageMagick-6.2.5.4-root/usr/bin/Magick++-config' /usr/bin/install -c 'wand/Wand-config' '/var/tmp/ImageMagick-6.2.5.4-root/usr/bin/Wand-config' -cd PerlMagick && /usr/bin/perl Makefile.PL INSTALLDIRS=vendor CC='gcc -L/home/tasaka1/rpmbuild/BUILD/ImageMagick-6.2.5/magick /.libs' LDDLFLAGS='-shared -L/home/tasaka1/rpmbuild/BUILD/ImageMagick-6.2.5/magick/.libs' +cd PerlMagick && /usr/bin/perl Makefile.PL INSTALLDIRS=vendor CC='gcc -L/builddir/build/BUILD/ImageMagick-6.2.5/magick/.libs' LDDLFLAGS='-shared -L/builddir/build/BUILD/ImageMagick-6.2.5/magick/.libs' Checking if your kit is complete... Looks good +Note (probably harmless): No library found for -lMagick Writing Makefile for Image::Magick ( cd PerlMagick && make CC='gcc' && \ make CC='gcc' install && \ make clean && rm -f Makefile.old ) -make[2]: Entering directory `/home/tasaka1/rpmbuild/BUILD/ImageMagick-6.2.5/PerlMagick' +make[2]: Entering directory `/builddir/build/BUILD/ImageMagick-6.2.5/PerlMagick' cp Magick.pm blib/lib/Image/Magick.pm AutoSplitting blib/lib/Image/Magick.pm (blib/lib/auto/Image/Magick) /usr/bin/perl /usr/lib/perl5/5.8.8/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.8/ExtUtils/typemap Magick.xs > Magick.xsc && mv Magick.xsc Magick.c @@ -1475,15 +1874,15 @@ Running Mkbootstrap for Image::Magick () chmod 644 Magick.bs rm -f blib/arch/auto/Image/Magick/Magick.so -gcc -shared -L/home/tasaka1/rpmbuild/BUILD/ImageMagick-6.2.5/magick/.libs Magick.o -o blib/arch/auto/Image/Magick/Magick.so \ - -L/usr/lib -lMagick -lfreetype -lz -L/usr/lib -ltiff -lfreetype -ljpeg -lgs -lXext -lSM -lICE -lX11 -lXt -lbz2 -lz -lpthrea d -lm -lpthread \ +gcc -shared -L/builddir/build/BUILD/ImageMagick-6.2.5/magick/.libs Magick.o -o blib/arch/auto/Image/Magick/Magick.so \ + -L/usr/lib -lfreetype -lz -L/usr/lib -ltiff -lfreetype -ljpeg -lgs -lXext -lSM -lICE -lX11 -lXt -lbz2 -lz -lpthread -lm -lp thread \
Created attachment 136845 [details] patch to link against libMagick.so.9 Backported from ImageMagick-6.2.8 This patch seems to work for me.
Removing dependency for FC6Blocker. Rawhide ImageMagick (ImageMagick-6.2.8.0-3.fc6) does not have this problem.
ImageMagick-6.2.5.4-4.2.1.fc5.6 has been pushed for fc5, which should resolve this issue. If these problems are still present in this version, then please make note of it in this bug report.
Well, ImageMagick-perl-6.2.5.4-4.2.1.fc5.6 seems okay for me.