Hello,

this package uses GifQuantizeBuffer() from giflib. The symbol has been
dropped in giflib 5.2 (libgif-dev/libgif7 5.2.1 is available in
experimental) and therefore the package
a) stops working when the gif library package is upgraded and
b) FTBFS against libgif-dev >= 5.2.

I do not think giflib did the right thing by dropping the symbol without
a soname bump but that is beside the point.[1] Even with the correct way
(giflib soname bump) this package FTBFS. I am quite confident that
GifQuantizeBuffer() will not be reintroduced - It was ripped out to
"reduce libgif size and attack surface".

I am reporting this /now/ with severity important, but please treat it
as rc issue.

cu Andreas

[1] I have suggested to upstream to do a soname bump. If this is not
accepted we will probably end up with newer libgif7 having a Breaks for
GifQuantizeBuffer()-using-software.
------------------------
g++ -g -O2 -fdebug-prefix-map=/dev/shm/GIFLIB/qutemol-0.4.1~cvs20081111=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -DPKGDATADIR='"/usr/share/qutemol/"' -Ivcg -Isrc -I. `wx-config --cppflags` -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2  -c -o src/gifSave.o src/gifSave.cpp
src/gifSave.cpp: In member function 'bool GifWrapper::AddFrame(Byte*, int, int, float)':
src/gifSave.cpp:69:9: error: 'GifQuantizeBuffer' was not declared in this scope
   69 |     if (GifQuantizeBuffer(sx, sy, &paletteSize,
      |         ^~~~~~~~~~~~~~~~~
make[1]: *** [<builtin>: src/gifSave.o] Error 1
make[1]: Leaving directory '/dev/shm/GIFLIB/qutemol-0.4.1~cvs20081111'
dh_auto_build: make -j1 "INSTALL=install --strip-program=true" returned exit code 2
make: *** [debian/rules:8: binary] Error 255

For reference, upstream proposed that applications requiring this
function should link lutil or make their own copy of the code [1].

Arch Linux bug report [2] refers to a patch [3], which resolves the issue.

Gentoo bug report [4] refers to a pull request [5], which was not accepted.


[1] https://sourceforge.net/p/giflib/bugs/132/
[2] https://bugs.archlinux.org/task/62211
[3] https://git.archlinux.org/svntogit/packages.git/tree/trunk/giflib-5.1.9-fix-missing-quantize-API-symbols.patch?h=packages/giflib
[4] https://bugs.gentoo.org/682198
[5] https://github.com/gentoo/gentoo/pull/12386

Hello,

yes, giflib upstream has dropped GifQuantizeBuffer "to reduce [...]
attack surface". One could fork giflib and undo this change, I am not
convinced that is a terribly good idea. (Fedora has done this recently.)

OTOH I am quite sure it would be terrible idea to ship libutil as a
library in Debian, the name on its own would be a strong enough reason
not to do it. ;-)

cu Andreas