Bug#1023938: findimagedupes: uninitialized value warnings when program is run

[Jonathan H N Chin]

Package: findimagedupes
Version: 2.20.1-1
Severity: normal

Dear Maintainer,

The debian build process appears to amend the Inline::C setup:

/usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm :
```
use Inline
C => 'DATA',
NAME => 'findimagedupes::C',
VERSION => '0.01',
CCFLAGSEX => "$ENV{'CFLAGS'} $ENV{'CPPFLAGS'}",
LDDLFLAGS => "$ENV{'LDFLAGS'}",
```

However, by default, these environment variables are not set,
resulting in warning messages when the program is run:

```
Use of uninitialized value in concatenation (.) or string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
Use of uninitialized value in concatenation (.) or string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
Use of uninitialized value $ENV{"LDFLAGS"} in string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
```


-jonathan



-- System Information:
Debian Release: bookworm/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.4.0-125-generic (SMP w/1 CPU thread)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages findimagedupes depends on:
ii libc6 2.36-4
ii libfile-mimeinfo-perl 0.33-1
ii libgraphics-magick-perl 1.4+really1.3.38+hg16739-1+b1
ii libinline-c-perl 0.82-1
ii libinline-perl 0.86-1
ii perl 5.36.0-4
ii perl-base [perlapi-5.36.0] 5.36.0-4

findimagedupes recommends no packages.

findimagedupes suggests no packages.

-- no debconf information

[Étienne Mollier]

Hi Jonathan,

Jonathan H N Chin, on 2022-11-12:

> The debian build process appears to amend the Inline::C setup:
>
> /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm :
> ```
> use Inline
> C => 'DATA',
> NAME => 'findimagedupes::C',
> VERSION => '0.01',
> CCFLAGSEX => "$ENV{'CFLAGS'} $ENV{'CPPFLAGS'}",
> LDDLFLAGS => "$ENV{'LDFLAGS'}",
> ```
>
> However, by default, these environment variables are not set,
> resulting in warning messages when the program is run:
>
> ```
> Use of uninitialized value in concatenation (.) or string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
> Use of uninitialized value in concatenation (.) or string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
> Use of uninitialized value $ENV{"LDFLAGS"} in string at /usr/lib/x86_64-linux-gnu/perl5/5.36/findimagedupes/C.pm line 5.
> ```

Thanks for this report. I saw this one, but banged my head on
this due to somehow not managing to handle dynamically linker
flags for hardening the binary (this is part of the standard
Debian build flags). Anyway, further investigation shown that
only linker flags are needed in this particular situation, so I
guess it wouldn't be too problematic to hardwire the needed
items. Not sure how much breakage it might trigger in the long
run though, but it seems better than removing hardening and put
the issue under the carpet.

> -jonathan

Have a nice day, :)
--
Étienne Mollier <emol...@emlwks999.eu>
Fingerprint: 8f91 b227 c7d6 f2b1 948c 8236 793c f67e 8f0d 11da
Sent from /dev/pts/2, please excuse my verbosity.
On air: Jørn Lande - Perfect Strangers