[Debian-med-packaging] Bug#799039: dcmqrscp : index.dat data corruption

[Mathieu Malaterre]

Dear Andreas,

On Mon, Sep 28, 2015 at 4:02 PM, Andreas Tille <tille at debian.org> wrote:
> Hi Mathieu,
>
> On Tue, Sep 15, 2015 at 09:32:14AM +0200, Mathieu Malaterre wrote:
>> Package: dcmtk
>> Version: 3.6.1~20150629-1
>> Severity: grave
>> Justification: causes non-serious data loss
>>
>> As describe in the previous bug report:
>>
>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715011#50
>>
>> One cannot simply upgrade dcmtk package without grave data loss
>> (index.dat binary format is not compatible), which should result as
>> -best case- index.dat corruption, or dcmqrscp to segfault and not
>> start.
>>
>> This correspond to the following upstream commit:
>> c8423ab1fcf0273061462697b8eca56f894984c7
>
> I can n ot find this commit under
>
>    git clone https://github.com/commontk/DCMTK.git

See:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715011#43

> Would you be able to provide a patch incorporating this commit to
> fix the issue?

I've never written a preinstall script before. I'd prefer you find
somebody else.

> Do you think it is better to switch back to the former version of dcmtk?

Given that this is an experimental package and that the
SONAME/SOVERSION scheme is not clear at that point (per upstream), I
would not have uploaded this version at this point in time, but that
is an entirely different issue IMHO.

>> This should be clearly indicated during package upgrades. Marking as
>> grave as I believe the DICOM file themselves are still kept as-is, so
>> this is IMHO not a critical `causes serious data loss`. Upstream may
>> have a finer understanding of the loss.
>
> You perfectly know that I have no contact to upstream and I'm quite busy
> with a lot of stuff.

`perfectly` ? Sorry to disapoint you, but I am not stalking you :)

>  If you are interested to help it would be great to
> discuss the issue with upstream how to fix this issue in Debian in the
> best possible way.  My motivation was simply to avoid the need for a
> migration of two dcmtk versions - one in unstable and one in
> experimental.  I do not feel able to maintain two versions.  May be
> also the later snapshot 3.6.1_20150924 would fix the issue?  Any hint
> would be welcome.

There is no going back. This is not backward compatible, and the
current dcmtk is trashing the memory (one byte of). Anyone using dcmtk
dcmqrscp from jessie should have noticed the crash (per original bug
report). Just display a warning user need to reconstruct the db (I
believe mysql and other such packages are doing this sort of things).

-M