mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/fluidsynth: security bump to version 2.5.7

Browse Source 
For change log since v2.4.7, see:
https://github.com/FluidSynth/fluidsynth/releases

According to:
https://github.com/FluidSynth/fluidsynth/blob/master/doc/wiki/ChangeLog.md

FluidSynth 2.5.6 fixes:
CVE-2026-58264 - a heap-based buffer overrun in command handler (GHSA-mqmq-w63q-cj94)
CVE-2026-61714 - a heap-based buffer overflow in MIDI player (GHSA-976m-35rw-h3m6)
CVE-2026-61721 - a heap-based buffer overrun for DLS samples (GHSA-59ph-rx8r-8p4j)
CVE-2026-61723 - a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47)
CVE-2026-61722 - a DLS articulation chunk integer overflow (GHSA-hp72-35pr-6h6r)
CVE-2026-61720 - a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w)

FluidSynth 2.5.2 fixes:
CVE-2025-68617 - a heap-based use-after-free involving DLS files (GHSA-ffw2-xvvp-39ch)

SDL2 audio support was removed upstream in commit:
89145b004a

It was replaced by the newer SDL3. This commit reflects that change
(update option name and comments, add legacy option entry).

Also, dynamic library dependency was added in Buildroot commit:
111a1c7091
This commot removes the duplicate dependency for SDL3.

FluidSynth also added a native DLS soundfont support in:
c959f8d208
It is enabled by default and uses C++17. This commit adds a new
option with a dependency on gcc >= 7.

The license option hash is also updated, after the FSF address
update in:
db42fa333b

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Julien Olivain
2026-08-09 20:09:26 +02:00
committed by Peter Korsgaard
parent 88351e5f9b
commit 566bdcb97f
4 changed files with 32 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Config.in.legacy
View File

@@ -146,6 +146,12 @@ endif
comment "Legacy options removed in 2026.08"
config BR2_PACKAGE_FLUIDSYNTH_SDL2
bool "fluidsynth sdl2 audio support removed"
select BR2_LEGACY
help
FluidSynth SDL2 audio support was removed in v2.5.0.
config BR2_PACKAGE_HOSTAPD_DRIVER_HOSTAP
bool "hostapd hostap driver removed"
select BR2_LEGACY

21
package/fluidsynth/Config.in
View File

@@ -84,15 +84,11 @@ comment "pulseaudio support needs a toolchain w/ dynamic library, wchar, threads
depends on BR2_PACKAGE_PULSEAUDIO_HAS_ATOMIC
depends on BR2_STATIC_LIBS || !BR2_USE_MMU || !BR2_TOOLCHAIN_HAS_THREADS
config BR2_PACKAGE_FLUIDSYNTH_SDL2
bool "sdl2"
depends on !BR2_STATIC_LIBS
select BR2_PACKAGE_SDL2
config BR2_PACKAGE_FLUIDSYNTH_SDL3
bool "sdl3"
select BR2_PACKAGE_SDL3
help
Enable SDL2 audio support.
comment "SDL2 audio support needs a toolchain w/ dynamic library"
depends on BR2_STATIC_LIBS
Enable SDL3 audio support.
comment "Misc options"
@@ -114,6 +110,15 @@ config BR2_PACKAGE_FLUIDSYNTH_FLOATS
Enable 32-bit single precision float support, instead of
64-bit double precision floats for DSP samples.
config BR2_PACKAGE_FLUIDSYNTH_NATIVE_DLS
bool "Native DLS soundfont"
depends on BR2_TOOLCHAIN_GCC_AT_LEAST_7 # C++17
help
Enable the native DLS soundfont format support.
comment "native dls soundfont support needs gcc >= 7"
depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_7
config BR2_PACKAGE_FLUIDSYNTH_READLINE
bool "readline"
select BR2_PACKAGE_READLINE

4
package/fluidsynth/fluidsynth.hash
View File

@@ -1,3 +1,3 @@
# Locally computed
sha256 7fb0e328c66a24161049e2b9e27c3b6e51a6904b31b1a647f73cc1f322523e88 fluidsynth-2.4.7.tar.gz
sha256 9b872a8a070b8ad329c4bd380fb1bf0000f564c75023ec8e1e6803f15364b9e9 LICENSE
sha256 ce27840221ab00dd59bf27e85ecbba480c6c2a7c9fbec4243658f68f59c07f4a fluidsynth-2.5.7.tar.gz
sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 LICENSE

16
package/fluidsynth/fluidsynth.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
FLUIDSYNTH_VERSION = 2.4.7
FLUIDSYNTH_VERSION = 2.5.7
FLUIDSYNTH_SITE = $(call github,FluidSynth,fluidsynth,v$(FLUIDSYNTH_VERSION))
FLUIDSYNTH_LICENSE = LGPL-2.1+
FLUIDSYNTH_LICENSE_FILES = LICENSE
@@ -46,6 +46,12 @@ else
FLUIDSYNTH_CONF_OPTS += -Denable-libsndfile=0
endif
ifeq ($(BR2_PACKAGE_FLUIDSYNTH_NATIVE_DLS),y)
FLUIDSYNTH_CONF_OPTS += -Denable-native-dls=1
else
FLUIDSYNTH_CONF_OPTS += -Denable-native-dls=0
endif
ifeq ($(BR2_PACKAGE_FLUIDSYNTH_PORTAUDIO),y)
FLUIDSYNTH_CONF_OPTS += -Denable-portaudio=1
FLUIDSYNTH_DEPENDENCIES += portaudio
@@ -67,11 +73,11 @@ else
FLUIDSYNTH_CONF_OPTS += -Denable-readline=0
endif
ifeq ($(BR2_PACKAGE_FLUIDSYNTH_SDL2),y)
FLUIDSYNTH_CONF_OPTS += -Denable-sdl2=1
FLUIDSYNTH_DEPENDENCIES += sdl2
ifeq ($(BR2_PACKAGE_FLUIDSYNTH_SDL3),y)
FLUIDSYNTH_CONF_OPTS += -Denable-sdl3=1
FLUIDSYNTH_DEPENDENCIES += sdl3
else
FLUIDSYNTH_CONF_OPTS += -Denable-sdl2=0
FLUIDSYNTH_CONF_OPTS += -Denable-sdl3=0
endif
ifeq ($(BR2_PACKAGE_SYSTEMD),y)