package/fluidsynth: add patch for CVE-2025-56225

Fixes the following vulnerability:

- CVE-2025-56225:
    fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer
    dereference in fluid_synth_monopoly.c, that can be triggered when
    loading an invalid midi file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-56225
  - 45f2a79f42

Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/fluidsynth/0001-Fix-a-nullpointer-dereference-during-legato-mode.patch

@@ -0,0 +1,25 @@
+From 45f2a79f4265dcc4f98cfbafdb10727fb1c0d411 Mon Sep 17 00:00:00 2001
+From: "Tom M." <tom.mbrt@googlemail.com>
+Date: Mon, 14 Jul 2025 18:13:38 +0200
+Subject: [PATCH] Fix a nullpointer dereference during legato mode (#1607)
+
+CVE: CVE-2025-56225
+Upstream: https://github.com/FluidSynth/fluidsynth/commit/45f2a79f4265dcc4f98cfbafdb10727fb1c0d411
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/synth/fluid_synth_monopoly.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/synth/fluid_synth_monopoly.c b/src/synth/fluid_synth_monopoly.c
+index d1de13196..6e6e2a906 100644
+--- a/src/synth/fluid_synth_monopoly.c
++++ b/src/synth/fluid_synth_monopoly.c
+@@ -410,7 +410,7 @@ int fluid_synth_noteoff_mono_LOCAL(fluid_synth_t *synth, int chan, int key)
+                 fluid_channel_breath_msb(channel))
+         {
+             /* legato playing detection */
+-            if(channel->mode  & FLUID_CHANNEL_LEGATO_PLAYING)
++            if (channel->mode & FLUID_CHANNEL_LEGATO_PLAYING && channel->preset != NULL)
+             {
+                 /* the list contains others notes */
+                 if(i_prev >= 0)

package/fluidsynth/fluidsynth.mk

@@ -12,6 +12,9 @@ FLUIDSYNTH_CPE_ID_VENDOR = fluidsynth
 FLUIDSYNTH_INSTALL_STAGING = YES
 FLUIDSYNTH_DEPENDENCIES = libglib2
 
+# 0001-Fix-a-nullpointer-dereference-during-legato-mode.patch
+FLUIDSYNTH_IGNORE_CVES += CVE-2025-56225
+
 ifeq ($(BR2_PACKAGE_FLUIDSYNTH_ALSA_LIB),y)
 FLUIDSYNTH_CONF_OPTS += -Denable-alsa=1
 FLUIDSYNTH_DEPENDENCIES += alsa-lib