Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fluidsynth for openSUSE:Factory checked in at 2026-07-08 17:35:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fluidsynth (Old) and /work/SRC/openSUSE:Factory/.fluidsynth.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fluidsynth" Wed Jul 8 17:35:11 2026 rev:90 rq:1364033 version:2.5.6 Changes: -------- --- /work/SRC/openSUSE:Factory/fluidsynth/fluidsynth.changes 2026-06-16 13:47:19.949968633 +0200 +++ /work/SRC/openSUSE:Factory/.fluidsynth.new.1982/fluidsynth.changes 2026-07-08 17:36:56.882325643 +0200 @@ -1,0 +2,15 @@ +Sat Jul 4 13:52:13 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 2.5.6 + * Fix CVE-2026-58264 - a heap-based buffer overrun in command + handler (GHSA-mqmq-w63q-cj94). + * Fix a heap-based buffer overflow in MIDI player + (GHSA-976m-35rw-h3m6). + * Fix a heap-based buffer overrun for DLS samples + (GHSA-59ph-rx8r-8p4j). + * Fix a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47). + * Fix a DLS articulation chunk integer overflow + (GHSA-hp72-35pr-6h6r). + * Fix a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w). + +------------------------------------------------------------------- Old: ---- fluidsynth-2.5.5.tar.gz New: ---- fluidsynth-2.5.6.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fluidsynth.spec ++++++ --- /var/tmp/diff_new_pack.zp3y9f/_old 2026-07-08 17:36:57.934362242 +0200 +++ /var/tmp/diff_new_pack.zp3y9f/_new 2026-07-08 17:36:57.942362520 +0200 @@ -20,7 +20,7 @@ %define sover 3 Name: fluidsynth -Version: 2.5.5 +Version: 2.5.6 Release: 0 Summary: A Real-Time Software Synthesizer That Uses Soundfont(tm) License: LGPL-2.1-or-later ++++++ fluidsynth-2.5.5.tar.gz -> fluidsynth-2.5.6.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/CMakeLists.txt new/fluidsynth-2.5.6/CMakeLists.txt --- old/fluidsynth-2.5.5/CMakeLists.txt 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/CMakeLists.txt 2026-07-04 12:25:20.000000000 +0200 @@ -47,7 +47,7 @@ # FluidSynth package version set ( FLUIDSYNTH_VERSION_MAJOR 2 ) set ( FLUIDSYNTH_VERSION_MINOR 5 ) -set ( FLUIDSYNTH_VERSION_MICRO 5 ) +set ( FLUIDSYNTH_VERSION_MICRO 6 ) set ( VERSION "${FLUIDSYNTH_VERSION_MAJOR}.${FLUIDSYNTH_VERSION_MINOR}.${FLUIDSYNTH_VERSION_MICRO}" ) set ( FLUIDSYNTH_VERSION ${VERSION} ) @@ -62,7 +62,7 @@ # This is not exactly the same algorithm as the libtool one, but the results are the same. set ( LIB_VERSION_CURRENT 3 ) set ( LIB_VERSION_AGE 5 ) -set ( LIB_VERSION_REVISION 4 ) +set ( LIB_VERSION_REVISION 5 ) set ( LIB_VERSION_INFO "${LIB_VERSION_CURRENT}.${LIB_VERSION_AGE}.${LIB_VERSION_REVISION}" ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/doc/fluidsynth-v20-devdoc.txt new/fluidsynth-2.5.6/doc/fluidsynth-v20-devdoc.txt --- old/fluidsynth-2.5.5/doc/fluidsynth-v20-devdoc.txt 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/doc/fluidsynth-v20-devdoc.txt 2026-07-04 12:25:20.000000000 +0200 @@ -8,8 +8,8 @@ \author David Henningsson \author Tom Moebert \author Copyright © 2003-2026 Peter Hanappe, Conrad Berhörster, Antoine Schmitt, Pedro López-Cabanillas, Josh Green, David Henningsson, Tom Moebert -\version Revision 2.5.5 -\date 2026-06-12 +\version Revision 2.5.6 +\date 2026-06-19 All the source code examples in this document are in the public domain; you can use them as you please. This document is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported License. To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ . The FluidSynth library is distributed under the GNU Lesser General Public License. A copy of the GNU Lesser General Public License is contained in the FluidSynth package; if not, visit https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/src/bindings/fluid_cmd.c new/fluidsynth-2.5.6/src/bindings/fluid_cmd.c --- old/fluidsynth-2.5.5/src/bindings/fluid_cmd.c 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/src/bindings/fluid_cmd.c 2026-07-04 12:25:20.000000000 +0200 @@ -748,8 +748,7 @@ channum = atoi(av[0]); value = atoi(av[1]); - fluid_channel_set_pitch_wheel_sensitivity(handler->synth->channel[channum], value); - return FLUID_OK; + return fluid_synth_pitch_wheel_sens(handler->synth, channum, value); } int diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/src/midi/fluid_midi.c new/fluidsynth-2.5.6/src/midi/fluid_midi.c --- old/fluidsynth-2.5.5/src/midi/fluid_midi.c 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/src/midi/fluid_midi.c 2026-07-04 12:25:20.000000000 +0200 @@ -1619,10 +1619,11 @@ { if(player->playback_callback) { + int *chan_is_playing = &player->channel_isplaying[event->channel % MAX_NUMBER_OF_CHANNELS]; player->playback_callback(player->playback_userdata, event); - if(event->type == NOTE_ON && event->param2 != 0 && !player->channel_isplaying[event->channel]) + if(event->type == NOTE_ON && event->param2 != 0 && !*chan_is_playing) { - player->channel_isplaying[event->channel] = TRUE; + *chan_is_playing = TRUE; } } } @@ -2140,7 +2141,7 @@ { if(fluid_atomic_int_get(&player->stopping)) { - for(i = 0; i < synth->midi_channels; i++) + for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++) { if(player->channel_isplaying[i]) { @@ -2188,7 +2189,7 @@ seek_ticks = fluid_atomic_int_get(&player->seek_ticks); if(seek_ticks >= 0) { - for(i = 0; i < synth->midi_channels; i++) + for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++) { if(player->channel_isplaying[i]) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/src/sfloader/fluid_dls.cpp new/fluidsynth-2.5.6/src/sfloader/fluid_dls.cpp --- old/fluidsynth-2.5.5/src/sfloader/fluid_dls.cpp 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/src/sfloader/fluid_dls.cpp 2026-07-04 12:25:20.000000000 +0200 @@ -1567,6 +1567,13 @@ uint32_t cues; // sample count READ32(this, cues); + // subchunk.size is uint32 and can be at max 0xFFFF'FFFF, therefore the max value of cues will be 0x3FFF'FFFF, as bigger + // values would require an uint64 chunksize, contrary to the RIFF spec. Catch possible overflow here. + if(cues > (std::numeric_limits<uint32_t>::max() - cbsize) / 4u) + { + throw std::runtime_error{ "Too many poolcue records are contained in the ptbl chunk." }; + } + if(cues * 4 + cbsize != subchunk.size) { throw std::runtime_error{ "DLS ptbl chunk has corrupted size" }; @@ -1697,9 +1704,10 @@ std::runtime_error{ "Exception thrown while allocating fluid_sample_t" }); } + bool invalid_loops_were_sanitized = false; for(auto &sample : samples) { - auto &fluid = samples_fluid.emplace_back(); + fluid_sample_t fluid{}; fluid.start = sample.start; fluid.end = sample.end - 1; fluid.samplerate = sample.samplerate; @@ -1713,6 +1721,7 @@ fluid.loopend = sample.start + wsmp.loop_start + wsmp.loop_length; fluid.origpitch = wsmp.unity_note; fluid.pitchadj = wsmp.fine_tune; + invalid_loops_were_sanitized |= fluid_sample_sanitize_loop(&fluid, sampledata.size() * sizeof(decltype(sampledata)::value_type)); } else { @@ -1725,6 +1734,18 @@ fluid.data = sampledata.data(); fluid.sampletype = FLUID_SAMPLETYPE_MONO; fluid.default_modulators = this->sfont->default_mod_list; + + if(fluid_sample_validate(&fluid, sampledata.size() * sizeof(decltype(sampledata)::value_type)) == FLUID_OK) + { + samples_fluid.push_back(std::move(fluid)); + } + } + + if(invalid_loops_were_sanitized) + { + FLUID_LOG(FLUID_WARN, + "Some invalid DLS sample loops were sanitized! If you experience audible glitches, " + "start fluidsynth in verbose mode for detailed information."); } // put info in dls_sample into region @@ -2523,7 +2544,12 @@ uint32_t connblocks; READ32(this, connblocks); - if(cbsize + connblocks * 12 != chunk.size) + if(connblocks > (std::numeric_limits<uint32_t>::max() - cbsize) / 12u) + { + throw std::runtime_error{ "Too many ConnectionBlocks are contained in the articulator chunk." }; + } + + if(cbsize + connblocks * 12u != chunk.size) { throw std::runtime_error{ "art chunk has corrupted size" }; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fluidsynth-2.5.5/src/sfloader/fluid_sffile.c new/fluidsynth-2.5.6/src/sfloader/fluid_sffile.c --- old/fluidsynth-2.5.5/src/sfloader/fluid_sffile.c 2026-06-12 21:12:08.000000000 +0200 +++ new/fluidsynth-2.5.6/src/sfloader/fluid_sffile.c 2026-07-04 12:25:20.000000000 +0200 @@ -758,13 +758,12 @@ */ SFMod *dmod; unsigned int count; - if (chunk.size % SF_MOD_SIZE != 0 || size == 0) + if (chunk.size < SF_MOD_SIZE || chunk.size % SF_MOD_SIZE != 0 || size == 0) { FLUID_LOG(FLUID_ERR, "DMOD chunk has invalid size (%d bytes)", chunk.size); return FALSE; } - // read the modulators sequentially count = chunk.size / SF_MOD_SIZE - 1; // minus the terminal record FLUID_LOG(FLUID_DBG, "Detected the DMOD chunk with %d modulators", count);
