diff mbox series

[meta-multimedia,kirkstone,v2] fluidsynth: patch CVE-2025-56225

Message ID 20260119184343.785649-1-skandigraun@gmail.com
State New
Headers show
Series [meta-multimedia,kirkstone,v2] fluidsynth: patch CVE-2025-56225 | expand

Commit Message

Gyorgy Sarvari Jan. 19, 2026, 6:43 p.m. UTC 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-56225

Pick the PR content referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---

v2: instead of adding the patch  to class-target specific recipe, add it to the
    common .inc file, so it applies to both native and target versions.

 .../fluidsynth/fluidsynth.inc                 |  4 ++-
 .../fluidsynth/CVE-2025-56225.patch           | 25 +++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth/CVE-2025-56225.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth.inc b/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth.inc
index a4590d61a9..17439e570a 100644
--- a/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth.inc
+++ b/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth.inc
@@ -4,7 +4,9 @@  SECTION = "libs/multimedia"
 LICENSE = "LGPL-2.1-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=fc178bcd425090939a8b634d1d6a9594"
 
-SRC_URI = "git://github.com/FluidSynth/fluidsynth.git;branch=master;protocol=https"
+SRC_URI = "git://github.com/FluidSynth/fluidsynth.git;branch=master;protocol=https \
+           file://CVE-2025-56225.patch \
+"
 SRCREV = "8b00644751578ba67b709a827cbe5133d849d339"
 S = "${WORKDIR}/git"
 PV = "2.2.6"
diff --git a/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth/CVE-2025-56225.patch b/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth/CVE-2025-56225.patch
new file mode 100644
index 0000000000..a1de14ca19
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/fluidsynth/fluidsynth/CVE-2025-56225.patch
@@ -0,0 +1,25 @@ 
+From 18ab31c1dad215188edf2bedc78be98a32492ec9 Mon Sep 17 00:00:00 2001
+From: "Tom M." <tom.mbrt@googlemail.com>
+Date: Mon, 14 Jul 2025 18:13:38 +0200
+Subject: [PATCH] Fix a nullpointer dereference during legato mode (#1607)
+
+CVE: CVE-2025-56225
+Upstream-Status: Backport [https://github.com/FluidSynth/fluidsynth/commit/45f2a79f4265dcc4f98cfbafdb10727fb1c0d411]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/synth/fluid_synth_monopoly.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/synth/fluid_synth_monopoly.c b/src/synth/fluid_synth_monopoly.c
+index d1de1319..6e6e2a90 100644
+--- a/src/synth/fluid_synth_monopoly.c
++++ b/src/synth/fluid_synth_monopoly.c
+@@ -410,7 +410,7 @@ int fluid_synth_noteoff_mono_LOCAL(fluid_synth_t *synth, int chan, int key)
+                 fluid_channel_breath_msb(channel))
+         {
+             /* legato playing detection */
+-            if(channel->mode  & FLUID_CHANNEL_LEGATO_PLAYING)
++            if (channel->mode & FLUID_CHANNEL_LEGATO_PLAYING && channel->preset != NULL)
+             {
+                 /* the list contains others notes */
+                 if(i_prev >= 0)