Bug#1146368: trixie-pu: package fluidsynth/2.4.4+dfsg-1+deb13u3

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:fluidsynth
User: [email protected]
Usertags: pu

Fixes two low severity security issues, all tests were fine
and tests in debusine look good. Debdiff below.

Cheers,
        Moritz

diff -Nru fluidsynth-2.4.4+dfsg/debian/changelog fluidsynth-2.4.4+dfsg/debian/changelog
--- fluidsynth-2.4.4+dfsg/debian/changelog	2026-03-04 20:50:29.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/changelog	2026-08-30 19:13:05.000000000 +0200
@@ -1,3 +1,10 @@
+fluidsynth (2.4.4+dfsg-1+deb13u3) trixie; urgency=medium
+
+  * CVE-2026-58264
+  * CVE-2026-61714
+
+ -- Moritz Mühlenhoff <[email protected]>  Sun, 30 Aug 2026 19:13:05 +0200
+
 fluidsynth (2.4.4+dfsg-1+deb13u2) trixie; urgency=medium
 
   * CVE-2025-56225
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch
--- fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch	1970-01-01 01:00:00.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch	2026-08-28 12:11:54.000000000 +0200
@@ -0,0 +1,17 @@
+From 762a3bd39a431cd45abf3bbcce7286c87909d087 Mon Sep 17 00:00:00 2001
+From: derselbst <[email protected]>
+Date: Fri, 19 Jun 2026 20:11:54 +0200
+Subject: [PATCH] Fix a heap-based buffer overrun in pitch_bend_range command
+
+--- fluidsynth-2.4.4+dfsg.orig/src/bindings/fluid_cmd.c
++++ fluidsynth-2.4.4+dfsg/src/bindings/fluid_cmd.c
+@@ -795,8 +795,7 @@ fluid_handle_pitch_bend_range(void *data
+ 
+     channum = atoi(av[0]);
+     value = atoi(av[1]);
+-    fluid_channel_set_pitch_wheel_sensitivity(handler->synth->channel[channum], value);
+-    return FLUID_OK;
++    return fluid_synth_pitch_wheel_sens(handler->synth, channum, value);
+ }
+ 
+ int
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch
--- fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch	1970-01-01 01:00:00.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch	2026-08-28 12:12:45.000000000 +0200
@@ -0,0 +1,39 @@
+From 772702e00cc6acc7c607efb40283e2269211effc Mon Sep 17 00:00:00 2001
+From: derselbst <[email protected]>
+Date: Sat, 27 Jun 2026 08:51:10 +0200
+Subject: [PATCH] Fix heap buffer overflow in MIDI player GHSA-976m-35rw-h3m6
+
+--- fluidsynth-2.4.4+dfsg.orig/src/midi/fluid_midi.c
++++ fluidsynth-2.4.4+dfsg/src/midi/fluid_midi.c
+@@ -1617,10 +1617,11 @@ fluid_track_send_events(fluid_track_t *t
+         {
+             if(player->playback_callback)
+             {
++                int *chan_is_playing = &player->channel_isplaying[event->channel % MAX_NUMBER_OF_CHANNELS];
+                 player->playback_callback(player->playback_userdata, event);
+-                if(event->type == NOTE_ON && event->param2 != 0 && !player->channel_isplaying[event->channel])
++                if(event->type == NOTE_ON && event->param2 != 0 && !*chan_is_playing)
+                 {
+-                    player->channel_isplaying[event->channel] = TRUE;
++                    *chan_is_playing = TRUE;
+                 }
+             }
+         }
+@@ -2138,7 +2139,7 @@ fluid_player_callback(void *data, unsign
+     {
+         if(fluid_atomic_int_get(&player->stopping))
+         {
+-            for(i = 0; i < synth->midi_channels; i++)
++            for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++)
+             {
+                 if(player->channel_isplaying[i])
+                 {
+@@ -2186,7 +2187,7 @@ fluid_player_callback(void *data, unsign
+         seek_ticks = fluid_atomic_int_get(&player->seek_ticks);
+         if(seek_ticks >= 0)
+         {
+-            for(i = 0; i < synth->midi_channels; i++)
++            for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++)
+             {
+                 if(player->channel_isplaying[i])
+                 {
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/series fluidsynth-2.4.4+dfsg/debian/patches/series
--- fluidsynth-2.4.4+dfsg/debian/patches/series	2026-03-04 20:50:16.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/series	2026-08-28 12:12:34.000000000 +0200
@@ -1 +1,3 @@
 CVE-2025-56225.patch
+CVE-2026-58264.patch
+CVE-2026-61714.patch