[Buildroot] [PATCH 1/1] package/fluidsynth: security bump to version 2.5.7

For change log since v2.4.7, see:
https://github.com/FluidSynth/fluidsynth/releases

According to:
https://github.com/FluidSynth/fluidsynth/blob/master/doc/wiki/ChangeLog.md

FluidSynth 2.5.6 fixes:
CVE-2026-58264 - a heap-based buffer overrun in command handler (GHSA-mqmq-w63q-cj94)
CVE-2026-61714 - a heap-based buffer overflow in MIDI player (GHSA-976m-35rw-h3m6)
CVE-2026-61721 - a heap-based buffer overrun for DLS samples (GHSA-59ph-rx8r-8p4j)
CVE-2026-61723 - a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47)
CVE-2026-61722 - a DLS articulation chunk integer overflow (GHSA-hp72-35pr-6h6r)
CVE-2026-61720 - a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w)

FluidSynth 2.5.2 fixes:
CVE-2025-68617 - a heap-based use-after-free involving DLS files (GHSA-ffw2-xvvp-39ch)

SDL2 audio support was removed upstream in commit:
https://github.com/FluidSynth/fluidsynth/commit/89145b004a44a53e734b6bf82a73cef255baef5d

It was replaced by the newer SDL3. This commit reflects that change
(update option name and comments, add legacy option entry).

Also, dynamic library dependency was added in Buildroot commit:
https://gitlab.com/buildroot.org/buildroot/-/commit/111a1c7091aed6f9da03c2a095bcc2f50a1ad32c
This commot removes the duplicate dependency for SDL3.

FluidSynth also added a native DLS soundfont support in:
https://github.com/FluidSynth/fluidsynth/commit/c959f8d208bbad9e396dfb745285806b5a4c5a07
It is enabled by default and uses C++17. This commit adds a new
option with a dependency on gcc >= 7.

The license option hash is also updated, after the FSF address
update in:
https://github.com/FluidSynth/fluidsynth/commit/db42fa333baf1cb7c60556ab75ad1e592c850f68

Signed-off-by: Julien Olivain <[email protected]>
---
Patch tested in:
https://gitlab.com/jolivain/buildroot/-/pipelines/2745501844

Note to the LTS maintainers:

The CVEs fixed here are a bit hard to backport.
This new FluidSynth version also depends of a new SDL3 library.

I let you decide what to do (update the package in LTS, do nothing,
try to backport, or remove the package). What would be your opinion
in such a case?
---
 Config.in.legacy                   |  6 ++++++
 package/fluidsynth/Config.in       | 21 +++++++++++++--------
 package/fluidsynth/fluidsynth.hash |  4 ++--
 package/fluidsynth/fluidsynth.mk   | 16 +++++++++++-----
 4 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/Config.in.legacy b/Config.in.legacy
index e2f9d9131f..49d2e33513 100644
--- a/Config.in.legacy
+++ b/Config.in.legacy
@@ -146,6 +146,12 @@ endif
 
 comment "Legacy options removed in 2026.08"
 
+config BR2_PACKAGE_FLUIDSYNTH_SDL2
+	bool "fluidsynth sdl2 audio support removed"
+	select BR2_LEGACY
+	help
+	  FluidSynth SDL2 audio support was removed in v2.5.0.
+
 config BR2_PACKAGE_TS4900_FPGA
 	bool "ts4900-fpga removed"
 	select BR2_LEGACY
diff --git a/package/fluidsynth/Config.in b/package/fluidsynth/Config.in
index 66fb07f45e..206824560b 100644
--- a/package/fluidsynth/Config.in
+++ b/package/fluidsynth/Config.in
@@ -84,15 +84,11 @@ comment "pulseaudio support needs a toolchain w/ dynamic library, wchar, threads
 	depends on BR2_PACKAGE_PULSEAUDIO_HAS_ATOMIC
 	depends on BR2_STATIC_LIBS || !BR2_USE_MMU || !BR2_TOOLCHAIN_HAS_THREADS
 
-config BR2_PACKAGE_FLUIDSYNTH_SDL2
-	bool "sdl2"
-	depends on !BR2_STATIC_LIBS
-	select BR2_PACKAGE_SDL2
+config BR2_PACKAGE_FLUIDSYNTH_SDL3
+	bool "sdl3"
+	select BR2_PACKAGE_SDL3
 	help
-	  Enable SDL2 audio support.
-
-comment "SDL2 audio support needs a toolchain w/ dynamic library"
-	depends on BR2_STATIC_LIBS
+	  Enable SDL3 audio support.
 
 comment "Misc options"
 
@@ -114,6 +110,15 @@ config BR2_PACKAGE_FLUIDSYNTH_FLOATS
 	  Enable 32-bit single precision float support, instead of
 	  64-bit double precision floats for DSP samples.
 
+config BR2_PACKAGE_FLUIDSYNTH_NATIVE_DLS
+	bool "Native DLS soundfont"
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_7 # C++17
+	help
+	  Enable the native DLS soundfont format support.
+
+comment "native dls soundfont support needs gcc >= 7"
+	depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_7
+
 config BR2_PACKAGE_FLUIDSYNTH_READLINE
 	bool "readline"
 	select BR2_PACKAGE_READLINE
diff --git a/package/fluidsynth/fluidsynth.hash b/package/fluidsynth/fluidsynth.hash
index 9953997692..0d727e75e6 100644
--- a/package/fluidsynth/fluidsynth.hash
+++ b/package/fluidsynth/fluidsynth.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  7fb0e328c66a24161049e2b9e27c3b6e51a6904b31b1a647f73cc1f322523e88  fluidsynth-2.4.7.tar.gz
-sha256  9b872a8a070b8ad329c4bd380fb1bf0000f564c75023ec8e1e6803f15364b9e9  LICENSE
+sha256  ce27840221ab00dd59bf27e85ecbba480c6c2a7c9fbec4243658f68f59c07f4a  fluidsynth-2.5.7.tar.gz
+sha256  20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95  LICENSE
diff --git a/package/fluidsynth/fluidsynth.mk b/package/fluidsynth/fluidsynth.mk
index e06afe4a07..1d6cb118ff 100644
--- a/package/fluidsynth/fluidsynth.mk
+++ b/package/fluidsynth/fluidsynth.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FLUIDSYNTH_VERSION = 2.4.7
+FLUIDSYNTH_VERSION = 2.5.7
 FLUIDSYNTH_SITE = $(call github,FluidSynth,fluidsynth,v$(FLUIDSYNTH_VERSION))
 FLUIDSYNTH_LICENSE = LGPL-2.1+
 FLUIDSYNTH_LICENSE_FILES = LICENSE
@@ -46,6 +46,12 @@ else
 FLUIDSYNTH_CONF_OPTS += -Denable-libsndfile=0
 endif
 
+ifeq ($(BR2_PACKAGE_FLUIDSYNTH_NATIVE_DLS),y)
+FLUIDSYNTH_CONF_OPTS += -Denable-native-dls=1
+else
+FLUIDSYNTH_CONF_OPTS += -Denable-native-dls=0
+endif
+
 ifeq ($(BR2_PACKAGE_FLUIDSYNTH_PORTAUDIO),y)
 FLUIDSYNTH_CONF_OPTS += -Denable-portaudio=1
 FLUIDSYNTH_DEPENDENCIES += portaudio
@@ -67,11 +73,11 @@ else
 FLUIDSYNTH_CONF_OPTS += -Denable-readline=0
 endif
 
-ifeq ($(BR2_PACKAGE_FLUIDSYNTH_SDL2),y)
-FLUIDSYNTH_CONF_OPTS += -Denable-sdl2=1
-FLUIDSYNTH_DEPENDENCIES += sdl2
+ifeq ($(BR2_PACKAGE_FLUIDSYNTH_SDL3),y)
+FLUIDSYNTH_CONF_OPTS += -Denable-sdl3=1
+FLUIDSYNTH_DEPENDENCIES += sdl3
 else
-FLUIDSYNTH_CONF_OPTS += -Denable-sdl2=0
+FLUIDSYNTH_CONF_OPTS += -Denable-sdl3=0
 endif
 
 ifeq ($(BR2_PACKAGE_SYSTEMD),y)
-- 
2.55.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot