Accepting request 1326785 from multimedia:libs

Add CVE reference in changelog

OBS-URL: https://build.opensuse.org/request/show/1326785
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/fluidsynth?expand=0&rev=85

fluidsynth-2.5.2.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1dcb13308b3aa383db658c60a7b63d73d0ff4601ccee589582ba7a816475410e
+size 2111488

fluidsynth.changes

@@ -1,3 +1,200 @@
+-------------------------------------------------------------------
+Fri Jan  2 17:53:50 UTC 2026 - Takashi Iwai <tiwai@suse.com>
+
+- Update to version 2.5.2:
+  * The CoreAudio driver has gained iOS support
+  * Improve error handling and reporting when loading default
+    soundfont
+  * Improve logging and side-effect mitigation when basic channel
+    configuration changes
+  * Fix CVE-2025-68617 - a heap-based use-after-free involving DLS files
+    (GHSA-ffw2-xvvp-39ch) (bsc#1255519)
+
+-------------------------------------------------------------------
+Fri Oct 31 19:58:32 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.5.1
+  * Previous versions have incorrectly exposed private C++ and
+    inline symbols; they are now hidden from the library.
+  * Fluidsynth now resets DataEntry values when it receives
+    (N)RPN MSB/LSB to prevent off-tuned channels.
+  * Fix a regression introduced in 2.5.0, that could have caused a
+    NULL pointer deref when playing AWE32 NRPN MIDIs.
+  * Fix a regression introduced in 2.5.0, that caused convex
+    unipolar modulators to use a concave mapping.
+  * Fix a regression introduced in 2.4.6, which in rare cases
+    could have caused the cutoff frequency of the IIR filter to
+    get stuck or change abruptly.
+  * Fix a build issue where fluidsynth was trying to find glib
+    even when it shouldn't.
+  * Fix typos in ALSA log messages.
+
+-------------------------------------------------------------------
+Sun Oct  5 19:26:20 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.5.0
+  New Features
+  * Add a C++11-based OS abstraction layer as a replacement for
+    glib, bringing these minor limitations when C++17 is
+    unavailable.
+  * Add native support for Downloadable Soundfont Format.
+  * Fluidsynth now recognizes the DMOD INFO-subchunk.
+  * A new positional flag has been introduced: -b, --bank-offset
+  Breaking Changes
+  * Support for SDL2 has been removed - pls. use SDL3 instead.
+  * The processing order of fluidsynth's configuration files has
+    been changed (#1573, refer to wiki for details).
+  * The legacy shell commands for reverb and chorus have been
+    removed (#1659, refer to UserManual for details).
+  Musically Breaking Changes
+  * It was discovered that fluidsynth was mapping some modulators
+    slightly inaccurately into their normalized range.
+  * Some Roland GS NPRN Params are now mapped to CC numbers.
+  * Fluidsynth now auto-detects whether Portamento Time is 7bit
+    or 14bit wide - this fixes the infamous Descent Game08 tune.
+  * Previously, fluidsynth's default behavior was to use
+    portamento only for those notes, that were played in a
+    successive / legato manner; to further improve the portamento
+    experience, this was changed and fluidsynth now plays
+    portamento for all notes by default.
+  Other Changes
+  * Fix drum kits not always being selected after SysEx GS Rythm
+    Part.
+  * The logic for parsing INFO chunks has been revised to improve
+    handling of unknown INFO-subchunks.
+  * Fix a race condition in fluid_synth_alloc_voice() public API
+    function (#1664).
+  * Fix installing static and shared libs cmake targets on the
+    same prefix (#1648).
+- Support for GLib and libinstpatch is deprecated.
+  * build with "-Dosal=cpp11 -Denable-libinstpatch=0"
+
+-------------------------------------------------------------------
+Fri Sep 12 19:36:41 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.8
+  * Fix systemd daemon failing with spaces in Soundfont filenames.
+  * Fluidsynth now explains why it discards invalid generators when
+    run in verbose mode.
+
+-------------------------------------------------------------------
+Wed Jul 16 17:01:35 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.7
+  * All previous versions of fluidsynth have incorrectly rejected
+    Soundfont files with unknown INFO subchunks.
+  * Fix incorrect GS DT1 SysEx checksum validation.
+  * Fix a NULL pointer dereference during legato mono playing.
+    (CVE-2025-56225, bsc#1256435)
+
+-------------------------------------------------------------------
+Sun May 11 07:58:30 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.6
+  * Fix MIDI player skipping some events when seeking.
+  * A regression introduced in 2.4.5 could have caused a
+    heap-based buffer overrun (#1560)
+  * Fix several issues when generating API docs with recent
+    versions of Doxygen.
+
+-------------------------------------------------------------------
+Tue Apr 15 10:43:26 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.5
+  * Fix SDL3 intercepting signals, causing CTRL+C to not quit
+    fluidsynth.
+  * Fix a few flaws in the AWE32 NRPN implementation.
+  * A regression introduced in 2.4.4 broke drum preset selection
+    for XG MIDIs.
+  * Fix fluidsynth's systemd user daemon being unable to create
+    lock file on some distros.
+  * Fix fluidsynth ignoring initialFilterFc generator limits.
+  * A regression introduced in 2.3.6 prevented SF2 NRPN messages
+    from being processed correctly.
+- Use ldconfig_scriptlets macro.
+
+-------------------------------------------------------------------
+Sun Mar 16 21:27:47 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.4
+  * Support for SDL3 has been added, support for SDL2 has been
+    deprecated.
+  * Soundfonts that are not respecting the 46 zero-sample
+    padding-space previously sounded incorrect when
+    synth.dynamic-sample-loading was active.
+  * Allow drum channels to profit from Soundfont Bank Offsets by
+    no longer ignoring MSB Bank changes.
+  * Revise the preset fallback logic for drum channels.
+  * A regression introduced in 2.4.1 may have caused interrupted
+    real-time playback when voices were using the lowpass filter.
+  * Improve multi-user experience when running fluidsynth as
+    systemd service.
+  * Fix ordering and dependencies of fluidsynth's systemd service.
+  * Revise fluidsynth's man page.
+
+-------------------------------------------------------------------
+Sun Jan 26 19:18:30 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.3
+  Bugfixes
+  * It was discovered, that exclusive class note terminations were
+    too slow.
+  * Fix a regression introduced in 2.4.0 that allowed the
+    amplitude of a voice playing in delay phase to rise infinitely.
+  * MSGS drum-style note-cut has been converted to an opt-in
+    setting synth.note-cut.
+  * Support for SDL2 has been disabled by default.
+  * Fix a regression introduced in 2.4.1 that could have caused
+    infinite audio gain output for some MIDI files under certain
+    configurations.
+  * Silence a warning issued by Systemd v254+
+- Update to version 2.4.2
+  * Fix audible clicks when turning off voices while using a high
+    filter resonance.
+  * Restore discovery of libsndfile.
+  * Fix a race condition when loading SF3 files containing
+    multiple uncompressed samples.
+- Update to version 2.4.1
+  * Fix clicks and pops caused when changing parameters of the
+    lowpass filter.
+  * Minor adjustment to AWE32 NRPN behavior.
+- Update to version 2.4.0
+  New Features
+  * Implement MSGS-style Drum Note Cut.
+  * Add support for AWE32 NRPNs.
+  * Add support for Polyphone's sample loop mode release.
+  * Add support for SF2.04 absolute value modulators.
+  Breaking Changes
+  * LASH support has been removed.
+  Musically Breaking changes
+  * The default settings for reverb and chorus have been tuned to
+    provide a more natural perception.
+  * The behavior of the volume envelope's delay phase was
+    previously incorrect.
+  * The ModLfoToVolume generator was not able to increase the
+    volume.
+  * Fluidsynth's default device-id was changed, allowing it to
+    process (most) SysEX events without further configuration.
+  * Previously, some modulators were treated in a non-standard way
+  Bug Fixes
+  * The former linear interpolation of IIR filter coefficients
+    could have caused audible clicks and cracks (#1345) - yet
+    there is still a potential for clicks and cracks, see #1415
+- Update to version 2.3.7
+  * Fix SF3 decoder producing crackling sound for loud samples.
+  * MIDI Format 2 is now rejected correctly since it was never
+    supported.
+  * Fix a regression introduced in 2.3.2 causing fluidsynth to
+    fail discovering Oboe.
+- Update to version 2.3.6
+  * Fix discovery of gobject by CMake.
+  * Fix a numerical instability that caused the chorus effect to
+    stop working correctly when fluidsynth was compiled in single
+    precision mode.
+  * Fix timing issues in MIDI player related to incorrect handling
+    of running status.
+  * Fix ignoring LSB for RPN Pitch bend range events.
+
 -------------------------------------------------------------------
 Thu Apr  4 09:08:25 UTC 2024 - Dirk Müller <dmueller@suse.com>
 

fluidsynth.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package fluidsynth
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,16 +16,20 @@
 #
 
 
+%define gcem_hash 012ae73c6d0a2cb09ffe86475f5c6fba3926e200
+
 %define sover   3
 Name:           fluidsynth
-Version:        2.3.5
+Version:        2.5.2
 Release:        0
 Summary:        A Real-Time Software Synthesizer That Uses Soundfont(tm)
 License:        LGPL-2.1-or-later
 Group:          Productivity/Multimedia/Sound/Midi
-URL:            https://www.fluidsynth.orga/
+URL:            https://www.fluidsynth.org/
+#Git-Clone:     https://github.com/FluidSynth/fluidsynth.git
 Source0:        https://github.com/FluidSynth/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
 Source1:        %{name}.conf
+Source2:        https://github.com/kthohr/gcem/archive/%{gcem_hash}.tar.gz#/gcem-%{gcem_hash}.tar.gz
 Source1000:     baselibs.conf
 BuildRequires:  cmake >= 3.13.0
 BuildRequires:  gcc-c++
@@ -33,12 +37,10 @@ BuildRequires:  ladspa-devel
 BuildRequires:  pkgconfig
 BuildRequires:  readline-devel
 BuildRequires:  pkgconfig(alsa)
-BuildRequires:  pkgconfig(dbus-1)
 BuildRequires:  pkgconfig(jack)
-BuildRequires:  pkgconfig(libinstpatch-1.0)
 BuildRequires:  pkgconfig(libpulse)
 BuildRequires:  pkgconfig(libsystemd)
-BuildRequires:  pkgconfig(sdl2)
+BuildRequires:  pkgconfig(sdl3)
 BuildRequires:  pkgconfig(sndfile)
 Recommends:     fluid-soundfont-gm
 %{?systemd_ordering}
@@ -69,12 +71,14 @@ This package contains the shared library for Fluidsynth.
 
 %prep
 %autosetup -p1
+tar -C gcem --strip-components=1 -x -f %{SOURCE2}
 
 %build
 %cmake \
+    -Dosal=cpp11 \
+    -Denable-dbus=0 \
     -DFLUID_DAEMON_ENV_FILE=%{_fillupdir}/sysconfig.%{name} \
-    -DDEFAULT_SOUNDFONT=/usr/share/sounds/sf2/FluidR3_GM.sf2 \
-    -Denable-lash=0
+    -DDEFAULT_SOUNDFONT=/usr/share/sounds/sf2/FluidR3_GM.sf2
 %cmake_build
 
 %check
@@ -103,12 +107,11 @@ ln -s %{_sbindir}/service %{buildroot}%{_sbindir}/rc%{name}
 %postun
 %systemd_user_postun %{name}.service
 
-%post -n libfluidsynth%{sover} -p /sbin/ldconfig
-%postun -n libfluidsynth%{sover} -p /sbin/ldconfig
+%ldconfig_scriptlets -n libfluidsynth%{sover}
 
 %files
 %license LICENSE
-%doc AUTHORS ChangeLog README.md THANKS TODO
+%doc AUTHORS ChangeLog.old README.md THANKS TODO
 %{_bindir}/%{name}
 %{_fillupdir}/sysconfig.%{name}
 %{_mandir}/man1/%{name}.1%{?ext_man}

gcem-012ae73c6d0a2cb09ffe86475f5c6fba3926e200.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:34ab0ee87a9eb26d3087fa9b49c2572ea8ee03db0c9705b83648301a3a3fc172
+size 57846