Accepting request 1326785 from multimedia:libs

Add CVE reference in changelog

OBS-URL: https://build.opensuse.org/request/show/1326785
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/fluidsynth?expand=0&rev=85

fluidsynth-2.5.2.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1dcb13308b3aa383db658c60a7b63d73d0ff4601ccee589582ba7a816475410e
+size 2111488

fluidsynth.changes

@@ -1,3 +1,82 @@
+-------------------------------------------------------------------
+Fri Jan  2 17:53:50 UTC 2026 - Takashi Iwai <tiwai@suse.com>
+
+- Update to version 2.5.2:
+  * The CoreAudio driver has gained iOS support
+  * Improve error handling and reporting when loading default
+    soundfont
+  * Improve logging and side-effect mitigation when basic channel
+    configuration changes
+  * Fix CVE-2025-68617 - a heap-based use-after-free involving DLS files
+    (GHSA-ffw2-xvvp-39ch) (bsc#1255519)
+
+-------------------------------------------------------------------
+Fri Oct 31 19:58:32 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.5.1
+  * Previous versions have incorrectly exposed private C++ and
+    inline symbols; they are now hidden from the library.
+  * Fluidsynth now resets DataEntry values when it receives
+    (N)RPN MSB/LSB to prevent off-tuned channels.
+  * Fix a regression introduced in 2.5.0, that could have caused a
+    NULL pointer deref when playing AWE32 NRPN MIDIs.
+  * Fix a regression introduced in 2.5.0, that caused convex
+    unipolar modulators to use a concave mapping.
+  * Fix a regression introduced in 2.4.6, which in rare cases
+    could have caused the cutoff frequency of the IIR filter to
+    get stuck or change abruptly.
+  * Fix a build issue where fluidsynth was trying to find glib
+    even when it shouldn't.
+  * Fix typos in ALSA log messages.
+
+-------------------------------------------------------------------
+Sun Oct  5 19:26:20 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.5.0
+  New Features
+  * Add a C++11-based OS abstraction layer as a replacement for
+    glib, bringing these minor limitations when C++17 is
+    unavailable.
+  * Add native support for Downloadable Soundfont Format.
+  * Fluidsynth now recognizes the DMOD INFO-subchunk.
+  * A new positional flag has been introduced: -b, --bank-offset
+  Breaking Changes
+  * Support for SDL2 has been removed - pls. use SDL3 instead.
+  * The processing order of fluidsynth's configuration files has
+    been changed (#1573, refer to wiki for details).
+  * The legacy shell commands for reverb and chorus have been
+    removed (#1659, refer to UserManual for details).
+  Musically Breaking Changes
+  * It was discovered that fluidsynth was mapping some modulators
+    slightly inaccurately into their normalized range.
+  * Some Roland GS NPRN Params are now mapped to CC numbers.
+  * Fluidsynth now auto-detects whether Portamento Time is 7bit
+    or 14bit wide - this fixes the infamous Descent Game08 tune.
+  * Previously, fluidsynth's default behavior was to use
+    portamento only for those notes, that were played in a
+    successive / legato manner; to further improve the portamento
+    experience, this was changed and fluidsynth now plays
+    portamento for all notes by default.
+  Other Changes
+  * Fix drum kits not always being selected after SysEx GS Rythm
+    Part.
+  * The logic for parsing INFO chunks has been revised to improve
+    handling of unknown INFO-subchunks.
+  * Fix a race condition in fluid_synth_alloc_voice() public API
+    function (#1664).
+  * Fix installing static and shared libs cmake targets on the
+    same prefix (#1648).
+- Support for GLib and libinstpatch is deprecated.
+  * build with "-Dosal=cpp11 -Denable-libinstpatch=0"
+
+-------------------------------------------------------------------
+Fri Sep 12 19:36:41 UTC 2025 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.4.8
+  * Fix systemd daemon failing with spaces in Soundfont filenames.
+  * Fluidsynth now explains why it discards invalid generators when
+    run in verbose mode.
+
 -------------------------------------------------------------------
 Wed Jul 16 17:01:35 UTC 2025 - Martin Hauke <mardnh@gmx.de>
 
@@ -6,6 +85,7 @@ Wed Jul 16 17:01:35 UTC 2025 - Martin Hauke <mardnh@gmx.de>
     Soundfont files with unknown INFO subchunks.
   * Fix incorrect GS DT1 SysEx checksum validation.
   * Fix a NULL pointer dereference during legato mono playing.
+    (CVE-2025-56225, bsc#1256435)
 
 -------------------------------------------------------------------
 Sun May 11 07:58:30 UTC 2025 - Martin Hauke <mardnh@gmx.de>

fluidsynth.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package fluidsynth
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,16 +16,20 @@
 #
 
 
+%define gcem_hash 012ae73c6d0a2cb09ffe86475f5c6fba3926e200
+
 %define sover   3
 Name:           fluidsynth
-Version:        2.4.7
+Version:        2.5.2
 Release:        0
 Summary:        A Real-Time Software Synthesizer That Uses Soundfont(tm)
 License:        LGPL-2.1-or-later
 Group:          Productivity/Multimedia/Sound/Midi
-URL:            https://www.fluidsynth.orga/
+URL:            https://www.fluidsynth.org/
+#Git-Clone:     https://github.com/FluidSynth/fluidsynth.git
 Source0:        https://github.com/FluidSynth/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
 Source1:        %{name}.conf
+Source2:        https://github.com/kthohr/gcem/archive/%{gcem_hash}.tar.gz#/gcem-%{gcem_hash}.tar.gz
 Source1000:     baselibs.conf
 BuildRequires:  cmake >= 3.13.0
 BuildRequires:  gcc-c++
@@ -33,12 +37,10 @@ BuildRequires:  ladspa-devel
 BuildRequires:  pkgconfig
 BuildRequires:  readline-devel
 BuildRequires:  pkgconfig(alsa)
-BuildRequires:  pkgconfig(dbus-1)
 BuildRequires:  pkgconfig(jack)
-BuildRequires:  pkgconfig(libinstpatch-1.0)
 BuildRequires:  pkgconfig(libpulse)
 BuildRequires:  pkgconfig(libsystemd)
-BuildRequires:  pkgconfig(sdl2)
+BuildRequires:  pkgconfig(sdl3)
 BuildRequires:  pkgconfig(sndfile)
 Recommends:     fluid-soundfont-gm
 %{?systemd_ordering}
@@ -69,9 +71,12 @@ This package contains the shared library for Fluidsynth.
 
 %prep
 %autosetup -p1
+tar -C gcem --strip-components=1 -x -f %{SOURCE2}
 
 %build
 %cmake \
+    -Dosal=cpp11 \
+    -Denable-dbus=0 \
     -DFLUID_DAEMON_ENV_FILE=%{_fillupdir}/sysconfig.%{name} \
     -DDEFAULT_SOUNDFONT=/usr/share/sounds/sf2/FluidR3_GM.sf2
 %cmake_build
@@ -102,12 +107,7 @@ ln -s %{_sbindir}/service %{buildroot}%{_sbindir}/rc%{name}
 %postun
 %systemd_user_postun %{name}.service
 
-%if %{undefined ldconfig_scriptlets}
-%post -n libfluidsynth%{sover} -p /sbin/ldconfig
-%postun -n libfluidsynth%{sover} -p /sbin/ldconfig
-%else
 %ldconfig_scriptlets -n libfluidsynth%{sover}
-%endif
 
 %files
 %license LICENSE

gcem-012ae73c6d0a2cb09ffe86475f5c6fba3926e200.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:34ab0ee87a9eb26d3087fa9b49c2572ea8ee03db0c9705b83648301a3a3fc172
+size 57846