From f44d656c0a1488240953ad8d90766a1c9e90fbda Mon Sep 17 00:00:00 2001 From: oreo639 <31916379+Oreo639@users.noreply.github.com> Date: Sat, 18 Dec 2021 00:09:14 -0800 Subject: [PATCH] SDL2_mixer: fix use after free with fluidsynth. Closes: #34600 [via git-merge-pr] --- .../fix_fluidsynth_use_after_free.patch | 30 +++++++++++++++++++ srcpkgs/SDL2_mixer/template | 2 +- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/SDL2_mixer/patches/fix_fluidsynth_use_after_free.patch diff --git a/srcpkgs/SDL2_mixer/patches/fix_fluidsynth_use_after_free.patch b/srcpkgs/SDL2_mixer/patches/fix_fluidsynth_use_after_free.patch new file mode 100644 index 00000000000..cd740ac85c1 --- /dev/null +++ b/srcpkgs/SDL2_mixer/patches/fix_fluidsynth_use_after_free.patch @@ -0,0 +1,30 @@ +From 6160668079f91d57a5d7bf0b40ffdd843be70daf Mon Sep 17 00:00:00 2001 +From: Sam Lantinga +Date: Wed, 20 Jan 2021 10:17:10 -0800 +Subject: [PATCH] Fixed use-after-free in music_fluidsynth.c + +Tom M. + +There is a dangerous use-after-free in FLUIDSYNTH_Delete(): the settings object is deleted **before** the synth. Since the settings have been created first to initialize the synth, you must first delete the synth and then delete the settings. This currently crashes all applications that use fluidsynth 2.1.6 and SDL2_mixer. Please apply the attached patch and release a bug fix release. + +Originally reported at https://github.com/FluidSynth/fluidsynth/issues/748 +--- + src/codecs/music_fluidsynth.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/codecs/music_fluidsynth.c b/src/codecs/music_fluidsynth.c +index 8667f0d9..a47247f4 100644 +--- a/music_fluidsynth.c ++++ b/music_fluidsynth.c +@@ -285,9 +285,10 @@ static void FLUIDSYNTH_Stop(void *context) + static void FLUIDSYNTH_Delete(void *context) + { + FLUIDSYNTH_Music *music = (FLUIDSYNTH_Music *)context; ++ fluid_settings_t *settings = fluidsynth.fluid_synth_get_settings(music->synth); + fluidsynth.delete_fluid_player(music->player); +- fluidsynth.delete_fluid_settings(fluidsynth.fluid_synth_get_settings(music->synth)); + fluidsynth.delete_fluid_synth(music->synth); ++ fluidsynth.delete_fluid_settings(settings); + SDL_free(music); + } + diff --git a/srcpkgs/SDL2_mixer/template b/srcpkgs/SDL2_mixer/template index 06a28928419..a5c0e512ba4 100644 --- a/srcpkgs/SDL2_mixer/template +++ b/srcpkgs/SDL2_mixer/template @@ -1,7 +1,7 @@ # Template file for 'SDL2_mixer' pkgname=SDL2_mixer version=2.0.4 -revision=3 +revision=4 build_style=gnu-configure hostmakedepends="pkg-config" makedepends="SDL2-devel libvorbis-devel libmikmod-devel libflac-devel