diff -Nru fluidsynth-1.1.11/debian/changelog fluidsynth-1.1.11/debian/changelog
--- fluidsynth-1.1.11/debian/changelog	2018-06-02 14:15:52.000000000 +0530
+++ fluidsynth-1.1.11/debian/changelog	2021-04-24 22:16:20.000000000 +0530
@@ -1,3 +1,11 @@
+fluidsynth (1.1.11-1+deb10u1) buster; urgency=medium
+
+  * Non-maintainer upload.
+  * Backport fix for use-after-free vulnerability. (CVE-2021-28421)
+    (Closes: #987168)
+
+ -- Reiner Herrmann <reiner@reiner-h.de>  Sat, 24 Apr 2021 18:46:20 +0200
+
 fluidsynth (1.1.11-1) unstable; urgency=medium
 
   * Team upload.
diff -Nru fluidsynth-1.1.11/debian/patches/CVE-2021-28421.patch fluidsynth-1.1.11/debian/patches/CVE-2021-28421.patch
--- fluidsynth-1.1.11/debian/patches/CVE-2021-28421.patch	1970-01-01 05:30:00.000000000 +0530
+++ fluidsynth-1.1.11/debian/patches/CVE-2021-28421.patch	2021-04-24 22:13:48.000000000 +0530
@@ -0,0 +1,75 @@
+Origin: backport, commit:005719628aef0bd48dc7b2f860c7e4ca16b81044
+Bug: https://github.com/FluidSynth/fluidsynth/issues/808
+Bug-Debian: https://bugs.debian.org/987168
+
+--- a/src/sfloader/fluid_defsfont.c
++++ b/src/sfloader/fluid_defsfont.c
+@@ -2706,7 +2706,7 @@
+ static int
+ load_pgen (int size, SFData * sf, FILE * fd)
+ {
+-  fluid_list_t *p, *p2, *p3, *dup, **hz = NULL;
++  fluid_list_t *p, *p2, *p3, *dup, **hz = NULL, *start_of_zone_list;
+   SFZone *z;
+   SFGen *g;
+   SFGenAmount genval;
+@@ -2718,7 +2718,7 @@
+     {				/* traverse through all presets */
+       gzone = FALSE;
+       discarded = FALSE;
+-      p2 = ((SFPreset *) (p->data))->zone;
++      start_of_zone_list = p2 = ((SFPreset *) (p->data))->zone;
+       if (p2)
+ 	hz = &p2;
+       while (p2)
+@@ -2829,10 +2829,13 @@
+ 		}
+ 	      else
+ 		{		/* previous global zone exists, discard */
++		  p2 = fluid_list_next(p2); /* advance to next zone before deleting the current list element */
+ 		  FLUID_LOG (FLUID_WARN,
+ 		    _("Preset \"%s\": Discarding invalid global zone"),
+ 		    ((SFPreset *) (p->data))->name);
+-		  sfont_zone_delete (sf, hz, (SFZone *) (p2->data));
++		  fluid_list_remove (start_of_zone_list, z);
++		  sfont_free_zone(z);
++		  continue;
+ 		}
+ 	    }
+ 
+@@ -3057,7 +3060,7 @@
+ static int
+ load_igen (int size, SFData * sf, FILE * fd)
+ {
+-  fluid_list_t *p, *p2, *p3, *dup, **hz = NULL;
++  fluid_list_t *p, *p2, *p3, *dup, **hz = NULL, *start_of_zone_list;
+   SFZone *z;
+   SFGen *g;
+   SFGenAmount genval;
+@@ -3069,7 +3072,7 @@
+     {				/* traverse through all instruments */
+       gzone = FALSE;
+       discarded = FALSE;
+-      p2 = ((SFInst *) (p->data))->zone;
++      start_of_zone_list = p2 = ((SFInst *) (p->data))->zone;
+       if (p2)
+ 	hz = &p2;
+       while (p2)
+@@ -3178,11 +3181,15 @@
+ 		    }
+ 		}
+ 	      else
+-		{		/* previous global zone exists, discard */
++		{
++		  p2 = fluid_list_next(p2); /* advance to next zone before deleting the current list element */
++		  /* previous global zone exists, discard */
+ 		  FLUID_LOG (FLUID_WARN,
+ 		    _("Instrument \"%s\": Discarding invalid global zone"),
+ 		    ((SFInst *) (p->data))->name);
+-		  sfont_zone_delete (sf, hz, (SFZone *) (p2->data));
++		  fluid_list_remove (start_of_zone_list, z);
++		  sfont_free_zone(z);
++		  continue;
+ 		}
+ 	    }
+ 
diff -Nru fluidsynth-1.1.11/debian/patches/series fluidsynth-1.1.11/debian/patches/series
--- fluidsynth-1.1.11/debian/patches/series	2018-03-15 21:54:33.000000000 +0530
+++ fluidsynth-1.1.11/debian/patches/series	2021-04-24 22:11:23.000000000 +0530
@@ -1 +1,2 @@
 1001-revert_abi_break_114.patch
+CVE-2021-28421.patch