diff --git a/NEWS b/NEWS
index a412ac5a2..131ccbd9e 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ ver 0.20.5 (not yet released)
   - id3: fix memory leak on corrupt ID3 tags
 * decoder
   - sidplay: don't require libsidutils when building with libsidplayfp
+* output
+  - httpd: fix two buffer overflows in IcyMetaData length calculation
 * mixer
   - alsa: fix crash bug
 
diff --git a/doc/include/tags.xml b/doc/include/tags.xml
index 554b43a82..b3554efb9 100644
--- a/doc/include/tags.xml
+++ b/doc/include/tags.xml
@@ -55,7 +55,8 @@
 
   <listitem>
     <para>
-      <varname>track</varname>: the track number within the album.
+      <varname>track</varname>: the decimal track number within the
+      album.
     </para>
   </listitem>
 
@@ -103,7 +104,8 @@
 
   <listitem>
     <para>
-      <varname>disc</varname>: the disc number in a multi-disc album.
+      <varname>disc</varname>: the decimal disc number in a multi-disc
+      album.
     </para>
   </listitem>
 
diff --git a/src/input/plugins/AlsaInputPlugin.cxx b/src/input/plugins/AlsaInputPlugin.cxx
index 2c6b8d09d..9607398e0 100644
--- a/src/input/plugins/AlsaInputPlugin.cxx
+++ b/src/input/plugins/AlsaInputPlugin.cxx
@@ -101,6 +101,7 @@ public:
 	~AlsaInputStream() {
 		BlockingCall(MultiSocketMonitor::GetEventLoop(), [this](){
 				MultiSocketMonitor::Reset();
+				DeferredMonitor::Cancel();
 			});
 
 		snd_pcm_close(capture_handle);
diff --git a/src/mixer/plugins/AlsaMixerPlugin.cxx b/src/mixer/plugins/AlsaMixerPlugin.cxx
index 77bbb8cd9..cf2dc2055 100644
--- a/src/mixer/plugins/AlsaMixerPlugin.cxx
+++ b/src/mixer/plugins/AlsaMixerPlugin.cxx
@@ -58,6 +58,7 @@ public:
 	~AlsaMixerMonitor() {
 		BlockingCall(MultiSocketMonitor::GetEventLoop(), [this](){
 				MultiSocketMonitor::Reset();
+				DeferredMonitor::Cancel();
 			});
 	}
 
diff --git a/src/output/plugins/httpd/IcyMetaDataServer.cxx b/src/output/plugins/httpd/IcyMetaDataServer.cxx
index e2fbddb85..a81d2850a 100644
--- a/src/output/plugins/httpd/IcyMetaDataServer.cxx
+++ b/src/output/plugins/httpd/IcyMetaDataServer.cxx
@@ -60,7 +60,11 @@ icy_server_metadata_string(const char *stream_title, const char* stream_url)
 {
 	// The leading n is a placeholder for the length information
 	auto icy_metadata = FormatString("nStreamTitle='%s';"
-					 "StreamUrl='%s';",
+					 "StreamUrl='%s';"
+					 /* pad 15 spaces just in case
+					    the length needs to be
+					    rounded up */
+					 "               ",
 					 stream_title,
 					 stream_url);
 
@@ -68,7 +72,7 @@ icy_server_metadata_string(const char *stream_title, const char* stream_url)
 
 	meta_length--; // subtract placeholder
 
-	meta_length = ((int)meta_length / 16) + 1;
+	meta_length = meta_length / 16;
 
 	icy_metadata[0] = meta_length;
 
@@ -109,5 +113,5 @@ icy_server_metadata_page(const Tag &tag, const TagType *types)
 	if (icy_string.IsNull())
 		return nullptr;
 
-	return Page::Copy(icy_string.c_str(), (icy_string[0] * 16) + 1);
+	return Page::Copy(icy_string.c_str(), uint8_t(icy_string[0]) * 16 + 1);
 }
diff --git a/src/tag/Handler.cxx b/src/tag/Handler.cxx
index c04bddb72..dda760c43 100644
--- a/src/tag/Handler.cxx
+++ b/src/tag/Handler.cxx
@@ -44,7 +44,7 @@ add_tag_tag(TagType type, const char *value, void *ctx)
 		unsigned n = strtoul(value, &end, 10);
 		if (value != end) {
 			char s[21];
-			if (snprintf(s, 21, "%u", n) >= 0)
+			if (snprintf(s, 21, "%u", n) > 0)
 				tag.AddItem(type, s);
 		}
 	} else