release v0.19.21

The user unit omits the "ProtectKernelModules" setting which fails
with modular kernels:

 Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not permitted

It is unfortunate that systemd (version 232) is unable to reduce its
own capabilities, because this requires us to split system and user
units.

 https://bugs.musicpd.org/view.php?id=4608

.gitignore

@@ -35,7 +35,7 @@ tags
 /mkinstalldirs
 /build
 /src/mpd
-/systemd/mpd.service
+/systemd/system/mpd.service
 /stamp-h1
 
 /src/dsd2pcm/dsd2pcm

Makefile.am

@@ -1449,8 +1449,13 @@ FILTER_LIBS = \
 
 if HAVE_SYSTEMD
 systemdsystemunit_DATA = \
-	systemd/mpd.socket \
-	systemd/mpd.service
+	systemd/system/mpd.socket \
+	systemd/system/mpd.service
+endif
+
+if HAVE_SYSTEMD_USER
+systemduserunit_DATA = \
+	systemd/user/mpd.service
 endif
 
 
@@ -2166,7 +2171,7 @@ EXTRA_DIST = $(doc_DATA) autogen.sh \
 	$(wildcard $(srcdir)/scripts/*.rb) \
 	$(man_MANS) $(DOCBOOK_FILES) doc/mpdconf.example doc/doxygen.conf \
 	$(wildcard $(srcdir)/doc/include/*.xml) \
-	systemd/mpd.socket \
+	systemd/system/mpd.socket \
 	android/AndroidManifest.xml \
 	android/build.py \
 	android/custom_rules.xml \

NEWS

@@ -1,3 +1,21 @@
+ver 0.19.21 (2016/12/13)
+* decoder
+  - ffmpeg: fix crash bug
+* fix unit test failure after recent "setprio" change
+* systemd: add user unit
+
+ver 0.19.20 (2016/12/09)
+* protocol
+  - "setprio" re-enqueues old song if priority has been raised
+* decoder
+  - ffmpeg: ignore empty packets
+  - pcm: fix corruption bug with partial frames (after short read)
+  - sidplay: fix playback speed with libsidplayfp
+* output
+  - winmm: fix 8 bit playback
+* fix gcc 7.0 -Wimplicit-fallthrough
+* systemd: paranoid security settings
+
 ver 0.19.19 (2016/08/23)
 * decoder
   - ffmpeg: bug fix for FFmpeg 3.1 support

configure.ac

@@ -1,10 +1,10 @@
 AC_PREREQ(2.60)
 
-AC_INIT(mpd, 0.19.19, musicpd-dev-team@lists.sourceforge.net)
+AC_INIT(mpd, 0.19.21, musicpd-dev-team@lists.sourceforge.net)
 
 VERSION_MAJOR=0
 VERSION_MINOR=19
-VERSION_REVISION=19
+VERSION_REVISION=21
 VERSION_EXTRA=0
 
 AC_CONFIG_SRCDIR([src/Main.cxx])
@@ -52,6 +52,22 @@ if test "x$with_systemdsystemunitdir" != xno; then
 fi
 AM_CONDITIONAL(HAVE_SYSTEMD, [test -n "$with_systemdsystemunitdir" -a "x$with_systemdsystemunitdir" != xno ])
 
+AC_ARG_WITH([systemduserunitdir],
+	    AS_HELP_STRING([--with-systemduserunitdir=DIR], [Directory for systemd service files]),
+	    [], [with_systemduserunitdir=no])
+if test "x$with_systemduserunitdir" = xyes; then
+	AC_MSG_CHECKING(for systemd)
+	with_systemduserunitdir=$($PKG_CONFIG --variable=systemduserunitdir systemd)
+	if test -z "$with_systemduserunitdir"; then
+		AC_MSG_ERROR([Failed to detect systemd])
+	fi
+	AC_MSG_RESULT([$with_systemduserunitdir])
+fi
+if test "x$with_systemduserunitdir" != xno; then
+	AC_SUBST([systemduserunitdir], [$with_systemduserunitdir])
+fi
+AM_CONDITIONAL(HAVE_SYSTEMD_USER, [test -n "$with_systemduserunitdir" -a "x$with_systemduserunitdir" != xno ])
+
 dnl ---------------------------------------------------------------------------
 dnl Declare Variables
 dnl ---------------------------------------------------------------------------
@@ -1905,7 +1921,8 @@ dnl Generate files
 dnl ---------------------------------------------------------------------------
 AC_CONFIG_FILES(Makefile)
 AC_CONFIG_FILES(doc/doxygen.conf)
-AC_CONFIG_FILES(systemd/mpd.service)
+AC_CONFIG_FILES(systemd/system/mpd.service)
+AC_CONFIG_FILES(systemd/user/mpd.service)
 AC_OUTPUT
 
 echo 'MPD is ready for compilation, type "make" to begin.'

doc/mpdconf.example

@@ -164,7 +164,7 @@
 # Permissions #################################################################
 #
 # If this setting is set, MPD will require password authorization. The password
-# can setting can be specified multiple times for different password profiles.
+# setting can be specified multiple times for different password profiles.
 #
 #password                        "password@read,add,control,admin"
 #

doc/protocol.xml

@@ -66,8 +66,8 @@
         <function>strcpy</function> just fine with UTF-8 encoded
         strings. For example: <returnvalue>OK</returnvalue> encoded in
         UTF-8 is simply <returnvalue>OK</returnvalue>.  For more
-        information on UTF=8:
-        http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8)
+        information on UTF-8:
+        <ulink url="http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8"/>)
       </para>
     </section>
 

doc/user.xml

@@ -151,7 +151,7 @@ apt-get install g++ \
         <application>systemd</application> unit files: a "service"
         unit and a "socket" unit.  These will only be installed when
         <application>MPD</application> was configured with
-        <parameter>--with-systemdsystemunitdir=/lib/systemd</parameter>.
+        <parameter>--with-systemdsystemunitdir=/lib/systemd/system</parameter>.
       </para>
 
       <para>
@@ -167,6 +167,33 @@ systemctl start mpd.socket</programlisting>
         <varname>port</varname> settings.
       </para>
     </section>
+
+    <section id="systemd_user">
+      <title><filename>systemd</filename> user unit</title>
+
+      <para>
+        You can launch <application>MPD</application> as a
+        <filename>systemd</filename> user unit.  The service file will
+        only be installed when <application>MPD</application> was
+        configured with
+        <parameter>--with-systemduserunitdir=/usr/lib/systemd/user</parameter>
+        or
+        <parameter>--with-systemduserunitdir=$HOME/.local/share/systemd/user</parameter>.
+      </para>
+
+      <para>
+        Once the user unit is installed, you can start and stop
+        <application>MPD</application> like any other service:
+      </para>
+
+      <programlisting>systemctl --user start mpd</programlisting>
+
+      <para>
+        To auto-start <application>MPD</application> upon login, type:
+      </para>
+
+      <programlisting>systemctl --user enable mpd</programlisting>
+    </section>
   </chapter>
 
   <chapter id="config">

src/LogInit.cxx

@@ -51,7 +51,7 @@ static constexpr Domain log_domain("log");
 
 #ifndef ANDROID
 
-static int out_fd;
+static int out_fd = -1;
 static AllocatedPath out_path = AllocatedPath::Null();
 
 static void redirect_logs(int fd)

src/decoder/plugins/FfmpegDecoderPlugin.cxx

@@ -71,7 +71,6 @@ FfmpegOpenInput(AVIOContext *pb,
 
 	int err = avformat_open_input(&context, filename, fmt, nullptr);
 	if (err < 0) {
-		avformat_free_context(context);
 		SetFfmpegError(error, err, "avformat_open_input() failed");
 		return nullptr;
 	}
@@ -643,7 +642,7 @@ FfmpegDecode(Decoder &decoder, InputStream &input,
 			/* end of file */
 			break;
 
-		if (packet.stream_index == audio_stream) {
+		if (packet.size > 0 && packet.stream_index == audio_stream) {
 			cmd = ffmpeg_send_packet(decoder, input,
 						 packet,
 						 *codec_context,

src/decoder/plugins/PcmDecoderPlugin.cxx

@@ -23,10 +23,28 @@
 #include "input/InputStream.hxx"
 #include "util/Error.hxx"
 #include "util/ByteReverse.hxx"
+#include "util/StaticFifoBuffer.hxx"
 #include "Log.hxx"
 
+#include <assert.h>
 #include <string.h>
 
+template<typename B>
+static bool
+FillBuffer(Decoder &decoder, InputStream &is, B &buffer)
+{
+	buffer.Shift();
+	auto w = buffer.Write();
+	assert(!w.IsEmpty());
+
+	size_t nbytes = decoder_read(decoder, is, w.data, w.size);
+	if (nbytes == 0 && is.LockIsEOF())
+		return false;
+
+	buffer.Append(nbytes);
+	return true;
+}
+
 static void
 pcm_stream_decode(Decoder &decoder, InputStream &is)
 {
@@ -50,25 +68,27 @@ pcm_stream_decode(Decoder &decoder, InputStream &is)
 	decoder_initialized(decoder, audio_format,
 			    is.IsSeekable(), total_time);
 
+	StaticFifoBuffer<uint8_t, 4096> buffer;
+
 	DecoderCommand cmd;
 	do {
-		char buffer[4096];
-
-		size_t nbytes = decoder_read(decoder, is,
-					     buffer, sizeof(buffer));
-
-		if (nbytes == 0 && is.LockIsEOF())
+		if (!FillBuffer(decoder, is, buffer))
 			break;
 
+		auto r = buffer.Read();
+		/* round down to the nearest frame size, because we
+		   must not pass partial frames to decoder_data() */
+		r.size -= r.size % frame_size;
+		buffer.Consume(r.size);
+
 		if (reverse_endian)
 			/* make sure we deliver samples in host byte order */
-			reverse_bytes_16((uint16_t *)buffer,
-					 (uint16_t *)buffer,
-					 (uint16_t *)(buffer + nbytes));
+			reverse_bytes_16((uint16_t *)r.data,
+					 (uint16_t *)r.data,
+					 (uint16_t *)(r.data + r.size));
 
-		cmd = nbytes > 0
-			? decoder_data(decoder, is,
-				       buffer, nbytes, 0)
+		cmd = !r.IsEmpty()
+			? decoder_data(decoder, is, r.data, r.size, 0)
 			: decoder_get_command(decoder);
 		if (cmd == DecoderCommand::SEEK) {
 			uint64_t frame = decoder_seek_where_frame(decoder);
@@ -76,6 +96,7 @@ pcm_stream_decode(Decoder &decoder, InputStream &is)
 
 			Error error;
 			if (is.LockSeek(offset, error)) {
+				buffer.Clear();
 				decoder_command_finished(decoder);
 			} else {
 				LogError(error);

src/decoder/plugins/SidplayDecoderPlugin.cxx

@@ -354,12 +354,19 @@ sidplay_file_decode(Decoder &decoder, Path path_fs)
 	DecoderCommand cmd;
 	do {
 		short buffer[4096];
-		size_t nbytes;
 
-		nbytes = player.play(buffer, ARRAY_SIZE(buffer));
-		if (nbytes == 0)
+		const auto result = player.play(buffer, ARRAY_SIZE(buffer));
+		if (result <= 0)
 			break;
 
+#ifdef HAVE_SIDPLAYFP
+		/* libsidplayfp returns the number of samples */
+		const size_t nbytes = result * sizeof(buffer[0]);
+#else
+		/* libsidplay2 returns the number of bytes */
+		const size_t nbytes = result;
+#endif
+
 		decoder_timestamp(decoder, (double)player.time() / timebase);
 
 		cmd = decoder_data(decoder, nullptr, buffer, nbytes, 0);
@@ -376,12 +383,9 @@ sidplay_file_decode(Decoder &decoder, Path path_fs)
 			}
 
 			/* ignore data until target time is reached */
-			while(data_time<target_time) {
-				nbytes=player.play(buffer, ARRAY_SIZE(buffer));
-				if(nbytes==0)
-					break;
+			while (data_time < target_time &&
+			       player.play(buffer, ARRAY_SIZE(buffer)) > 0)
 				data_time = player.time();
-			}
 
 			decoder_command_finished(decoder);
 		}

src/input/plugins/AlsaInputPlugin.cxx

@@ -247,6 +247,10 @@ AlsaInputStream::Recover(int err)
 	case -EPIPE:
 		LogDebug(alsa_input_domain, "Buffer Overrun");
 		// drop through
+#if GCC_CHECK_VERSION(7,0)
+		[[fallthrough]];
+#endif
+
 	case -ESTRPIPE:
 	case -EINTR:
 		err = snd_pcm_recover(capture_handle, err, 1);

src/output/plugins/AlsaOutputPlugin.cxx

@@ -760,6 +760,9 @@ alsa_recover(AlsaOutput *ad, int err)
 		if (err == -EAGAIN)
 			return 0;
 		/* fall-through to snd_pcm_prepare: */
+#if GCC_CHECK_VERSION(7,0)
+		[[fallthrough]];
+#endif
 	case SND_PCM_STATE_SETUP:
 	case SND_PCM_STATE_XRUN:
 		ad->period_position = 0;

src/output/plugins/WinmmOutputPlugin.cxx

@@ -148,10 +148,10 @@ winmm_output_open(AudioOutput *ao, AudioFormat &audio_format,
 	}
 
 	switch (audio_format.format) {
-	case SampleFormat::S8:
 	case SampleFormat::S16:
 		break;
 
+	case SampleFormat::S8:
 	case SampleFormat::S24_P32:
 	case SampleFormat::S32:
 	case SampleFormat::FLOAT:

src/queue/Queue.cxx

@@ -426,14 +426,15 @@ Queue::SetPriority(unsigned position, uint8_t priority, int after_order)
 
 		if (_order < (unsigned)after_order) {
 			/* the specified song has been played already
-			   - enqueue it only if its priority has just
-			   become bigger than the current one's */
+			   - enqueue it only if its priority has been
+			   increased and is now bigger than the
+			   current one's */
 
 			const unsigned after_position =
 				OrderToPosition(after_order);
 			const Item *after_item =
 				&items[after_position];
-			if (old_priority > after_item->priority ||
+			if (priority <= old_priority ||
 			    priority <= after_item->priority)
 				/* priority hasn't become bigger */
 				return true;

src/storage/CompositeStorage.cxx

@@ -265,22 +265,13 @@ CompositeStorage::FindStorage(const char *uri) const
 	return result;
 }
 
-CompositeStorage::FindResult
-CompositeStorage::FindStorage(const char *uri, Error &error) const
-{
-	auto result = FindStorage(uri);
-	if (result.directory == nullptr)
-		error.Set(composite_domain, "No such directory");
-	return result;
-}
-
 bool
 CompositeStorage::GetInfo(const char *uri, bool follow, FileInfo &info,
 			  Error &error)
 {
 	const ScopeLock protect(mutex);
 
-	auto f = FindStorage(uri, error);
+	auto f = FindStorage(uri);
 	if (f.directory->storage != nullptr &&
 	    f.directory->storage->GetInfo(f.uri, follow, info, error))
 		return true;
@@ -295,6 +286,8 @@ CompositeStorage::GetInfo(const char *uri, bool follow, FileInfo &info,
 		return true;
 	}
 
+	if (!error.IsDefined())
+		error.Set(composite_domain, "No such directory");
 	return false;
 }
 
@@ -304,13 +297,15 @@ CompositeStorage::OpenDirectory(const char *uri,
 {
 	const ScopeLock protect(mutex);
 
-	auto f = FindStorage(uri, error);
+	auto f = FindStorage(uri);
 	const Directory *directory = f.directory->Find(f.uri);
 	if (directory == nullptr || directory->children.empty()) {
 		/* no virtual directories here */
 
-		if (f.directory->storage == nullptr)
+		if (f.directory->storage == nullptr) {
+			error.Set(composite_domain, "No such directory");
 			return nullptr;
+		}
 
 		return f.directory->storage->OpenDirectory(f.uri, error);
 	}

src/storage/CompositeStorage.hxx

@@ -45,7 +45,7 @@ class CompositeStorage final : public Storage {
 	 */
 	struct Directory {
 		/**
-		 * The #Storage mounted n this virtual directory.  All
+		 * The #Storage mounted in this virtual directory.  All
 		 * "leaf" Directory instances must have a #Storage.
 		 * Other Directory instances may have one, and child
 		 * mounts will be "mixed" in.
@@ -155,9 +155,16 @@ private:
 		}
 	}
 
+	/**
+	 * Follow the given URI path, and find the outermost directory
+	 * which is a #Storage mount point.  If there are no mounts,
+	 * it returns the root directory (with a nullptr "storage"
+	 * attribute, of course).  FindResult::uri contains the
+	 * remaining unused part of the URI (may be empty if all of
+	 * the URI was used).
+	 */
 	gcc_pure
 	FindResult FindStorage(const char *uri) const;
-	FindResult FindStorage(const char *uri, Error &error) const;
 
 	const char *MapToRelativeUTF8(const Directory &directory,
 				      const char *uri) const;

src/tag/TagItem.hxx

@@ -21,7 +21,6 @@
 #define MPD_TAG_ITEM_HXX
 
 #include "TagType.h"
-#include "Compiler.h"
 
 /**
  * One tag value.  It is a mapping of #TagType to am arbitrary string
@@ -35,11 +34,14 @@ struct TagItem {
 	/**
 	 * the value of this tag; this is a variable length string
 	 */
-	char value[sizeof(long) - sizeof(type)];
+	char value[1];
 
 	TagItem() = default;
 	TagItem(const TagItem &other) = delete;
 	TagItem &operator=(const TagItem &other) = delete;
-} gcc_packed;
+};
+
+static_assert(sizeof(TagItem) == 2, "Unexpected size");
+static_assert(alignof(TagItem) == 1, "Unexpected alignment");
 
 #endif

src/tag/TagPool.cxx

@@ -50,7 +50,7 @@ struct TagPoolSlot {
 
 	static TagPoolSlot *Create(TagPoolSlot *_next, TagType type,
 				   const char *value, size_t length);
-} gcc_packed;
+};
 
 TagPoolSlot *
 TagPoolSlot::Create(TagPoolSlot *_next, TagType type,

systemd/mpd.service.in

@@ -1,13 +0,0 @@
-[Unit]
-Description=Music Player Daemon
-After=network.target sound.target
-
-[Service]
-ExecStart=@prefix@/bin/mpd --no-daemon
-
-# allow MPD to use real-time priority 50
-LimitRTPRIO=50
-LimitRTTIME=infinity
-
-[Install]
-WantedBy=multi-user.target

systemd/system/mpd.service.in

@@ -0,0 +1,26 @@
+[Unit]
+Description=Music Player Daemon
+After=network.target sound.target
+
+[Service]
+ExecStart=@prefix@/bin/mpd --no-daemon
+
+# allow MPD to use real-time priority 50
+LimitRTPRIO=50
+LimitRTTIME=infinity
+
+# disallow writing to /usr, /bin, /sbin, ...
+ProtectSystem=yes
+
+# more paranoid security settings
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+RestrictNamespaces=yes
+
+[Install]
+WantedBy=multi-user.target
+Also=mpd.socket

systemd/user/mpd.service.in

@@ -0,0 +1,29 @@
+[Unit]
+Description=Music Player Daemon
+After=network.target sound.target
+
+[Service]
+ExecStart=@prefix@/bin/mpd --no-daemon
+
+# allow MPD to use real-time priority 50
+LimitRTPRIO=50
+LimitRTTIME=infinity
+
+# disallow writing to /usr, /bin, /sbin, ...
+ProtectSystem=yes
+
+# more paranoid security settings
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+RestrictNamespaces=yes
+
+# Note that "ProtectKernelModules=yes" is missing in the user unit
+# because systemd 232 is unable to reduce its own capabilities
+# ("Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not
+# permitted")
+
+[Install]
+WantedBy=default.target

test/test_queue_priority.cxx

@@ -164,21 +164,6 @@ QueuePriorityTest::TestPriority()
 
 	check_descending_priority(&queue, current_order + 1);
 
-	/* priority=60 for the old prio50 item; must not be moved,
-	   because it's before the current song, and it's status
-	   hasn't changed (it was already higher before) */
-
-	unsigned c_order = 0;
-	unsigned c_position = queue.OrderToPosition(c_order);
-	CPPUNIT_ASSERT_EQUAL(50u, unsigned(queue.items[c_position].priority));
-	queue.SetPriority(c_position, 60, current_order);
-
-	current_order = queue.PositionToOrder(current_position);
-	CPPUNIT_ASSERT_EQUAL(3u, current_order);
-
-	c_order = queue.PositionToOrder(c_position);
-	CPPUNIT_ASSERT_EQUAL(0u, c_order);
-
 	/* move the prio=20 item back */
 
 	a_order = queue.PositionToOrder(a_position);