release v0.23.11

These settings do not work if CURL was compiled with
CURL_DISABLE_PROXY, and cause error "An unknown option was passed in
to libcurl".

Fixes regression by commit 7ab0dfc8ce

NEWS

@@ -1,3 +1,15 @@
+ver 0.23.11 (2022/11/28)
+* database
+  - simple: move default database to ~/.cache/mpd/db from ~/.cache/mpd.db
+  - simple: default "cache_directory" to ~/.cache/mpd/mounts
+* macOS: fix build failure "no archive members specified"
+* Windows
+  - fix crash bug (stack buffer overflow) after I/O errors
+  - fix path traversal bug because backslash was allowed in playlist names
+* Android/Windows
+  - update OpenSSL to 3.0.7
+  - re-enable CURL's verbose error strings
+
 ver 0.23.10 (2022/10/14)
 * storage
   - curl: fix file time stamps

android/AndroidManifest.xml

@@ -2,8 +2,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           package="org.musicpd"
           android:installLocation="auto"
-          android:versionCode="69"
-          android:versionName="0.23.10">
+          android:versionCode="70"
+          android:versionName="0.23.11">
 
   <uses-sdk android:minSdkVersion="21" android:targetSdkVersion="30"/>
 

doc/conf.py

@@ -38,7 +38,10 @@ author = 'Max Kellermann'
 # built documents.
 #
 # The short X.Y version.
-version = '0.23.10'
+with open('../meson.build') as f:
+    import re
+    version = re.match(r"project\([^\)]*\bversion:\s*'([^']+)'",
+                       f.read(4096)).group(1)
 # The full version, including alpha/beta/rc tags.
 #release = version + '~git'
 
@@ -47,7 +50,7 @@ version = '0.23.10'
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = "en"
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

doc/index.rst

@@ -11,6 +11,12 @@ Music Player Daemon
    client
    protocol
 
+.. toctree::
+   :maxdepth: 1
+   :caption: man pages:
+
+   mpd.1
+   mpd.conf.5
 
 Indices and tables
 ==================

doc/plugins.rst

@@ -219,8 +219,9 @@ Opens remote files or streams over HTTP using libcurl.
 
 Note that unless overridden by the below settings (e.g. by setting
 them to a blank value), general curl configuration from environment
-variables such as ``http_proxy`` or specified in :file:`~/.curlrc`
-will be in effect.
+variables such as ``http_proxy`` will be in effect.
+
+User name and password are read from an optional :file:`~/.netrc`, :file:`~/.curlrc` is not read.
 
 .. list-table::
    :widths: 20 80

meson.build

@@ -1,7 +1,7 @@
 project(
   'mpd',
   ['c', 'cpp'],
-  version: '0.23.10',
+  version: '0.23.11',
   meson_version: '>= 0.56.0',
   default_options: [
     'c_std=c11',
@@ -390,6 +390,7 @@ endif
 
 if enable_database
   sources += [
+    'src/storage/StorageState.cxx',
     'src/queue/PlaylistUpdate.cxx',
     'src/command/StorageCommands.cxx',
     'src/command/DatabaseCommands.cxx',

python/build/libs.py

@@ -43,8 +43,8 @@ opus = AutotoolsProject(
 )
 
 flac = AutotoolsProject(
-    'http://downloads.xiph.org/releases/flac/flac-1.4.0.tar.xz',
-    'af41c0733c93c237c3e52f64dd87e3b0d9af38259f1c7d11e8cbf583c48c2506',
+    'http://downloads.xiph.org/releases/flac/flac-1.4.2.tar.xz',
+    'e322d58a1f48d23d9dd38f432672865f6f79e73a6f9cc5a5f57fcaa83eb5a8e4',
     'lib/libFLAC.a',
     [
         '--disable-shared', '--enable-static',
@@ -387,19 +387,18 @@ ffmpeg = FfmpegProject(
 )
 
 openssl = OpenSSLProject(
-    'https://www.openssl.org/source/openssl-3.0.5.tar.gz',
-    'aa7d8d9bef71ad6525c55ba11e5f4397889ce49c2c9349dcea6d3e4f0b024a7a',
+    'https://www.openssl.org/source/openssl-3.0.7.tar.gz',
+    '83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e',
     'include/openssl/ossl_typ.h',
 )
 
 curl = CmakeProject(
-    'https://curl.se/download/curl-7.85.0.tar.xz',
-    '88b54a6d4b9a48cb4d873c7056dcba997ddd5b7be5a2d537a4acb55c20b04be6',
+    'https://curl.se/download/curl-7.86.0.tar.xz',
+    '2d61116e5f485581f6d59865377df4463f2e788677ac43222b496d4e49fb627b',
     'lib/libcurl.a',
     [
         '-DBUILD_CURL_EXE=OFF',
         '-DBUILD_SHARED_LIBS=OFF',
-        '-DCURL_DISABLE_VERBOSE_STRINGS=ON',
         '-DCURL_DISABLE_LDAP=ON',
         '-DCURL_DISABLE_TELNET=ON',
         '-DCURL_DISABLE_DICT=ON',

python/build/meson.py

@@ -82,8 +82,8 @@ endian = '{endian}'
 def configure(toolchain, src, build, args=()):
     cross_file = make_cross_file(toolchain)
     configure = [
-        'meson',
-        src, build,
+        'meson', 'setup',
+        build, src,
 
         '--prefix', toolchain.install_prefix,
 

src/PlaylistFile.cxx

@@ -81,6 +81,9 @@ spl_valid_name(const char *name_utf8)
 	 */
 
 	return std::strchr(name_utf8, '/') == nullptr &&
+#ifdef _WIN32
+		std::strchr(name_utf8, '\\') == nullptr &&
+#endif
 		std::strchr(name_utf8, '\n') == nullptr &&
 		std::strchr(name_utf8, '\r') == nullptr;
 }

src/StateFileConfig.cxx

@@ -32,7 +32,7 @@ StateFileConfig::StateFileConfig(const ConfigData &config)
 {
 #ifdef ANDROID
 	if (path.IsNull()) {
-		const auto cache_dir = GetUserCacheDir();
+		const auto cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return;
 

src/archive/plugins/meson.build

@@ -22,6 +22,10 @@ if libzzip_dep.found()
   found_archive_plugin = true
 endif
 
+if not found_archive_plugin
+  subdir_done()
+endif
+
 archive_plugins = static_library(
   'archive_plugins',
   archive_plugins_sources,

src/db/Configured.cxx

@@ -24,6 +24,7 @@
 #include "config/Param.hxx"
 #include "config/Block.hxx"
 #include "fs/AllocatedPath.hxx"
+#include "fs/FileSystem.hxx"
 #include "fs/StandardDirectory.hxx"
 #include "util/RuntimeError.hxx"
 
@@ -51,17 +52,30 @@ CreateConfiguredDatabase(const ConfigData &config,
 	} else {
 		/* if there is no override, use the cache directory */
 
-		const AllocatedPath cache_dir = GetUserCacheDir();
+		const AllocatedPath cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return nullptr;
 
-		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("mpd.db"));
+		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("db"));
 		auto db_file_utf8 = db_file.ToUTF8();
 		if (db_file_utf8.empty())
 			return nullptr;
 
 		ConfigBlock block;
 		block.AddBlockParam("path", std::move(db_file_utf8), -1);
+
+		{
+			const auto mounts_dir = cache_dir
+				/ Path::FromFS(PATH_LITERAL("mounts"));
+			CreateDirectoryNoThrow(mounts_dir);
+
+			if (auto mounts_dir_utf8 = mounts_dir.ToUTF8();
+			    !mounts_dir_utf8.empty())
+				block.AddBlockParam("cache_directory",
+						    std::move(mounts_dir_utf8),
+						    -1);
+		}
+
 		return DatabaseGlobalInit(main_event_loop, io_event_loop,
 					  listener, block);
 	}

src/fs/FileSystem.hxx

@@ -67,6 +67,16 @@ StatFile(Path file, struct stat &buf, bool follow_symlinks = true)
 
 #endif
 
+static inline bool
+CreateDirectoryNoThrow(Path path) noexcept
+{
+#ifdef _WIN32
+	return CreateDirectory(path.c_str(), nullptr);
+#else
+	return mkdir(path.c_str(), 0777);
+#endif
+}
+
 /**
  * Truncate a file that exists already.  Throws std::system_error on
  * error.

src/fs/StandardDirectory.cxx

@@ -53,6 +53,12 @@
 #include "Main.hxx"
 #endif
 
+#ifdef USE_XDG
+#include "Version.h" // for PACKAGE_NAME
+#define APP_FILENAME PATH_LITERAL(PACKAGE_NAME)
+static constexpr Path app_filename = Path::FromFS(APP_FILENAME);
+#endif
+
 #if !defined(_WIN32) && !defined(ANDROID)
 class PasswdEntry
 {
@@ -284,6 +290,24 @@ GetUserCacheDir() noexcept
 #endif
 }
 
+AllocatedPath
+GetAppCacheDir() noexcept
+{
+#ifdef USE_XDG
+	if (const auto user_dir = GetUserCacheDir(); !user_dir.IsNull()) {
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
+		return dir;
+	}
+
+	return nullptr;
+#elif defined(ANDROID)
+	return context->GetCacheDir(Java::GetEnv());
+#else
+	return nullptr;
+#endif
+}
+
 AllocatedPath
 GetUserRuntimeDir() noexcept
 {
@@ -297,7 +321,7 @@ GetUserRuntimeDir() noexcept
 AllocatedPath
 GetAppRuntimeDir() noexcept
 {
-#ifdef __linux__
+#if defined(__linux__) && !defined(ANDROID)
 	/* systemd specific; see systemd.exec(5) */
 	if (const char *runtime_directory = getenv("RUNTIME_DIRECTORY"))
 		if (auto dir = StringView{runtime_directory}.Split(':').first;
@@ -307,8 +331,8 @@ GetAppRuntimeDir() noexcept
 
 #ifdef USE_XDG
 	if (const auto user_dir = GetUserRuntimeDir(); !user_dir.IsNull()) {
-		auto dir = user_dir / Path::FromFS("mpd");
-		mkdir(dir.c_str(), 0700);
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
 		return dir;
 	}
 #endif

src/fs/StandardDirectory.hxx

@@ -43,6 +43,13 @@ GetUserMusicDir() noexcept;
 AllocatedPath
 GetUserCacheDir() noexcept;
 
+/**
+ * Obtains cache directory for this application.
+ */
+[[gnu::const]]
+AllocatedPath
+GetAppCacheDir() noexcept;
+
 /**
  * Obtains the runtime directory for the current user.
  */

src/input/plugins/CurlInputPlugin.cxx

@@ -439,8 +439,14 @@ CurlInputStream::InitEasy()
 	request->SetVerifyPeer(verify_peer);
 	request->SetVerifyHost(verify_host);
 	request->SetOption(CURLOPT_HTTPHEADER, request_headers.Get());
-	request->SetProxyVerifyPeer(verify_peer);
-	request->SetProxyVerifyHost(verify_host);
+
+	try {
+		request->SetProxyVerifyPeer(verify_peer);
+		request->SetProxyVerifyHost(verify_host);
+	} catch (...) {
+		/* these methods fail if libCURL was compiled with
+		   CURL_DISABLE_PROXY; ignore silently */
+	}
 }
 
 void

src/storage/meson.build

@@ -17,7 +17,6 @@ storage_glue = static_library(
   'CompositeStorage.cxx',
   'MemoryDirectoryReader.cxx',
   'Configured.cxx',
-  'StorageState.cxx',
   include_directories: inc,
   dependencies: [
     boost_dep,
@@ -31,4 +30,3 @@ storage_glue_dep = declare_dependency(
     storage_plugins_dep,
   ],
 )
-

src/system/Error.hxx

@@ -70,8 +70,11 @@ FormatLastError(DWORD code, const char *fmt, Args&&... args) noexcept
 {
 	char buffer[512];
 	const auto end = buffer + sizeof(buffer);
-	size_t length = snprintf(buffer, sizeof(buffer) - 128,
+	constexpr std::size_t max_prefix = sizeof(buffer) - 128;
+	size_t length = snprintf(buffer, max_prefix,
 				 fmt, std::forward<Args>(args)...);
+	if (length >= max_prefix)
+		length = max_prefix - 1;
 	char *p = buffer + length;
 	*p++ = ':';
 	*p++ = ' ';

subprojects/expat.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = expat-2.4.9
-source_url = https://github.com/libexpat/libexpat/releases/download/R_2_4_9/expat-2.4.9.tar.xz
-source_filename = expat-2.4.9.tar.bz2
-source_hash = 6e8c0728fe5c7cd3f93a6acce43046c5e4736c7b4b68e032e9350daa0efc0354
-patch_filename = expat_2.4.9-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.4.9-1/get_patch
-patch_hash = 51b42d935008552f9d6c4d3e7511b84690a2a0c9d90165d1d192fc892f0a4787
-wrapdb_version = 2.4.9-1
+directory = expat-2.5.0
+source_url = https://github.com/libexpat/libexpat/releases/download/R_2_5_0/expat-2.5.0.tar.xz
+source_filename = expat-2.5.0.tar.bz2
+source_hash = ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
+patch_filename = expat_2.5.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.5.0-1/get_patch
+patch_hash = 0d0d6e07ed21cf4892126a8270f5fd182012ab34b3ebe24932a2bef5ca608a61
+wrapdb_version = 2.5.0-1
 
 [provide]
 expat = expat_dep

subprojects/fmt.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = fmt-9.0.0
-source_url = https://github.com/fmtlib/fmt/archive/9.0.0.tar.gz
-source_filename = fmt-9.0.0.tar.gz
-source_hash = 9a1e0e9e843a356d65c7604e2c8bf9402b50fe294c355de0095ebd42fb9bd2c5
-patch_filename = fmt_9.0.0-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/fmt_9.0.0-1/get_patch
-patch_hash = 5f12924065e0fe7ccae40593d256a082955c273cb2880b3e3de05df9d8d10697
-wrapdb_version = 9.0.0-1
+directory = fmt-9.1.0
+source_url = https://github.com/fmtlib/fmt/archive/9.1.0.tar.gz
+source_filename = fmt-9.1.0.tar.gz
+source_hash = 5dea48d1fcddc3ec571ce2058e13910a0d4a6bab4cc09a809d8b1dd1c88ae6f2
+patch_filename = fmt_9.1.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/fmt_9.1.0-1/get_patch
+patch_hash = 4557b9ba87b3eb63694ed9b21d1a2117d4a97ca56b91085b10288e9a5294adf8
+wrapdb_version = 9.1.0-1
 
 [provide]
 fmt = fmt_dep

test/meson.build

@@ -288,7 +288,8 @@ if enable_database
       dependencies: [
         log_dep,
         tag_dep,
-        storage_glue_dep,
+        fs_dep,
+        storage_plugins_dep,
         gtest_dep,
       ],
     ),

test/test_translate_song.cxx

@@ -14,6 +14,7 @@
 #include "ls.hxx"
 #include "Log.hxx"
 #include "db/DatabaseSong.hxx"
+#include "storage/Registry.hxx"
 #include "storage/StorageInterface.hxx"
 #include "storage/plugins/LocalStorage.hxx"
 #include "Mapper.hxx"
@@ -36,6 +37,13 @@ uri_supported_scheme(const char *uri) noexcept
 	return strncmp(uri, "http://", 7) == 0;
 }
 
+const StoragePlugin *
+GetStoragePluginByUri(const char *) noexcept
+{
+	// dummy symbol
+	return nullptr;
+}
+
 static constexpr auto music_directory = PATH_LITERAL("/music");
 static Storage *storage;