release v0.23.12

If the environment variable $HOME does not exist, don't attempt to
obtain it from /etc/passwd; without $HOME, the calling process
indicates that it does not wish MPD to access the home directory.

This also prevents MPD from attempting to load
`/root/.config/mpd/mpd.conf` if MPD got started as global systemd
service.  Reading from there makes no sense, only /etc/mpd.conf shall
be used then.

This piece of code was initially added by commit 5d85792178.

Closes https://github.com/MusicPlayerDaemon/MPD/issues/1687

NEWS

@@ -1,3 +1,26 @@
+ver 0.23.12 (2023/01/17)
+* input
+  - curl: require CURL 7.55.0 or later
+* decoder
+  - mad: fix integer underflow with very small files
+* tags
+  - fix crash bug due to race condition
+* output
+  - pipewire: adjust to PipeWire 0.3.64 API change
+* fix build failures with GCC 13
+
+ver 0.23.11 (2022/11/28)
+* database
+  - simple: move default database to ~/.cache/mpd/db from ~/.cache/mpd.db
+  - simple: default "cache_directory" to ~/.cache/mpd/mounts
+* macOS: fix build failure "no archive members specified"
+* Windows
+  - fix crash bug (stack buffer overflow) after I/O errors
+  - fix path traversal bug because backslash was allowed in playlist names
+* Android/Windows
+  - update OpenSSL to 3.0.7
+  - re-enable CURL's verbose error strings
+
 ver 0.23.10 (2022/10/14)
 * storage
   - curl: fix file time stamps

android/AndroidManifest.xml

@@ -2,8 +2,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           package="org.musicpd"
           android:installLocation="auto"
-          android:versionCode="69"
-          android:versionName="0.23.10">
+          android:versionCode="71"
+          android:versionName="0.23.12">
 
   <uses-sdk android:minSdkVersion="21" android:targetSdkVersion="30"/>
 

doc/conf.py

@@ -38,7 +38,10 @@ author = 'Max Kellermann'
 # built documents.
 #
 # The short X.Y version.
-version = '0.23.10'
+with open('../meson.build') as f:
+    import re
+    version = re.match(r"project\([^\)]*\bversion:\s*'([^']+)'",
+                       f.read(4096)).group(1)
 # The full version, including alpha/beta/rc tags.
 #release = version + '~git'
 
@@ -47,7 +50,7 @@ version = '0.23.10'
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = "en"
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

doc/index.rst

@@ -11,6 +11,12 @@ Music Player Daemon
    client
    protocol
 
+.. toctree::
+   :maxdepth: 1
+   :caption: man pages:
+
+   mpd.1
+   mpd.conf.5
 
 Indices and tables
 ==================

doc/plugins.rst

@@ -219,8 +219,9 @@ Opens remote files or streams over HTTP using libcurl.
 
 Note that unless overridden by the below settings (e.g. by setting
 them to a blank value), general curl configuration from environment
-variables such as ``http_proxy`` or specified in :file:`~/.curlrc`
-will be in effect.
+variables such as ``http_proxy`` will be in effect.
+
+User name and password are read from an optional :file:`~/.netrc`, :file:`~/.curlrc` is not read.
 
 .. list-table::
    :widths: 20 80

meson.build

@@ -1,7 +1,7 @@
 project(
   'mpd',
   ['c', 'cpp'],
-  version: '0.23.10',
+  version: '0.23.12',
   meson_version: '>= 0.56.0',
   default_options: [
     'c_std=c11',
@@ -205,7 +205,6 @@ enable_daemon = not is_windows and not is_android and get_option('daemon')
 conf.set('ENABLE_DAEMON', enable_daemon)
 
 conf.set('HAVE_GETPWNAM_R', compiler.has_function('getpwnam_r'))
-conf.set('HAVE_GETPWUID_R', compiler.has_function('getpwuid_r'))
 conf.set('HAVE_INITGROUPS', compiler.has_function('initgroups'))
 conf.set('HAVE_FNMATCH', compiler.has_function('fnmatch'))
 
@@ -390,6 +389,7 @@ endif
 
 if enable_database
   sources += [
+    'src/storage/StorageState.cxx',
     'src/queue/PlaylistUpdate.cxx',
     'src/command/StorageCommands.cxx',
     'src/command/DatabaseCommands.cxx',

python/build/libs.py

@@ -43,8 +43,8 @@ opus = AutotoolsProject(
 )
 
 flac = AutotoolsProject(
-    'http://downloads.xiph.org/releases/flac/flac-1.4.0.tar.xz',
-    'af41c0733c93c237c3e52f64dd87e3b0d9af38259f1c7d11e8cbf583c48c2506',
+    'http://downloads.xiph.org/releases/flac/flac-1.4.2.tar.xz',
+    'e322d58a1f48d23d9dd38f432672865f6f79e73a6f9cc5a5f57fcaa83eb5a8e4',
     'lib/libFLAC.a',
     [
         '--disable-shared', '--enable-static',
@@ -387,19 +387,18 @@ ffmpeg = FfmpegProject(
 )
 
 openssl = OpenSSLProject(
-    'https://www.openssl.org/source/openssl-3.0.5.tar.gz',
-    'aa7d8d9bef71ad6525c55ba11e5f4397889ce49c2c9349dcea6d3e4f0b024a7a',
+    'https://www.openssl.org/source/openssl-3.0.7.tar.gz',
+    '83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e',
     'include/openssl/ossl_typ.h',
 )
 
 curl = CmakeProject(
-    'https://curl.se/download/curl-7.85.0.tar.xz',
-    '88b54a6d4b9a48cb4d873c7056dcba997ddd5b7be5a2d537a4acb55c20b04be6',
+    'https://curl.se/download/curl-7.87.0.tar.xz',
+    'ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff',
     'lib/libcurl.a',
     [
         '-DBUILD_CURL_EXE=OFF',
         '-DBUILD_SHARED_LIBS=OFF',
-        '-DCURL_DISABLE_VERBOSE_STRINGS=ON',
         '-DCURL_DISABLE_LDAP=ON',
         '-DCURL_DISABLE_TELNET=ON',
         '-DCURL_DISABLE_DICT=ON',
@@ -451,7 +450,7 @@ jack = JackProject(
 )
 
 boost = BoostProject(
-    'https://boostorg.jfrog.io/artifactory/main/release/1.80.0/source/boost_1_80_0.tar.bz2',
-    '1e19565d82e43bc59209a168f5ac899d3ba471d55c7610c677d4ccf2c9c500c0',
+    'https://boostorg.jfrog.io/artifactory/main/release/1.81.0/source/boost_1_81_0.tar.bz2',
+    '71feeed900fbccca04a3b4f2f84a7c217186f28a940ed8b7ed4725986baf99fa',
     'include/boost/version.hpp',
 )

python/build/meson.py

@@ -82,8 +82,8 @@ endian = '{endian}'
 def configure(toolchain, src, build, args=()):
     cross_file = make_cross_file(toolchain)
     configure = [
-        'meson',
-        src, build,
+        'meson', 'setup',
+        build, src,
 
         '--prefix', toolchain.install_prefix,
 

src/PlaylistFile.cxx

@@ -81,6 +81,9 @@ spl_valid_name(const char *name_utf8)
 	 */
 
 	return std::strchr(name_utf8, '/') == nullptr &&
+#ifdef _WIN32
+		std::strchr(name_utf8, '\\') == nullptr &&
+#endif
 		std::strchr(name_utf8, '\n') == nullptr &&
 		std::strchr(name_utf8, '\r') == nullptr;
 }

src/RemoteTagCache.hxx

@@ -28,7 +28,11 @@
 #include <boost/intrusive/list.hpp>
 #include <boost/intrusive/unordered_set.hpp>
 
+#include <array>
+#include <functional>
+#include <memory>
 #include <string>
+#include <utility>
 
 class RemoteTagCacheHandler;
 

src/StateFileConfig.cxx

@@ -32,7 +32,7 @@ StateFileConfig::StateFileConfig(const ConfigData &config)
 {
 #ifdef ANDROID
 	if (path.IsNull()) {
-		const auto cache_dir = GetUserCacheDir();
+		const auto cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return;
 

src/archive/plugins/meson.build

@@ -22,6 +22,10 @@ if libzzip_dep.found()
   found_archive_plugin = true
 endif
 
+if not found_archive_plugin
+  subdir_done()
+endif
+
 archive_plugins = static_library(
   'archive_plugins',
   archive_plugins_sources,

src/db/Configured.cxx

@@ -24,6 +24,7 @@
 #include "config/Param.hxx"
 #include "config/Block.hxx"
 #include "fs/AllocatedPath.hxx"
+#include "fs/FileSystem.hxx"
 #include "fs/StandardDirectory.hxx"
 #include "util/RuntimeError.hxx"
 
@@ -51,17 +52,30 @@ CreateConfiguredDatabase(const ConfigData &config,
 	} else {
 		/* if there is no override, use the cache directory */
 
-		const AllocatedPath cache_dir = GetUserCacheDir();
+		const AllocatedPath cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return nullptr;
 
-		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("mpd.db"));
+		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("db"));
 		auto db_file_utf8 = db_file.ToUTF8();
 		if (db_file_utf8.empty())
 			return nullptr;
 
 		ConfigBlock block;
 		block.AddBlockParam("path", std::move(db_file_utf8), -1);
+
+		{
+			const auto mounts_dir = cache_dir
+				/ Path::FromFS(PATH_LITERAL("mounts"));
+			CreateDirectoryNoThrow(mounts_dir);
+
+			if (auto mounts_dir_utf8 = mounts_dir.ToUTF8();
+			    !mounts_dir_utf8.empty())
+				block.AddBlockParam("cache_directory",
+						    std::move(mounts_dir_utf8),
+						    -1);
+		}
+
 		return DatabaseGlobalInit(main_event_loop, io_event_loop,
 					  listener, block);
 	}

src/decoder/plugins/MadDecoderPlugin.cxx

@@ -798,6 +798,8 @@ MadDecoder::UpdateTimerNextFrame() noexcept
 DecoderCommand
 MadDecoder::SubmitPCM(size_t i, size_t pcm_length) noexcept
 {
+	assert(i <= pcm_length);
+
 	size_t num_samples = pcm_length - i;
 
 	mad_fixed_to_24_buffer(output_buffer, synth.pcm,
@@ -843,7 +845,7 @@ MadDecoder::SynthAndSubmit() noexcept
 	size_t pcm_length = synth.pcm.length;
 	if (drop_end_samples &&
 	    current_frame == max_frames - drop_end_frames - 1) {
-		if (drop_end_samples >= pcm_length)
+		if (i + drop_end_samples >= pcm_length)
 			return DecoderCommand::STOP;
 
 		pcm_length -= drop_end_samples;

src/fs/FileSystem.hxx

@@ -67,6 +67,16 @@ StatFile(Path file, struct stat &buf, bool follow_symlinks = true)
 
 #endif
 
+static inline bool
+CreateDirectoryNoThrow(Path path) noexcept
+{
+#ifdef _WIN32
+	return CreateDirectory(path.c_str(), nullptr);
+#else
+	return mkdir(path.c_str(), 0777);
+#endif
+}
+
 /**
  * Truncate a file that exists already.  Throws std::system_error on
  * error.

src/fs/StandardDirectory.cxx

@@ -34,7 +34,6 @@
 #include <shlobj.h>
 #else
 #include <stdlib.h>
-#include <unistd.h>
 #include <pwd.h>
 #endif
 
@@ -53,6 +52,12 @@
 #include "Main.hxx"
 #endif
 
+#ifdef USE_XDG
+#include "Version.h" // for PACKAGE_NAME
+#define APP_FILENAME PATH_LITERAL(PACKAGE_NAME)
+static constexpr Path app_filename = Path::FromFS(APP_FILENAME);
+#endif
+
 #if !defined(_WIN32) && !defined(ANDROID)
 class PasswdEntry
 {
@@ -74,15 +79,6 @@ public:
 		return result != nullptr;
 	}
 
-	bool ReadByUid(uid_t uid) {
-#ifdef HAVE_GETPWUID_R
-		getpwuid_r(uid, &pw, buf.data(), buf.size(), &result);
-#else
-		result = getpwuid(uid);
-#endif
-		return result != nullptr;
-	}
-
 	const passwd *operator->() {
 		assert(result != nullptr);
 		return result;
@@ -284,6 +280,24 @@ GetUserCacheDir() noexcept
 #endif
 }
 
+AllocatedPath
+GetAppCacheDir() noexcept
+{
+#ifdef USE_XDG
+	if (const auto user_dir = GetUserCacheDir(); !user_dir.IsNull()) {
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
+		return dir;
+	}
+
+	return nullptr;
+#elif defined(ANDROID)
+	return context->GetCacheDir(Java::GetEnv());
+#else
+	return nullptr;
+#endif
+}
+
 AllocatedPath
 GetUserRuntimeDir() noexcept
 {
@@ -297,7 +311,7 @@ GetUserRuntimeDir() noexcept
 AllocatedPath
 GetAppRuntimeDir() noexcept
 {
-#ifdef __linux__
+#if defined(__linux__) && !defined(ANDROID)
 	/* systemd specific; see systemd.exec(5) */
 	if (const char *runtime_directory = getenv("RUNTIME_DIRECTORY"))
 		if (auto dir = StringView{runtime_directory}.Split(':').first;
@@ -307,8 +321,8 @@ GetAppRuntimeDir() noexcept
 
 #ifdef USE_XDG
 	if (const auto user_dir = GetUserRuntimeDir(); !user_dir.IsNull()) {
-		auto dir = user_dir / Path::FromFS("mpd");
-		mkdir(dir.c_str(), 0700);
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
 		return dir;
 	}
 #endif
@@ -351,10 +365,8 @@ GetHomeDir() noexcept
 	if (const auto home = getenv("HOME");
 	    IsValidPathString(home) && IsValidDir(home))
 		return AllocatedPath::FromFS(home);
-
-	if (PasswdEntry pw; pw.ReadByUid(getuid()))
-		return SafePathFromFS(pw->pw_dir);
 #endif
+
 	return nullptr;
 }
 

src/fs/StandardDirectory.hxx

@@ -43,6 +43,13 @@ GetUserMusicDir() noexcept;
 AllocatedPath
 GetUserCacheDir() noexcept;
 
+/**
+ * Obtains cache directory for this application.
+ */
+[[gnu::const]]
+AllocatedPath
+GetAppCacheDir() noexcept;
+
 /**
  * Obtains the runtime directory for the current user.
  */

src/input/plugins/CurlInputPlugin.cxx

@@ -439,8 +439,14 @@ CurlInputStream::InitEasy()
 	request->SetVerifyPeer(verify_peer);
 	request->SetVerifyHost(verify_host);
 	request->SetOption(CURLOPT_HTTPHEADER, request_headers.Get());
-	request->SetProxyVerifyPeer(verify_peer);
-	request->SetProxyVerifyHost(verify_host);
+
+	try {
+		request->SetProxyVerifyPeer(verify_peer);
+		request->SetProxyVerifyHost(verify_host);
+	} catch (...) {
+		/* these methods fail if libCURL was compiled with
+		   CURL_DISABLE_PROXY; ignore silently */
+	}
 }
 
 void

src/io/FileReader.hxx

@@ -42,6 +42,8 @@
 #include "io/UniqueFileDescriptor.hxx"
 #endif
 
+#include <cstdint>
+
 class Path;
 class FileInfo;
 

src/lib/curl/Easy.hxx

@@ -186,10 +186,6 @@ public:
 		SetOption(CURLOPT_POSTFIELDSIZE, (long)size);
 	}
 
-	void SetHttpPost(const struct curl_httppost *post) {
-		SetOption(CURLOPT_HTTPPOST, post);
-	}
-
 	template<typename T>
 	bool GetInfo(CURLINFO info, T value_r) const noexcept {
 		return ::curl_easy_getinfo(handle, info, value_r) == CURLE_OK;
@@ -199,10 +195,10 @@ public:
 	 * Returns the response body's size, or -1 if that is unknown.
 	 */
 	[[gnu::pure]]
-	int64_t GetContentLength() const noexcept {
-		double value;
-		return GetInfo(CURLINFO_CONTENT_LENGTH_DOWNLOAD, &value)
-			? (int64_t)value
+	curl_off_t GetContentLength() const noexcept {
+		curl_off_t value;
+		return GetInfo(CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &value)
+			? value
 			: -1;
 	}
 

src/lib/curl/meson.build

@@ -1,4 +1,4 @@
-curl_dep = dependency('libcurl', version: '>= 7.33', required: get_option('curl'))
+curl_dep = dependency('libcurl', version: '>= 7.55', required: get_option('curl'))
 conf.set('ENABLE_CURL', curl_dep.found())
 if not curl_dep.found()
   subdir_done()

src/output/plugins/PipeWireOutputPlugin.cxx

@@ -523,7 +523,13 @@ PipeWireOutput::Open(AudioFormat &audio_format)
 		pw_properties_setf(props, PW_KEY_REMOTE_NAME, "%s", remote);
 
 	if (target != nullptr && target_id == PW_ID_ANY)
-		pw_properties_setf(props, PW_KEY_NODE_TARGET, "%s", target);
+		pw_properties_setf(props,
+#if PW_CHECK_VERSION(0, 3, 64)
+				   PW_KEY_TARGET_OBJECT,
+#else
+				   PW_KEY_NODE_TARGET,
+#endif
+				   "%s", target);
 
 #ifdef PW_KEY_NODE_RATE
 	/* ask PipeWire to change the graph sample rate to ours

src/storage/meson.build

@@ -17,7 +17,6 @@ storage_glue = static_library(
   'CompositeStorage.cxx',
   'MemoryDirectoryReader.cxx',
   'Configured.cxx',
-  'StorageState.cxx',
   include_directories: inc,
   dependencies: [
     boost_dep,
@@ -31,4 +30,3 @@ storage_glue_dep = declare_dependency(
     storage_plugins_dep,
   ],
 )
-

src/system/Error.hxx

@@ -70,8 +70,11 @@ FormatLastError(DWORD code, const char *fmt, Args&&... args) noexcept
 {
 	char buffer[512];
 	const auto end = buffer + sizeof(buffer);
-	size_t length = snprintf(buffer, sizeof(buffer) - 128,
+	constexpr std::size_t max_prefix = sizeof(buffer) - 128;
+	size_t length = snprintf(buffer, max_prefix,
 				 fmt, std::forward<Args>(args)...);
+	if (length >= max_prefix)
+		length = max_prefix - 1;
 	char *p = buffer + length;
 	*p++ = ':';
 	*p++ = ' ';

src/tag/Builder.cxx

@@ -263,8 +263,14 @@ TagBuilder::RemoveAll() noexcept
 void
 TagBuilder::RemoveType(TagType type) noexcept
 {
+	if (items.empty())
+		/* don't acquire the tag_pool_lock if we're not going
+		   to call tag_pool_put_item() anyway */
+		return;
+
 	const auto begin = items.begin(), end = items.end();
 
+	const std::scoped_lock<Mutex> protect(tag_pool_lock);
 	items.erase(std::remove_if(begin, end,
 				   [type](TagItem *item) {
 					   if (item->type != type)

subprojects/expat.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = expat-2.4.9
-source_url = https://github.com/libexpat/libexpat/releases/download/R_2_4_9/expat-2.4.9.tar.xz
-source_filename = expat-2.4.9.tar.bz2
-source_hash = 6e8c0728fe5c7cd3f93a6acce43046c5e4736c7b4b68e032e9350daa0efc0354
-patch_filename = expat_2.4.9-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.4.9-1/get_patch
-patch_hash = 51b42d935008552f9d6c4d3e7511b84690a2a0c9d90165d1d192fc892f0a4787
-wrapdb_version = 2.4.9-1
+directory = expat-2.5.0
+source_url = https://github.com/libexpat/libexpat/releases/download/R_2_5_0/expat-2.5.0.tar.xz
+source_filename = expat-2.5.0.tar.bz2
+source_hash = ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
+patch_filename = expat_2.5.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.5.0-1/get_patch
+patch_hash = 0d0d6e07ed21cf4892126a8270f5fd182012ab34b3ebe24932a2bef5ca608a61
+wrapdb_version = 2.5.0-1
 
 [provide]
 expat = expat_dep

subprojects/fmt.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = fmt-9.0.0
-source_url = https://github.com/fmtlib/fmt/archive/9.0.0.tar.gz
-source_filename = fmt-9.0.0.tar.gz
-source_hash = 9a1e0e9e843a356d65c7604e2c8bf9402b50fe294c355de0095ebd42fb9bd2c5
-patch_filename = fmt_9.0.0-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/fmt_9.0.0-1/get_patch
-patch_hash = 5f12924065e0fe7ccae40593d256a082955c273cb2880b3e3de05df9d8d10697
-wrapdb_version = 9.0.0-1
+directory = fmt-9.1.0
+source_url = https://github.com/fmtlib/fmt/archive/9.1.0.tar.gz
+source_filename = fmt-9.1.0.tar.gz
+source_hash = 5dea48d1fcddc3ec571ce2058e13910a0d4a6bab4cc09a809d8b1dd1c88ae6f2
+patch_filename = fmt_9.1.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/fmt_9.1.0-1/get_patch
+patch_hash = 4557b9ba87b3eb63694ed9b21d1a2117d4a97ca56b91085b10288e9a5294adf8
+wrapdb_version = 9.1.0-1
 
 [provide]
 fmt = fmt_dep

test/meson.build

@@ -288,7 +288,8 @@ if enable_database
       dependencies: [
         log_dep,
         tag_dep,
-        storage_glue_dep,
+        fs_dep,
+        storage_plugins_dep,
         gtest_dep,
       ],
     ),

test/test_translate_song.cxx

@@ -14,6 +14,7 @@
 #include "ls.hxx"
 #include "Log.hxx"
 #include "db/DatabaseSong.hxx"
+#include "storage/Registry.hxx"
 #include "storage/StorageInterface.hxx"
 #include "storage/plugins/LocalStorage.hxx"
 #include "Mapper.hxx"
@@ -36,6 +37,13 @@ uri_supported_scheme(const char *uri) noexcept
 	return strncmp(uri, "http://", 7) == 0;
 }
 
+const StoragePlugin *
+GetStoragePluginByUri(const char *) noexcept
+{
+	// dummy symbol
+	return nullptr;
+}
+
 static constexpr auto music_directory = PATH_LITERAL("/music");
 static Storage *storage;