release v0.23.12

If the environment variable $HOME does not exist, don't attempt to
obtain it from /etc/passwd; without $HOME, the calling process
indicates that it does not wish MPD to access the home directory.

This also prevents MPD from attempting to load
`/root/.config/mpd/mpd.conf` if MPD got started as global systemd
service.  Reading from there makes no sense, only /etc/mpd.conf shall
be used then.

This piece of code was initially added by commit 5d85792178.

Closes https://github.com/MusicPlayerDaemon/MPD/issues/1687

NEWS

@@ -1,3 +1,38 @@
+ver 0.23.12 (2023/01/17)
+* input
+  - curl: require CURL 7.55.0 or later
+* decoder
+  - mad: fix integer underflow with very small files
+* tags
+  - fix crash bug due to race condition
+* output
+  - pipewire: adjust to PipeWire 0.3.64 API change
+* fix build failures with GCC 13
+
+ver 0.23.11 (2022/11/28)
+* database
+  - simple: move default database to ~/.cache/mpd/db from ~/.cache/mpd.db
+  - simple: default "cache_directory" to ~/.cache/mpd/mounts
+* macOS: fix build failure "no archive members specified"
+* Windows
+  - fix crash bug (stack buffer overflow) after I/O errors
+  - fix path traversal bug because backslash was allowed in playlist names
+* Android/Windows
+  - update OpenSSL to 3.0.7
+  - re-enable CURL's verbose error strings
+
+ver 0.23.10 (2022/10/14)
+* storage
+  - curl: fix file time stamps
+* decoder
+  - ffmpeg: fix libfmt 9 compiler warning
+* encoder
+  - flac: fix failure when libFLAC is built without Ogg support
+* output
+  - alsa: fix crash bug
+* Windows
+  - log to stdout by default, don't require "log_file" setting
+
 ver 0.23.9 (2022/08/18)
 * input
   - cdio_paranoia: add options "mode" and "skip"

android/AndroidManifest.xml

@@ -2,8 +2,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           package="org.musicpd"
           android:installLocation="auto"
-          android:versionCode="68"
-          android:versionName="0.23.9">
+          android:versionCode="71"
+          android:versionName="0.23.12">
 
   <uses-sdk android:minSdkVersion="21" android:targetSdkVersion="30"/>
 

doc/conf.py

@@ -38,7 +38,10 @@ author = 'Max Kellermann'
 # built documents.
 #
 # The short X.Y version.
-version = '0.23.9'
+with open('../meson.build') as f:
+    import re
+    version = re.match(r"project\([^\)]*\bversion:\s*'([^']+)'",
+                       f.read(4096)).group(1)
 # The full version, including alpha/beta/rc tags.
 #release = version + '~git'
 
@@ -47,7 +50,7 @@ version = '0.23.9'
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = "en"
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

doc/index.rst

@@ -11,6 +11,12 @@ Music Player Daemon
    client
    protocol
 
+.. toctree::
+   :maxdepth: 1
+   :caption: man pages:
+
+   mpd.1
+   mpd.conf.5
 
 Indices and tables
 ==================

doc/plugins.rst

@@ -219,8 +219,9 @@ Opens remote files or streams over HTTP using libcurl.
 
 Note that unless overridden by the below settings (e.g. by setting
 them to a blank value), general curl configuration from environment
-variables such as ``http_proxy`` or specified in :file:`~/.curlrc`
-will be in effect.
+variables such as ``http_proxy`` will be in effect.
+
+User name and password are read from an optional :file:`~/.netrc`, :file:`~/.curlrc` is not read.
 
 .. list-table::
    :widths: 20 80

doc/user.rst

@@ -199,7 +199,7 @@ Compiling for Android
 You need:
 
 * Android SDK
-* `Android NDK r23 <https://developer.android.com/ndk/downloads>`_
+* `Android NDK r25b <https://developer.android.com/ndk/downloads>`_
 * `Meson 0.56.0 <http://mesonbuild.com/>`__ and `Ninja
   <https://ninja-build.org/>`__
 * cmake

meson.build

@@ -1,7 +1,7 @@
 project(
   'mpd',
   ['c', 'cpp'],
-  version: '0.23.9',
+  version: '0.23.12',
   meson_version: '>= 0.56.0',
   default_options: [
     'c_std=c11',
@@ -205,7 +205,6 @@ enable_daemon = not is_windows and not is_android and get_option('daemon')
 conf.set('ENABLE_DAEMON', enable_daemon)
 
 conf.set('HAVE_GETPWNAM_R', compiler.has_function('getpwnam_r'))
-conf.set('HAVE_GETPWUID_R', compiler.has_function('getpwuid_r'))
 conf.set('HAVE_INITGROUPS', compiler.has_function('initgroups'))
 conf.set('HAVE_FNMATCH', compiler.has_function('fnmatch'))
 
@@ -251,6 +250,14 @@ endif
 
 fmt_dep = dependency('fmt', fallback: ['fmt', 'fmt_dep'])
 
+if compiler.get_id() == 'clang' and compiler.version().version_compare('<15')
+  fmt_dep = declare_dependency(
+    dependencies: fmt_dep,
+    # suppress bogus clang 14 warning (the version in Android NDK r25b)
+    compile_args: ['-Wno-unused-local-typedef'],
+  )
+endif
+
 log = static_library(
   'log',
   'src/Log.cxx',
@@ -382,6 +389,7 @@ endif
 
 if enable_database
   sources += [
+    'src/storage/StorageState.cxx',
     'src/queue/PlaylistUpdate.cxx',
     'src/command/StorageCommands.cxx',
     'src/command/DatabaseCommands.cxx',

python/build/libs.py

@@ -43,20 +43,22 @@ opus = AutotoolsProject(
 )
 
 flac = AutotoolsProject(
-    'http://downloads.xiph.org/releases/flac/flac-1.3.4.tar.xz',
-    '8ff0607e75a322dd7cd6ec48f4f225471404ae2730d0ea945127b1355155e737',
+    'http://downloads.xiph.org/releases/flac/flac-1.4.2.tar.xz',
+    'e322d58a1f48d23d9dd38f432672865f6f79e73a6f9cc5a5f57fcaa83eb5a8e4',
     'lib/libFLAC.a',
     [
         '--disable-shared', '--enable-static',
+        '--disable-stack-smash-protection',
         '--disable-xmms-plugin', '--disable-cpplibs',
         '--disable-doxygen-docs',
+        '--disable-programs',
     ],
     subdirs=['include', 'src/libFLAC'],
 )
 
 zlib = ZlibProject(
-    'http://zlib.net/zlib-1.2.12.tar.xz',
-    '7db46b8d7726232a621befaab4a1c870f00a90805511c0e0090441dac57def18',
+    'http://zlib.net/zlib-1.2.13.tar.xz',
+    'd14c38e313afc35a9a8760dadf26042f51ea0f5d154b0630a31da0540107fb98',
     'lib/libz.a',
 )
 
@@ -112,16 +114,20 @@ libmodplug = AutotoolsProject(
 )
 
 libopenmpt = AutotoolsProject(
-    'https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-0.5.12+release.autotools.tar.gz',
-    '892aea7a599b5d21842bebf463b5aafdad5711be7008dd84401920c6234820af',
+    'https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-0.6.6+release.autotools.tar.gz',
+    '6ddb9e26a430620944891796fefb1bbb38bd9148f6cfc558810c0d3f269876c7',
     'lib/libopenmpt.a',
     [
         '--disable-shared', '--enable-static',
         '--disable-openmpt123',
+        '--disable-examples',
+        '--disable-tests',
+        '--disable-doxygen-doc',
         '--without-mpg123', '--without-ogg', '--without-vorbis', '--without-vorbisfile',
         '--without-portaudio', '--without-portaudiocpp', '--without-sndfile',
+        '--without-flac',
     ],
-    base='libopenmpt-0.5.12+release.autotools',
+    base='libopenmpt-0.6.6+release.autotools',
 )
 
 wildmidi = CmakeProject(
@@ -151,8 +157,8 @@ gme = CmakeProject(
 )
 
 ffmpeg = FfmpegProject(
-    'http://ffmpeg.org/releases/ffmpeg-5.1.tar.xz',
-    '55eb6aab5ee235550fa54a33eaf8bf1b4ec66c01453182b12f6a993d75698b03',
+    'http://ffmpeg.org/releases/ffmpeg-5.1.2.tar.xz',
+    '619e706d662c8420859832ddc259cd4d4096a48a2ce1eefd052db9e440eef3dc',
     'lib/libavcodec.a',
     [
         '--disable-shared', '--enable-static',
@@ -381,19 +387,18 @@ ffmpeg = FfmpegProject(
 )
 
 openssl = OpenSSLProject(
-    'https://www.openssl.org/source/openssl-3.0.5.tar.gz',
-    'aa7d8d9bef71ad6525c55ba11e5f4397889ce49c2c9349dcea6d3e4f0b024a7a',
+    'https://www.openssl.org/source/openssl-3.0.7.tar.gz',
+    '83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e',
     'include/openssl/ossl_typ.h',
 )
 
 curl = CmakeProject(
-    'https://curl.se/download/curl-7.84.0.tar.xz',
-    '2d118b43f547bfe5bae806d8d47b4e596ea5b25a6c1f080aef49fbcd817c5db8',
+    'https://curl.se/download/curl-7.87.0.tar.xz',
+    'ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff',
     'lib/libcurl.a',
     [
         '-DBUILD_CURL_EXE=OFF',
         '-DBUILD_SHARED_LIBS=OFF',
-        '-DCURL_DISABLE_VERBOSE_STRINGS=ON',
         '-DCURL_DISABLE_LDAP=ON',
         '-DCURL_DISABLE_TELNET=ON',
         '-DCURL_DISABLE_DICT=ON',
@@ -422,8 +427,8 @@ curl = CmakeProject(
 )
 
 libnfs = AutotoolsProject(
-    'https://github.com/sahlberg/libnfs/archive/libnfs-5.0.1.tar.gz',
-    '7ef445410b42f36b9bad426608b53ccb9ccca4101e545c383f564c11db672ca8',
+    'https://github.com/sahlberg/libnfs/archive/libnfs-5.0.2.tar.gz',
+    '637e56643b19da9fba98f06847788c4dad308b723156a64748041035dcdf9bd3',
     'lib/libnfs.a',
     [
         '--disable-shared', '--enable-static',
@@ -434,7 +439,7 @@ libnfs = AutotoolsProject(
 
         '--disable-utils', '--disable-examples',
     ],
-    base='libnfs-libnfs-5.0.1',
+    base='libnfs-libnfs-5.0.2',
     autoreconf=True,
 )
 
@@ -445,7 +450,7 @@ jack = JackProject(
 )
 
 boost = BoostProject(
-    'https://boostorg.jfrog.io/artifactory/main/release/1.79.0/source/boost_1_79_0.tar.bz2',
-    '475d589d51a7f8b3ba2ba4eda022b170e562ca3b760ee922c146b6c65856ef39',
+    'https://boostorg.jfrog.io/artifactory/main/release/1.81.0/source/boost_1_81_0.tar.bz2',
+    '71feeed900fbccca04a3b4f2f84a7c217186f28a940ed8b7ed4725986baf99fa',
     'include/boost/version.hpp',
 )

python/build/meson.py

@@ -82,8 +82,8 @@ endian = '{endian}'
 def configure(toolchain, src, build, args=()):
     cross_file = make_cross_file(toolchain)
     configure = [
-        'meson',
-        src, build,
+        'meson', 'setup',
+        build, src,
 
         '--prefix', toolchain.install_prefix,
 

src/LogInit.cxx

@@ -158,12 +158,15 @@ log_init(const ConfigData &config, bool verbose, bool use_stdout)
 			    getenv("NOTIFY_SOCKET") != nullptr) {
 				/* if MPD was started as a systemd
 				   service, default to journal (which
-				   is connected to fd=2) */
+				   is connected to stdout&stderr) */
 				out_fd = STDOUT_FILENO;
 				return;
 			}
 #endif
-#ifndef HAVE_SYSLOG
+#ifdef _WIN32
+			/* default to stdout on Windows */
+			out_fd = STDOUT_FILENO;
+#elif !defined(HAVE_SYSLOG)
 			throw std::runtime_error("config parameter 'log_file' not found");
 #endif
 #ifdef HAVE_SYSLOG

src/PlaylistFile.cxx

@@ -81,6 +81,9 @@ spl_valid_name(const char *name_utf8)
 	 */
 
 	return std::strchr(name_utf8, '/') == nullptr &&
+#ifdef _WIN32
+		std::strchr(name_utf8, '\\') == nullptr &&
+#endif
 		std::strchr(name_utf8, '\n') == nullptr &&
 		std::strchr(name_utf8, '\r') == nullptr;
 }

src/RemoteTagCache.hxx

@@ -28,7 +28,11 @@
 #include <boost/intrusive/list.hpp>
 #include <boost/intrusive/unordered_set.hpp>
 
+#include <array>
+#include <functional>
+#include <memory>
 #include <string>
+#include <utility>
 
 class RemoteTagCacheHandler;
 

src/StateFileConfig.cxx

@@ -32,7 +32,7 @@ StateFileConfig::StateFileConfig(const ConfigData &config)
 {
 #ifdef ANDROID
 	if (path.IsNull()) {
-		const auto cache_dir = GetUserCacheDir();
+		const auto cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return;
 

src/android/Context.cxx

@@ -46,7 +46,7 @@ Context::Initialise(JNIEnv *env) noexcept
 AllocatedPath
 Context::GetExternalFilesDir(JNIEnv *env, const char *type) noexcept
 {
-	assert(_type != nullptr);
+	assert(type != nullptr);
 
 	jobject file = env->CallObjectMethod(Get(), getExternalFilesDir_method,
 					     Java::String::Optional(env, type).Get());

src/archive/plugins/Iso9660ArchivePlugin.cxx

@@ -166,7 +166,7 @@ class Iso9660InputStream final : public InputStream {
 			assert(fill <= data.size());
 			assert(position <= fill);
 
-			return {&data[position], &data[fill]};
+			return {data.data() + position, data.data() + fill};
 		}
 
 		void Consume(size_t nbytes) noexcept {

src/archive/plugins/meson.build

@@ -22,6 +22,10 @@ if libzzip_dep.found()
   found_archive_plugin = true
 endif
 
+if not found_archive_plugin
+  subdir_done()
+endif
+
 archive_plugins = static_library(
   'archive_plugins',
   archive_plugins_sources,

src/db/Configured.cxx

@@ -24,6 +24,7 @@
 #include "config/Param.hxx"
 #include "config/Block.hxx"
 #include "fs/AllocatedPath.hxx"
+#include "fs/FileSystem.hxx"
 #include "fs/StandardDirectory.hxx"
 #include "util/RuntimeError.hxx"
 
@@ -51,17 +52,30 @@ CreateConfiguredDatabase(const ConfigData &config,
 	} else {
 		/* if there is no override, use the cache directory */
 
-		const AllocatedPath cache_dir = GetUserCacheDir();
+		const AllocatedPath cache_dir = GetAppCacheDir();
 		if (cache_dir.IsNull())
 			return nullptr;
 
-		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("mpd.db"));
+		const auto db_file = cache_dir / Path::FromFS(PATH_LITERAL("db"));
 		auto db_file_utf8 = db_file.ToUTF8();
 		if (db_file_utf8.empty())
 			return nullptr;
 
 		ConfigBlock block;
 		block.AddBlockParam("path", std::move(db_file_utf8), -1);
+
+		{
+			const auto mounts_dir = cache_dir
+				/ Path::FromFS(PATH_LITERAL("mounts"));
+			CreateDirectoryNoThrow(mounts_dir);
+
+			if (auto mounts_dir_utf8 = mounts_dir.ToUTF8();
+			    !mounts_dir_utf8.empty())
+				block.AddBlockParam("cache_directory",
+						    std::move(mounts_dir_utf8),
+						    -1);
+		}
+
 		return DatabaseGlobalInit(main_event_loop, io_event_loop,
 					  listener, block);
 	}

src/decoder/plugins/FfmpegDecoderPlugin.cxx

@@ -31,6 +31,7 @@
 #include "lib/ffmpeg/Format.hxx"
 #include "lib/ffmpeg/Codec.hxx"
 #include "lib/ffmpeg/SampleFormat.hxx"
+#include "lib/ffmpeg/LibFmt.hxx"
 #include "../DecoderAPI.hxx"
 #include "FfmpegMetaData.hxx"
 #include "FfmpegIo.hxx"

src/decoder/plugins/MadDecoderPlugin.cxx

@@ -798,6 +798,8 @@ MadDecoder::UpdateTimerNextFrame() noexcept
 DecoderCommand
 MadDecoder::SubmitPCM(size_t i, size_t pcm_length) noexcept
 {
+	assert(i <= pcm_length);
+
 	size_t num_samples = pcm_length - i;
 
 	mad_fixed_to_24_buffer(output_buffer, synth.pcm,
@@ -843,7 +845,7 @@ MadDecoder::SynthAndSubmit() noexcept
 	size_t pcm_length = synth.pcm.length;
 	if (drop_end_samples &&
 	    current_frame == max_frames - drop_end_frames - 1) {
-		if (drop_end_samples >= pcm_length)
+		if (i + drop_end_samples >= pcm_length)
 			return DecoderCommand::STOP;
 
 		pcm_length -= drop_end_samples;

src/encoder/plugins/FlacEncoderPlugin.cxx

@@ -38,6 +38,7 @@ class FlacEncoder final : public Encoder {
 
 	FLAC__StreamEncoder *const fse;
 	const unsigned compression;
+	const bool oggflac;
 
 	PcmBuffer expand_buffer;
 
@@ -122,7 +123,7 @@ flac_encoder_init(const ConfigBlock &block)
 }
 
 static void
-flac_encoder_setup(FLAC__StreamEncoder *fse, unsigned compression,
+flac_encoder_setup(FLAC__StreamEncoder *fse, unsigned compression, bool oggflac,
 		   const AudioFormat &audio_format)
 {
 	unsigned bits_per_sample;
@@ -157,7 +158,7 @@ flac_encoder_setup(FLAC__StreamEncoder *fse, unsigned compression,
 		throw FormatRuntimeError("error setting flac sample rate to %d",
 					 audio_format.sample_rate);
 
-	if (!FLAC__stream_encoder_set_ogg_serial_number(fse,
+	if (oggflac && !FLAC__stream_encoder_set_ogg_serial_number(fse,
 						  GenerateSerial()))
 		throw FormatRuntimeError("error setting ogg serial number");
 }
@@ -166,11 +167,12 @@ FlacEncoder::FlacEncoder(AudioFormat _audio_format, FLAC__StreamEncoder *_fse, u
 	:Encoder(_oggchaining),
 	 audio_format(_audio_format), fse(_fse),
 	 compression(_compression),
+	 oggflac(_oggflac),
 	 output_buffer(8192)
 {
 	/* this immediately outputs data through callback */
 
-	auto init_status = _oggflac ?
+	auto init_status = oggflac ?
 		FLAC__stream_encoder_init_ogg_stream(fse,
 						     nullptr, WriteCallback,
 						     nullptr, nullptr, nullptr,
@@ -209,7 +211,7 @@ PreparedFlacEncoder::Open(AudioFormat &audio_format)
 		throw std::runtime_error("FLAC__stream_encoder_new() failed");
 
 	try {
-		flac_encoder_setup(fse, compression, audio_format);
+		flac_encoder_setup(fse, compression, oggflac, audio_format);
 	} catch (...) {
 		FLAC__stream_encoder_delete(fse);
 		throw;
@@ -222,7 +224,7 @@ void
 FlacEncoder::SendTag(const Tag &tag)
 {
 	/* re-initialize encoder since flac_encoder_finish resets everything */
-	flac_encoder_setup(fse, compression, audio_format);
+	flac_encoder_setup(fse, compression, oggflac, audio_format);
 
 	FLAC__StreamMetadata *metadata = FLAC__metadata_object_new(FLAC__METADATA_TYPE_VORBIS_COMMENT);
 	FLAC__StreamMetadata_VorbisComment_Entry entry;

src/fs/FileSystem.hxx

@@ -67,6 +67,16 @@ StatFile(Path file, struct stat &buf, bool follow_symlinks = true)
 
 #endif
 
+static inline bool
+CreateDirectoryNoThrow(Path path) noexcept
+{
+#ifdef _WIN32
+	return CreateDirectory(path.c_str(), nullptr);
+#else
+	return mkdir(path.c_str(), 0777);
+#endif
+}
+
 /**
  * Truncate a file that exists already.  Throws std::system_error on
  * error.

src/fs/StandardDirectory.cxx

@@ -34,7 +34,6 @@
 #include <shlobj.h>
 #else
 #include <stdlib.h>
-#include <unistd.h>
 #include <pwd.h>
 #endif
 
@@ -53,6 +52,12 @@
 #include "Main.hxx"
 #endif
 
+#ifdef USE_XDG
+#include "Version.h" // for PACKAGE_NAME
+#define APP_FILENAME PATH_LITERAL(PACKAGE_NAME)
+static constexpr Path app_filename = Path::FromFS(APP_FILENAME);
+#endif
+
 #if !defined(_WIN32) && !defined(ANDROID)
 class PasswdEntry
 {
@@ -74,15 +79,6 @@ public:
 		return result != nullptr;
 	}
 
-	bool ReadByUid(uid_t uid) {
-#ifdef HAVE_GETPWUID_R
-		getpwuid_r(uid, &pw, buf.data(), buf.size(), &result);
-#else
-		result = getpwuid(uid);
-#endif
-		return result != nullptr;
-	}
-
 	const passwd *operator->() {
 		assert(result != nullptr);
 		return result;
@@ -284,6 +280,24 @@ GetUserCacheDir() noexcept
 #endif
 }
 
+AllocatedPath
+GetAppCacheDir() noexcept
+{
+#ifdef USE_XDG
+	if (const auto user_dir = GetUserCacheDir(); !user_dir.IsNull()) {
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
+		return dir;
+	}
+
+	return nullptr;
+#elif defined(ANDROID)
+	return context->GetCacheDir(Java::GetEnv());
+#else
+	return nullptr;
+#endif
+}
+
 AllocatedPath
 GetUserRuntimeDir() noexcept
 {
@@ -297,7 +311,7 @@ GetUserRuntimeDir() noexcept
 AllocatedPath
 GetAppRuntimeDir() noexcept
 {
-#ifdef __linux__
+#if defined(__linux__) && !defined(ANDROID)
 	/* systemd specific; see systemd.exec(5) */
 	if (const char *runtime_directory = getenv("RUNTIME_DIRECTORY"))
 		if (auto dir = StringView{runtime_directory}.Split(':').first;
@@ -307,8 +321,8 @@ GetAppRuntimeDir() noexcept
 
 #ifdef USE_XDG
 	if (const auto user_dir = GetUserRuntimeDir(); !user_dir.IsNull()) {
-		auto dir = user_dir / Path::FromFS("mpd");
-		mkdir(dir.c_str(), 0700);
+		auto dir = user_dir / app_filename;
+		CreateDirectoryNoThrow(dir);
 		return dir;
 	}
 #endif
@@ -351,10 +365,8 @@ GetHomeDir() noexcept
 	if (const auto home = getenv("HOME");
 	    IsValidPathString(home) && IsValidDir(home))
 		return AllocatedPath::FromFS(home);
-
-	if (PasswdEntry pw; pw.ReadByUid(getuid()))
-		return SafePathFromFS(pw->pw_dir);
 #endif
+
 	return nullptr;
 }
 

src/fs/StandardDirectory.hxx

@@ -43,6 +43,13 @@ GetUserMusicDir() noexcept;
 AllocatedPath
 GetUserCacheDir() noexcept;
 
+/**
+ * Obtains cache directory for this application.
+ */
+[[gnu::const]]
+AllocatedPath
+GetAppCacheDir() noexcept;
+
 /**
  * Obtains the runtime directory for the current user.
  */

src/input/plugins/CurlInputPlugin.cxx

@@ -439,6 +439,14 @@ CurlInputStream::InitEasy()
 	request->SetVerifyPeer(verify_peer);
 	request->SetVerifyHost(verify_host);
 	request->SetOption(CURLOPT_HTTPHEADER, request_headers.Get());
+
+	try {
+		request->SetProxyVerifyPeer(verify_peer);
+		request->SetProxyVerifyHost(verify_host);
+	} catch (...) {
+		/* these methods fail if libCURL was compiled with
+		   CURL_DISABLE_PROXY; ignore silently */
+	}
 }
 
 void

src/io/FileReader.hxx

@@ -42,6 +42,8 @@
 #include "io/UniqueFileDescriptor.hxx"
 #endif
 
+#include <cstdint>
+
 class Path;
 class FileInfo;
 

src/java/File.cxx

@@ -49,9 +49,6 @@ Java::File::Initialise(JNIEnv *env) noexcept
 AllocatedPath
 Java::File::ToAbsolutePath(JNIEnv *env, jobject _file) noexcept
 {
-	assert(env != nullptr);
-	assert(_file != nullptr);
-
 	LocalObject file(env, _file);
 
 	const jstring path = GetAbsolutePath(env, file);

src/lib/curl/Easy.hxx

@@ -186,10 +186,6 @@ public:
 		SetOption(CURLOPT_POSTFIELDSIZE, (long)size);
 	}
 
-	void SetHttpPost(const struct curl_httppost *post) {
-		SetOption(CURLOPT_HTTPPOST, post);
-	}
-
 	template<typename T>
 	bool GetInfo(CURLINFO info, T value_r) const noexcept {
 		return ::curl_easy_getinfo(handle, info, value_r) == CURLE_OK;
@@ -199,10 +195,10 @@ public:
 	 * Returns the response body's size, or -1 if that is unknown.
 	 */
 	[[gnu::pure]]
-	int64_t GetContentLength() const noexcept {
-		double value;
-		return GetInfo(CURLINFO_CONTENT_LENGTH_DOWNLOAD, &value)
-			? (int64_t)value
+	curl_off_t GetContentLength() const noexcept {
+		curl_off_t value;
+		return GetInfo(CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &value)
+			? value
 			: -1;
 	}
 

src/lib/curl/Request.hxx

@@ -123,6 +123,14 @@ public:
 		easy.SetVerifyPeer(value);
 	}
 
+	void SetProxyVerifyHost(bool value) {
+		easy.SetOption(CURLOPT_PROXY_SSL_VERIFYHOST, value ? 2L : 0L);
+	}
+
+	void SetProxyVerifyPeer(bool value) {
+		easy.SetOption(CURLOPT_PROXY_SSL_VERIFYPEER, value);
+	}
+
 	void SetNoBody(bool value=true) {
 		easy.SetNoBody(value);
 	}

src/lib/curl/meson.build

@@ -1,4 +1,4 @@
-curl_dep = dependency('libcurl', version: '>= 7.33', required: get_option('curl'))
+curl_dep = dependency('libcurl', version: '>= 7.55', required: get_option('curl'))
 conf.set('ENABLE_CURL', curl_dep.found())
 if not curl_dep.found()
   subdir_done()

src/lib/ffmpeg/LibFmt.hxx

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2003-2022 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#pragma once
+
+extern "C" {
+#include <libavutil/samplefmt.h>
+}
+
+#include <fmt/format.h>
+
+template<>
+struct fmt::formatter<AVSampleFormat> : formatter<string_view>
+{
+	template<typename FormatContext>
+	auto format(const AVSampleFormat format, FormatContext &ctx) {
+		const char *name = av_get_sample_fmt_name(format);
+		if (name == nullptr)
+			name = "?";
+
+		return formatter<string_view>::format(name, ctx);
+	}
+};

src/output/plugins/AlsaOutputPlugin.cxx

@@ -812,8 +812,12 @@ AlsaOutput::Open(AudioFormat &audio_format)
 				      fmt::format("Failed to open ALSA device \"{}\"",
 						  GetDevice()).c_str());
 
+	const char *pcm_name = snd_pcm_name(pcm);
+	if (pcm_name == nullptr)
+		pcm_name = "?";
+
 	FmtDebug(alsa_output_domain, "opened {} type={}",
-		 snd_pcm_name(pcm),
+		 pcm_name,
 		 snd_pcm_type_name(snd_pcm_type(pcm)));
 
 #ifdef ENABLE_DSD

src/output/plugins/PipeWireOutputPlugin.cxx

@@ -523,7 +523,13 @@ PipeWireOutput::Open(AudioFormat &audio_format)
 		pw_properties_setf(props, PW_KEY_REMOTE_NAME, "%s", remote);
 
 	if (target != nullptr && target_id == PW_ID_ANY)
-		pw_properties_setf(props, PW_KEY_NODE_TARGET, "%s", target);
+		pw_properties_setf(props,
+#if PW_CHECK_VERSION(0, 3, 64)
+				   PW_KEY_TARGET_OBJECT,
+#else
+				   PW_KEY_NODE_TARGET,
+#endif
+				   "%s", target);
 
 #ifdef PW_KEY_NODE_RATE
 	/* ask PipeWire to change the graph sample rate to ours

src/storage/meson.build

@@ -17,7 +17,6 @@ storage_glue = static_library(
   'CompositeStorage.cxx',
   'MemoryDirectoryReader.cxx',
   'Configured.cxx',
-  'StorageState.cxx',
   include_directories: inc,
   dependencies: [
     boost_dep,
@@ -31,4 +30,3 @@ storage_glue_dep = declare_dependency(
     storage_plugins_dep,
   ],
 )
-

src/storage/plugins/CurlStorage.cxx

@@ -34,7 +34,6 @@
 #include "event/InjectEvent.hxx"
 #include "thread/Mutex.hxx"
 #include "thread/Cond.hxx"
-#include "time/Parser.hxx"
 #include "util/ASCII.hxx"
 #include "util/RuntimeError.hxx"
 #include "util/StringCompare.hxx"
@@ -171,8 +170,9 @@ struct DavResponse {
 	}
 };
 
+[[gnu::pure]]
 static unsigned
-ParseStatus(const char *s)
+ParseStatus(const char *s) noexcept
 {
 	/* skip the "HTTP/1.1" prefix */
 	const char *space = std::strchr(s, ' ');
@@ -182,37 +182,37 @@ ParseStatus(const char *s)
 	return strtoul(space + 1, nullptr, 10);
 }
 
+[[gnu::pure]]
 static unsigned
-ParseStatus(const char *s, size_t length)
+ParseStatus(const char *s, size_t length) noexcept
 {
 	return ParseStatus(std::string(s, length).c_str());
 }
 
+[[gnu::pure]]
 static std::chrono::system_clock::time_point
-ParseTimeStamp(const char *s)
+ParseTimeStamp(const char *s) noexcept
 {
-	try {
-		// TODO: make this more robust
-		return ParseTimePoint(s, "%a, %d %b %Y %T");
-	} catch (...) {
-		return std::chrono::system_clock::time_point::min();
-	}
+	return std::chrono::system_clock::from_time_t(curl_getdate(s, nullptr));
 }
 
+[[gnu::pure]]
 static std::chrono::system_clock::time_point
-ParseTimeStamp(const char *s, size_t length)
+ParseTimeStamp(const char *s, size_t length) noexcept
 {
 	return ParseTimeStamp(std::string(s, length).c_str());
 }
 
+[[gnu::pure]]
 static uint64_t
-ParseU64(const char *s)
+ParseU64(const char *s) noexcept
 {
 	return strtoull(s, nullptr, 10);
 }
 
+[[gnu::pure]]
 static uint64_t
-ParseU64(const char *s, size_t length)
+ParseU64(const char *s, size_t length) noexcept
 {
 	return ParseU64(std::string(s, length).c_str());
 }
@@ -278,6 +278,7 @@ public:
 				  "<a:resourcetype/>"
 				  "<a:getcontenttype/>"
 				  "<a:getcontentlength/>"
+				  "<a:getlastmodified/>"
 				  "</a:prop>"
 				  "</a:propfind>");
 	}

src/system/Error.hxx

@@ -70,8 +70,11 @@ FormatLastError(DWORD code, const char *fmt, Args&&... args) noexcept
 {
 	char buffer[512];
 	const auto end = buffer + sizeof(buffer);
-	size_t length = snprintf(buffer, sizeof(buffer) - 128,
+	constexpr std::size_t max_prefix = sizeof(buffer) - 128;
+	size_t length = snprintf(buffer, max_prefix,
 				 fmt, std::forward<Args>(args)...);
+	if (length >= max_prefix)
+		length = max_prefix - 1;
 	char *p = buffer + length;
 	*p++ = ':';
 	*p++ = ' ';

src/tag/Builder.cxx

@@ -263,8 +263,14 @@ TagBuilder::RemoveAll() noexcept
 void
 TagBuilder::RemoveType(TagType type) noexcept
 {
+	if (items.empty())
+		/* don't acquire the tag_pool_lock if we're not going
+		   to call tag_pool_put_item() anyway */
+		return;
+
 	const auto begin = items.begin(), end = items.end();
 
+	const std::scoped_lock<Mutex> protect(tag_pool_lock);
 	items.erase(std::remove_if(begin, end,
 				   [type](TagItem *item) {
 					   if (item->type != type)

src/time/Parser.cxx

@@ -1,57 +0,0 @@
-/*
- * Copyright 2014-2019 Max Kellermann <max.kellermann@gmail.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * - Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * - Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the
- * distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
- * FOUNDATION OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "Parser.hxx"
-#include "Convert.hxx"
-
-#include <cassert>
-#include <stdexcept>
-
-#include <time.h>
-
-std::chrono::system_clock::time_point
-ParseTimePoint(const char *s, const char *format)
-{
-	assert(s != nullptr);
-	assert(format != nullptr);
-
-#ifdef _WIN32
-	/* TODO: emulate strptime()? */
-	(void)s;
-	(void)format;
-	throw std::runtime_error("Time parsing not implemented on Windows");
-#else
-	struct tm tm{};
-	const char *end = strptime(s, format, &tm);
-	if (end == nullptr || *end != 0)
-		throw std::runtime_error("Failed to parse time stamp");
-
-	return TimeGm(tm);
-#endif /* !_WIN32 */
-}

src/time/Parser.hxx

@@ -1,43 +0,0 @@
-/*
- * Copyright 2014-2019 Max Kellermann <max.kellermann@gmail.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * - Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * - Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the
- * distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
- * FOUNDATION OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef TIME_PARSER_HXX
-#define TIME_PARSER_HXX
-
-#include <chrono>
-
-/**
- * Parse a time stamp.
- *
- * Throws std::runtime_error on error.
- */
-std::chrono::system_clock::time_point
-ParseTimePoint(const char *s, const char *format);
-
-#endif

src/time/meson.build

@@ -1,6 +1,5 @@
 time = static_library(
   'time',
-  'Parser.cxx',
   'Convert.cxx',
   'ISO8601.cxx',
   'Math.cxx',

subprojects/expat.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = expat-2.4.8
-source_url = https://github.com/libexpat/libexpat/releases/download/R_2_4_8/expat-2.4.8.tar.xz
-source_filename = expat-2.4.8.tar.bz2
-source_hash = f79b8f904b749e3e0d20afeadecf8249c55b2e32d4ebb089ae378df479dcaf25
-patch_filename = expat_2.4.8-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.4.8-1/get_patch
-patch_hash = 9aec253a2c6d1c0feb852c5c6920298d14701eeec7acc6832bb402438b52112a
+directory = expat-2.5.0
+source_url = https://github.com/libexpat/libexpat/releases/download/R_2_5_0/expat-2.5.0.tar.xz
+source_filename = expat-2.5.0.tar.bz2
+source_hash = ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
+patch_filename = expat_2.5.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/expat_2.5.0-1/get_patch
+patch_hash = 0d0d6e07ed21cf4892126a8270f5fd182012ab34b3ebe24932a2bef5ca608a61
+wrapdb_version = 2.5.0-1
 
 [provide]
 expat = expat_dep
-

subprojects/fmt.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = fmt-8.1.1
-source_url = https://github.com/fmtlib/fmt/archive/8.1.1.tar.gz
-source_filename = fmt-8.1.1.tar.gz
-source_hash = 3d794d3cf67633b34b2771eb9f073bde87e846e0d395d254df7b211ef1ec7346
-patch_filename = fmt_8.1.1-2_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/fmt_8.1.1-2/get_patch
-patch_hash = cd001046281330a8862591780a9ea71a1fa594edd0d015deb24e44680c9ea33b
-wrapdb_version = 8.1.1-2
+directory = fmt-9.1.0
+source_url = https://github.com/fmtlib/fmt/archive/9.1.0.tar.gz
+source_filename = fmt-9.1.0.tar.gz
+source_hash = 5dea48d1fcddc3ec571ce2058e13910a0d4a6bab4cc09a809d8b1dd1c88ae6f2
+patch_filename = fmt_9.1.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/fmt_9.1.0-1/get_patch
+patch_hash = 4557b9ba87b3eb63694ed9b21d1a2117d4a97ca56b91085b10288e9a5294adf8
+wrapdb_version = 9.1.0-1
 
 [provide]
 fmt = fmt_dep

subprojects/sqlite3.wrap

@@ -1,12 +1,12 @@
 [wrap-file]
-directory = sqlite-amalgamation-3380000
-source_url = https://sqlite.org/2022/sqlite-amalgamation-3380000.zip
-source_filename = sqlite-amalgamation-3380000.zip
-source_hash = e055f6054e97747a135c89e36520c0a423249e8a91c5fc445163f4a6adb20df6
-patch_filename = sqlite3_3.38.0-1_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/sqlite3_3.38.0-1/get_patch
-patch_hash = 49e30bf010ff63ab772d5417885e6905379025ceac80382e292c6dbd3a9da744
+directory = sqlite-amalgamation-3390300
+source_url = https://sqlite.org/2022/sqlite-amalgamation-3390300.zip
+source_filename = sqlite-amalgamation-3390300.zip
+source_hash = a89db3030d229d860ae56a8bac50ac9761434047ae886e47e7c8f9f428fa98ad
+patch_filename = sqlite3_3.39.3-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/sqlite3_3.39.3-1/get_patch
+patch_hash = f5c41ff7b3da1108ed221b9a820b41188550cafb8a6c3d247bb40bd598775050
+wrapdb_version = 3.39.3-1
 
 [provide]
 sqlite3 = sqlite3_dep
-

subprojects/vorbis.wrap

@@ -3,13 +3,12 @@ directory = libvorbis-1.3.7
 source_url = https://downloads.xiph.org/releases/vorbis/libvorbis-1.3.7.tar.xz
 source_filename = libvorbis-1.3.7.tar.xz
 source_hash = b33cc4934322bcbf6efcbacf49e3ca01aadbea4114ec9589d1b1e9d20f72954b
-patch_filename = vorbis_1.3.7-3_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/vorbis_1.3.7-3/get_patch
-patch_hash = 6cb90a61ede8c64d3e8e379b96dcc800c9dd69e925122b3d73d8f59a563c3afa
-wrapdb_version = 1.3.7-3
+patch_filename = vorbis_1.3.7-4_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/vorbis_1.3.7-4/get_patch
+patch_hash = 979e22b24b16c927040700dfd8319cd6ba29bf52a14dbc66b1cb4ea60504f14a
+wrapdb_version = 1.3.7-4
 
 [provide]
 vorbis = vorbis_dep
 vorbisfile = vorbisfile_dep
 vorbisenc = vorbisenc_dep
-

test/meson.build

@@ -288,7 +288,8 @@ if enable_database
       dependencies: [
         log_dep,
         tag_dep,
-        storage_glue_dep,
+        fs_dep,
+        storage_plugins_dep,
         gtest_dep,
       ],
     ),
@@ -320,11 +321,6 @@ if curl_dep.found()
     include_directories: inc,
     dependencies: [
       curl_dep,
-
-      # Explicitly linking with zlib here works around a linker
-      # failure on Windows, because our Windows CURL build is
-      # statically linked and thus declares no dependency on zlib
-      zlib_dep,
     ],
   )
 

test/net/meson.build

@@ -19,6 +19,7 @@ test(
     include_directories: inc,
     dependencies: [
       net_dep,
+      util_dep,
       gtest_dep,
     ],
   ),

test/test_translate_song.cxx

@@ -14,6 +14,7 @@
 #include "ls.hxx"
 #include "Log.hxx"
 #include "db/DatabaseSong.hxx"
+#include "storage/Registry.hxx"
 #include "storage/StorageInterface.hxx"
 #include "storage/plugins/LocalStorage.hxx"
 #include "Mapper.hxx"
@@ -36,6 +37,13 @@ uri_supported_scheme(const char *uri) noexcept
 	return strncmp(uri, "http://", 7) == 0;
 }
 
+const StoragePlugin *
+GetStoragePluginByUri(const char *) noexcept
+{
+	// dummy symbol
+	return nullptr;
+}
+
 static constexpr auto music_directory = PATH_LITERAL("/music");
 static Storage *storage;