From 3a01cfc90c7d52856882d65815f716a933c13657 Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Fri, 21 Aug 2026 11:17:48 -0400 Subject: [PATCH 1/6] command/StickerCommands: validate find arguments After removing optional sort and window clauses, sticker find expects either four arguments or an operator/value pair for a total of six. With five arguments, the current code reads a nonexistent sixth element and may crash the daemon. Reject all other argument counts before accessing the optional value. --- src/command/StickerCommands.cxx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/command/StickerCommands.cxx b/src/command/StickerCommands.cxx index 0061da15bb..ecafdd0bf1 100644 --- a/src/command/StickerCommands.cxx +++ b/src/command/StickerCommands.cxx @@ -524,7 +524,12 @@ handle_sticker(Client &client, Request args, Response &r) args.pop_back(); } - bool has_op = args.size() > 4; + if (args.size() != 4 && args.size() != 6) { + r.Error(ACK_ERROR_ARG, "bad request"); + return CommandResult::ERROR; + } + + const bool has_op = args.size() == 6; auto value = has_op ? args[5] : nullptr; StickerOperator op = StickerOperator::EXISTS; if (has_op) { From 3e8a477925e42eafc110f3aed917920da5126442 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Tue, 25 Aug 2026 13:10:37 +0200 Subject: [PATCH 2/6] python/build/libs.py: update libopenmpt to 0.8.8 --- python/build/libs.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/python/build/libs.py b/python/build/libs.py index 560e70be39..6115eca77d 100644 --- a/python/build/libs.py +++ b/python/build/libs.py @@ -40,8 +40,8 @@ ) libopenmpt = AutotoolsProject( - 'https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-0.8.7+release.autotools.tar.gz', - '275c29ef47be9992f62a35fcc96f7ca05c06d2fd05c9298b8dee9f743f75b089', + 'https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-0.8.8+release.autotools.tar.gz', + 'd4f00ddd29eecb9594bda7be76c13aaa2de1dadc18391c3e905f728ec9af8822', 'lib/libopenmpt.a', [ '--disable-shared', '--enable-static', @@ -53,7 +53,7 @@ '--without-portaudio', '--without-portaudiocpp', '--without-sndfile', '--without-flac', ], - base='libopenmpt-0.8.7+release.autotools', + base='libopenmpt-0.8.8+release.autotools', ) wildmidi = CmakeProject( From 1c73f83a428824490efd1c1ea2a4ba69a9a8d982 Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Tue, 25 Aug 2026 15:30:04 -0400 Subject: [PATCH 3/6] upnp: defer cleanup for HTTP status errors Deleting the device description downloader from OnHeaders() frees the CurlResponseHandlerAdapter while DataReceived() still uses it. A UPnP server can trigger a use-after-free by returning a non-200 response with body data. Throw HttpStatusError so the adapter defers cleanup until OnError(). --- src/lib/upnp/Discovery.cxx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/lib/upnp/Discovery.cxx b/src/lib/upnp/Discovery.cxx index 8caf936755..8edc46e16b 100644 --- a/src/lib/upnp/Discovery.cxx +++ b/src/lib/upnp/Discovery.cxx @@ -8,6 +8,7 @@ #include "Error.hxx" #include "lib/curl/Global.hxx" #include "lib/curl/Handler.hxx" +#include "lib/curl/HttpStatusError.hxx" #include "lib/curl/Request.hxx" #include "event/Call.hxx" #include "event/InjectEvent.hxx" @@ -104,10 +105,9 @@ void UPnPDeviceDirectory::Downloader::OnHeaders(unsigned status, Curl::Headers &&) { - if (status != 200) { - Destroy(); - return; - } + if (status != 200) + throw HttpStatusError(status, + "Failed to download UPnP device description"); } void From a150b6b9725cae48679b65b6e521ea398e5e3534 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Wed, 26 Aug 2026 22:11:09 +0200 Subject: [PATCH 4/6] python/build/libs.py: update WildMidi to 0.5.0 --- python/build/libs.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/build/libs.py b/python/build/libs.py index 6115eca77d..252bbc2f11 100644 --- a/python/build/libs.py +++ b/python/build/libs.py @@ -57,8 +57,8 @@ ) wildmidi = CmakeProject( - 'https://github.com/Mindwerks/wildmidi/releases/download/wildmidi-0.4.6/wildmidi-0.4.6.tar.gz', - '24ca992639ce76efa3737029fceb3672385d56e2ac0a15d50b40cc12d26e60de', + 'https://github.com/Mindwerks/wildmidi/releases/download/wildmidi-0.5.0/wildmidi-0.5.0.tar.gz', + '84a0d75fa2ea818995a57a7ccbfdda8c1042a39f388d5561b767a2c275b1b1eb', 'lib/libWildMidi.a', [ '-DBUILD_SHARED_LIBS=OFF', From 8715ad031e1bd041fb454105d01c17a3494c1033 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Thu, 27 Aug 2026 10:43:30 +0200 Subject: [PATCH 5/6] python/build/cmake.py: set CMAKE_FIND_ROOT_PATH on Android This fixes WildMidi 0.5.0 build failures because WildMidi doesn't find libm.a - it's not looking in the NDK sysroot. By setting these cmake variables, we tell cmake where to find everything. Add both NDK sysroot and our own install prefix to CMAKE_FIND_ROOT_PATH. --- python/build/cmake.py | 12 ++++++++++++ python/build/toolchain.py | 2 ++ 2 files changed, 14 insertions(+) diff --git a/python/build/cmake.py b/python/build/cmake.py index 12887d3bac..a877e87008 100644 --- a/python/build/cmake.py +++ b/python/build/cmake.py @@ -61,6 +61,18 @@ def __write_cmake_toolchain_file(f: TextIO, toolchain: AnyToolchain) -> None: set(CMAKE_FIND_ROOT_PATH "{toolchain.install_prefix}") set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) +""") + elif toolchain.is_android: + # search libraries and headers only in the sysroot, not on + # the build host + f.write(f""" +set(CMAKE_SYSROOT {toolchain.sysroot}) + +set(CMAKE_FIND_ROOT_PATH {toolchain.install_prefix} ${{CMAKE_SYSROOT}}) +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY) """) def configure(toolchain: AnyToolchain, src: str, build: str, args: list[str]=[], env: Optional[Mapping[str, str]]=None) -> None: diff --git a/python/build/toolchain.py b/python/build/toolchain.py index 6e449b8821..fac15a1d48 100644 --- a/python/build/toolchain.py +++ b/python/build/toolchain.py @@ -73,6 +73,8 @@ def __init__(self, top_path: str, lib_path: str, llvm_path = os.path.join(ndk_path, 'toolchains', 'llvm', 'prebuilt', build_arch()) llvm_triple = host_triplet + android_api_level + self.sysroot = os.path.join(llvm_path, 'sysroot') + common_flags = '-Os -g' common_flags += ' ' + abi_info['cflags'] From b1c87eb85e9b211369e42433526b55469bf1b6c9 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Thu, 27 Aug 2026 11:26:33 +0200 Subject: [PATCH 6/6] release v0.24.15 --- NEWS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 240b72db05..24430f0e90 100644 --- a/NEWS +++ b/NEWS @@ -1,4 +1,4 @@ -ver 0.24.15 (not yet released) +ver 0.24.15 (2026/08/27) * protocol - fix crash on "sticker delete" and "sticker find" * database