Merge master.

27 files changed, 202 insertions, 77 deletions

diff --git a/src/lib/analyse_audio_job.cc b/src/lib/analyse_audio_job.cc
index 347cc0a0f..60b10e7b6 100644
--- a/src/lib/analyse_audio_job.cc
+++ b/src/lib/analyse_audio_job.cc
@@ -87,7 +87,7 @@ AnalyseAudioJob::analyse (shared_ptr<const AudioBuffers> b)
 		for (int j = 0; j < b->channels(); ++j) {
 			float s = b->data(j)[i];
 			if (fabsf (s) < 10e-7) {
-				/* stringstream can't serialise and recover inf or -inf, so prevent such
+				/* SafeStringStream can't serialise and recover inf or -inf, so prevent such
 				   values by replacing with this (140dB down) */
 				s = 10e-7;
 			}
diff --git a/src/lib/compose.hpp b/src/lib/compose.hpp
index b3f410c8e..aa67b5a1f 100644
--- a/src/lib/compose.hpp
+++ b/src/lib/compose.hpp
@@ -33,10 +33,10 @@
 #ifndef STRING_COMPOSE_H
 #define STRING_COMPOSE_H
 
-#include <sstream>
 #include <string>
 #include <list>
 #include <map>			// for multimap
+#include "safe_stringstream.h"
 
 namespace StringPrivate
 {
@@ -56,7 +56,7 @@ namespace StringPrivate
     std::string str() const;
 
   private:
-    std::ostringstream os;
+    SafeStringStream os;
     int arg_no;
 
     // we store the output as a list - when the output string is requested, the
diff --git a/src/lib/config.cc b/src/lib/config.cc
index 14539044d..4f2a75574 100644
--- a/src/lib/config.cc
+++ b/src/lib/config.cc
@@ -17,7 +17,6 @@
 
 */
 
-#include <sstream>
 #include <cstdlib>
 #include <fstream>
 #include <glib.h>
diff --git a/src/lib/content.cc b/src/lib/content.cc
index bbbe9b6ce..21e49a2c9 100644
--- a/src/lib/content.cc
+++ b/src/lib/content.cc
@@ -31,11 +31,11 @@
 #include "ui_signaller.h"
 #include "exceptions.h"
 #include "film.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::set;
 using std::list;
 using std::cout;
@@ -225,7 +225,7 @@ Content::length_after_trim () const
 string
 Content::identifier () const
 {
-	stringstream s;
+	SafeStringStream s;
 	
 	s << Content::digest()
 	  << "_" << position().get()
diff --git a/src/lib/dcp_video.cc b/src/lib/dcp_video.cc
index 9b1c8c33e..d84986651 100644
--- a/src/lib/dcp_video.cc
+++ b/src/lib/dcp_video.cc
@@ -34,7 +34,6 @@
 #include <stdexcept>
 #include <cstdio>
 #include <iomanip>
-#include <sstream>
 #include <iostream>
 #include <fstream>
 #include <unistd.h>
@@ -67,7 +66,6 @@
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::cout;
 using boost::shared_ptr;
 using boost::lexical_cast;
@@ -282,10 +280,9 @@ DCPVideo::encode_remotely (ServerDescription serv)
 	LOG_GENERAL (N_("Sending frame %1 to remote"), _index);
 	
 	/* Send XML metadata */
-	stringstream xml;
-	doc.write_to_stream (xml, "UTF-8");
-	socket->write (xml.str().length() + 1);
-	socket->write ((uint8_t *) xml.str().c_str(), xml.str().length() + 1);
+	string xml = doc.write_to_string ("UTF-8");
+	socket->write (xml.length() + 1);
+	socket->write ((uint8_t *) xml.c_str(), xml.length() + 1);
 
 	/* Send binary data */
 	_frame->send_binary (socket, _burn_subtitles);
diff --git a/src/lib/ffmpeg_content.cc b/src/lib/ffmpeg_content.cc
index 0af53d883..bb4e02230 100644
--- a/src/lib/ffmpeg_content.cc
+++ b/src/lib/ffmpeg_content.cc
@@ -34,13 +34,13 @@ extern "C" {
 #include "log.h"
 #include "exceptions.h"
 #include "frame_rate_change.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 #define LOG_GENERAL(...) film->log()->log (String::compose (__VA_ARGS__), Log::TYPE_GENERAL);
 
 using std::string;
-using std::stringstream;
 using std::vector;
 using std::list;
 using std::cout;
@@ -235,7 +235,7 @@ FFmpegContent::information () const
 		return "";
 	}
 	
-	stringstream s;
+	SafeStringStream s;
 	
 	s << String::compose (_("%1 frames; %2 frames per second"), video_length_after_3d_combine().frames (video_frame_rate()), video_frame_rate()) << "\n";
 	s << VideoContent::information ();
@@ -352,7 +352,7 @@ FFmpegContent::set_audio_mapping (AudioMapping m)
 string
 FFmpegContent::identifier () const
 {
-	stringstream s;
+	SafeStringStream s;
 
 	s << VideoContent::identifier();
 
diff --git a/src/lib/ffmpeg_decoder.cc b/src/lib/ffmpeg_decoder.cc
index 4e5d9bb1e..15443c346 100644
--- a/src/lib/ffmpeg_decoder.cc
+++ b/src/lib/ffmpeg_decoder.cc
@@ -23,7 +23,6 @@
 
 #include <stdexcept>
 #include <vector>
-#include <sstream>
 #include <iomanip>
 #include <iostream>
 #include <stdint.h>
diff --git a/src/lib/ffmpeg_examiner.cc b/src/lib/ffmpeg_examiner.cc
index 62b909b1d..48d85da6f 100644
--- a/src/lib/ffmpeg_examiner.cc
+++ b/src/lib/ffmpeg_examiner.cc
@@ -26,13 +26,13 @@ extern "C" {
 #include "ffmpeg_audio_stream.h"
 #include "ffmpeg_subtitle_stream.h"
 #include "util.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
 using std::cout;
 using std::max;
-using std::stringstream;
 using boost::shared_ptr;
 using boost::optional;
 
@@ -176,14 +176,14 @@ FFmpegExaminer::video_size () const
 ContentTime
 FFmpegExaminer::video_length () const
 {
-	ContentTime const length = ContentTime::from_seconds (double (_format_context->duration - _format_context->start_time) / AV_TIME_BASE);
+	ContentTime const length = ContentTime::from_seconds (double (_format_context->duration) / AV_TIME_BASE);
 	return ContentTime (max (ContentTime::Type (1), length.get ()));
 }
 
 string
 FFmpegExaminer::audio_stream_name (AVStream* s) const
 {
-	stringstream n;
+	SafeStringStream n;
 
 	n << stream_name (s);
 
@@ -199,7 +199,7 @@ FFmpegExaminer::audio_stream_name (AVStream* s) const
 string
 FFmpegExaminer::subtitle_stream_name (AVStream* s) const
 {
-	stringstream n;
+	SafeStringStream n;
 
 	n << stream_name (s);
 
@@ -213,7 +213,7 @@ FFmpegExaminer::subtitle_stream_name (AVStream* s) const
 string
 FFmpegExaminer::stream_name (AVStream* s) const
 {
-	stringstream n;
+	SafeStringStream n;
 
 	if (s->metadata) {
 		AVDictionaryEntry const * lang = av_dict_get (s->metadata, "language", 0, 0);
diff --git a/src/lib/film.cc b/src/lib/film.cc
index 0891838ff..577c29e3a 100644
--- a/src/lib/film.cc
+++ b/src/lib/film.cc
@@ -22,7 +22,6 @@
 #include <algorithm>
 #include <fstream>
 #include <cstdlib>
-#include <sstream>
 #include <iomanip>
 #include <unistd.h>
 #include <boost/filesystem.hpp>
@@ -54,11 +53,11 @@
 #include "ratio.h"
 #include "cross.h"
 #include "cinema.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::multimap;
 using std::pair;
 using std::map;
@@ -162,7 +161,7 @@ Film::video_identifier () const
 {
 	assert (container ());
 
-	stringstream s;
+	SafeStringStream s;
 	s.imbue (std::locale::classic ());
 	
 	s << container()->id()
@@ -504,7 +503,7 @@ Film::file (boost::filesystem::path f) const
 string
 Film::isdcf_name (bool if_created_now) const
 {
-	stringstream d;
+	SafeStringStream d;
 
 	string raw_name = name ();
 
@@ -827,7 +826,7 @@ Film::info_path (int f, Eyes e) const
 	boost::filesystem::path p;
 	p /= info_dir ();
 
-	stringstream s;
+	SafeStringStream s;
 	s.width (8);
 	s << setfill('0') << f;
 
@@ -854,7 +853,7 @@ Film::j2c_path (int f, Eyes e, bool t) const
 	p /= "j2c";
 	p /= video_identifier ();
 
-	stringstream s;
+	SafeStringStream s;
 	s.width (8);
 	s << setfill('0') << f;
 
diff --git a/src/lib/filter_graph.cc b/src/lib/filter_graph.cc
index f6a6c4529..d2427c31f 100644
--- a/src/lib/filter_graph.cc
+++ b/src/lib/filter_graph.cc
@@ -34,10 +34,10 @@ extern "C" {
 #include "exceptions.h"
 #include "image.h"
 #include "ffmpeg_content.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
-using std::stringstream;
 using std::string;
 using std::list;
 using std::pair;
@@ -83,7 +83,7 @@ FilterGraph::FilterGraph (shared_ptr<const FFmpegContent> content, dcp::Size s,
 		throw DecodeError (N_("Could not create buffer sink filter"));
 	}
 
-	stringstream a;
+	SafeStringStream a;
 	a << "video_size=" << _size.width << "x" << _size.height << ":"
 	  << "pix_fmt=" << _pixel_format << ":"
 	  << "time_base=1/1:"
diff --git a/src/lib/image_content.cc b/src/lib/image_content.cc
index 70d777bca..84b0b75c9 100644
--- a/src/lib/image_content.cc
+++ b/src/lib/image_content.cc
@@ -25,12 +25,12 @@
 #include "job.h"
 #include "frame_rate_change.h"
 #include "exceptions.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
 using std::cout;
-using std::stringstream;
 using boost::shared_ptr;
 
 ImageContent::ImageContent (shared_ptr<const Film> f, boost::filesystem::path p)
@@ -134,7 +134,7 @@ ImageContent::full_length () const
 string
 ImageContent::identifier () const
 {
-	stringstream s;
+	SafeStringStream s;
 	s << VideoContent::identifier ();
 	s << "_" << video_length().get();
 	return s.str ();
diff --git a/src/lib/internet.cc b/src/lib/internet.cc
index 99ae5c214..c28e650fd 100644
--- a/src/lib/internet.cc
+++ b/src/lib/internet.cc
@@ -24,11 +24,11 @@
 #include <curl/curl.h>
 #include <zip.h>
 #include "util.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::list;
 using boost::optional;
 using boost::function;
@@ -130,11 +130,10 @@ ftp_ls (string url)
 		return list<string> ();
 	}
 
-	stringstream s (ls_raw);
-	string line;
+	SafeStringStream s (ls_raw);
 	list<string> ls;
 	while (s.good ()) {
-		getline (s, line);
+		string const line = s.getline ();
 		if (line.length() > 55) {
 			string const file = line.substr (55);
 			if (file != "." && file != "..") {
diff --git a/src/lib/job.cc b/src/lib/job.cc
index 31a10a44b..1d3cb73b6 100644
--- a/src/lib/job.cc
+++ b/src/lib/job.cc
@@ -37,7 +37,6 @@
 using std::string;
 using std::list;
 using std::cout;
-using std::stringstream;
 using boost::shared_ptr;
 
 Job::Job (shared_ptr<const Film> f)
@@ -309,7 +308,7 @@ Job::status () const
 		pc = 99;
 	}
 
-	stringstream s;
+	SafeStringStream s;
 	if (!finished ()) {
 		s << pc << N_("%");
 		if (p >= 0 && t > 10 && r > 0) {
diff --git a/src/lib/kdm.cc b/src/lib/kdm.cc
index a2ed1be73..108860594 100644
--- a/src/lib/kdm.cc
+++ b/src/lib/kdm.cc
@@ -29,10 +29,10 @@
 #include "util.h"
 #include "film.h"
 #include "config.h"
+#include "safe_stringstream.h"
 
 using std::list;
 using std::string;
-using std::stringstream;
 using std::cout;
 using boost::shared_ptr;
 
@@ -234,9 +234,9 @@ email_kdms (
 		
 		quickmail_initialize ();
 
-		stringstream start;
+		SafeStringStream start;
 		start << from.date() << " " << from.time_of_day();
-		stringstream end;
+		SafeStringStream end;
 		end << to.date() << " " << to.time_of_day();
 		
 		string subject = Config::instance()->kdm_subject();
@@ -260,7 +260,7 @@ email_kdms (
 		boost::algorithm::replace_all (body, "$END_TIME", end.str ());
 		boost::algorithm::replace_all (body, "$CINEMA_NAME", i->cinema->name);
 		
-		stringstream screens;
+		SafeStringStream screens;
 		for (list<ScreenKDM>::const_iterator j = i->screen_kdms.begin(); j != i->screen_kdms.end(); ++j) {
 			screens << j->screen->name << ", ";
 		}
diff --git a/src/lib/log.cc b/src/lib/log.cc
index 4de6bd874..5e8277a23 100644
--- a/src/lib/log.cc
+++ b/src/lib/log.cc
@@ -26,6 +26,7 @@
 #include "log.h"
 #include "cross.h"
 #include "config.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
@@ -63,7 +64,7 @@ Log::log (string message, int type)
 	time (&t);
 	string a = ctime (&t);
 
-	stringstream s;
+	SafeStringStream s;
 	s << a.substr (0, a.length() - 1) << N_(": ");
 
 	if (type & TYPE_ERROR) {
@@ -90,7 +91,7 @@ Log::microsecond_log (string m, int t)
 	struct timeval tv;
 	gettimeofday (&tv, 0);
 
-	stringstream s;
+	SafeStringStream s;
 	s << tv.tv_sec << N_(":") << tv.tv_usec << N_(" ") << m;
 	do_log (s.str ());
 }	
diff --git a/src/lib/md5_digester.cc b/src/lib/md5_digester.cc
index 1244209bd..1d4d1974a 100644
--- a/src/lib/md5_digester.cc
+++ b/src/lib/md5_digester.cc
@@ -18,12 +18,11 @@
 */
 
 #include <iomanip>
-#include <sstream>
 #include <openssl/md5.h>
 #include "md5_digester.h"
+#include "safe_stringstream.h"
 
 using std::string;
-using std::stringstream;
 using std::hex;
 using std::setfill;
 using std::setw;
@@ -51,7 +50,7 @@ MD5Digester::get () const
 		unsigned char digest[MD5_DIGEST_LENGTH];
 		MD5_Final (digest, &_context);
 		
-		stringstream s;
+		SafeStringStream s;
 		for (int i = 0; i < MD5_DIGEST_LENGTH; ++i) {
 			s << hex << setfill('0') << setw(2) << ((int) digest[i]);
 		}
diff --git a/src/lib/safe_stringstream.cc b/src/lib/safe_stringstream.cc
new file mode 100644
index 000000000..01d545045
--- /dev/null
+++ b/src/lib/safe_stringstream.cc
@@ -0,0 +1,23 @@
+/*
+    Copyright (C) 2014 Carl Hetherington <cth@carlh.net>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#include <boost/thread/mutex.hpp>
+#include "safe_stringstream.h"
+
+boost::mutex SafeStringStream::_mutex;
diff --git a/src/lib/safe_stringstream.h b/src/lib/safe_stringstream.h
new file mode 100644
index 000000000..e455de964
--- /dev/null
+++ b/src/lib/safe_stringstream.h
@@ -0,0 +1,115 @@
+/*
+    Copyright (C) 2014 Carl Hetherington <cth@carlh.net>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#ifndef DCPOMATIC_SAFE_STRINGSTREAM_H
+#define DCPOMATIC_SAFE_STRINGSTREAM_H
+
+#include <boost/thread/mutex.hpp>
+
+/* I've not been able to reproduce it, but there have been reports that DCP-o-matic crashes
+ * on OS X with two simultaneous backtraces that look like this:
+ *
+ * 0 libSystem.B.dylib  0x00007fff84ebe264 __numeric_load_locale + 125
+ * 1 libSystem.B.dylib  0x00007fff84e2aac4 loadlocale + 323
+ * 2 libstdc++.6.dylib  0x00007fff8976ba69 std::__convert_from_v(int* const&, char*, int, char const*, ...) + 199
+ * 3 libstdc++.6.dylib  0x00007fff8974e99b std::ostreambuf_iterator<char, std::char_traits<char> > std::num_put<char, std::ostreambuf_iterator<char,
+std::char_traits<char> > >::_M_insert_float<double>(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, char, double) const + 199
+ * 4 libstdc++.6.dylib  0x00007fff8974ebc0 std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> >
+>::do_put(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, double) const + 28
+ * 5 libstdc++.6.dylib  0x00007fff897566a2 std::ostream& std::ostream::_M_insert<double>(double) + 178
+ * 6 libdcpomatic.dylib 0x0000000100331e21 StringPrivate::Composition& StringPrivate::Composition::arg<float>(float const&) + 33
+ *
+ * in two different threads.  I'm assuming that for some bizarre reason it is unsafe to use two separate stringstream
+ * objects in different threads on OS X.  This is a hack to work around it.
+ */
+
+class SafeStringStream
+{
+public:
+	SafeStringStream ()
+	{}
+	
+	SafeStringStream (std::string s)
+		: _stream (s)
+	{}
+	
+	template <class T>
+	std::ostream& operator<< (T val)
+	{
+		boost::mutex::scoped_lock lm (_mutex);
+		_stream << val;
+		return _stream;
+	}
+
+	template <class T>
+	std::istream& operator>> (T& val)
+	{
+		boost::mutex::scoped_lock lm (_mutex);
+		_stream >> val;
+		return _stream;
+	}
+
+	std::string str () const {
+		return _stream.str ();
+	}
+
+	void str (std::string const & s) {
+		_stream.str (s);
+	}
+
+	void imbue (std::locale const & loc)
+	{
+		boost::mutex::scoped_lock lm (_mutex);
+		_stream.imbue (loc);
+	}
+
+	void width (int w)
+	{
+		_stream.width (w);
+	}
+
+	void precision (int p)
+	{
+		_stream.precision (p);
+	}
+
+	bool good () const
+	{
+		return _stream.good ();
+	}
+
+	std::string getline ()
+	{
+		boost::mutex::scoped_lock lm (_mutex);
+		std::string s;
+		std::getline (_stream, s);
+		return s;
+	}
+
+	void setf (std::ios_base::fmtflags flags, std::ios_base::fmtflags mask)
+	{
+		_stream.setf (flags, mask);
+	}
+
+private:
+	static boost::mutex _mutex;
+	std::stringstream _stream;
+};
+
+#endif
diff --git a/src/lib/server.cc b/src/lib/server.cc
index 5598ef69f..d2c573c1b 100644
--- a/src/lib/server.cc
+++ b/src/lib/server.cc
@@ -24,7 +24,6 @@
 
 #include <string>
 #include <vector>
-#include <sstream>
 #include <iostream>
 #include <boost/algorithm/string.hpp>
 #include <boost/scoped_array.hpp>
@@ -39,6 +38,7 @@
 #include "cross.h"
 #include "player_video.h"
 #include "encoded_data.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
@@ -48,7 +48,6 @@
 #define LOG_ERROR_NC(...)   _log->log (__VA_ARGS__, Log::TYPE_ERROR);
 
 using std::string;
-using std::stringstream;
 using std::multimap;
 using std::vector;
 using std::list;
@@ -104,9 +103,9 @@ Server::process (shared_ptr<Socket> socket, struct timeval& after_read, struct t
 	scoped_array<char> buffer (new char[length]);
 	socket->read (reinterpret_cast<uint8_t*> (buffer.get()), length);
 
-	stringstream s (buffer.get());
+	string s (buffer.get());
 	shared_ptr<cxml::Document> xml (new cxml::Document ("EncodingRequest"));
-	xml->read_stream (s);
+	xml->read_string (s);
 	if (xml->number_child<int> ("Version") != SERVER_LINK_VERSION) {
 		cerr << "Mismatched server/client versions\n";
 		LOG_ERROR_NC ("Mismatched server/client versions");
@@ -180,7 +179,7 @@ Server::worker_thread ()
 			struct timeval end;
 			gettimeofday (&end, 0);
 
-			stringstream message;
+			SafeStringStream message;
 			message.precision (2);
 			message << fixed
 				<< "Encoded frame " << frame << " from " << ip << ": "
@@ -251,14 +250,13 @@ Server::broadcast_received ()
 		xmlpp::Document doc;
 		xmlpp::Element* root = doc.create_root_node ("ServerAvailable");
 		root->add_child("Threads")->add_child_text (raw_convert<string> (_worker_threads.size ()));
-		stringstream xml;
-		doc.write_to_stream (xml, "UTF-8");
+		string xml = doc.write_to_string ("UTF-8");
 
 		shared_ptr<Socket> socket (new Socket);
 		try {
 			socket->connect (boost::asio::ip::tcp::endpoint (_broadcast.send_endpoint.address(), Config::instance()->server_port_base() + 1));
-			socket->write (xml.str().length() + 1);
-			socket->write ((uint8_t *) xml.str().c_str(), xml.str().length() + 1);
+			socket->write (xml.length() + 1);
+			socket->write ((uint8_t *) xml.c_str(), xml.length() + 1);
 		} catch (...) {
 
 		}
diff --git a/src/lib/server_finder.cc b/src/lib/server_finder.cc
index 9b0cd0376..14cb3af59 100644
--- a/src/lib/server_finder.cc
+++ b/src/lib/server_finder.cc
@@ -27,7 +27,6 @@
 #include "ui_signaller.h"
 
 using std::string;
-using std::stringstream;
 using std::list;
 using std::vector;
 using std::cout;
@@ -116,9 +115,9 @@ try
 		scoped_array<char> buffer (new char[length]);
 		sock->read (reinterpret_cast<uint8_t*> (buffer.get()), length);
 		
-		stringstream s (buffer.get());
+		string s (buffer.get());
 		shared_ptr<cxml::Document> xml (new cxml::Document ("ServerAvailable"));
-		xml->read_stream (s);
+		xml->read_string (s);
 
 		string const ip = sock->socket().remote_endpoint().address().to_string ();
 		if (!server_found (ip)) {
diff --git a/src/lib/sndfile_content.cc b/src/lib/sndfile_content.cc
index a573d43c4..1a1797665 100644
--- a/src/lib/sndfile_content.cc
+++ b/src/lib/sndfile_content.cc
@@ -25,11 +25,11 @@
 #include "compose.hpp"
 #include "job.h"
 #include "util.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::cout;
 using boost::shared_ptr;
 using dcp::raw_convert;
@@ -79,7 +79,7 @@ SndfileContent::information () const
 		return "";
 	}
 	
-	stringstream s;
+	SafeStringStream s;
 
 	s << String::compose (
 		_("%1 channels, %2kHz, %3 samples"),
diff --git a/src/lib/stack.cpp b/src/lib/stack.cpp
index a8183d344..167524017 100644
--- a/src/lib/stack.cpp
+++ b/src/lib/stack.cpp
@@ -9,7 +9,6 @@
 #include <iomanip>
 #include <ostream>
 #include <stdexcept>
-#include <sstream>
 
 #include "stack.hpp"
 
diff --git a/src/lib/transcode_job.cc b/src/lib/transcode_job.cc
index 1a162b654..23a46d06d 100644
--- a/src/lib/transcode_job.cc
+++ b/src/lib/transcode_job.cc
@@ -27,6 +27,7 @@
 #include "film.h"
 #include "transcoder.h"
 #include "log.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
@@ -34,7 +35,6 @@
 #define LOG_ERROR_NC(...)   _film->log()->log (__VA_ARGS__, Log::TYPE_ERROR);
 
 using std::string;
-using std::stringstream;
 using std::fixed;
 using std::setprecision;
 using std::cout;
@@ -90,7 +90,7 @@ TranscodeJob::status () const
 		return Job::status ();
 	}
 
-	stringstream s;
+	SafeStringStream s;
 
 	s << Job::status ();
 
diff --git a/src/lib/update.cc b/src/lib/update.cc
index 44ecbb232..0146df484 100644
--- a/src/lib/update.cc
+++ b/src/lib/update.cc
@@ -18,7 +18,6 @@
 */
 
 #include <string>
-#include <sstream>
 #include <boost/algorithm/string.hpp>
 #include <curl/curl.h>
 #include <libcxml/cxml.h>
@@ -26,6 +25,7 @@
 #include "update.h"
 #include "version.h"
 #include "ui_signaller.h"
+#include "safe_stringstream.h"
 
 #define BUFFER_SIZE 1024
 
@@ -113,10 +113,9 @@ UpdateChecker::thread ()
 			/* Parse the reply */
 			
 			_buffer[_offset] = '\0';
-			stringstream s;
-			s << _buffer;
+			string s (_buffer);
 			cxml::Document doc ("Update");
-			doc.read_stream (s);
+			doc.read_string (s);
 			
 			{
 				boost::mutex::scoped_lock lm (_data_mutex);
diff --git a/src/lib/util.cc b/src/lib/util.cc
index 60953b544..c9685aa44 100644
--- a/src/lib/util.cc
+++ b/src/lib/util.cc
@@ -22,7 +22,6 @@
  *  @brief Some utility functions and classes.
  */
 
-#include <sstream>
 #include <iomanip>
 #include <iostream>
 #include <fstream>
@@ -72,6 +71,7 @@ extern "C" {
 #include "rect.h"
 #include "md5_digester.h"
 #include "audio_processor.h"
+#include "safe_stringstream.h"
 #ifdef DCPOMATIC_WINDOWS
 #include "stack.hpp"
 #endif
@@ -79,7 +79,6 @@ extern "C" {
 #include "i18n.h"
 
 using std::string;
-using std::stringstream;
 using std::setfill;
 using std::ostream;
 using std::endl;
@@ -123,7 +122,7 @@ seconds_to_hms (int s)
 	int h = m / 60;
 	m -= (h * 60);
 
-	stringstream hms;
+	SafeStringStream hms;
 	hms << h << N_(":");
 	hms.width (2);
 	hms << std::setfill ('0') << m << N_(":");
@@ -144,7 +143,7 @@ seconds_to_approximate_hms (int s)
 	int h = m / 60;
 	m -= (h * 60);
 
-	stringstream ap;
+	SafeStringStream ap;
 
 	bool const hours = h > 0;
 	bool const minutes = h < 10 && m > 0;
@@ -263,7 +262,7 @@ stacktrace (ostream& out, int levels)
 static string
 ffmpeg_version_to_string (int v)
 {
-	stringstream s;
+	SafeStringStream s;
 	s << ((v & 0xff0000) >> 16) << N_(".") << ((v & 0xff00) >> 8) << N_(".") << (v & 0xff);
 	return s.str ();
 }
@@ -889,7 +888,7 @@ divide_with_round (int64_t a, int64_t b)
 string
 dependency_version_summary ()
 {
-	stringstream s;
+	SafeStringStream s;
 	s << N_("libopenjpeg ") << opj_version () << N_(", ")
 	  << N_("libavcodec ") << ffmpeg_version_to_string (avcodec_version()) << N_(", ")
 	  << N_("libavfilter ") << ffmpeg_version_to_string (avfilter_version()) << N_(", ")
diff --git a/src/lib/video_content.cc b/src/lib/video_content.cc
index 0a3e378ee..796e6575a 100644
--- a/src/lib/video_content.cc
+++ b/src/lib/video_content.cc
@@ -32,6 +32,7 @@
 #include "exceptions.h"
 #include "frame_rate_change.h"
 #include "log.h"
+#include "safe_stringstream.h"
 
 #include "i18n.h"
 
@@ -45,7 +46,6 @@ int const VideoContentProperty::VIDEO_SCALE	  = 4;
 int const VideoContentProperty::COLOUR_CONVERSION = 5;
 
 using std::string;
-using std::stringstream;
 using std::setprecision;
 using std::cout;
 using std::vector;
@@ -217,7 +217,7 @@ VideoContent::information () const
 		return "";
 	}
 	
-	stringstream s;
+	SafeStringStream s;
 
 	s << String::compose (
 		_("%1x%2 pixels (%3:1)"),
@@ -309,7 +309,7 @@ VideoContent::set_scale (VideoContentScale s)
 string
 VideoContent::identifier () const
 {
-	stringstream s;
+	SafeStringStream s;
 	s << Content::identifier()
 	  << "_" << crop().left
 	  << "_" << crop().right
@@ -479,7 +479,7 @@ VideoContentScale::as_xml (xmlpp::Node* node) const
 string
 VideoContentScale::id () const
 {
-	stringstream s;
+	SafeStringStream s;
 	
 	if (_ratio) {
 		s << _ratio->id () << "_";
diff --git a/src/lib/wscript b/src/lib/wscript
index 15f26c34f..2510ebe2a 100644
--- a/src/lib/wscript
+++ b/src/lib/wscript
@@ -65,6 +65,7 @@ sources = """
           raw_image_proxy.cc
           render_subtitles.cc
           resampler.cc
+          safe_stringstream.cc
           scp_dcp_job.cc
           scaler.cc
           send_kdm_email_job.cc