fix(ui,db): harden NULL handling, fix CWE-134, optimize iterations

security(CWE-134): fix format string injections + add CI check
fix(ui): subwindow lifecycle, newwin/newpad guards, fallback timestamps
fix(db): sqlite cleanup on failures, sqlite3_close_v2
fix(xmpp): queued_messages loop, barejid leak
perf(core): g_hash_table_iter_init instead of g_hash_table_get_keys
refactor(ui): CLAMP macro in _check_subwin_width
test: XEP-0012 and XEP-0045 functional tests

Author: jabber.developer2
Closes #58, #85

src/ui/buffer.c

@@ -140,6 +140,10 @@ void
 buffer_remove_entry(ProfBuff buffer, int entry)
 {
     GSList* node = g_slist_nth(buffer->entries, entry);
+    if (node == NULL) {
+        // Index out of range; nothing to remove
+        return;
+    }
     ProfBuffEntry* e = node->data;
     buffer->lines -= e->_lines;
     _free_entry(e);
@@ -168,6 +172,9 @@ ProfBuffEntry*
 buffer_get_entry(ProfBuff buffer, int entry)
 {
     GSList* node = g_slist_nth(buffer->entries, entry);
+    if (node == NULL) {
+        return NULL;
+    }
     return node->data;
 }
 
@@ -189,6 +196,7 @@ buffer_get_entry_by_id(ProfBuff buffer, const char* const id)
 static ProfBuffEntry*
 _create_entry(const char* show_char, int pad_indent, GDateTime* time, int flags, theme_item_t theme_item, const char* const display_from, const char* const from_jid, const char* const message, DeliveryReceipt* receipt, const char* const id, int y_start_pos, int y_end_pos)
 {
+    assert(time != NULL);
     ProfBuffEntry* e = malloc(sizeof(struct prof_buff_entry_t));
     e->show_char = STRDUP_OR_NULL(show_char);
     e->pad_indent = pad_indent;