merge: sync upstream profanity-im/profanity

Sync with upstream profanity-im/profanity.

Major upstream changes incorporated:

Memory management
  - Replace malloc+memset with g_new0 throughout codebase
  - Adopt auto_gchar / auto_gcharv / auto_gerror / auto_jid cleanup macros
  - Replace free() with g_free() for GAlloc'd memory

Editor rewrite
  - Remove pthread-based async editor; use GChildWatch callback API
  - New launch_editor(initial_content, callback, user_data) interface
  - Proper signal handling (SIGINT, SIGTSTP, SIGPIPE reset in child)
  - ui_suspend()/ui_resume() integration for TTY management

OMEMO improvements
  - Dual backend support: libsignal-protocol-c and libomemo-c
  - Proper pre-key removal after use (XEP-0384 compliance)
  - Automatic pre-key regeneration when store drops below threshold
  - New functions: omemo_is_device_active(), omemo_is_jid_trusted()
  - omemo_get_jid_untrusted_fingerprints() for better error messages
  - Fingerprint notifications on new device identity discovery
  - Deterministic pre-key ID generation tracking max_pre_key_id
  - omemo_trust_changed() UI updates on trust state changes

JID validation
  - RFC 6122-compliant validation in jid_is_valid()
  - Character-level checks (RFC 6122 forbidden chars: & ' / : < > @)
  - Length limits: 1023 per component, 3071 total
  - New jid_is_valid_user_jid() for user vs. service JID distinction

Database
  - Schema migration v3: UNIQUE constraint on archive_id for deduplication
  - Triggers for corrected message tracking (replaces_db_id / replaced_by_db_id)
  - db_history_result_t return type, _truncate_datetime_suffix()

UI / console
  - win_warn_needed() / win_warn_sent() warning deduplication hash table
  - PAD_MIN_HEIGHT dynamic pad sizing with PAD_THRESHOLD auto-cleanup
  - Spellcheck integration in input field with Unicode word detection
  - cons_spellcheck_setting() for /settings ui output
  - /[command]? shortcut for command help

Account config
  - Account name sanitization for GKeyFile special chars ([ ] = # \n \r)
  - Replace popen() with g_spawn_sync() for eval_password
  - TLS policy: add "direct" option alongside legacy

Connection
  - Port validation with g_assert (0–65535)
  - SHA-256 certificate fingerprint support (XMPP_CERT_PUBKEY_FINGERPRINT_SHA256)
  - "direct" TLS policy alias for legacy SSL

Common utilities
  - str_xml_sanitize() for XML 1.0 illegal character removal
  - string_matches_one_of() with formatted error messages
  - valid_tls_policy_option() helper
  - prof_date_time_format_iso8601() utility
  - Improved strip_arg_quotes() with backslash unescaping
  - prof_occurrences() uses g_slist_prepend + reverse for performance

PGP / OX
  - Proper GPGME resource cleanup with goto-cleanup pattern
  - g_string_free(xmppuri) leak fix in _ox_key_lookup

CSV export
  - Use GString + g_file_set_contents instead of raw write() syscalls

Tests
  - Restructured into subdirectories: command/, config/, xmpp/, ui/, omemo/, otr/, pgp/
  - New test_cmd_ac.c for autocompleter unit tests
  - Updated stubs for new UI suspend/resume functions

License headers
  - Migrate to SPDX-3.0 identifiers (GPL-3.0-or-later WITH OpenSSL-exception)

────────────────────────────────────────────────────
cproof-specific preservations:

  - XEP-0308 LMC: replace_id ?: id logic in message/stanza/omemo
  - Force encryption: cmd_force_encryption, test_forced_encryption
  - CWE-134: format string protection (cons_show("%s", ...))
  - y_start_pos-based paging in window.c
  - db_history_result_t return type, _truncate_datetime_suffix()

Merge-time fixes:

  - common.c: format-security (-Werror) — cons_show(errmsg) → cons_show("%s", errmsg)
  - database.c: null-deref guard — !msg->timestamp → msg && !msg->timestamp
  - console.c: implicit size_t → int cast — (int)(maxlen + 1)
  - tlscerts.c: %d for size_t — %zu

Build system:
  - Kept autotools (Makefile.am, configure.ac); upstream uses Meson
  - Restored deleted files: bootstrap.sh, autogen.sh, ax_valgrind_check.m4, configure-debug
  - Updated Makefile.am test paths for subdirectory structure
  - Added test_cmd_ac, test_forced_encryption to test sources

Functional tests:
  - Use cproof version; upstream requires stbbr_for_xmlns from updated stabber
  - Not yet available in devs/stabber fork

Closes #64

Merge author: jabber.developer2
Commits authors:
 Michael Vetter <jubalh@iodoru.org>
& Steffen Jaeckel <s@jaeckel.eu>

src/xmpp/message.c

@@ -3,35 +3,9 @@
  * vim: expandtab:ts=4:sts=4:sw=4
  *
  * Copyright (C) 2012 - 2019 James Booth <boothj5@gmail.com>
- * Copyright (C) 2019 - 2025 Michael Vetter <jubalh@iodoru.org>
- *
- * This file is part of Profanity.
- *
- * Profanity is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Profanity is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Profanity.  If not, see <https://www.gnu.org/licenses/>.
- *
- * In addition, as a special exception, the copyright holders give permission to
- * link the code of portions of this program with the OpenSSL library under
- * certain conditions as described in each individual source file, and
- * distribute linked combinations including the two.
- *
- * You must obey the GNU General Public License in all respects for all of the
- * code used other than OpenSSL. If you modify file(s) with this exception, you
- * may extend this exception to your version of the file(s), but you are not
- * obligated to do so. If you do not wish to do so, delete this exception
- * statement from your version. If you delete this exception statement from all
- * source files in the program, then also delete it here.
+ * Copyright (C) 2019 - 2026 Michael Vetter <jubalh@iodoru.org>
  *
+ * SPDX-License-Identifier: GPL-3.0-or-later WITH OpenSSL-exception
  */
 
 #include "config.h"
@@ -91,18 +65,37 @@ static void _handle_pubsub(xmpp_stanza_t* const stanza, xmpp_stanza_t* const eve
 static gboolean _handle_form(xmpp_stanza_t* const stanza);
 static gboolean _handle_jingle_message(xmpp_stanza_t* const stanza);
 static gboolean _should_ignore_based_on_silence(xmpp_stanza_t* const stanza);
+#ifdef HAVE_OMEMO
+static void _receive_omemo(xmpp_stanza_t* const stanza, ProfMessage* message);
+#endif
 
 #ifdef HAVE_LIBGPGME
 static xmpp_stanza_t* _ox_openpgp_signcrypt(xmpp_ctx_t* ctx, const char* const to, const char* const text);
 #endif // HAVE_LIBGPGME
 
+#ifdef HAVE_OMEMO
+static void
+_receive_omemo(xmpp_stanza_t* const stanza, ProfMessage* message)
+{
+    message->plain = omemo_receive_message(stanza, &message->trusted, &message->omemo_err);
+    if (message->omemo_err != OMEMO_ERR_NONE) {
+        message->enc = PROF_MSG_ENC_OMEMO;
+        if (message->plain == NULL) {
+            message->plain = omemo_error_to_string(message->omemo_err);
+        }
+    } else if (message->plain != NULL) {
+        message->enc = PROF_MSG_ENC_OMEMO;
+    }
+}
+#endif // HAVE_OMEMO
+
 static GHashTable* pubsub_event_handlers;
 
 gchar*
 get_display_name(const ProfMessage* const message, int* flags)
 {
     if (equals_our_barejid(message->from_jid->barejid)) {
-        return g_strdup("me");
+        return prefs_get_string(PREF_OUTGOING_STAMP);
     } else {
         if (flags)
             *flags = NO_ME;
@@ -353,9 +346,10 @@ message_handlers_init(void)
 ProfMessage*
 message_init(void)
 {
-    ProfMessage* message = calloc(1, sizeof(ProfMessage));
+    ProfMessage* message = g_new0(ProfMessage, 1);
 
     message->enc = PROF_MSG_ENC_NONE;
+    message->omemo_err = OMEMO_ERR_NONE;
     message->trusted = true;
     message->type = PROF_MSG_TYPE_UNINITIALIZED;
     message->marked_read = -1;
@@ -421,7 +415,7 @@ message_handlers_clear(void)
 void
 message_pubsub_event_handler_add(const char* const node, ProfMessageCallback func, ProfMessageFreeCallback free_func, void* userdata)
 {
-    ProfMessageHandler* handler = malloc(sizeof(ProfMessageHandler));
+    ProfMessageHandler* handler = g_new(ProfMessageHandler, 1);
     handler->func = func;
     handler->free_func = free_func;
     handler->userdata = userdata;
@@ -477,7 +471,7 @@ message_send_chat_pgp(const char* const barejid, const char* const msg, gboolean
     ProfAccount* account = accounts_get_account(session_get_account_name());
     if (account->pgp_keyid) {
         auto_jid Jid* jidp = jid_create(jid);
-        auto_char char* encrypted = p_gpg_encrypt(jidp->barejid, msg, account->pgp_keyid);
+        auto_gchar gchar* encrypted = p_gpg_encrypt(jidp->barejid, msg, account->pgp_keyid);
         if (encrypted) {
             message = xmpp_message_new(ctx, STANZA_TYPE_CHAT, jid, id);
             xmpp_message_set_body(message, "This message is encrypted (XEP-0027).");
@@ -1093,9 +1087,12 @@ _handle_groupchat(xmpp_stanza_t* const stanza)
     char* stanzaid = NULL;
     xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
     if (stanzaidst) {
-        stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
-        if (stanzaid) {
-            message->stanzaid = strdup(stanzaid);
+        const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
+        if (by && (g_strcmp0(by, from_jid->barejid) == 0)) {
+            stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
+            if (stanzaid) {
+                message->stanzaid = strdup(stanzaid);
+            }
         }
     }
 
@@ -1111,10 +1108,7 @@ _handle_groupchat(xmpp_stanza_t* const stanza)
 
     // check omemo encryption
 #ifdef HAVE_OMEMO
-    message->plain = omemo_receive_message(stanza, &message->trusted);
-    if (message->plain != NULL) {
-        message->enc = PROF_MSG_ENC_OMEMO;
-    }
+    _receive_omemo(stanza, message);
 #endif
 
     if (!message->plain && !message->body) {
@@ -1271,10 +1265,7 @@ _handle_muc_private_message(xmpp_stanza_t* const stanza)
 
     // check omemo encryption
 #ifdef HAVE_OMEMO
-    message->plain = omemo_receive_message(stanza, &message->trusted);
-    if (message->plain != NULL) {
-        message->enc = PROF_MSG_ENC_OMEMO;
-    }
+    _receive_omemo(stanza, message);
 #endif
 
     message->timestamp = stanza_get_delay(stanza);
@@ -1405,9 +1396,12 @@ _handle_chat(xmpp_stanza_t* const stanza, gboolean is_mam, gboolean is_carbon, c
         char* stanzaid = NULL;
         xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
         if (stanzaidst) {
-            stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
-            if (stanzaid) {
-                message->stanzaid = strdup(stanzaid);
+            const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
+            if (by && equals_our_barejid(by)) {
+                stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
+                if (stanzaid) {
+                    message->stanzaid = strdup(stanzaid);
+                }
             }
         }
     }
@@ -1438,10 +1432,7 @@ _handle_chat(xmpp_stanza_t* const stanza, gboolean is_mam, gboolean is_carbon, c
 
 #ifdef HAVE_OMEMO
     // check omemo encryption
-    message->plain = omemo_receive_message(stanza, &message->trusted);
-    if (message->plain != NULL) {
-        message->enc = PROF_MSG_ENC_OMEMO;
-    }
+    _receive_omemo(stanza, message);
 #endif
 
     xmpp_stanza_t* encrypted = xmpp_stanza_get_child_by_ns(stanza, STANZA_NS_ENCRYPTED);
@@ -1535,6 +1526,20 @@ _handle_mam(xmpp_stanza_t* const stanza)
 
     // <result xmlns='urn:xmpp:mam:2' queryid='f27' id='5d398-28273-f7382'>
     // same as <stanza-id> from XEP-0359 for live messages
+    const char* by = xmpp_stanza_get_attribute(result, "by");
+    const char* from = xmpp_stanza_get_from(stanza);
+    if (by) {
+        if (g_strcmp0(by, from) != 0) {
+            log_warning("MAM result 'by' attribute (%s) does not match 'from' (%s)", by, from);
+            return TRUE;
+        }
+    } else {
+        if (from && !equals_our_barejid(from)) {
+            log_warning("MAM result from %s with no 'by' attribute (expected our own JID)", from);
+            return TRUE;
+        }
+    }
+
     const char* result_id = xmpp_stanza_get_id(result);
 
     GDateTime* timestamp = stanza_get_delay_from(forwarded, NULL);
@@ -1636,7 +1641,7 @@ _ox_openpgp_signcrypt(xmpp_ctx_t* ctx, const char* const to, const char* const t
     char rpad_data[randnr];
     for (int i = 0; i < randnr; i++) {
         int rchar = (rand() % 52) + 65;
-        rpad_data[i] = rchar;
+        rpad_data[i] = (char)rchar;
     }
     rpad_data[randnr - 1] = '\0';