fix: CWE-134 format string audit and compiler hardening

Security:
Fix CWE-134 in iq.c: user-controlled string passed as format argument
Add G_GNUC_PRINTF annotations to all variadic printf-like wrappers
in ui.h, log.h and http_common.h
Compiler flags (configure.ac):

Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2
Add -Wextra, -Wnull-dereference, -Wpointer-arith,
-Wimplicit-function-declaration, -Wundef, -Wfloat-equal,
-Wredundant-decls, -Walloc-zero
Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2
Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op,
-Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow,
-Warray-bounds=2
Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter,
-Wno-missing-field-initializers, -Wno-sign-compare,
-Wno-cast-function-type
Remove AM_CFLAGS/CFLAGS duplication
Bug fixes found by new warnings:

chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL
rosterwin.c: merge duplicated if/else branches into single condition
omemo.c: redundant else-if in omemo_automatic_start; remove
unnecessary scope block and goto, use early return
console.c: pointer compared to integer 0 instead of NULL
stanza.c: increase pri_str/idle_str buffers from 10 to 12 bytes
(INT_MIN = -2147483648 needs 12 bytes including NUL)
vcard.c: NULL guard for filename before g_file_set_contents
api.c: broken log_warning() calls with extra format argument
Format mismatch fixes:

chatwin.c: Jid* → char* for %s
connection.c: %x → %lx for long flags
cmd_funcs.c: %d → %zu for size_t; cast gpointer to char* for %s
cmd_defs.c: %d → %u for g_list_length() return (guint)
iq.c: barejid → fulljid for from_jid
console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
gpointer → (char*) casts for %s
Const-correctness and cleanup:

database.c: const for type, query, sort variables
form.c/xmpp.h: const for form_set_value parameter
files.c: refactor to early return, eliminating NULL logfile path
muc.c/muc.h: remove meaningless top-level const on return type
common.c: const for URL string literal
Remove stale declarations: cons_show_desktop_prefs (ui.h),
connection_set_priority (connection.h),
omemo_devicelist_configure_and_request (omemo.h)
test_common.c: add currb NULL check to silence -Wnull-dereference
Tooling (check-cwe134.sh):

Reduce from 5 checks to 2 (checks 1-3 redundant with -Wformat=2)
Check 1: verify known wrappers have G_GNUC_PRINTF attribute
Check 2: auto-detect unannotated variadic printf-like functions
Match both const char* and const gchar* in variadic patterns

Author: jabber.developer2 <jabber.developer2@jabber.space>

check-cwe134.sh

@@ -1,8 +1,14 @@
 #!/bin/bash
-# check-cwe134.sh - Static analysis for CWE-134 format string vulnerabilities
+# check-cwe134.sh - Verify __attribute__((format)) on printf-like wrappers
 #
-# This script detects potentially unsafe usage of format string functions
-# where user-controlled data may be passed without "%s" wrapper.
+# CWE-134 format string vulnerabilities are caught at compile time by
+# -Wformat=2 (includes -Wformat-security + -Wformat-nonliteral), BUT only
+# for functions annotated with __attribute__((format(printf, N, M))) or
+# G_GNUC_PRINTF(N, M).
+#
+# This script ensures every variadic function whose last fixed parameter
+# looks like a format string has the annotation.  Without it, the compiler
+# silently ignores format misuse.
 #
 # Usage: ./check-cwe134.sh [directory]
 
@@ -10,59 +16,103 @@ set -e
 
 DIR="${1:-src}"
 
-echo "=== CWE-134 Format String Vulnerability Check ==="
+echo "=== CWE-134: format attribute audit ==="
 echo "Scanning: $DIR"
 echo ""
 
-# Functions that accept format strings
-FORMAT_FUNCS="cons_show|cons_debug|cons_show_error|log_info|log_error|log_warning|log_debug|win_println|win_print"
-
 ERRORS=0
 
-echo "Checking for unsafe format string usage..."
+# --------------------------------------------------------------------- #
+# Known printf-like wrappers that MUST have the attribute                #
+# --------------------------------------------------------------------- #
+REQUIRED_ATTRIBUTED=(
+    "cons_show"
+    "cons_debug"
+    "cons_show_error"
+    "cons_show_padded"
+    "log_debug"
+    "log_info"
+    "log_warning"
+    "log_error"
+    "win_print"
+    "win_println"
+    "win_println_indent"
+    "win_println_va"
+    "win_append"
+    "win_appendln"
+    "win_append_highlight"
+    "win_appendln_highlight"
+    "win_command_exec_error"
+)
+
+echo "Check 1: Known wrappers must have G_GNUC_PRINTF / __attribute__((format))"
 echo ""
 
-# Pattern 1: function call with single variable argument (no format string)
-# Example: cons_show(variable);  - BAD
-# Example: cons_show("%s", variable);  - OK
-# Matches: func(identifier) or func(identifier->member) or func(identifier[index])
-RESULTS=$(grep -rn --include="*.c" -P "($FORMAT_FUNCS)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*\w+\s*\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
+for func in "${REQUIRED_ATTRIBUTED[@]}"; do
+    HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null \
+        | grep -Ec "format\(printf|G_GNUC_PRINTF" || true)
+    if [ "$HAS_ATTR" -eq 0 ]; then
+        echo "  ❌ $func — missing format attribute"
+        ERRORS=$((ERRORS + 1))
+    fi
+done
 
-# Filter out function definitions, declarations, and safe api_* wrappers
-RESULTS=$(echo "$RESULTS" | grep -v "const char\|void \|^[^:]*:[0-9]*:[a-z_]*(\|api_cons_show\|api_log_" || true)
+if [ "$ERRORS" -eq 0 ]; then
+    echo "  ✅ All known wrappers annotated."
+fi
 
-if [ -n "$RESULTS" ]; then
-    echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND:"
+# --------------------------------------------------------------------- #
+# Auto-detect new variadic functions that look like printf wrappers      #
+# but are NOT in the known list and NOT annotated.                       #
+# Heuristic: declaration has (... const char* ..., ...) and no attribute #
+# --------------------------------------------------------------------- #
+echo ""
+echo "Check 2: Detect unannotated printf-like variadic declarations in headers"
+echo ""
+
+KNOWN_RE=$(IFS="|"; echo "${REQUIRED_ATTRIBUTED[*]}")
+
+# Find variadic declarations with a const char* / gchar* parameter followed by ...)
+# that do NOT have a format attribute on the preceding line
+NEW_ISSUES=$(grep -B1 -rn --include="*.h" \
+    'const g\?char\s*\*.*,\s*\.\.\.)' "$DIR" 2>/dev/null \
+    | awk '
+        /format\(printf|G_GNUC_PRINTF/ { skip=1; next }
+        /const g?char.*,.*\.\.\.\)/ {
+            if (skip) { skip=0; next }
+            print
+        }
+        { skip=0 }
+    ' \
+    | grep -E "void\s+\w+\s*\(" \
+    | grep -Ev "($KNOWN_RE)" \
+    || true)
+
+if [ -n "$NEW_ISSUES" ]; then
+    echo "  ⚠️  Possibly unannotated new printf-like functions:"
     echo ""
-    echo "$RESULTS"
+    echo "$NEW_ISSUES"
     echo ""
-    ERRORS=$(echo "$RESULTS" | wc -l)
+    NEW_COUNT=$(echo "$NEW_ISSUES" | wc -l)
+    ERRORS=$((ERRORS + NEW_COUNT))
 else
-    echo "✅ No obvious CWE-134 issues found."
-fi
-
-# Additional check: GString->str passed directly (not as %s argument)
-echo ""
-echo "Checking for GString->str passed to format functions..."
-
-GSTRING_RESULTS=$(grep -rn --include="*.c" -P "($FORMAT_FUNCS)\s*\([^)]*->str\s*\)" "$DIR" 2>/dev/null | grep -v '"%s"' || true)
-
-if [ -n "$GSTRING_RESULTS" ]; then
-    echo "⚠️  GString->str passed without \"%s\" (review manually):"
-    echo ""
-    echo "$GSTRING_RESULTS"
-    echo ""
+    echo "  ✅ No unannotated variadic printf-like functions found."
 fi
 
+# --------------------------------------------------------------------- #
+# Summary                                                                #
+# --------------------------------------------------------------------- #
 echo ""
 echo "=== Summary ==="
-echo "Critical issues: $ERRORS"
+echo "Issues: $ERRORS"
+echo ""
 
 if [ "$ERRORS" -gt 0 ]; then
+    echo "Fix: add the attribute before the declaration in the .h file:"
+    echo "  G_GNUC_PRINTF(N, M)          // N = format arg, M = first vararg"
+    echo "  void my_func(ProfWin* w, const char* fmt, ...);"
     echo ""
-    echo "Fix by adding \"%s\" format specifier:"
-    echo "  BAD:  cons_show(variable);"
-    echo "  GOOD: cons_show(\"%s\", variable);"
+    echo "The compiler flag -Wformat=2 will then catch all misuse automatically."
     exit 1
 fi