fix: address config injection and SIGCHLD handling

- Sanitize account names to prevent GKeyFile config injection by
  blocking special characters like #, \n, and \r.
- Ensure GLib's SIGCHLD handler is initialized before forking
  external editors to prevent zombie processes.
- Add missing error check for OMEMO random key generation.
- Replace hardcoded console tab ID with a named constant.
- Log invalid JIDs safely to prevent potential null pointer issues.

src/config/accounts.c

@@ -43,7 +43,8 @@ _sanitize_account_name(const char* const name)
     gchar* sanitized = g_strdup(name);
     gchar* p = sanitized;
     while (*p) {
-        if (*p == '[' || *p == ']' || *p == '=') {
+        // GKeyFile special characters: [ ] = # \n \r
+        if (*p == '[' || *p == ']' || *p == '=' || *p == '#' || *p == '\n' || *p == '\r') {
             *p = '_';
         }
         p++;

src/database_sqlite.c

@@ -232,6 +232,10 @@ _sqlite_init(ProfAccount* account)
         auto_sqlite char* init_version_query = sqlite3_mprintf(
             "INSERT INTO `DbVersion` (`version`) VALUES (%d) ON CONFLICT(`version`) DO NOTHING",
             latest_version);
+        if (!init_version_query) {
+            log_error("OOM allocating initial DbVersion insert query");
+            goto out;
+        }
         if (SQLITE_OK != sqlite3_exec(g_chatlog_database, init_version_query, NULL, 0, &err_msg)) {
             goto out;
         }

src/log.c

@@ -348,10 +348,11 @@ log_stderr_init(log_level_t level)
         goto err_free;
     }
 
-    int dup_fd = dup2(stderr_pipe[1], STDERR_FILENO);
-    if (dup_fd < 0)
+    if (dup2(stderr_pipe[1], STDERR_FILENO) < 0)
         goto err_free;
-    close(dup_fd);
+    // fd 2 now owns the pipe write end; release the original.
+    close(stderr_pipe[1]);
+    stderr_pipe[1] = STDERR_FILENO;
 
     stderr_level = level;
     stderr_inited = 1;

src/omemo/omemo.c

@@ -806,6 +806,10 @@ omemo_on_message_send(ProfWin* win, const char* const message, gboolean request_
     key_tag = gcry_malloc_secure(AES128_GCM_KEY_LENGTH + AES128_GCM_TAG_LENGTH);
 
     key = gcry_random_bytes_secure(AES128_GCM_KEY_LENGTH + AES128_GCM_IV_LENGTH, GCRY_VERY_STRONG_RANDOM);
+    if (!key) {
+        log_error("[OMEMO][SEND] cannot generate random key/IV");
+        goto out;
+    }
     iv = key + AES128_GCM_KEY_LENGTH;
 
     res = aes128gcm_encrypt(ciphertext, &ciphertext_len, tag, &tag_len, (const unsigned char* const)message, strlen(message), iv, key);

src/tools/editor.c

@@ -9,14 +9,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later WITH OpenSSL-exception
  */
 
-#include <fcntl.h>
 #include <glib.h>
 #include <errno.h>
-#include <stdio.h> // necessary for readline
-#include <readline/readline.h>
+#include <stdio.h>
 #include <sys/wait.h>
 #include <unistd.h>
-#include <pthread.h>
 #include <signal.h>
 
 #include "config/files.h"
@@ -124,6 +121,12 @@ launch_editor(gchar* initial_content, void (*callback)(gchar* content, void* dat
 
     ui_suspend();
 
+    // Ensure GLib's SIGCHLD handler is installed before forking to prevent
+    // zombie children if the editor is launched before the main loop starts.
+    GMainContext* main_ctx = g_main_context_default();
+    g_main_context_acquire(main_ctx);
+    g_main_context_release(main_ctx);
+
     pid_t pid = fork();
     if (pid == -1) {
         log_error("[Editor] Failed to fork: %s", strerror(errno));

src/ui/statusbar.c

@@ -55,6 +55,8 @@ static GTimeZone* tz;
 static StatusBar* statusbar;
 static WINDOW* statusbar_win;
 
+#define CONSOLE_TAB_ID 10 // Console tab ID in status bar hash table
+
 void _get_range_bounds(guint* start, guint* end, gboolean is_static);
 static guint _status_bar_draw_time(guint pos);
 static guint _status_bar_draw_maintext(guint pos);
@@ -157,7 +159,7 @@ void
 status_bar_current(guint i)
 {
     if (i == 0) {
-        statusbar->current_tab = 10;
+        statusbar->current_tab = CONSOLE_TAB_ID;
     } else {
         statusbar->current_tab = i;
     }

src/xmpp/jid.c

@@ -32,6 +32,7 @@ Jid*
 jid_create(const gchar* const str)
 {
     if (!jid_is_valid(str)) {
+        log_debug("[JID] invalid JID: '%s'", str ?: "(null)");
         return NULL;
     }
 
@@ -217,7 +218,7 @@ jid_destroy(Jid* jid)
     g_free(jid->resourcepart);
     g_free(jid->barejid);
     g_free(jid->fulljid);
-    free(jid);
+    g_free(jid);
 }
 
 gboolean