fix(omemo): guard NULL fingerprint decode and log failures (CWE-476/457)

Absorbs the still-relevant null-pointer guards from #107 and extends them for consistency across all _omemo_fingerprint_decode() callers:
- _omemo_fingerprint_decode(): return NULL on NULL input instead of dereferencing it via strlen().
- omemo_is_trusted_identity(): bail out (FALSE) when decode fails and zero-init fingerprint_len, instead of passing a NULL buffer / reading an uninitialized length into signal_buffer_append().
- omemo_trust(): bail out when decode fails (previously unchecked; under OOM it would save a bogus 1-byte identity).

Every decode failure is now logged (omemo_is_trusted_identity / omemo_trust / omemo_untrust) instead of failing silently; omemo_trust also surfaces a user-facing error.

The cmd_funcs.c hunks from #107 are dropped: master already has the strtok guard, and its fdopen guard is more complete (it closes the fd).

src/command/cmd_ac.c

@@ -47,7 +47,6 @@ static char* _notify_autocomplete(ProfWin* window, const char* const input, gboo
 static char* _theme_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _spellcheck_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _autoaway_autocomplete(ProfWin* window, const char* const input, gboolean previous);
-static char* _autoping_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _autoconnect_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _account_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _who_autocomplete(ProfWin* window, const char* const input, gboolean previous);
@@ -1057,7 +1056,6 @@ cmd_ac_init(void)
 
     autocomplete_add(autoping_ac, "set");
     autocomplete_add(autoping_ac, "timeout");
-    autocomplete_add(autoping_ac, "warning");
 
     autocomplete_add(plugins_ac, "install");
     autocomplete_add(plugins_ac, "update");
@@ -1409,7 +1407,6 @@ cmd_ac_init(void)
     g_hash_table_insert(ac_funcs, "/alias", _alias_autocomplete);
     g_hash_table_insert(ac_funcs, "/autoaway", _autoaway_autocomplete);
     g_hash_table_insert(ac_funcs, "/autoconnect", _autoconnect_autocomplete);
-    g_hash_table_insert(ac_funcs, "/autoping", _autoping_autocomplete);
     g_hash_table_insert(ac_funcs, "/avatar", _avatar_autocomplete);
     g_hash_table_insert(ac_funcs, "/ban", _ban_autocomplete);
     g_hash_table_insert(ac_funcs, "/blocked", _blocked_autocomplete);
@@ -1937,6 +1934,7 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
         { "/prefs", prefs_ac },
         { "/disco", disco_ac },
         { "/room", room_ac },
+        { "/autoping", autoping_ac },
         { "/mainwin", winpos_ac },
         { "/inputwin", winpos_ac },
     };
@@ -4266,20 +4264,6 @@ _executable_autocomplete(ProfWin* window, const char* const input, gboolean prev
     return result;
 }
 
-static char*
-_autoping_autocomplete(ProfWin* window, const char* const input, gboolean previous)
-{
-    char* result = NULL;
-
-    result = autocomplete_param_with_ac(input, "/autoping", autoping_ac, TRUE, previous);
-    if (result) {
-        return result;
-    }
-
-    result = autocomplete_param_with_func(input, "/autoping warning", prefs_autocomplete_boolean_choice, previous, NULL);
-    return result;
-}
-
 static char*
 _lastactivity_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {

src/command/cmd_defs.c

@@ -1964,14 +1964,12 @@ static const struct cmd_t command_defs[] = {
               CMD_TAG_CONNECTION)
       CMD_SYN(
               "/autoping set <seconds>",
-              "/autoping timeout <seconds>",
-              "/autoping warning on|off")
+              "/autoping timeout <seconds>")
       CMD_DESC(
               "Set the interval between sending ping requests to the server to ensure the connection is kept alive.")
       CMD_ARGS(
               { "set <seconds>", "Number of seconds between sending pings, a value of 0 disables autoping." },
-              { "timeout <seconds>", "Seconds to wait for autoping responses, after which the connection is considered broken." },
-              { "warning on|off", "Enable or disable autoping availability warning." })
+              { "timeout <seconds>", "Seconds to wait for autoping responses, after which the connection is considered broken." })
     },
 
     { CMD_PREAMBLE("/ping",

src/command/cmd_funcs.c

@@ -6374,8 +6374,6 @@ cmd_autoping(ProfWin* window, const char* const command, gchar** args)
             cons_bad_cmd_usage(command);
         }
 
-    } else if (g_strcmp0(cmd, "warning") == 0) {
-        _cmd_set_boolean_preference(value, "Autoping availability warning", PREF_AUTOPING_WARNING);
     } else {
         cons_bad_cmd_usage(command);
     }

src/config/preferences.c

@@ -2290,7 +2290,6 @@ _get_group(preference_t pref)
     case PREF_TRAY:
     case PREF_TRAY_READ:
     case PREF_ADV_NOTIFY_DISCO_OR_VERSION:
-    case PREF_AUTOPING_WARNING:
         return PREF_GROUP_NOTIFICATIONS;
     case PREF_DBLOG:
     case PREF_CHLOG:
@@ -2647,8 +2646,6 @@ _get_key(preference_t pref)
         return "enabled";
     case PREF_SPELLCHECK_LANG:
         return "lang";
-    case PREF_AUTOPING_WARNING:
-        return "autoping.warning";
     default:
         return NULL;
     }
@@ -2702,7 +2699,6 @@ _get_default_boolean(preference_t pref)
     case PREF_MOOD:
     case PREF_STROPHE_SM_ENABLED:
     case PREF_STROPHE_SM_RESEND:
-    case PREF_AUTOPING_WARNING:
         return TRUE;
     case PREF_SPELLCHECK_ENABLE:
     case PREF_PGP_PUBKEY_AUTOIMPORT:

src/config/preferences.h

@@ -169,7 +169,6 @@ typedef enum {
     PREF_FORCE_ENCRYPTION_MODE,
     PREF_SPELLCHECK_ENABLE,
     PREF_SPELLCHECK_LANG,
-    PREF_AUTOPING_WARNING
 } preference_t;
 
 typedef struct prof_alias_t

src/ui/console.c

@@ -1703,11 +1703,6 @@ cons_notify_setting(void)
     else
         cons_show("Subscription requests (/notify sub) : OFF");
 
-    if (prefs_get_boolean(PREF_AUTOPING_WARNING))
-        cons_show("Autoping warning (/autoping warning): ON");
-    else
-        cons_show("Autoping warning (/autoping warning): OFF");
-
     gint remind_period = prefs_get_notify_remind();
     if (remind_period == 0) {
         cons_show("Reminder period (/notify remind)    : OFF");
@@ -2008,26 +2003,21 @@ cons_autoping_setting(void)
 {
     gint autoping_interval = prefs_get_autoping();
     if (autoping_interval == 0) {
-        cons_show("Autoping interval (/autoping)       : OFF");
+        cons_show("Autoping interval (/autoping)   : OFF");
     } else if (autoping_interval == 1) {
-        cons_show("Autoping interval (/autoping)       : 1 second");
+        cons_show("Autoping interval (/autoping)   : 1 second");
     } else {
-        cons_show("Autoping interval (/autoping)       : %d seconds", autoping_interval);
+        cons_show("Autoping interval (/autoping)   : %d seconds", autoping_interval);
     }
 
     gint autoping_timeout = prefs_get_autoping_timeout();
     if (autoping_timeout == 0) {
-        cons_show("Autoping timeout (/autoping)        : OFF");
+        cons_show("Autoping timeout (/autoping)    : OFF");
     } else if (autoping_timeout == 1) {
-        cons_show("Autoping timeout (/autoping)        : 1 second");
+        cons_show("Autoping timeout (/autoping)    : 1 second");
     } else {
-        cons_show("Autoping timeout (/autoping)        : %d seconds", autoping_timeout);
+        cons_show("Autoping timeout (/autoping)    : %d seconds", autoping_timeout);
     }
-
-    if (prefs_get_boolean(PREF_AUTOPING_WARNING))
-        cons_show("Autoping warning (/autoping warning): ON");
-    else
-        cons_show("Autoping warning (/autoping warning): OFF");
 }
 
 void

src/ui/window.c

@@ -67,20 +67,6 @@ _win_ensure_pad_capacity(ProfWin* window, WINDOW* win, int lines_needed)
         }
     }
 }
-
-// upper-bound estimate of rows a message body occupies (hard newlines + soft-wrap), to reserve pad space before printing so a tall message isn't clipped (a clipped height desyncs the scroll offset)
-static int
-_win_estimated_lines(WINDOW* win, const char* const message, int indent, int pad_indent)
-{
-    int usable = MAX(1, getmaxx(win) - (indent + pad_indent));
-    int newlines = 0;
-    for (const char* p = message; *p; p++) {
-        if (*p == '\n') {
-            newlines++;
-        }
-    }
-    return newlines + utf8_display_len(message) / usable + 2;
-}
 static const char* LOADING_MESSAGE = "Loading older messages…";
 static const char* CONS_WIN_TITLE = "CProof. Type /help for help information.";
 static const char* XML_WIN_TITLE = "XML Console";
@@ -2015,7 +2001,7 @@ _win_print_internal(ProfWin* window, const char* show_char, int pad_indent, GDat
         }
     }
 
-    _win_ensure_pad_capacity(window, window->layout->win, getcury(window->layout->win) + _win_estimated_lines(window->layout->win, message + offset, indent, pad_indent));
+    _win_ensure_pad_capacity(window, window->layout->win, getcury(window->layout->win));
 
     if (prefs_get_boolean(PREF_WRAP)) {
         _win_print_wrapped(window->layout->win, message + offset, indent, pad_indent);

src/xmpp/iq.c

@@ -103,7 +103,6 @@ static void _ping_get_handler(xmpp_stanza_t* const stanza);
 static int _version_result_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* const userdata);
-static int _disco_autoping_warning_message(GHashTable* features);
 static int _http_upload_response_id_handler(xmpp_stanza_t* const stanza, void* const upload_ctx);
 static int _last_activity_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _room_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
@@ -2430,10 +2429,6 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
             }
             child = xmpp_stanza_get_next(child);
         }
-
-        if (!from) {
-            _disco_autoping_warning_message(features);
-        }
     }
 
     connection_features_received(from);
@@ -2441,22 +2436,6 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
     return 0;
 }
 
-static int
-_disco_autoping_warning_message(GHashTable* features)
-{
-    gboolean server_supports_ping = g_hash_table_contains(features, "urn:xmpp:ping");
-    gboolean users_prefers_warning = prefs_get_boolean(PREF_AUTOPING_WARNING);
-    gboolean is_autoping_enabled = prefs_get_autoping() != 0;
-
-    if (!is_autoping_enabled && server_supports_ping && users_prefers_warning) {
-        cons_show("This server supports XEP-0199: XMPP Ping (better keepalive detection),\n"
-                  "but autoping feature is currently disabled in settings.\n"
-                  "Consider enabling it (e.g., `/autoping set 30`) for improved connection stability.\n"
-                  "Use `/autoping warning off` to disable this message.");
-    }
-    return 0;
-}
-
 static int
 _http_upload_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata)
 {

tests/functionaltests/functionaltests.c

@@ -150,12 +150,6 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(autoping_sends_ping_after_interval),
         PROF_FUNC_TEST(autoping_server_not_supporting_ping),
 
-        /* Autoping availability warning - negative cases wait ~3s */
-        PROF_FUNC_TEST(autoping_warning_shown_when_disabled),
-        PROF_FUNC_TEST(autoping_warning_not_shown_when_server_unsupported),
-        PROF_FUNC_TEST(autoping_warning_not_shown_when_autoping_enabled),
-        PROF_FUNC_TEST(autoping_warning_not_shown_when_user_disabled),
-
         /* Service Discovery - XEP-0030 */
         PROF_FUNC_TEST(disco_info_shows_identity),
         PROF_FUNC_TEST(disco_info_shows_features),

tests/functionaltests/test_autoping.c

@@ -112,99 +112,3 @@ autoping_server_not_supporting_ping(void** state)
     // Should show error about ping not being supported
     assert_true(prof_output_regex("Server ping not supported"));
 }
-
-/*
- * Autoping availability warning.
- *
- * The warning fires from the on-connect disco handler, so the three inputs
- * (server ping support, autoping interval, warning preference) must all be
- * set before prof_connect().
- */
-
-/* Stable substring of the warning text emitted by iq.c. */
-#define AUTOPING_WARNING_MATCH "This server supports XEP-0199"
-
-static void
-_stub_server_disco(gboolean with_ping)
-{
-    if (with_ping) {
-        stbbr_for_query("http://jabber.org/protocol/disco#info",
-            "<iq to='stabber@localhost/profanity' type='result' from='localhost'>"
-                "<query xmlns='http://jabber.org/protocol/disco#info'>"
-                    "<identity category='server' type='im' name='Stabber'/>"
-                    "<feature var='urn:xmpp:ping'/>"
-                "</query>"
-            "</iq>"
-        );
-    } else {
-        stbbr_for_query("http://jabber.org/protocol/disco#info",
-            "<iq to='stabber@localhost/profanity' type='result' from='localhost'>"
-                "<query xmlns='http://jabber.org/protocol/disco#info'>"
-                    "<identity category='server' type='im' name='Stabber'/>"
-                "</query>"
-            "</iq>"
-        );
-    }
-}
-
-void
-autoping_warning_shown_when_disabled(void** state)
-{
-    // All conditions met: server supports ping, autoping off, warning on (default).
-    _stub_server_disco(TRUE);
-
-    prof_input("/autoping set 0");
-    assert_true(prof_output_exact("Autoping disabled."));
-
-    prof_connect();
-
-    assert_true(prof_output_regex(AUTOPING_WARNING_MATCH));
-}
-
-void
-autoping_warning_not_shown_when_server_unsupported(void** state)
-{
-    // Server does not advertise urn:xmpp:ping -> no warning even with autoping off.
-    _stub_server_disco(FALSE);
-
-    prof_input("/autoping set 0");
-    assert_true(prof_output_exact("Autoping disabled."));
-
-    prof_connect();
-
-    prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
-    assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
-}
-
-void
-autoping_warning_not_shown_when_autoping_enabled(void** state)
-{
-    // Warning is suppressed while autoping is enabled.
-    _stub_server_disco(TRUE);
-
-    prof_input("/autoping set 30");
-    assert_true(prof_output_exact("Autoping interval set to 30 seconds."));
-
-    prof_connect();
-
-    prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
-    assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
-}
-
-void
-autoping_warning_not_shown_when_user_disabled(void** state)
-{
-    // User opted out -> no warning. Command takes on|off ("enable|disable" doc is wrong).
-    _stub_server_disco(TRUE);
-
-    prof_input("/autoping set 0");
-    assert_true(prof_output_exact("Autoping disabled."));
-
-    prof_input("/autoping warning off");
-    assert_true(prof_output_exact("Autoping availability warning disabled."));
-
-    prof_connect();
-
-    prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
-    assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
-}

tests/functionaltests/test_autoping.h

@@ -4,7 +4,3 @@ void autoping_timeout_set(void** state);
 void autoping_timeout_zero_disables(void** state);
 void autoping_sends_ping_after_interval(void** state);
 void autoping_server_not_supporting_ping(void** state);
-void autoping_warning_shown_when_disabled(void** state);
-void autoping_warning_not_shown_when_server_unsupported(void** state);
-void autoping_warning_not_shown_when_autoping_enabled(void** state);
-void autoping_warning_not_shown_when_user_disabled(void** state);