Use a larger buffer size for untarred filenames.

Only used for untarring smiley themes on Windows.
I suspect this won't affect anything. 256 just seems very
small. 4096 seems less likely to lead to truncated filenames
and I'm not worried about trying to open a filename that's
too long for the OS--I think this code handles that sanely.

--HG--
branch : release-2.x.y
Fix incorrect uses of strncpy().

I think these aren't actually a problem because prefix is 155 bytes and
filename is 100 bytes, but that's no excuse for writing bad code.

The third argument to strncpy is intended to be the size of the destination
buffer--not the size of the source. We have less error-prone functions now,
let's use them.

--HG--
branch : release-2.x.y
ACTUALLY use size of destination buffer.

Whoops :-P

--HG--
branch : release-2.x.y
Fix sizeof calls.

Sorry, forgot that sizeof(pointer to stack buffer) doesn't do what
I want.

--HG--
branch : release-2.x.y
Rip out "only" list support from our Windows untar code.

We don't use it, and it's easier for me to rip it out than try to
figure out if my change broke the if statement here.

--HG--
branch : release-2.x.y
Don't reuse the n2 variable.

Use a separate variable, just to avoid confusion. Local variables
are EXTREMELY cheap, since they're just an address on the stack.

Using separate variables for separate uses reduces chances of bugs.

--HG--
branch : release-2.x.y
Fix a bug in the untar code that we use on Windows where we
weren't stripping the drive letter from the path of files in the
tar archive, which could allow a malicious tar file to overwrite
arbitrary files on the file system.

Thanks to Yves Younan of Sourcefire VRT for discovering this and
reporting it to us.

--HG--
branch : release-2.x.y
Merge

--HG--
branch : release-2.x.y
Add bounds checking when parsing emoticon responses in MXit. This fixes
a potential remote crash when parsing a malformed emoticon response.
We'll need to get a CVE ID for this.

Discovered by Yves Younan and Richard Johnson of Sourcefire VRT. Thanks
to Sourcefire VRT for finding this and reporting it to us!

--HG--
branch : release-2.x.y
In Novell Groupwise, fix potential remote crash parsing server message
that indicates that a large amount of memory should be allocated. I
added arbitrary max size checks that are hopefully larger than any real
expected value. It was kinda weird that the existing check on checked
MAXINT. We'll want to request a CVE ID for this.

Discovered by Yves Younan and Richard Johnson of Sourcefire VRT

--HG--
branch : release-2.x.y
Manual merge. Only 1 easy conflict in ChangeLog.

--HG--
branch : release-2.x.y
Merge pidgin/main branch release-2.x.y into private/main branch release-2.x.y.
Only one file with conflicts: ChangeLog.

--HG--
branch : release-2.x.y
Pull changes from ssh://hg@hg.pidgin.im/pidgin/main
Easy manual merge: Only conflicts were in ChangeLog.

--HG--
branch : release-2.x.y
Merge changes from the pidgin.main release-2.x.y branch into
the private release-2.x.y.

No manual changes needed.

--HG--
branch : release-2.x.y
Merge the release-2.x.y branch from the main pidgin/main repo
into the release-2.x.y branch in our private repo.

--HG--
branch : release-2.x.y
Gadu-Gadu: fix protobuf-c undefined behaviour. Fixes #16327

--HG--
branch : release-2.x.y
Fix basic constraints checking for both our SSL plugins.

This was reported to our private security@pidgin.im mailing list
by an anonymous person and Jacob Appelbaum of the Tor project.

The general problem is described by Moxie Marlinspike here:
http://www.thoughtcrime.org/ie-ssl-chain.txt

Turns out BOTH of our SSL/TLS plugins are vulnerable to this. It allows
a malicious man-in-the-middle to impersonate an https server accessed by
Pidgin.

The fix for this was difficult. We'd really like to just delegate all cert
validate to the NSS or GnuTLS plugins and not do any of it ourselves, because
they're experts and we're not. And this is essentially the change we made for
NSS. However, this was difficult for GnuTLS because we need a context that we
don't have access to in the right function. We could have done it, but it
would have been a little hacky. So for our GnuTLS plugin we added basic
constraints checking ourselves. In Pidgin 3.0.0 would should clean this up
and remove a lot of internal cert validation and ALWAYS delegate to the
SSL/TLS library.

The NSS parts of this patch were written by Kai Engert and Daniel Atallah.
I wrote the GnuTLS parts.

We'll be requesting a CVE number for this.

Also, my thanks to Jacob Appelbaum and Moxie Marlinspike for their efforts
over many years to improve the security of the software that we use on a
daily basis. They are both stand-out citizens who have made contributions
to protect the privacy of all internet users. Thanks, guys!

--HG--
branch : release-2.x.y
Add placeholder CVE # to make it more likely we'll remember to enter it here.

--HG--
branch : release-2.x.y
Fix a possible information leak when preping XMPP JIDs.

Discovered and fixed by Thijs Alkemade and Paul Aurich and reported
to us privately on our security@pidgin.im mailing list.

--HG--
branch : release-2.x.y
Add CVE values, update Sourcefire VRT reference to Cisco Talos

--HG--
branch : release-2.x.y