yahoo: Fix reading memory locations past the buffer bounds

 * Also improve behavior when parsing malformed P2P packets (it seems like it
   might be better to just disconnect when this happens, but I'm not familiar
   with why the code as added to try to handle the malformed packets).
 * Also, add a comment about the mistaken assumption in p2p packet handling that
   reads are being buffered and that partial packets can be subsequently filled
   in.
CID 732047 Negative array index write
msn: Fix NUL-pointer deref issue parsing Message Headers

 * Thanks to Fabian Yamaguchi and Christian Wressnegger of the University of Goettingen
msn: Fix NUL-pointer deref issue parsing mail notifications

 * Thanks to Fabian Yamaguchi and Christian Wressnegger of the University of Goettingen
msn: Fix fault handling NUL-pointer derefs
Fix purple_util_fetch_url_request variants to avoid implicitly trusting the
Content-Length specified by the server.
This issue was identified by Jacob Appelbaum of the Tor Project

 * Add a default limit of 512KiB when no explicit download limit has been specified to the API
 ** This may be controversial, but anything that needs more than that should specify it explicitly
 * Don't allocate more memory than the maximum download limit (+ header_length, which effectively doubles the limit)
 * Use g_try_realloc() instead of g_realloc() to avoid aborting when memory can't be allocated
 * Remove spurious comment about the header data not being nul-terminated - it is (line 3846)
 * Avoid looking in the HTTP body for headers (just a correctness bug)
Merge from /pidgin/main using "hg pull https://hg.pidgin.im/pidgin/main"
No conflicts.
"unlimited" is not a valid value when fetching an http document.
The function defauls to 512 KiB if a negative max is specified.
Add max download size change to ChangeLog.
Fix non-nul terminated buffer during oscar direct connect negotiation.
User must have either accepted the direct connect request or initiated it
or order to trigger this.

CID 732103
Mention my previous commit in ChangeLog
Fix security-related url notification issues: xdg-open remote execution, replacing g_spawn_command_line_ with g_spawn_ and opera 'open in current tab' bug
Yahoo: fix potential NULL pointer dereference
Correct HTTP chunked transfers code (not fixed in rev ebe3fb4a3bc2)
Merge
msn: prevent potential heap overflow when constructing a message to be sent

 * Thanks goes to Matt Jones for noticing this
Gadu-Gadu: fix a possible HTTP Content-Length integer overflow (VRT-2013-1001)
Mxit: fix a possible segfault, refs VRT-2013-1002
Manual merge. Only 1 conflict, in ChangeLog.
Fix grammar.