1.10.3: the September audit

A pass over the whole tree: a wide warning set, GCC's static analyzer, the sanitizers driven through every render harness in the classic, XP and Classic Dark looks, fuzzing of the PNG, JPEG, BMP, ICO and cursor decoders, leak checks and a visual sweep of every window. Fixed: an uninitialised palette for a PNG with a short palette chunk; a null write in the Luna Start panel when its row table fills; a null cursor slot; a deref-before-check in the tree control; Default Programs with nothing to edit; an unquoted .desktop name passed to xdg-mime; realloc results assigned straight back in the text and list controls; the logon password lingering in memory after PAM had used it (scrubbed now); a lost D-Bus connection ending the desktop session; the update page's links vanishing on the dark scheme. Faster: icon labels and ellipses are measured by bisection instead of a text measurement per character on every repaint. The whole account, with how to repeat it, is in docs/AUDIT.md.

curl -sL jacktulli.github.io/w2k | sh