v4.10.2

Fixed

• core: fix freeze when displaying a very long message, for example a corrupted log file displayed in backlog (#637)
• core: fix memory leak when the last buffer is closed
• api: fix compilation error with macro weechat_file_compare
• guile: fix return value of functions mkdir_home, mkdir and mkdir_parents when the directory cannot be created
• perl: fix wrong arguments error in function nicklist_remove_all
• relay/api: fix memory leak when a message without body is sent to a client connected with websocket
• tcl: return 0 instead of raising an error in functions mkdir_home, mkdir and mkdir_parents when the directory cannot be created
• tcl: add missing function completion_free

Security

• core: fix integer overflow in dynamic strings when their size exceeds 4 GiB (GHSA-h394-85x4-68c7)
• core: fix heap buffer overflow in charset conversion when the converted string is more than 4 times longer than the input and contains invalid chars, for example with charset TSCII (GHSA-q32h-5qvq-3936)
• irc: limit number of prefix modes in PREFIX of message 005 to prevent memory exhaustion
• irc: escape ${ in values of variables $nick, $channel and $server in commands /allchan, /allpv and /allserv, to prevent evaluation of untrusted values
• irc: escape ${ in server options addresses, nicks, password and autojoin set from an IRC URL (irc://...), to prevent evaluation of untrusted values
• irc: escape ${ in channel names saved in server option autojoin, to prevent evaluation of channel names received from the server (for example on channel forward)
• irc: fix heap buffer overflow in nick prefixes when the server sends an empty PREFIX in message 005 and the connection is lost before message 001 (GHSA-xj8h-x2w9-m8m6)
• relay: limit size of HTTP headers received from a client to prevent memory exhaustion (GHSA-h394-85x4-68c7)
• relay: fix heap buffer overflow in path of hdata sent to clients with "weechat" protocol (GHSA-8wr2-x42m-7fxv)