Summary
Fix critical severity security issue in src/streams.h.
Vulnerability
| Field | Value |
|---|---|
| ID | V-001 |
| Severity | CRITICAL |
| Scanner | multi_agent_ai |
| Rule | V-001 |
| File | src/streams.h:61 |
| Assessment | Likely exploitable |
Description: Multiple memcpy operations in src/streams.h perform unchecked memory copies. In VectorWriter::write(), the code calculates nOverwrite = std::min(src.size(), vchData.size() - nPos) but does not validate nPos <= vchData.size() first. If nPos > vchData.size(), the unsigned subtraction underflows, resulting in a massive value passed to std::min, causing memcpy to write far beyond buffer bounds.
Evidence
Exploitation scenario: An attacker crafts a data stream with a manipulated position field (nPos) exceeding the buffer size.
Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.
Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a local CLI tool - exploitation requires the attacker to control command-line arguments or input files.
Changes
src/streams.h
Note: The following lines in the same file use a similar pattern and may also need review:
src/streams.h:114,src/streams.h:147,src/streams.h:220,src/streams.h:571
Behavior Preservation
The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.
Automated security fix by OrbisAI Security
