fix: multiple memcpy operations in luat_vfs in luat_vfs.c

[orbisai0security]

Summary

Fix critical severity security issue in luat/vfs/luat_vfs.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	luat/vfs/luat_vfs.c:350

Description: Multiple memcpy operations in luat_vfs.c use lengths derived from source strings (strlen + 1) without verifying that the destination buffer is large enough to hold the data. At line 350, file_path_len is computed from _DirName but the allocated file_path buffer size is not validated against the actual string length before copying. At line 358, ents[i].d_name is appended to file_path without checking remaining buffer capacity. An attacker who can influence directory names or mount point strings can trigger a heap or stack overflow.

Changes

• luat/vfs/luat_vfs.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud