fix: add buffer-length check in stoolap.c

[anupamme]

Summary

Fix critical severity security issue in src/stoolap.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/stoolap.c:291
Assessment	Likely exploitable
CWE	CWE-120

Description: Multiple memcpy operations copy data without validating that the source length fits within the destination buffer capacity. An attacker can supply crafted input with length values exceeding allocated buffer sizes, causing heap buffer overflow and memory corruption.

Evidence

Exploitation scenario: Attacker provides malicious input data with crafted length values through the JavaScript API that propagate to internal C functions.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/stoolap.c

Note: The following lines in the same file use a similar pattern and may also need review: src/stoolap.c:236, src/stoolap.c:292, src/stoolap.c:464, src/stoolap.c:483, src/stoolap.c:629 (and 26 more)

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security