Skip to content

fix: nine strcpy calls in initializeitems in InitializeItems.c#5

Open
orbisai0security wants to merge 1 commit into
kolmank:masterfrom
orbisai0security:fix-v-003-strcpy-buffer-overflow-initializeitems
Open

fix: nine strcpy calls in initializeitems in InitializeItems.c#5
orbisai0security wants to merge 1 commit into
kolmank:masterfrom
orbisai0security:fix-v-003-strcpy-buffer-overflow-initializeitems

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix high severity security issue in msi2lmp/src/InitializeItems.c.

Vulnerability

Field Value
ID V-003
Severity HIGH
Scanner multi_agent_ai
Rule V-003
File msi2lmp/src/InitializeItems.c:15

Description: Nine strcpy calls in InitializeItems.c copy string literals into fixed-size keyword buffers without bounds checking. While the current source strings are hardcoded constants, strcpy performs no length validation and will overflow the destination buffer if it is smaller than the source string. The risk is elevated if keyword buffer sizes in the struct definitions are ever reduced, if longer keyword strings are added in future development, or if any code path allows user-influenced content to reach these buffers via force field file parsing.

Changes

  • msi2lmp/src/InitializeItems.c

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by Orbis Security AI
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant