fix: three memcpy operations in jv_print in jv_print.c

[orbisai0security]

Summary

Fix critical severity security issue in src/jv_print.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/jv_print.c:86
CWE	CWE-120

Description: Three memcpy operations in jv_print.c copy data into destination buffers without verifying that the source length fits within the remaining destination buffer capacity. At line 86, memcpy(cb + 2, codes[ci], len) does not confirm that len bytes are available in the cb buffer beyond offset 2. At lines 426 and 434, memcpy(outbuf, str, l) does not validate l against the allocated size of outbuf. A crafted JSON input that produces an oversized color code, string segment, or output value triggers a heap buffer overflow, overwriting adjacent heap metadata or allocations.

Changes

• src/jv_print.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security