fix: multiple memcpy calls in clib/arr in arr.h

[orbisai0security]

Summary

Fix critical severity security issue in clib/arr.h.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	clib/arr.h:14

Description: Multiple memcpy calls in clib/arr.h and clib/mem.c lack bounds validation. In clib/arr.h:14, arr_cap(src) bytes are copied into tar without verifying that tar has sufficient capacity. In clib/mem.c:162, len bytes are written to buf_top(buf) without checking that len does not exceed the remaining buffer space. An attacker-controlled input that inflates the source size or the len parameter can overflow the destination heap buffer, corrupting adjacent allocations or heap metadata. These macros and functions are used pervasively throughout the codebase, making the attack surface broad.

Changes

• clib/arr.h

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security