fix: the stb_image library performs row-swap memcpy ... in stb_image.h

[orbisai0security]

Summary

Fix critical severity security issue in src/terminal/stb_image.h.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	src/terminal/stb_image.h:1236
CWE	CWE-190

Description: The stb_image library performs row-swap memcpy operations at lines 1236-1238 using a bytes_copy value derived from attacker-controlled image metadata (width * channels * bytes_per_channel) without validating the result against the allocated row buffer size. A crafted image with manipulated width/height/channel fields causes bytes_copy to exceed the allocated buffer, overflowing into adjacent heap memory. Integer overflow in the size calculation (e.g., width=65535, channels=4 producing bytes_copy=262140 while allocation overflowed to a smaller size) makes this reliably exploitable. The zlib decode functions at lines 531/534 have the same integer overflow risk in length calculations.

Changes

• src/terminal/stb_image.h

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security