fix: multiple memcpy calls in image processing funct... in bmms.c

[orbisai0security]

Summary

Fix critical severity security issue in src/bmms.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/bmms.c:163
CWE	CWE-120

Description: Multiple memcpy calls in image processing functions do not validate that the source data fits within the destination allocation. In src/bmms.c:163, the expression w * h * pd * sizeof*tmp can overflow if attacker-controlled image dimensions are large, resulting in an undersized allocation followed by a heap buffer overflow. In src/imprintf.c:562-564, exactly 0x100 bytes are copied from bufopt into a 0x100-byte allocation without verifying bufopt is null-terminated or bounded within 0x100 bytes. In src/ransac.c:106-108, the size s used in memcpy is not validated against the actual allocation sizes of the target buffers.

Changes

• src/bmms.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security