fix: add buffer-length check in capture-menger.c - #182

Summary

Address high severity security finding in src/adapters/menger/tools/native/headless/capture-menger.c.

Vulnerability

Description: The capture-menger.c tool allocates memory for image buffers using multiplication of width and height parameters without overflow checking. If an attacker can control the width and height values (e.g., through command-line arguments, configuration files, or input data), they can trigger an integer overflow in the multiplication (size_t)width * (size_t)height * 4. This results in a small allocation followed by writes that exceed the allocated buffer size, causing a heap buffer overflow.

Evidence

Exploitation scenario: An attacker who can control the width and height parameters passed to the capture-menger tool provides values like width=1073741824 and height=2.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/adapters/menger/tools/native/headless/capture-menger.c

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

Automated security fix by OrbisAI Security