fix: the http response callback performs memcpy with... in...

[orbisai0security]

Summary

Fix critical severity security issue in native/zero-c/runtime/zero_http_curl.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	native/zero-c/runtime/zero_http_curl.c:114
CWE	CWE-120

Description: The HTTP response callback performs memcpy with a size derived from incoming network data. While a too_large flag exists, it may not prevent overflow in all scenarios, particularly with chunked transfer encoding where multiple callbacks accumulate data before the flag is checked. If accumulated size exceeds the pre-allocated buffer before the flag triggers, a heap buffer overflow occurs.

Changes

• native/zero-c/runtime/zero_http_curl.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[vercel]

@orbisai0security is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.