fix: multiple unsafe c string operations exist in ipc in ipc.c

[orbisai0security]

Summary

Fix critical severity security issue in common/recipes-lib/ipc/files/ipc.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	common/recipes-lib/ipc/files/ipc.c:109
CWE	CWE-120

Description: Multiple unsafe C string operations exist in ipc.c and DBusServerMemtest.c. sprintf() constructs Unix domain socket paths at lines 109 and 259 with no bounds checking on the 'endpoint' parameter. strcpy() at line 329 copies the endpoint string into a fixed-size buffer without length validation. strcat() at DBusServerMemtest.c:73 appends to objectName without verifying remaining buffer space. The sun_path field in struct sockaddr_un is typically 108 bytes; an endpoint name exceeding this limit causes a stack or heap buffer overflow, overwriting adjacent memory.

Changes

• common/recipes-lib/ipc/files/ipc.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[meta-codesync]

@facebook-github-bot has imported this pull request. If you are a Meta employee, you can view this in D104775173. (Because this pull request was imported automatically, there will not be any future comments.)