fix: add bounds check before memcpy in decoder.cpp

[orbisai0security]

Summary

Fix critical severity security issue in wasm/decoder.cpp.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	wasm/decoder.cpp:267
Assessment	Confirmed exploitable

Description: The decoder performs three memcpy operations copying Y, U, and V plane data from decoded video frames into a destination buffer without validating that the copy sizes (videoWidth, halfw) fit within the allocated destination buffer. A malicious video stream with manipulated frame dimensions can cause writes beyond the allocated heap buffer in WebAssembly linear memory.

Evidence

Exploitation scenario: Attacker crafts a malicious H.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• wasm/decoder.cpp

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[vercel]

@orbisai0security is attempting to deploy a commit to the langhuihui's projects Team on Vercel.

A member of the Team first needs to authorize it.