fix: the membuf_grow function in md2html/md2html in md2html.c

[orbisai0security]

Summary

Fix critical severity security issue in md2html/md2html.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	md2html/md2html.c:88
CWE	CWE-120

Description: The membuf_grow function in md2html/md2html.c computes new_asize without checking for integer overflow. If an attacker supplies a crafted Markdown document that causes the buffer size calculation to overflow (new_asize wraps around to a small value), realloc returns a smaller-than-expected buffer. The subsequent memcpy at line 103 then writes 'size' bytes into a buffer that is too small, causing a heap buffer overflow that corrupts adjacent heap memory.

Changes

• md2html/md2html.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security