fix: remove unsafe sprintf() in grpc-server.cpp

[orbisai0security]

Summary

Fix critical severity security issue in backend/cpp/ik-llama-cpp/grpc-server.cpp.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	backend/cpp/ik-llama-cpp/grpc-server.cpp:329

Description: Three calls to sprintf() at lines 329, 343, and 355 in the ik-llama-cpp gRPC inference server write formatted timing and token-count statistics into a fixed-size stack buffer without specifying a maximum output length. The sprintf() function does not enforce any buffer size limit. If the formatted output — including large numeric values for token counts or timing measurements — exceeds the allocated stack buffer size, the overflow will overwrite adjacent stack memory including return addresses and saved frame pointers, enabling potential arbitrary code execution.

Changes

• backend/cpp/ik-llama-cpp/grpc-server.cpp

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security