fix: add buffer-length check in browser.c

[orbisai0security]

Summary

Fix critical severity security issue in packages/gscope/src/browser.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	packages/gscope/src/browser.c:363
CWE	CWE-120

Description: At browser.c:367, each result node allocates a fixed 1024-byte buffer (node->buf) to hold source file content, symbol names, or cscope database entries. There is no bounds checking enforced before data is written into this buffer. Any source file line, identifier, or cscope entry exceeding 1024 bytes will overflow into adjacent heap memory. This is a classic heap buffer overflow: the allocation size is hardcoded and does not adapt to the actual length of the data being stored.

Changes

• packages/gscope/src/browser.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security