fix: add buffer-length check in savefile.c

[orbisai0security]

Summary

Fix critical severity security issue in src/savefile/savefile.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/savefile/savefile.c:129
CWE	CWE-120

Description: Two unbounded strcpy calls in savefile.c copy user- or file-controlled strings into a fixed-size buffer (savefile.last_scene) without any length validation. Line 129 copies 'name' directly into the buffer, and line 134 copies 'entry' at an offset (len+1) into the same buffer. If either string exceeds the remaining buffer capacity, adjacent memory is overwritten, enabling classic stack or heap buffer overflow. This is the highest-risk finding in the codebase because save files are a natural external input vector that an attacker can craft and distribute.

Changes

• src/savefile/savefile.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security