fix: at spr_3c in spr_3c.c

[orbisai0security]

Summary

Fix high severity security issue in Resources/sbl6/segalib/spr/spr_3c.c.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	Resources/sbl6/segalib/spr/spr_3c.c:1256

Description: At spr_3c.c line 1256, memcpy copies vertex normal data from obj->vertNormal into cBuf->vertBright without an explicit bounds check. If the source array (obj->vertNormal) contains more elements than the destination buffer (cBuf->vertBright) can hold, adjacent heap memory is overwritten. This is a classic CWE-120/CWE-787 pattern in a C rendering library that processes external asset data. The copy size appears to be derived from the object structure itself, meaning a crafted asset with an inflated vertex count directly controls the overflow magnitude.

Changes

• Resources/sbl6/segalib/spr/spr_3c.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security