fix: six memcpy calls in libgps/os_compat in os_compat.c

[orbisai0security]

Summary

Fix critical severity security issue in libgps/os_compat.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	libgps/os_compat.c:207
CWE	CWE-120

Description: Six memcpy calls in libgps/os_compat.c copy data into destination buffers using lengths derived from source data (slen, len, srclen, maxlen) without first validating that the source length fits within the destination buffer capacity. These helper functions are called throughout the GPS data processing pipeline. An attacker who can supply GPS or NMEA data with crafted length fields can cause the computed copy length to exceed the destination buffer size, triggering a heap or stack buffer overflow.

Changes

• libgps/os_compat.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security