fix: the utf8_range simd validation routines (avx2, ... in lemire-avx2.c

[orbisai0security]

Summary

Fix critical severity security issue in third_party/utf8_range/lemire-avx2.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	third_party/utf8_range/lemire-avx2.c:218

Description: The utf8_range SIMD validation routines (AVX2, SSE, NEON variants) copy a tail segment of 'len - i' bytes from 'src + i' into a fixed-size stack buffer without verifying that 'len - i' does not exceed the buffer's capacity. Similarly, main.c:270 copies neg[i].len bytes into buf+1024 without checking that neg[i].len does not exceed the remaining buffer space (sizeof(buf) - 1024). Since utf8_range is invoked for every UTF-8 string field in every parsed protobuf message, this vulnerability is reachable by any attacker who can supply crafted protobuf messages to an application using this library.

Changes

• third_party/utf8_range/lemire-avx2.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security