fix: at line 172, strcpy copies the value of a steam... in...

[orbisai0security]

Summary

Fix critical severity security issue in code/steamshim/steamshim_child.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	code/steamshim/steamshim_child.c:172

Description: At line 172, strcpy copies the value of a Steam environment variable (envr, obtained via getenv()) into a fixed-size stack or heap buffer (buf) without any length validation. If the environment variable value exceeds the size of buf, adjacent memory — including the stack return address — is overwritten. Lines 340, 350, 364, 372, and 382 similarly use strcpy to copy IPC-received buf content into the fixed-size event.name struct field without bounds checking, creating six distinct overflow sites in the same file.

Changes

• code/steamshim/steamshim_child.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security