fix: add bounds check before memcpy in ngx_http_vod_module.c

[orbisai0security]

Summary

Fix critical severity security issue in ngx_http_vod_module.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	ngx_http_vod_module.c:856

Description: At ngx_http_vod_module.c:856, ngx_memcpy copies original_buffer.len bytes from original_buffer.data into buffer_copy without verifying that the destination allocation is at least original_buffer.len bytes large. At line 935, part_count * sizeof(buffers[0]) bytes are copied without validating part_count against the allocated size of the buffers array. If an attacker can influence these length values through crafted MP4 or HLS input, they can overflow the heap buffer, overwriting adjacent heap metadata or allocations.

Changes

• ngx_http_vod_module.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security