fix: the midifile library copies sysex and meta even... in midifile.c

[orbisai0security]

Summary

Fix critical severity security issue in midifile/midifile.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	midifile/midifile.c:2973

Description: The midifile library copies sysex and meta event data into heap-allocated destination buffers using a data_length value read directly from the MIDI file, without verifying that data_length does not exceed the allocated size of the destination buffer. An attacker can craft a MIDI file where the declared event data length exceeds the actual allocated buffer, causing memcpy to write beyond the heap allocation boundary and corrupt adjacent heap memory.

Changes

• midifile/midifile.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[CrazyCritic89]

Damn, I wasn't even thinking about potential security flaws in the libraries. Should've considering the age of this and how long it's been since its last update. Thank you for this!

I'm planning on moving to fmidi soon if you want to look at that. Of course, this isn't set in stone, just an idea.

I'll be merging this. Thanks again!