fix: four malloc calls in src/scanner in scanner.c

[anupamme]

Summary

Fix high severity security issue in src/scanner.c.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/scanner.c:19
Assessment	Likely exploitable

Description: Four malloc calls in src/scanner.c lack NULL return value validation before pointer dereference. Under memory pressure or resource exhaustion conditions, malloc returns NULL causing immediate segmentation fault when the pointer is dereferenced, resulting in denial of service.

Evidence

Exploitation scenario: Attacker triggers memory pressure through concurrent parsing requests or large input submissions, causing malloc to return NULL.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/scanner.c

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security