fix: remove unsafe exec() in consdiff.c

[orbisai0security]

Summary

Fix critical severity security issue in src/feature/dircommon/consdiff.c.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	src/feature/dircommon/consdiff.c:876
CWE	CWE-120

Description: Multiple memcpy calls in the consensus diff processing subsystem use length values (diff_cdline->len, cdline->len, a_size) derived directly from externally-supplied consensus diff documents without adequate bounds validation. At line 876, memcpy(diff_line, diff_cdline->s, diff_cdline->len) copies data where diff_cdline->len originates from parsing a network-supplied consensus diff. If the destination buffer diff_line was allocated based on a different size calculation, or if diff_cdline->len is not validated against the actual allocated size of diff_line, a heap buffer overflow occurs. Similarly at line 1328, cdline->len controls the copy size into 'out'. A malicious directory server can craft a consensus diff with mismatched length fields to trigger heap corruption, potentially enabling arbitrary code execution within the Tor daemon process.

Changes

• src/feature/dircommon/consdiff.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security