[Autofix][critical] Alert #6: Unbounded write

[xengine-qyt]

🤖 Copilot Autofix 自动修复报告

---

📋 基本信息

字段	内容
Alert ID	#6
安全级别	critical
规则名称	Unbounded write
问题文件	XEngine_Source/XEngine_APIModuleIPMac/APIModule_MACInfo/APIModule_MACInfo.cpp 第 87 行
CWE 分类	external/cwe/cwe-120, external/cwe/cwe-787, external/cwe/cwe-805
规则标签	external/cwe/cwe-120, external/cwe/cwe-787, external/cwe/cwe-805, reliability, security

---

🔍 问题说明

Unbounded write

The program performs a buffer copy or write operation with no upper limit on the size of the copy. An unexpectedly long input that reaches this code will cause the buffer to overflow. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.

Recommendation

Always control the length of buffer copy and buffer write operations. strncpy should be used over strcpy, snprintf over sprintf, and in other cases 'n-variant' functions should be preferred.

Example

void congratulateUser(const char *userName)
{
	char buffer[80];

	// BAD: this could overflow the buffer if the UserName is long
	sprintf(buffer, "Congratulations, %s!", userName);

	MessageBox(hWnd, buffer, "New Messa

---

### 🤖 AI 修复思路

Use bounded copy operations at every fixed-buffer write from parsed CSV data, and validate field count before indexing.  
Best fix (without changing intended functionality) in `XEngine_Source/XEngine_APIModuleIPMac/APIModule_MACInfo/APIModule_MACInfo.cpp`:

1. After CSV parsing, ensure `stl_ListField` has at least 5 elements before using `[0]...[4]`.
2. Replace `_tcsxcpy` with bounded `_tcsxncpy` using `sizeof(dest)/sizeof(dest[0]) - 1`.
3. Explicitly null-terminate each destination buffer after copy.
4. In `APIModule_MACInfo_CSVParse`, bound-check `nIndex` before writing into `tszFieldStr` to avoid overflow during CSV tokenization.

No new dependencies are required.

---

### ✅ Review 检查清单

- [ ] 理解了漏洞的成因和影响范围
- [ ] 确认 AI 修复逻辑正确，没有遗漏边界情况
- [ ] 确认修复没有改变原有业务逻辑
- [ ] 确认没有引入新的安全问题
- [ ] CI / 单元测试全部通过
- [ ] 如有必要，已补充对应的测试用例

---

> 此 PR 由 GitHub Copilot Autofix 自动生成，请仔细审核后再 merge。