fix: use bounded strlcpy/snprintf in jni-c-toxcore.c

[orbisai0security]

Summary

Fix critical severity security issue in jni-c-toxcore/jni-c-toxcore.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	jni-c-toxcore/jni-c-toxcore.c:499

Description: At line 499 of jni-c-toxcore.c, strcpy(fmt_copy, fmt) copies a format string into a fixed-size buffer without any bounds checking. If the fmt parameter originates from network-supplied Tox protocol data (e.g., a peer-supplied message or format string), an attacker can supply a string longer than the destination buffer, overwriting adjacent stack or heap memory and potentially achieving arbitrary code execution on the Android device.

Changes

• jni-c-toxcore/jni-c-toxcore.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security