Fix two stack buffer overflows in ADMesh stl_read (solid name + MW parse)
Bound the ASCII-STL solid-name fscanf scanset to the buffer size, and bound
the OrcaSlicer-specific "MW" metadata sscanf %s conversions to their buffers:
- fscanf(fp, " solid %[^\n]", solid_name) -> %255[^\n] (solid_name[256])
- sscanf(mw_position+3, "%s %s %s", ...) -> %15s %127s %15s
(version_str[16], model_id_str[128], country_code_str[16])
Both are reachable by opening a crafted .stl and overwrite saved stack state
(instruction-pointer control on the no-PAC arm64 macOS build). The solid-name
defect is inherited from the shared ADMesh loader (bambulab/BambuStudio#12153);
the MW parse is OrcaSlicer-specific.
Co-authored-by: Kevin Finisterre <kfinisterre@KevinsMacStudio.localdomain>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Move many third-party components' source codes from the src folder to a new folder called deps_src. The goal is to make the code structure clearer and easier to navigate.
