fix: the url encoding function uses sprintf without ... in pdfrects.c

[orbisai0security]

Summary

Fix high severity security issue in pdfrects.c.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	pdfrects.c:1795

Description: The URL encoding function uses sprintf without bounds checking to write percent-encoded characters into a buffer. Each special character in a filename expands from 1 byte to 3 bytes (e.g., space becomes %20). If the output buffer was not allocated to account for worst-case 3x expansion, the sprintf calls will write beyond the buffer boundary, corrupting adjacent heap memory.

Changes

• pdfrects.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security