fix: remove unsafe exec() in spi_stm32.c

[orbisai0security]

Summary

Fix critical severity security issue in fpga_firmware/software/wasca_test9/spi_stm32.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	fpga_firmware/software/wasca_test9/spi_stm32.c:436

Description: The spi_stm32.c file uses strcpy() at lines 436-437 to copy build_date and build_time strings into fixed-size fields of the max_ver_buff structure (wl_verinfo_max_t). strcpy() performs no bounds checking whatsoever. If either source string exceeds the destination field size — which can be triggered by a crafted SPI packet supplying an oversized string — adjacent stack or heap memory is silently overwritten. On embedded MCUs without stack canaries (which are not confirmed to be enabled), this directly enables redirection of execution to attacker-controlled code.

Changes

• old/fpga_firmware/software/wasca_test9/spi_stm32.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security