fix: tool/menu in menu.c

[orbisai0security]

Summary

Fix critical severity security issue in tool/menu.c.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	tool/menu.c:155

Description: tool/menu.c contains at least 8 distinct free() call sites for menu-related pointers (p, n, cmd_ptr). The unconditional free at line 371 followed by the conditional free at line 376 (if (NULL != cmd_ptr) free(cmd_ptr)) strongly suggests cmd_ptr can be freed twice if the NULL check at line 376 is reached with a non-NULL stale pointer value. Additionally, the pointer p is freed at lines 155, 170, 184, 225, and 420 — if any error path or early return causes two of these sites to execute for the same pointer, a double-free occurs. Freed pointers that are not immediately set to NULL are also candidates for use-after-free if dereferenced before the next assignment.

Changes

• tool/menu.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security