fix(Vss): correct wrong-field NULL checks and integer overflow in string-array serialization

[SoundMatt]

Summary

Three bugs in Avtp_Vss_GetVssData() and Avtp_Vss_SerializeStringArray() in src/avtp/acf/custom/Vss.c:

1. VSS_UINT64_ARRAY — NULL guard checks the wrong field (line 352)

// Before
if (val->data_int64_array->data != NULL) {   // wrong field
    // writes into data_uint64_array->data

The guard reads data_int64_array->data instead of data_uint64_array->data. If data_uint64_array->data is NULL but data_int64_array->data is not, the loop writes through a NULL pointer. Conversely, if data_uint64_array->data is valid but data_int64_array->data is NULL, the copy is silently skipped.

2. VSS_STRING_ARRAY — NULL guard checks the wrong field (line 401)

// Before
if (val->data_double_array->data != NULL) {  // wrong field
    memcpy(val->data_string_array->data, ...);

The guard reads data_double_array->data while the memcpy destination is data_string_array->data. A crafted VSS packet that sets VSS_STRING_ARRAY type while data_string_array->data is NULL and data_double_array->data is non-NULL would trigger a NULL-pointer memcpy write.

3. SerializeStringArray — uint16_t accumulator overflows for large arrays (line 623)

// Before
uint16_t total_length = 0;
total_length += strings[i]->data_length + 2;   // wraps at 65535

total_length is uint16_t. Accumulating many strings can silently wrap to a value much smaller than the actual payload, causing the stored data_length to be wrong. Downstream deserialization then uses this truncated length as the memcpy size, enabling a buffer over-read.

Changes

• Fix the NULL guards in VSS_UINT64_ARRAY and VSS_STRING_ARRAY to check the correct field.
• Accumulate total_length in uint32_t; cap at UINT16_MAX before assigning to the uint16_t struct field.

Testing

• VSS_UINT64_ARRAY deserialization with valid data_uint64_array->data now correctly copies data.
• VSS_STRING_ARRAY deserialization with NULL data_string_array->data no longer writes through NULL.
• SerializeStringArray with strings summing to >65535 bytes now saturates at UINT16_MAX rather than wrapping.