fix: remove unsafe exec() in showwal.c

[orbisai0security]

Summary

Fix critical severity security issue in tool/showwal.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	tool/showwal.c:184
CWE	CWE-120

Description: Seven unbounded sprintf() calls in tool/showwal.c write formatted output into fixed-size stack buffers (zBuf, zDesc) without specifying a maximum output length. The most dangerous instance is at line 329, where a 64-bit integer is formatted with '%lld' — this can produce up to 20 characters. If zDesc is smaller than 20 bytes, the stack buffer overflows, overwriting the saved return address and enabling arbitrary code execution. All seven call sites share this pattern.

Changes

• tool/showwal.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security