fix: add parameterized queries in sqlite-vec-ivf.c

[orbisai0security]

Summary

Fix high severity security issue in sqlite-vec-ivf.c.

Vulnerability

Field	Value
ID	V-005
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-005
File	sqlite-vec-ivf.c:465

Description: In sqlite-vec-ivf.c, zSql buffers are freed via sqlite3_free at multiple call sites across the file. Error handling paths or early returns may cause sqlite3_free to be called multiple times on the same pointer (double-free), or the pointer may be accessed after freeing (use-after-free). Lines 359 and 362 show two consecutive sqlite3_free calls that may operate on the same zSql pointer under certain error conditions. An attacker who can trigger specific error conditions during query preparation may exploit these heap corruption conditions.

Changes

• sqlite-vec-ivf.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security