fix(p2p): bound sscanf field widths in tuya_sdp.c to prevent stack overflow

[maidang-xing]

Problem

tuya_p2p_rtc_sdp_decode() in src/tuya_p2p/base_ice/src/tuya_sdp.c parses SDP lines received from the remote P2P peer using sscanf() with unbounded %s conversions into fixed-size stack buffers:

Line	SDP line	Buffers
L948	a=msid-semantic:	wms_name[65], wms_id[65]
L959	a=msid:	msid[65], track_id[65]
L975	a=group:BUNDLE	m1[65], m2[65], m3[65]
L1070	a=fmtp:	str_pt[32], str_attr[256]
L1084	a=ssrc-group:FID	ssrc[65], ssrc_rtx[65]

An attacker on the peer side controls the SDP answer and can send an arbitrarily long token in any of these lines, overflowing the stack buffers and potentially achieving remote code execution.

Fix

Add maximum field widths (size - 1) to every %s conversion so each token is safely truncated to the destination buffer size:

-    int cnt = sscanf(p, "%s %s", wms_name, wms_id);
+    int cnt = sscanf(p, "%64s %64s", wms_name, wms_id);

No parsing behavior changes for well-formed SDP (real tokens are far shorter than the limits).

Verification

Compiled tuya_sdp.c standalone with stubs and exercised tuya_p2p_rtc_sdp_decode() under AddressSanitizer with a malicious SDP containing 200-byte/300-byte tokens in all five affected lines:

• Before fix: AddressSanitizer: stack-buffer-overflow, WRITE of 201 bytes into wms_id (char[65]) at tuya_sdp.c:948 — crashes exactly at the reported location
• After fix: decode completes cleanly, tokens truncated to buffer size, no sanitizer reports

==ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 201
    #3 tuya_p2p_rtc_sdp_decode tuya_sdp.c:948

Also confirmed the remaining sscanf calls in src/tuya_p2p/ are either numeric-only or already width-limited (%63s in local_store.c).