[Yudis-bit]

Problem

rpmi_shmem_transport_init() copies a device-tree reg-names entry into the 16-byte qctx->name buffer. fdt_stringlist_get() reports the string length without its terminating NUL. A 16-character name fills the buffer without a terminator; a name longer than 16 characters writes past it. The copy currently has no length check.

Fix

Copy at most RPMI_NAME_CHARS_MAX - 1 bytes and terminate the stored name. Longer entries are truncated. This bounds the write without changing queue selection, which uses the queue index.

Validation

• RISC-V cross-build of OpenSBI generic firmware passed with gcc-riscv64-linux-gnu. The CI branch used the same source tree as this PR; only this commit's message changed afterward.
• git diff --check passed.
• No RPMI mailbox runtime test was run.

Closes #417.

OpenSBI asks for patches on its mailing list. This PR is a discussion link; the patch is being prepared for that review path.

[Yudis-bit]

A correction to the description: a2p-db-and-shmem is 16 characters, and fdt_stringlist_get() returns a length excluding the terminating NUL. That example fills the 16-byte destination without terminating it; it does not itself demonstrate a write past the buffer. I should have distinguished those cases in the report.

The proposal bounds the stored name and explicitly terminates it. Would maintainers prefer truncating an overlong queue name, as proposed here, or rejecting it as invalid input?

The validation limitation in the description still applies: no cross-build or runtime validation is reported. I also note the mailing-list submission requirement in docs/contributing.md; this GitHub discussion does not replace that review.