[parthod0x]

Addresses the memory-safety half of #58.

Problem

qx.cpp, qswap.cpp and nostromo.cpp copy a user-supplied asset name into an 8-byte field with no bound — 19 sites of the form:

char assetNameS1[8] = {0};
memcpy(assetNameS1, assetName, strlen(assetName));   // unbounded

(plus the assetNameU1[8], &v.asset.assetName and &input.assetName variants). A name longer than the field overflows it. AddressSanitizer on an 11-char name:

ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 11 ...

Fix

Add a small copyAssetNameBounded() helper in asset_utils.h that caps the copy at the field size (asset names are at most 7 chars), mirroring the bounded copy asset_utils.cpp already uses:

inline void copyAssetNameBounded(void* dst, const char* assetName, size_t capacity = 7)
{
    size_t n = assetName ? strlen(assetName) : 0;
    if (n > capacity) n = capacity;
    memcpy(dst, assetName, n);
}

All 19 sites now route through it, so an over-long name can no longer corrupt memory even if it slips past input validation.

Verification (AddressSanitizer)

Driving the real helper from asset_utils.h: the original unbounded pattern reports stack-buffer-overflow, WRITE of size 11 on an 8-byte buffer with an 11-char name; copyAssetNameBounded bounds the copy to 7 and is clean.

This is the defense-in-depth complement to the up-front validation #58 asks for (reject names > 7 chars before any fee is paid), and the same bug class as the node-IP / proposal-URL copies in #134.

[fnordspace]

I think instead of adding a new function it is enough to check the input with `sanityCheckValidAssetName``` for the two missing SC:

 case NOSTROMO_TRANSFER_SHARE_MANAGEMENT_RIGHTS:
      sanityCheckNode(g_nodeIp, g_nodePort);
      sanityCheckSeed(g_seed);
      sanityCheckValidAssetName(g_nost_tokenName);
      ...
  case NOSTROMO_CHECK_TOKEN_CREATABILITY:
      sanityCheckNode(g_nodeIp, g_nodePort);
      sanityCheckValidAssetName(g_nost_tokenName);
      ...

[parthod0x]

Reworked per your suggestion: removed the helper and all the copy-site edits, and just added sanityCheckValidAssetName(g_nost_tokenName) to the two cases that were missing it — NOSTROMO_TRANSFER_SHARE_MANAGEMENT_RIGHTS and NOSTROMO_CHECK_TOKEN_CREATABILITY. Every other asset command already validates up front. Rebased onto main; compiles clean under /WX. Thanks!