fix: add bounds check before memcpy in rpmsg_sockif.c

[orbisai0security]

Summary

`rpmsg_socket_ept_cb()` in `net/rpmsg/rpmsg_sockif.c` copies received
data into `conn->recvdata` using `conn->recvlen` as the copy length.
`conn->recvlen` is peer-supplied (from the message header) and was not
bounded against the actual payload length (`len`) before being passed
to `memcpy()`. A malicious remote peer could send a crafted RPMSG
packet with an inflated length field, causing a heap buffer overflow
in `conn->recvdata`.

This patch clamps `conn->recvlen` to the real payload size immediately
before each `memcpy()` call, separately for the SOCK_STREAM and
SOCK_DGRAM paths.

Impact

• Security: Fixes a heap buffer overflow reachable from a remote
  RPMSG peer. No API or ABI changes.
• Compatibility: No behavioural change for well-formed packets;
  oversized length fields in malformed packets are now silently
  truncated rather than overflowing the destination buffer.

Testing

Built for `rv-virt:nsh` (RISC-V QEMU) with no new warnings or errors:

```
tools/configure.sh rv-virt:nsh
make -j$(nproc)
```

Note: Full RPMSG socket runtime testing on real hardware (e.g.
STM32MP1 or i.MX8) is recommended before merging.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• arduino-mega2560
• esp32-devkitc
• hifive1-revb
• mirtoo
• qemu-armv8a
• qemu-intel64
• rx65n-rsk2mb
• s698pm-dkit
• stm32-nucleo-f103rb

[xiaoxiang781216]

@linguini1 why close the security fix without dissussion?

[xiaoxiang781216]

@CV-Bowen please review whether the change is valid?

[linguini1]

The author stated on a previous PR that there is a human in the loop, so I was mistaken. The word "autonomous" does not indicate that.

Please follow the contributing guidelines.

[orbisai0security]

The author stated on a previous PR that there is a human in the loop, so I was mistaken. The word "autonomous" does not indicate that.

Please follow the contributing guidelines.

done.

[linguini1]

Waiting for runtime testing as recommended by author.

Also, please add the "Assisted-by: " field to your commit (see contributing guide).

[orbisai0security]

Added the Assisted-by: Claude (Anthropic) trailer to the commit.

Regarding runtime testing: we don't currently have access to RPMSG-capable hardware (e.g. STM32MP1 or i.MX8 with dual-core IPC). If a maintainer or reviewer with such hardware could validate the fix at runtime, that would be appreciated. The change is a pure bounds-clamp (MIN) applied before existing memcpy calls, so it cannot alter behavior for well-formed packets — only prevents overflow from malformed ones.