I call H5Rget_name() twice, once to get the length of the object's name, the second time to get the actual name (as described at http://www.hdfgroup.org/HDF5/doc/RM/RM_H5R.html#Reference-GetName).
In my initial version I passed NULL as the name buffer and a size of 0 -- that failed an assert on the name parameter. My next version had a zero-length character array as the name buffer (and size still as 0). That resulted in a thrashed stack, as in H5G_get_name_by_addr() from H5Gname.c there is an HDstrncpy(name, "/", 2); which is done regardless of the buffer size.
H5G_get_name_by_addr() allows for a NULL name -- shouldn't H5Rget_name() also allow its name parameter to be NULL ??
And then the buffer size should be checked before the initial path separator is copied.