Even with the argument checks, you still need to check *pos < len before trying to read buffer[*pos].