Language: C
Label: safe
CWE: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

Code:
static int ntlm_decode_oem_str(struct wire_field_hdr *str_hdr,
                               struct ntlm_buffer *buffer,
                               size_t payload_offs, char **_str)
{
    uint16_t str_len;
    uint32_t str_offs;
    char *str = NULL;

    str_len = le16toh(str_hdr->len);
    if (str_len == 0) goto done;

    str_offs = le32toh(str_hdr->offset);
    if ((str_offs < payload_offs) ||
        (str_offs > buffer->length) ||
        (UINT32_MAX - str_offs < str_len) ||
        (str_offs + str_len > buffer->length)) {
        return ERR_DECODE;
    }

    str = strndup((const char *)&buffer->data[str_offs], str_len);
    if (!str) return ENOMEM;

done:
    *_str = str;
    return 0;
}