Language: C
Label: safe
CWE: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Code:
static pj_status_t get_name(int rec_counter, const pj_uint8_t *pkt, 
                            const pj_uint8_t *start, const pj_uint8_t *max,
                            pj_str_t *name)
{
    const pj_uint8_t *p;
    pj_status_t status;

    /* Limit the number of recursion */
    if (rec_counter > 10) {
        /* Too many name recursion */
        return PJLIB_UTIL_EDNSINNAMEPTR;
    }

    if (start >= max)
        return PJLIB_UTIL_EDNSINNAMEPTR;

    p = start;
    while (*p) {
        if ((*p & 0xc0) == 0xc0) {
            /* Compression is found! */
            pj_uint16_t offset;

            /* Get the 14bit offset */
            pj_memcpy(&offset, p, 2);
            offset ^= pj_htons((pj_uint16_t)(0xc0 << 8));
            offset = pj_ntohs(offset);

            /* Check that offset is valid */
            if (offset >= max - pkt)
                return PJLIB_UTIL_EDNSINNAMEPTR;

            /* Retrieve the name from that offset. */
            status = get_name(rec_counter+1, pkt, pkt + offset, max, name);
            if (status != PJ_SUCCESS)
                return status;

            return PJ_SUCCESS;
        } else {
            unsigned label_len = *p;

            /* Check that label length is valid.
             * Each label consists of an octet length (of size 1) followed
             * by the octet of the specified length (label_len). Then it
             * must be followed by either another label's octet length or
             * a zero length octet (that terminates the sequence).
             */
            if (p+1+label_len+1 > max)
                return PJLIB_UTIL_EDNSINNAMEPTR;

            pj_memcpy(name->ptr + name->slen, p+1, label_len);
            name->slen += label_len;

            p += label_len + 1;
            if (*p != 0) {
                *(name->ptr + name->slen) = '.';
                ++name->slen;
            }
        }
    }

    return PJ_SUCCESS;
}