Language: C
Label: safe
CWE: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

Code:
static int ntlm_decode_field(struct wire_field_hdr *hdr,
                             struct ntlm_buffer *buffer,
                             size_t payload_offs,
                             struct ntlm_buffer *field)
{
    struct ntlm_buffer b = { NULL, 0 };
    uint32_t offs;
    uint16_t len;

    len = le16toh(hdr->len);
    if (len == 0) goto done;

    offs = le32toh(hdr->offset);
    if ((offs < payload_offs) ||
        (offs > buffer->length) ||
        (UINT32_MAX - offs < len) ||
        (offs + len > buffer->length)) {
        return ERR_DECODE;
    }

    b.data = malloc(len);
    if (!b.data) return ENOMEM;

    b.length = len;
    memcpy(b.data, &buffer->data[offs], b.length);

done:
    *field = b;
    return 0;
}