The "_nx_secure_x509_asn1_tlv_block_parse()" function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer before checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns "NX_SECURE_X509_ASN1_LENGTH_TOO_LONG", but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c The remainder of the function is correctly ordered. The multi-byte length path is guarded by "length_bytes > 4 || length_bytes > *buffer_length" before its read loop, the decoded value is checked against "length > *buffer_length", and the second single-byte length read follows its own "*buffer_length < 1" guard. The tag read is the only load placed ahead of its check.