int TLSInStream::readTLS(U8* buf, int len, bool wait)
{
  int n;

  n = in->check(1, 1, wait);
  if (n == 0)
    return 0;

  n = gnutls_record_recv(session, (void *) buf, len);
  if (n == GNUTLS_E_INTERRUPTED || n == GNUTLS_E_AGAIN)
    return 0;

  if (n < 0) throw TLSException("readTLS", n);

  return n;
}
The software writes data past the end, or before the beginning, of the intended buffer.