static INLINE BOOL ntlm_av_pair_get_len(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pAvLen)
{
	UINT16 AvLen;
	if (!pAvPair)
		return FALSE;

	if (size < sizeof(NTLM_AV_PAIR))
		return FALSE;

	Data_Read_UINT16(&pAvPair->AvLen, AvLen);

	*pAvLen = AvLen;
	return TRUE;
}
The software reads data past the end, or before the beginning, of the intended buffer.