Prevent pulling TLV tag and length over end of the buffer.

Checks whether there are at least 4 bytes available to pull tag and length values.
On tlv_list unpack, if the size is sent as 0, immediately exit the function

nfapi/open-nFAPI/common/src/nfapi.c

@@ -889,8 +889,8 @@ int unpack_nr_tlv_list(unpack_tlv_t unpack_fns[],
   nfapi_tl_t generic_tl;
   uint8_t numBadTags = 0;
   uint16_t idx = 0;
-
-  while ((uint8_t *)(*ppReadPackedMsg) < end) {
+  if (size == 0) { return 1; }
+  while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) {
     // unpack the tl and process the values accordingly
     if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0)
       return 0;

nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c

@@ -1347,7 +1347,7 @@ uint8_t unpack_nr_config_request(uint8_t **ppReadPackedMsg, uint8_t *end, void *
   nfapi_tl_t generic_tl;
   uint8_t numBadTags = 0;
   unsigned long idx = 0;
-  while ((uint8_t *)(*ppReadPackedMsg) < end) {
+  while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) {
     // unpack the tl and process the values accordingly
     if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0)
       return 0;