Heap out-of-bounds read in libsmb2 NTLM CHALLENGE decode

A heap out-of-bounds read parsing the NTLM type-2 CHALLENGE the server sends during SESSION_SETUP — reachable pre-auth from any server the client connects to.

ntlm_decode_challenge_message() (lib/ntlmssp.c) validates only buf && len > 0, then reads a fixed 56-byte header and follows offset fields without bounding them: memcpy(auth_data->ntlm_buf, buf, challenge_header_len) (:355, 56 bytes, no len >= 56 check), plus reads at &buf[12]/[16]/[40]/[44]. A CHALLENGE shorter than 56 bytes over-reads the token buffer (ASan: OOB READ size 56 at ntlmssp.c:355).

There is a related gap in the payload copies: the offset inoff (from buf[16] / buf[44]) indexes buf at :372 and :392, but the guard only checks the length (inlen < len), never the offset — so a large inoff over-reads too.

Fix: reject tokens shorter than 56 bytes, and bound the offset (inoff < len && inlen <= len - inoff, ordered to avoid unsigned underflow).