Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds Read

A buffer pointer underflow vulnerability exists in curl's telnet protocol handler (`lib/telnet.c`). When processing telnet suboptions in the `CURL_TS_SE` state, the code unconditionally decrements the suboption buffer pointer by 2 (`subpointer -= 2`), even when the `CURL_SB_ACCUM` macro skips …

#define CURL_SB_ACCUM(x, c)                                   \
  do {                                                        \
    if(x->subpointer < (x->subbuffer + sizeof(x->subbuffer))) \
      *x->subpointer++ = (c);                                 \
  } while(0)