Reassemble a stream of TLV messages in C

Messages arrive over a byte stream in type-length-value (TLV) form: a type, a length, then that many bytes of value. The stream is delivered in chunks of arbitrary size, so one message may be split across several chunks and one chunk may hold several messages.

In C, write a reassembler that is fed chunks as they arrive and hands out each complete message exactly once. Explain how you buffer partial messages, how you handle a length that is too large or a malformed header, and how you keep copies and allocations down.