Although to be fair, from what I can glean from reports, it's some sort of bounds checking problem, hence a typical error of the inexperienced and hurried, but most modern compilers will warn you about that sort of thing, if you turn the warnings on, and in a piece of code like this it is inexcusable. Hence, NSA sounds like a reasonable provenance for it.

... since it is part of an open-source, publicly distributed code base. It does not seem to have been introduced deliberately, its a bug and its security implications were not publicly understood until Tuesday, when the researchers who discovered it made it public.