f84acec8ea
length, instead of the encoding length to d2i_ASN1_OBJECT. This wasn't visible before becuse ASN1_get_object() used to read past the length of the supplied buffer.