Fix typo in OBJ_txt2obj which incorrectly passed the content

length, instead of the encoding length to d2i_ASN1_OBJECT.

This wasn't visible before becuse ASN1_get_object() used
to read past the length of the supplied buffer.

2 files changed, 7 insertions, 1 deletions

diff --git a/CHANGES b/CHANGES
index 15b69a3f3d..c6b51e9f2a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1908,6 +1908,12 @@ des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   *) Clean old EAY MD5 hack from e_os.h.
      [Richard Levitte]
 
+ Changes between 0.9.6g and 0.9.6h  [xx XXX xxxx]
+
+  *) Fix typo in OBJ_txt2obj which incorrectly passed the content
+     length, instead of the encoding length to d2i_ASN1_OBJECT.
+     [Steve Henson]
+
  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
 
   *) [In 0.9.6g-engine release:]
diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 02c3719f04..ce779dc1b5 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -425,7 +425,7 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
 	a2d_ASN1_OBJECT(p,i,s,-1);
 	
 	p=buf;
-	op=d2i_ASN1_OBJECT(NULL,&p,i);
+	op=d2i_ASN1_OBJECT(NULL,&p,j);
 	OPENSSL_free(buf);
 	return op;
 	}