check for zero size in time and object ids.

diff --git a/lib/decoding.c b/lib/decoding.c
index 1151afe..7c6c9af 100644 (file)
--- a/lib/decoding.c
+++ b/lib/decoding.c
@@ -284,9 +284,11 @@ _asn1_get_time_der (const unsigned char *der, int der_len, int *ret_len,
 
   if (der_len <= 0 || str == NULL)
     return ASN1_DER_ERROR;
+
   str_len = asn1_get_length_der (der, der_len, &len_len);
-  if (str_len < 0 || str_size < str_len)
+  if (str_len <= 0 || str_size < str_len)
     return ASN1_DER_ERROR;
+
   memcpy (str, der + len_len, str_len);
   str[str_len] = 0;
   *ret_len = str_len + len_len;
@@ -312,7 +314,7 @@ _asn1_get_objectid_der (const unsigned char *der, int der_len, int *ret_len,
 
   len = asn1_get_length_der (der, der_len, &len_len);
 
-  if (len < 0 || len > der_len || len_len > der_len)
+  if (len <= 0 || len + len_len > der_len)
     return ASN1_DER_ERROR;
 
   val1 = der[len_len] / 40;