Index: crypto/x509v3/v3_addr.c
--- crypto/x509v3/v3_addr.c.~1~	2009-03-15 10:04:42.000000000 -0400
+++ crypto/x509v3/v3_addr.c	2010-12-13 23:07:55.000000000 -0500
@@ -177,12 +177,18 @@
   unsigned char addr[ADDR_RAW_BUF_LEN];
   int i, n;
 
+  if (bs->length < 0)
+    return 0;
   switch (afi) {
   case IANA_AFI_IPV4:
+    if (bs->length > 4)
+      return 0;
     addr_expand(addr, bs, 4, fill);
     BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
     break;
   case IANA_AFI_IPV6:
+    if (bs->length > 16)
+      return 0;
     addr_expand(addr, bs, 16, fill);
     for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2)
       ;
Index: crypto/x509v3/v3_asid.c
--- crypto/x509v3/v3_asid.c.~1~	2008-12-16 08:41:49.000000000 -0500
+++ crypto/x509v3/v3_asid.c	2010-12-13 23:14:05.000000000 -0500
@@ -373,7 +372,7 @@
 int v3_asid_is_canonical(ASIdentifiers *asid)
 {
   return (asid == NULL ||
-	  (ASIdentifierChoice_is_canonical(asid->asnum) ||
+	  (ASIdentifierChoice_is_canonical(asid->asnum) &&
 	   ASIdentifierChoice_is_canonical(asid->rdi)));
 }