Fix typo in OBJ_txt2obj which incorrectly passed the content
length, instead of the encoding length to d2i_ASN1_OBJECT.

This wasn't visible before becuse ASN1_get_object() used
to read past the length of the supplied buffer.

CHANGES

@@ -1908,6 +1908,12 @@ des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   *) Clean old EAY MD5 hack from e_os.h.
      [Richard Levitte]
 
+ Changes between 0.9.6g and 0.9.6h  [xx XXX xxxx]
+
+  *) Fix typo in OBJ_txt2obj which incorrectly passed the content
+     length, instead of the encoding length to d2i_ASN1_OBJECT.
+     [Steve Henson]
+
  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
 
   *) [In 0.9.6g-engine release:]

crypto/objects/obj_dat.c

@@ -425,7 +425,7 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
 	a2d_ASN1_OBJECT(p,i,s,-1);
 	
 	p=buf;
-	op=d2i_ASN1_OBJECT(NULL,&p,i);
+	op=d2i_ASN1_OBJECT(NULL,&p,j);
 	OPENSSL_free(buf);
 	return op;
 	}