The attached file causes a reproducible crash when executed on my computer (x86_64,Linux,Glibc 2.21):

$ tests/cert-basic crash1.crt
ksba: ERROR: object length field 42 octects too large
Certificate in `crash1.crt':

serial....: (#00EE04D9636253D675#)
issuer....: `CN=\81'

Segmentation fault

GDB attributes the crash to dn.c:311:
311 if (!(*s & 0x80))

According to tis-interpreter (http://trust-in-soft.com/tis-interpreter/ ) the first noteworthy undefined
behavior when executing that program on that input is a bit earlier: at the same line 311, *s has read some
uninitialized memory from a malloc-allocated block a few iterations before s was an invalid pointer. At the
time of reading uninitialized memory, s was pointing somewhere in a block allocated from function
ksba_malloc(). The call-stack was as follows:

src/dn.c:311:[kernel] warning: accessing uninitialized left-value: assert \initialized(s);

stack: append_utf8_value :: src/dn.c:608 <-
       append_atv :: src/dn.c:670 <-
       dn_to_str :: src/dn.c:695 <-
       _ksba_dn_to_str :: src/cert.c:606 <-
       get_name :: src/cert.c:757 <-
       _ksba_cert_get_subject :: src/visibility.c:205 <-
       ksba_cert_get_subject :: tests/cert-basic.c:432 <-
       one_file :: tests/cert-basic.c:592 <-
       main

src/dn.c:311:[kernel] warning: completely indeterminate value in mallocksba_malloc_l130_935, 142 bytes
from the start.

If you have difficulties reproducing the crash, I can provide specific instrumentation to make it more
obvious.

If the cert-basic program is supposed to be representative of how other software components should use libksba
on untrusted data, then this bug has security implications, because uninitialized memory is read and because a
crash can happen.