Reported-by: Jonathan Bar Or
The issue is a heap OOB read when parsing OCSP, and can only be triggered via NDEBUG (i.e. "release") builds. Generally speaking, there are many cases when assert() calls continue, and in NDEBUG, assert() calls are not compiled, and simply fallen-through.
Although the use of NDEBUG is never a good idea, the assert should not be triggred.