diff --git a/library/x509.c b/library/x509.c
index 380fec2..1826f1d 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -361,6 +361,8 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
         return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
 
+    end = *p + len;
+
     if( ( end - *p ) < 1 )
         return( MBEDTLS_ERR_X509_INVALID_NAME +
                 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
@@ -394,6 +396,12 @@
     val->p = *p;
     *p += val->len;
 
+    if( *p != end )
+    {
+        return( MBEDTLS_ERR_X509_INVALID_NAME +
+                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+    }
+
     cur->next = NULL;
 
     return( 0 );
diff --git a/library/x509_crl.c b/library/x509_crl.c
index 8450f87..64fac0e 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -103,6 +103,9 @@
 {
     int ret;
 
+    if( *p == end )
+        return( 0 );
+
     /*
      * crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
      *                              -- if present, version MUST be v2
@@ -115,6 +118,8 @@
         return( ret );
     }
 
+    end = ext->p + ext->len;
+
     while( *p < end )
     {
         /*
diff --git a/library/x509_crt.c b/library/x509_crt.c
index dfd22f6..0287b5b 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -891,6 +891,9 @@
     size_t len;
     unsigned char *end_ext_data, *end_ext_octet;
 
+    if( *p == end )
+        return( 0 );
+
     if( ( ret = mbedtls_x509_get_ext( p, end, &crt->v3_ext, 3 ) ) != 0 )
     {
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
@@ -899,6 +902,7 @@
         return( ret );
     }
 
+    end = crt->v3_ext.p + crt->v3_ext.len;
     while( *p < end )
     {
         /*