diff --git a/lib/util/quickder.c b/lib/util/quickder.c

--- a/lib/util/quickder.c

+++ b/lib/util/quickder.c

@@ -757,6 +757,13 @@

                         }

                         case SEC_ASN1_BIT_STRING: {

+                            /* Can't be 8 or more spare bits, or any spare bits

+			     * if there are no octets. */

+                            if (temp.data[0] >= 8 || (temp.data[0] > 0 && temp.len == 1)) {

+                                PORT_SetError(SEC_ERROR_BAD_DER);

+                                rv = SECFailure;

+                                break;

+                            }

                             /* change the length in the SECItem to be the number

                                of bits */

                             temp.len = (temp.len - 1) * 8 - (temp.data[0] & 0x7);