der: Add test for overly-long encodings of bit strings.

Author: briansmith

src/der.rs

@@ -753,6 +753,18 @@ mod tests {
             Err(Error::BadDer)
         ));
 
+        // Zero bits must be stripped before encoding.
+        for pad in 0..=7 {
+            assert_eq!(
+                bit_string_flags(untrusted::Input::from(&[pad, 0])).err(),
+                Some(Error::BadDer)
+            );
+            assert_eq!(
+                bit_string_flags(untrusted::Input::from(&[pad, 1, 0])).err(),
+                Some(Error::BadDer),
+            );
+        }
+
         // invalid padding for empty set
         for pad in 1..=255 {
             assert_eq!(