No, the vulnerabilities are in the ASN.1 code, in places like libssl/src/crypto/asn1/a_set.c, tasn_dec.c. There's also stuff in the PKCS 7 and X.509 code, but t

No, the vulnerabilities are in the ASN.1 code, in places like libssl/src/crypto/asn1/a_set.c, tasn_dec.c. There's also stuff in the PKCS 7 and X.509 code, but that code is still very much ASN.1 code, since it contains handwritten coders and decoders for PKCS 7 and X.509 (the asn1 directory contains the code for the generic types, like INT, SET, STRING, etc.). There's also some weird stuff, like an X509 time comparison functions in x509_vfy.c that is like the ones in asn1/a_XXXtime.c.