Paranoia: in ASN1_mbstring_ncopy(), check for len < 0 instead of len == -1,
in order to catch all negative sizes.