Fix and reproducer for cve-2018-1000654

This adds a fix and a reproducer for cve-2018-1000654.

Checklist

• Code modified for feature
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated

Reviewer's checklist:

• There is a test suite reasonably covering new functionality or modifications
• Function naming, parameters, return values, types, etc., are consistent with other code
• This feature/change has adequate documentation added
• No obvious mistakes in the code