Why would RSA_size() crash?

[G S]

Hi all.

I'm trying to use the OpenSSL crypto lib.  I've generated a public/private
RSA key pair.  Then I wrote some code to try to encrypt an eight-byte random
string.  But it crashes in RSA_size().  Here's the code:

            BIO* bp = BIO_new_mem_buf(_publicKey, -1);                //
Create a new memory buffer BIO.
            RSA* pubKey = PEM_read_bio_RSA_PUBKEY(bp, 0, 0, 0);        //
And read the RSA key from it.
            BIO_free(bp);

            // Allocate a string to hold the encrypted result.
            unsigned char encryptedRandKey[RSA_size(pubKey)];

_pubKey is a null-terminated character string that contains the RSA public
key in PEM format (including -----BEGIN and so forth).  RSA_size() crashes
with bad access.  Removing BIO_free() didn't make any difference.  I also
just tried assigning the value of RSA_size() to an int, and it crashed.

Any ideas here?

Thanks!

Gavin