Duh, thanks to the people who pointed out that the pointer returned by PEM_read_bio_RSA_PUBKEY might be null, and indeed it is (sadly I have to use Xcode, which refuses to show any local variables and GDB claims they don't exist).
The question now is why it's null, since I know the string itself is populated. It may be that newlines are getting stripped somehow. I store all of the key text in a database and return it to the app as an XML element. Dumping the element to the console shows newlines, but a printf of the character string I use as the BIO source does not show newlines.
