OIDs represented as word32 instead of word16

[aidankeefe2022]

Description

This fixes two issues in how OIDs are represented in wolfSSL.
Breaking change. Word16 cannot represent many real OID arcs -- e.g. 1.2.840.113549.1.1.1 (RSA encryption). This was widened to word 32 in three public symbols:

• Two callback types: wc_UnknownExtCallback and wc_UnknownExtCallbackEx
• One function: wc_EncodeObjectId

The callback types appear as fields in WOLFSSL_CERT_MANAGER, wc_PKCS7, and DecodedCert.

New internal functions were added to handle this change EncodeObjectId_ex and DecodeObjectId_ex both handle
word32 OIDs. The non _ex functions were left due to them being called by FIPS code and that code expects word16.

Non-breaking bug fix. DER encoding packs the first two arcs into a single value (40 x first + second), so decoding assumed the second arc was 0-39. That assumption holds only when the first arc is 0 or 1; when the first arc is 2, the second arc is unbounded and base-128 encodes to a value above 127. Decoding now special-cases this.

Example -- 2.100.3:
encodes -> 0x81, 0x34, 0x03
before: decoded as 4.20.3 (0x81,0x34 unpacked to 180; 180/40=4 rem 20)
after: decodes as 2.100.3

Testing

Added tests for DecodeObjectId and EncodeObjectId covering word32 OIDs, plus a test for an OID whose first arc is 2 and second arc is 100, verifying correct decoding of the byte form.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +384 B (+0.1%, 768,116 B / 1,048,576 B, total: 73% used)

linuxkm-standard

• Data: __patchable_function_entries +16 B (+0.0%, 46,024 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10710

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 1

Low (1)

OID arcs widened to word32 still printed with %d

File: wolfcrypt/src/asn.c:14386
Function: GenerateDNSEntryRIDString
Category: Incorrect sizeof/type usage

tmpName was widened from word16 to word32 but is still printed via XSNPRINTF(..., "%d.", tmpName[i]); word32 (unsigned int) no longer matches %d, producing a -Wformat warning that breaks -Werror builds. Same pattern in PrintObjectIdNum (asn.c:37660). Arc values are bounded, so no runtime misprint.

Recommendation: Use "%u" (or cast the argument to int) at both call sites that print word32 OID arcs.

Referenced code: wolfcrypt/src/asn.c:14386-14387 (2 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[JacobBarthelmeh]

For some reason I had just envisioned an API argument change. It makes sense though for some of the internals of the function to change too, this looks good but it is more risk than I had envisioned.

[aidankeefe2022]

Jenkins retest this please