]> git.ipfire.org Git - thirdparty/openssl.git/commit
ASN1: Fix type handling in AKID serial number conversion
authorDaniel Kubec <kubec@openssl.org>
Thu, 22 Jan 2026 13:54:10 +0000 (14:54 +0100)
committerTomas Mraz <tomas@openssl.org>
Mon, 26 Jan 2026 15:29:26 +0000 (16:29 +0100)
commit7b9f20d94fbd7a870e406509ef4bd93d005dc1c7
treef6783369a857014f4dcc925662229f11c533f573
parenta3e67efa015ca68f2e2be00889d92612f5bb5040
ASN1: Fix type handling in AKID serial number conversion

The Authority Key Identifier's serial number field is an ASN1 integer, so use
the appropriate i2s_ASN1_INTEGER function instead of i2s_ASN1_OCTET_STRING
for string conversion. This fixes handling of negative serial numbers
which were previously displayed incorrectly.

While negative serial numbers are not RFC-compliant, we want to process
existing CRLs and certificates that may contain them, as this does not cause
any security issues. Rejecting invalid serial numbers during
generation is out of scope for this change.

Fixes #27406

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 15:29:33 2026
(Merged from https://github.com/openssl/openssl/pull/29717)
crypto/x509/v3_akid.c