[openssl/openssl] 723e67: Fix X509_ATTRIBUTE_set1_data() for BIT STRING attr...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 723e67bb0d66208730344e9d56db32b75a44cf06
      https://github.com/openssl/openssl/commit/723e67bb0d66208730344e9d56db32b75a44cf06
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M crypto/x509/x509_att.c
    M doc/man3/X509_ATTRIBUTE.pod

  Log Message:
  -----------
  Fix X509_ATTRIBUTE_set1_data() for BIT STRING attribute values

Commit 9044e5f42556 ("Convert internal use of ASN1_STRING_set and
ASN1_STRING_length") replaced ASN1_STRING_set() with the new
ASN1_STRING_set1_data() in X509_ATTRIBUTE_set1_data(). The new setter
intentionally rejects strings of type V_ASN1_BIT_STRING, so creating an
attribute value of type BIT STRING from raw bytes with an explicit
length now fails with ASN1_R_ILLEGAL_BITSTRING_FORMAT.

This broke PKCS8_add_keyusage() and therefore PKCS#12 creation with a
non-zero keytype (e.g. 'openssl pkcs12 -export -keyex' or '-keysig'),
as well as the public X509_ATTRIBUTE_create_by_*() and
X509at_add1_attr_by_*() APIs when used with BIT STRING values supplied
as bytes plus an explicit length.

Restore the previous behaviour by dispatching to ASN1_BIT_STRING_set1()
with zero unused bits when attrtype is V_ASN1_BIT_STRING, keeping
ASN1_STRING_set1_data() for the other types: the signature of this
explicit-length raw-data API provides no way to specify another
unused-bit count, so the data is taken as complete octets, which
preserves the previous encoding for supplied raw-byte values. Document
this in the X509_ATTRIBUTE manual page.

Fixes #32234

Assisted-by: Cline:Qwen3.8 Max
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Wed Aug 19 15:44:48 2026
Merged-from: https://github.com/openssl/openssl/pull/32238


  Commit: bd482e23d0001805ae7c6a9a7f65cc0aa0fb6ced
      https://github.com/openssl/openssl/commit/bd482e23d0001805ae7c6a9a7f65cc0aa0fb6ced
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M test/recipes/80-test_pkcs12.t
    M test/x509_internal_test.c

  Log Message:
  -----------
  Add regression tests for BIT STRING X509 attributes

Test that X509_ATTRIBUTE_create_by_NID() accepts a BIT STRING value
supplied as raw bytes with an explicit length, as done for the keyUsage
attribute by openssl pkcs12 -export -keyex and -keysig via
PKCS8_add_keyusage(). Both KEY_EX (0x10) and KEY_SIG (0x80) are exercised
at this common boundary, and the resulting attribute is checked for the
expected type, value, length, and zero unused bits.

Also pass -keyex to an existing PKCS12 export test so the reported CLI
path is covered end to end.

Regression test for https://github.com/openssl/openssl/issues/32234

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Wed Aug 19 15:44:50 2026
Merged-from: https://github.com/openssl/openssl/pull/32238


Compare: https://github.com/openssl/openssl/compare/ee7c64fbcd24...bd482e23d000

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/ee7c64-bd482e%40github.com.