Commit 674760c25d for openssl.org

commit 674760c25dba6337c88ebf26484ca4a301e0c728
Author: Kron Kastrati <kronkastrati900@gmail.com>
Date:   Tue Nov 3 12:28:25 2026 +0100

    crypto/x509/x_attrib.c: print INTEGER attribute values in decimal

    ossl_print_attribute_value() handled V_ASN1_INTEGER
    and V_ASN1_ENUMERATED in a shared case using
    ASN1_ENUMERATED_get_int64(), which rejects INTEGERs.  INTEGER attribute
    values therefore fell back to hex of the unsigned magnitude, dropping
    the sign, and left a "wrong integer type" error on the error queue.
    Use the getter that matches the value's type.

    Add a test certificate with positive and negative INTEGER subject
    directory attributes, and update the existing attributeMappings
    expectation, whose INTEGER localityName value is now printed as 830
    instead of 03:3E.

    Resolves: https://github.com/openssl/openssl/issues/33425
    Fixes: 41c1b6f0a549 "ossl_print_attribute_value(): Multiple minor fixes for style and other errors"
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Nov  6 03:49:51 2026
    Merged-from: https://github.com/openssl/openssl/pull/33509

diff --git a/crypto/x509/x_attrib.c b/crypto/x509/x_attrib.c
index 98a99cc43b..a8bc978657 100644
--- a/crypto/x509/x_attrib.c
+++ b/crypto/x509/x_attrib.c
@@ -95,15 +95,21 @@ int ossl_print_attribute_value(BIO *out,
         }

     case V_ASN1_INTEGER:
-    case V_ASN1_ENUMERATED:
         if (BIO_printf(out, "%*s", indent, "") < 0)
             return 0;
-        if (ASN1_ENUMERATED_get_int64(&int_val, av->value.integer) > 0) {
+        if (ASN1_INTEGER_get_int64(&int_val, av->value.integer) > 0)
             return BIO_printf(out, "%lld", (long long int)int_val) > 0;
-        }
         str = av->value.integer;
         return ossl_bio_print_hex(out, str->data, str->length);

+    case V_ASN1_ENUMERATED:
+        if (BIO_printf(out, "%*s", indent, "") < 0)
+            return 0;
+        if (ASN1_ENUMERATED_get_int64(&int_val, av->value.enumerated) > 0)
+            return BIO_printf(out, "%lld", (long long int)int_val) > 0;
+        str = av->value.enumerated;
+        return ossl_bio_print_hex(out, str->data, str->length);
+
     case V_ASN1_BIT_STRING:
         if (BIO_printf(out, "%*s", indent, "") < 0)
             return 0;
diff --git a/test/certs/ext-subjectDirectoryAttributes-integer.pem b/test/certs/ext-subjectDirectoryAttributes-integer.pem
new file mode 100644
index 0000000000..50c8254bac
--- /dev/null
+++ b/test/certs/ext-subjectDirectoryAttributes-integer.pem
@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBOjCB7aADAgECAhRnEYpofIuzFpXwnvHMx9pxKkzj6zAFBgMrZXAwETEPMA0G
+A1UEAwwGc2FtcGxlMCAXDTI2MTEwMzEwNTI1OVoYDzIxMjYxMDEwMTA1MjU5WjAR
+MQ8wDQYDVQQDDAZzYW1wbGUwKjAFBgMrZXADIQB9xOCHd+eAK8O03VZBac5nqRkQ
+SDyTbjw0fzCLVDoUi6NVMFMwHQYDVR0OBBYEFM9PNdHnVUMtiu71+DbJ8VEiaQO/
+MA8GA1UdEwEB/wQFMAMBAf8wIQYDVR0JBBowGDAKBgMqAwQxAwIBKjAKBgMqAwUx
+AwIB/zAFBgMrZXADQQBfKWoJVwqlHOes9SuSsc9oSk6kv7JyXA3j+XHEVx7mktZo
+GvtVGlUwekVZD8RXgUigkhm2vjPwLmhKTdqM2AAJ
+-----END CERTIFICATE-----
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t
index 6d8f2cacde..f6ac1ea683 100644
--- a/test/recipes/25-test_x509.t
+++ b/test/recipes/25-test_x509.t
@@ -17,7 +17,7 @@ use File::Compare qw/compare_text/;

 setup("test_x509");

-plan tests => 158;
+plan tests => 160;

 # Prevent MSys2 filename munging for arguments that look like file paths but
 # aren't
@@ -242,6 +242,14 @@ cert_contains($sda_cert,
               "localityName",
               1, 'X.509 Subject Directory Attributes');

+my $sda_int_cert = srctop_file(@certs, "ext-subjectDirectoryAttributes-integer.pem");
+cert_contains($sda_int_cert,
+              '1\.2\.3\.4: 42 ',
+              1, 'X.509 Subject Directory Attributes INTEGER');
+cert_contains($sda_int_cert,
+              '1\.2\.3\.5: -1 ',
+              1, 'X.509 Subject Directory Attributes negative INTEGER');
+
 my $ass_info_cert = srctop_file(@certs, "ext-associatedInformation.pem");
 cert_contains($ass_info_cert,
               "Steve Brule",
@@ -427,7 +435,7 @@ cert_contains($attr_map_cert,
 # localityName has an INTEGER value here, which was intentional to test the
 # display of non-string values.
 cert_contains($attr_map_cert,
-              "commonName:asdf == localityName:03:3E",
+              "commonName:asdf == localityName:830",
               1, 'X.509 Attribute Mappings');

 my $aaa_cert = srctop_file(@certs, "ext-allowedAttributeAssignments.pem");