Handle short-name-less NIDs in X509_NAME_print_ex

All the built-in NIDs have short names, but a misbehaving caller might
install a custom one with OBJ_create.

Change-Id: Ifd98b0a326abbed286219751db0d57e3ee1656b7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93667
Auto-Submit: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>

crypto/x509/name_print.cc

diff --git a/crypto/x509/name_print.cc b/crypto/x509/name_print.cc
index 20a30cb..e4db871 100644
--- a/crypto/x509/name_print.cc
+++ b/crypto/x509/name_print.cc
@@ -44,8 +44,6 @@
 static int do_name_ex(BIO *out, const X509_NAME *n, int indent,
                       unsigned long flags) {
   int prev = -1, orflags;
-  char objtmp[80];
-  const char *objbuf;
   int outlen, len;
   const char *sep_dn, *sep_mv, *sep_eq;
   int sep_dn_len, sep_mv_len, sep_eq_len;
@@ -129,13 +127,17 @@
     const ASN1_OBJECT *fn = X509_NAME_ENTRY_get_object(ent);
     const ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);
     assert((flags & XN_FLAG_FN_MASK) == XN_FLAG_FN_SN);
+    // Print the short name if available, othewise serialize the OID.
+    char objtmp[80];
+    const char *objbuf = nullptr;
     int fn_nid = OBJ_obj2nid(fn);
-    if (fn_nid == NID_undef) {
-      OBJ_obj2txt(objtmp, sizeof(objtmp), fn, 1);
-      objbuf = objtmp;
-    } else {
+    if (fn_nid != NID_undef) {
       objbuf = OBJ_nid2sn(fn_nid);
     }
+    if (objbuf == nullptr) {
+      OBJ_obj2txt(objtmp, sizeof(objtmp), fn, /*always_return_oid=*/1);
+      objbuf = objtmp;
+    }
     int objlen = strlen(objbuf);
     if (!maybe_write(out, objbuf, objlen) ||
         !maybe_write(out, sep_eq, sep_eq_len)) {

crypto/x509/x509_test.cc

diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index 2c5d913..1cfb7cf 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc
@@ -5843,6 +5843,11 @@
 }
 
 TEST(X509Test, NamePrint) {
+  // Registering one of the test OIDs as a nameless OID should not impact
+  // printing. Note this impacts global state.
+  ASSERT_NE(OBJ_create("1.2.840.113554.4.1.72585.3", nullptr, nullptr),
+            NID_undef);
+
   // kTestName is a DER-encoded X.509 that covers many cases.
   //
   // SEQUENCE {