From 1e9514f3c4225f67836f9b67cd68e97f45087325 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Thu, 14 Sep 2017 09:02:52 -0700
Subject: [PATCH 1/8] Add MarshalWithOpts method to have fine-grained control
 over data masking

---
 src/encoding/json/encode.go | 41 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/src/encoding/json/encode.go b/src/encoding/json/encode.go
index 9a2f84133544f7..de0b729367dc2c 100644
--- a/src/encoding/json/encode.go
+++ b/src/encoding/json/encode.go
@@ -181,6 +181,31 @@ func MarshalIndent(v interface{}, prefix, indent string) ([]byte, error) {
 	return buf.Bytes(), nil
 }
 
+// MarshalWithOpts is like Marshal but applies custom Marshalling, including data masking and indentation to format the output.
+// The Opts interface specifies methods to control:
+// - Output prefix and indentation options
+// - Omitting empty values (e.g. empty strings)
+// - Custom data masking to have fine-grained control over which specific fields are omitted during serialization.
+// Each JSON element in the output will begin on a new line beginning with prefix
+// followed by one or more copies of indent according to the indentation nesting.
+func MarshalWithOpts(v interface{}, opts Opts) ([]byte, error) {
+  e := &encodeState{}
+  err := e.marshal(v, encOpts{escapeHTML: true, optx: opts})
+  if err != nil {
+    return nil, err
+  }
+  if opts.Indent() != "" {
+    var buf bytes.Buffer
+    err = Indent(&buf, e.Bytes(), opts.Prefix(), opts.Indent())
+    if err != nil {
+      return nil, err
+    }
+    return buf.Bytes(), nil
+  } else {
+    return e.Bytes(), nil
+  }
+}
+
 // HTMLEscape appends to dst the JSON-encoded src with <, >, &, U+2028 and U+2029
 // characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029
 // so that the JSON will be safe to embed inside HTML <script> tags.
@@ -260,6 +285,13 @@ type MarshalerError struct {
 	Err  error
 }
 
+type Opts interface {
+  OmitEmpty() bool                     // Exclude fields that have empty values.
+  Omit(s reflect.Value, f string) bool // Return true if field 'f' of struct value 's' should be omitted.
+  Prefix() string  // Each JSON element in the output will begin on a new line beginning with this prefix
+  Indent() string  // The indentation string.
+}
+
 func (e *MarshalerError) Error() string {
 	return "json: error calling MarshalJSON for type " + e.Type.String() + ": " + e.Err.Error()
 }
@@ -330,6 +362,8 @@ type encOpts struct {
 	quoted bool
 	// escapeHTML causes '<', '>', and '&' to be escaped in JSON strings.
 	escapeHTML bool
+  // Omit empty
+  optx Opts
 }
 
 type encoderFunc func(e *encodeState, v reflect.Value, opts encOpts)
@@ -620,12 +654,17 @@ type structEncoder struct {
 	fieldEncs []encoderFunc
 }
 
+func (se *structEncoder) omitField(v reflect.Value, fv reflect.Value, f field, opts encOpts) bool {
+  return ((f.omitEmpty || (opts.optx != nil && opts.optx.OmitEmpty())) && isEmptyValue(fv)) ||
+    (opts.optx != nil && opts.optx.Omit(v, f.name))
+}
+
 func (se *structEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
 	e.WriteByte('{')
 	first := true
 	for i, f := range se.fields {
 		fv := fieldByIndex(v, f.index)
-		if !fv.IsValid() || f.omitEmpty && isEmptyValue(fv) {
+    if !fv.IsValid() || se.omitField(v, fv, f, opts) {
 			continue
 		}
 		if first {

From 35ff0823a25a85c714a3a8d1eea66a8ef00b66c1 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Tue, 23 Jun 2020 16:44:09 -0700
Subject: [PATCH 2/8] Draft support for ASN.1 object identifiers with one sub
 oid more than 2^31-1

---
 src/encoding/asn1/asn1.go         | 245 +++++++++++++++++++++++++-----
 src/encoding/asn1/asn1_test.go    |  44 +++++-
 src/encoding/asn1/common.go       |   2 +-
 src/encoding/asn1/marshal.go      |  91 ++++++++++-
 src/encoding/asn1/marshal_test.go |   8 +
 5 files changed, 341 insertions(+), 49 deletions(-)

diff --git a/src/encoding/asn1/asn1.go b/src/encoding/asn1/asn1.go
index d809dde2781cd8..dc045dba610150 100644
--- a/src/encoding/asn1/asn1.go
+++ b/src/encoding/asn1/asn1.go
@@ -127,7 +127,12 @@ func parseInt32(bytes []byte) (int32, error) {
 	return int32(ret64), nil
 }
 
-var bigOne = big.NewInt(1)
+var (
+	bigOne    = big.NewInt(1)
+	bigTwo    = big.NewInt(2)
+	bigForty  = big.NewInt(40)
+	bigEighty = big.NewInt(80)
+)
 
 // parseBigInt treats the given bytes as a big-endian, signed integer and returns
 // the result.
@@ -220,6 +225,8 @@ var NullBytes = []byte{TagNull, 0}
 
 // An ObjectIdentifier represents an ASN.1 OBJECT IDENTIFIER.
 type ObjectIdentifier []int
+type ObjectIdentifierInt64 []int64
+type ObjectIdentifierBigInt []*big.Int
 
 // Equal reports whether oi and other represent the same identifier.
 func (oi ObjectIdentifier) Equal(other ObjectIdentifier) bool {
@@ -251,7 +258,11 @@ func (oi ObjectIdentifier) String() string {
 // parseObjectIdentifier parses an OBJECT IDENTIFIER from the given bytes and
 // returns it. An object identifier is a sequence of variable length integers
 // that are assigned in a hierarchy.
-func parseObjectIdentifier(bytes []byte) (s ObjectIdentifier, err error) {
+// If all sub-oids are less than max int32, the return value is a ObjectIdentifier.
+// If at least one sub-oid is more than max int32, and all sub-oids are less than max int64,
+// the return value is a ObjectIdentifierInt64.
+// If at least one sub-oid is more than max int64, the return value is a ObjectIdentifierBigInt.
+func parseObjectIdentifier(bytes []byte) (s interface{}, err error) {
 	if len(bytes) == 0 {
 		err = SyntaxError{"zero length OBJECT IDENTIFIER"}
 		return
@@ -259,36 +270,161 @@ func parseObjectIdentifier(bytes []byte) (s ObjectIdentifier, err error) {
 
 	// In the worst case, we get two elements from the first byte (which is
 	// encoded differently) and then every varint is a single byte long.
-	s = make([]int, len(bytes)+1)
+	s = ObjectIdentifier(make([]int, len(bytes)+1))
 
 	// The first varint is 40*value1 + value2:
 	// According to this packing, value1 can take the values 0, 1 and 2 only.
 	// When value1 = 0 or value1 = 1, then value2 is <= 39. When value1 = 2,
 	// then there are no restrictions on value2.
-	v, offset, err := parseBase128Int(bytes, 0)
+	val, offset, err := parseBase128Int(bytes, 0)
 	if err != nil {
 		return
 	}
-	if v < 80 {
-		s[0] = v / 40
-		s[1] = v % 40
-	} else {
-		s[0] = 2
-		s[1] = v - 80
+	switch v := val.(type) {
+	case int:
+		if v < 80 {
+			s.(ObjectIdentifier)[0] = v / 40
+			s.(ObjectIdentifier)[1] = v % 40
+		} else {
+			s.(ObjectIdentifier)[0] = 2
+			s.(ObjectIdentifier)[1] = v - 80
+		}
+	case int64:
+		s = ObjectIdentifierInt64(make([]int64, len(bytes)+1))
+		if v < 80 {
+			s.(ObjectIdentifierInt64)[0] = v / 40
+			s.(ObjectIdentifierInt64)[1] = v % 40
+		} else {
+			s.(ObjectIdentifierInt64)[0] = 2
+			s.(ObjectIdentifierInt64)[1] = v - 80
+		}
+	case *big.Int:
+		s = ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
+		if v.Cmp(bigEighty) == -1 {
+			s.(ObjectIdentifierBigInt)[0] = new(big.Int).Div(v, bigForty)
+			s.(ObjectIdentifierBigInt)[1] = new(big.Int).Mod(v, bigForty)
+		} else {
+			s.(ObjectIdentifierBigInt)[0] = bigTwo
+			s.(ObjectIdentifierBigInt)[1] = new(big.Int).Sub(v, bigEighty)
+		}
 	}
 
 	i := 2
 	for ; offset < len(bytes); i++ {
-		v, offset, err = parseBase128Int(bytes, offset)
+		val, offset, err = parseBase128Int(bytes, offset)
 		if err != nil {
 			return
 		}
-		s[i] = v
+		switch v := val.(type) {
+		case int:
+			switch s.(type) {
+			case ObjectIdentifier:
+				s.(ObjectIdentifier)[i] = v
+			case ObjectIdentifierInt64:
+				s.(ObjectIdentifierInt64)[i] = int64(v)
+			case ObjectIdentifierBigInt:
+				s.(ObjectIdentifierBigInt)[i] = big.NewInt(int64(v))
+			}
+		case int64:
+			switch s.(type) {
+			case ObjectIdentifier:
+				t := ObjectIdentifierInt64(make([]int64, len(bytes)+1))
+				for j := 0; j < i; j++ {
+					t[j] = int64(s.(ObjectIdentifier)[j])
+				}
+				s = t
+				s.(ObjectIdentifierInt64)[i] = int64(v)
+			case ObjectIdentifierInt64:
+				s.(ObjectIdentifierInt64)[i] = int64(v)
+			case []*big.Int:
+				s.(ObjectIdentifierBigInt)[i] = big.NewInt(int64(v))
+			}
+		case *big.Int:
+			switch s.(type) {
+			case ObjectIdentifier:
+				t := ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
+				for j := 0; j < i; j++ {
+					t[j] = big.NewInt(int64(s.(ObjectIdentifier)[j]))
+				}
+				s = t
+				s.(ObjectIdentifierBigInt)[i] = v
+			case ObjectIdentifierInt64:
+				t := ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
+				for j := 0; j < i; j++ {
+					t[j] = big.NewInt(s.(ObjectIdentifierInt64)[j])
+				}
+				s = t
+				s.(ObjectIdentifierBigInt)[i] = v
+			case []*big.Int:
+				s.(ObjectIdentifierBigInt)[i] = v
+			}
+		}
+	}
+	switch t := s.(type) {
+	case ObjectIdentifier:
+		s = t[0:i]
+	case ObjectIdentifierInt64:
+		s = t[0:i]
+	case ObjectIdentifierBigInt:
+		s = t[0:i]
 	}
-	s = s[0:i]
 	return
 }
 
+// Equal reports whether oi and other represent the same identifier.
+func (oi ObjectIdentifierInt64) Equal(other ObjectIdentifierInt64) bool {
+	if len(oi) != len(other) {
+		return false
+	}
+	for i := 0; i < len(oi); i++ {
+		if oi[i] != other[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (oi ObjectIdentifierInt64) String() string {
+	var s string
+
+	for i, v := range oi {
+		if i > 0 {
+			s += "."
+		}
+		s += strconv.FormatInt(v, 10)
+	}
+
+	return s
+}
+
+// Equal reports whether oi and other represent the same identifier.
+func (oi ObjectIdentifierBigInt) Equal(other ObjectIdentifierBigInt) bool {
+	if len(oi) != len(other) {
+		return false
+	}
+	for i := 0; i < len(oi); i++ {
+		if oi[i].Cmp(other[i]) != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (oi ObjectIdentifierBigInt) String() string {
+	var s string
+
+	for i, v := range oi {
+		if i > 0 {
+			s += "."
+		}
+		s += v.String()
+	}
+
+	return s
+}
+
 // ENUMERATED
 
 // An Enumerated is represented as a plain int.
@@ -301,17 +437,22 @@ type Flag bool
 
 // parseBase128Int parses a base-128 encoded int from the given offset in the
 // given byte slice. It returns the value and the new offset.
-func parseBase128Int(bytes []byte, initOffset int) (ret, offset int, err error) {
+// The return value may be a int, int64 or big.Int depending on the size of the input data.
+func parseBase128Int(bytes []byte, initOffset int) (ret interface{}, offset int, err error) {
 	offset = initOffset
 	var ret64 int64
+	var retBigInt *big.Int
 	for shifted := 0; offset < len(bytes); shifted++ {
-		// 5 * 7 bits per byte == 35 bits of data
-		// Thus the representation is either non-minimal or too large for an int32
-		if shifted == 5 {
-			err = StructuralError{"base 128 integer too large"}
-			return
+		// 9 * 7 bits per byte == 63 bits of data
+		// Thus the representation is either non-minimal or too large for an int64. Use big.Int
+		if shifted >= 9 {
+			if shifted == 9 {
+				retBigInt = big.NewInt(ret64)
+			}
+			retBigInt.Lsh(retBigInt, 7)
+		} else {
+			ret64 <<= 7
 		}
-		ret64 <<= 7
 		b := bytes[offset]
 		// integers should be minimally encoded, so the leading octet should
 		// never be 0x80
@@ -319,13 +460,19 @@ func parseBase128Int(bytes []byte, initOffset int) (ret, offset int, err error)
 			err = SyntaxError{"integer is not minimally encoded"}
 			return
 		}
-		ret64 |= int64(b & 0x7f)
+		if shifted >= 9 {
+			retBigInt.Or(retBigInt, big.NewInt(int64(b&0x7f)))
+		} else {
+			ret64 |= int64(b & 0x7f)
+		}
 		offset++
 		if b&0x80 == 0 {
-			ret = int(ret64)
-			// Ensure that the returned value fits in an int on all platforms
-			if ret64 > math.MaxInt32 {
-				err = StructuralError{"base 128 integer too large"}
+			if ret64 <= math.MaxInt32 {
+				ret = int(ret64)
+			} else if shifted >= 9 {
+				ret = retBigInt
+			} else {
+				ret = ret64
 			}
 			return
 		}
@@ -541,10 +688,16 @@ func parseTagAndLength(bytes []byte, initOffset int) (ret tagAndLength, offset i
 	// If the bottom five bits are set, then the tag number is actually base 128
 	// encoded afterwards
 	if ret.tag == 0x1f {
-		ret.tag, offset, err = parseBase128Int(bytes, offset)
+		var v interface{}
+		v, offset, err = parseBase128Int(bytes, offset)
 		if err != nil {
 			return
 		}
+		var ok bool
+		if ret.tag, ok = v.(int); !ok {
+			err = StructuralError{"base 128 integer too large"}
+			return
+		}
 		// Tags should be encoded in minimal form.
 		if ret.tag < 0x1f {
 			err = SyntaxError{"non-minimal tag"}
@@ -653,14 +806,16 @@ func parseSequenceOf(bytes []byte, sliceType reflect.Type, elemType reflect.Type
 }
 
 var (
-	bitStringType        = reflect.TypeOf(BitString{})
-	objectIdentifierType = reflect.TypeOf(ObjectIdentifier{})
-	enumeratedType       = reflect.TypeOf(Enumerated(0))
-	flagType             = reflect.TypeOf(Flag(false))
-	timeType             = reflect.TypeOf(time.Time{})
-	rawValueType         = reflect.TypeOf(RawValue{})
-	rawContentsType      = reflect.TypeOf(RawContent(nil))
-	bigIntType           = reflect.TypeOf(new(big.Int))
+	bitStringType              = reflect.TypeOf(BitString{})
+	objectIdentifierType       = reflect.TypeOf(ObjectIdentifier{})
+	objectIdentifierInt64Type  = reflect.TypeOf(ObjectIdentifierInt64{})
+	objectIdentifierBigIntType = reflect.TypeOf(ObjectIdentifierBigInt{})
+	enumeratedType             = reflect.TypeOf(Enumerated(0))
+	flagType                   = reflect.TypeOf(Flag(false))
+	timeType                   = reflect.TypeOf(time.Time{})
+	rawValueType               = reflect.TypeOf(RawValue{})
+	rawContentsType            = reflect.TypeOf(RawContent(nil))
+	bigIntType                 = reflect.TypeOf(new(big.Int))
 )
 
 // invalidLength reports whether offset + length > sliceLength, or if the
@@ -856,9 +1011,18 @@ func parseField(v reflect.Value, bytes []byte, initOffset int, params fieldParam
 		result := RawValue{t.class, t.tag, t.isCompound, innerBytes, bytes[initOffset:offset]}
 		v.Set(reflect.ValueOf(result))
 		return
-	case objectIdentifierType:
+	case objectIdentifierType, objectIdentifierInt64Type, objectIdentifierBigIntType:
 		newSlice, err1 := parseObjectIdentifier(innerBytes)
-		v.Set(reflect.MakeSlice(v.Type(), len(newSlice), len(newSlice)))
+		var l int
+		switch s := newSlice.(type) {
+		case ObjectIdentifier:
+			l = len(s)
+		case ObjectIdentifierInt64:
+			l = len(s)
+		case ObjectIdentifierBigInt:
+			l = len(s)
+		}
+		v.Set(reflect.MakeSlice(v.Type(), l, l))
 		if err1 == nil {
 			reflect.Copy(v, reflect.ValueOf(newSlice))
 		}
@@ -1006,11 +1170,14 @@ func parseField(v reflect.Value, bytes []byte, initOffset int, params fieldParam
 
 // canHaveDefaultValue reports whether k is a Kind that we will set a default
 // value for. (A signed integer, essentially.)
-func canHaveDefaultValue(k reflect.Kind) bool {
-	switch k {
+func canHaveDefaultValue(v reflect.Value) bool {
+	switch v.Kind() {
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		return true
 	}
+	if v.IsValid() && v.Type() == reflect.TypeOf((*big.Int)(nil)) {
+		return true
+	}
 
 	return false
 }
@@ -1026,7 +1193,7 @@ func setDefaultValue(v reflect.Value, params fieldParameters) (ok bool) {
 	if params.defaultValue == nil {
 		return
 	}
-	if canHaveDefaultValue(v.Kind()) {
+	if canHaveDefaultValue(v) {
 		v.SetInt(*params.defaultValue)
 	}
 	return
diff --git a/src/encoding/asn1/asn1_test.go b/src/encoding/asn1/asn1_test.go
index 8daae97faad400..f5c6ef9960500e 100644
--- a/src/encoding/asn1/asn1_test.go
+++ b/src/encoding/asn1/asn1_test.go
@@ -225,19 +225,49 @@ func TestBitStringRightAlign(t *testing.T) {
 	}
 }
 
+type defaultValueTest struct {
+	v  interface{}
+	ok bool
+}
+
+var defaultValueTestData = []defaultValueTest{
+	{int8(4), true},
+	{int16(4), true},
+	{int(4), true},
+	{int32(4), true},
+	{int64(4), true},
+	{big.NewInt(4), true},
+	{byte(4), false},
+	{"abc", false},
+	{nil, false},
+}
+
+func TestCanHaveDefaultValue(t *testing.T) {
+	for _, test := range defaultValueTestData {
+		if canHaveDefaultValue(reflect.ValueOf(test.v)) != test.ok {
+			t.Errorf("Bad result. Type '%v' can have default value: %v", reflect.ValueOf(test.v).Type(), test.ok)
+		}
+	}
+}
+
 type objectIdentifierTest struct {
 	in  []byte
 	ok  bool
-	out ObjectIdentifier // has base type[]int
+	out interface{} // has base type []int, []int64 or []*big.Int
 }
 
 var objectIdentifierTestData = []objectIdentifierTest{
-	{[]byte{}, false, []int{}},
-	{[]byte{85}, true, []int{2, 5}},
-	{[]byte{85, 0x02}, true, []int{2, 5, 2}},
-	{[]byte{85, 0x02, 0xc0, 0x00}, true, []int{2, 5, 2, 0x2000}},
-	{[]byte{0x81, 0x34, 0x03}, true, []int{2, 100, 3}},
-	{[]byte{85, 0x02, 0xc0, 0x80, 0x80, 0x80, 0x80}, false, []int{}},
+	{[]byte{}, false, ObjectIdentifier{}},
+	{[]byte{85}, true, ObjectIdentifier{2, 5}},
+	{[]byte{85, 0x02}, true, ObjectIdentifier{2, 5, 2}},
+	{[]byte{85, 0x02, 0xc0, 0x00}, true, ObjectIdentifier{2, 5, 2, 0x2000}},
+	{[]byte{0x81, 0x34, 0x03}, true, ObjectIdentifier{2, 100, 3}},
+	{[]byte{85, 0x02, 0xc0, 0x80, 0x80, 0x80, 0x80}, false, ObjectIdentifier{}},
+	// At least one sub-oid has a value higher than max int32 value, but less than max int64 value
+	{[]byte{0x2a, 0x24, 0x81, 0xf9, 0xcf, 0x99, 0xf2, 0x60, 0x85, 0x1a, 0x42, 0x01, 0x01}, true, ObjectIdentifierInt64{1, 2, 36, 67006527840, 666, 66, 1, 1}},
+	{[]byte{0x2a, 0xc0, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, ObjectIdentifierInt64{1, 2, 1 << 62, 1}},
+	// At least one sub-oid has a value higher than max int64 value
+	{[]byte{0x2a, 0x84, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, ObjectIdentifierBigInt{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 65), big.NewInt(1)}},
 }
 
 func TestObjectIdentifier(t *testing.T) {
diff --git a/src/encoding/asn1/common.go b/src/encoding/asn1/common.go
index e2aa8bd9c578e3..0d94d13d285dd6 100644
--- a/src/encoding/asn1/common.go
+++ b/src/encoding/asn1/common.go
@@ -150,7 +150,7 @@ func getUniversalType(t reflect.Type) (matchAny bool, tagNumber int, isCompound,
 	switch t {
 	case rawValueType:
 		return true, -1, false, true
-	case objectIdentifierType:
+	case objectIdentifierType, objectIdentifierInt64Type, objectIdentifierBigIntType:
 		return false, TagOID, false, true
 	case bitStringType:
 		return false, TagBitString, false, true
diff --git a/src/encoding/asn1/marshal.go b/src/encoding/asn1/marshal.go
index 0d34d5aa1e8152..7735e3fc22a68d 100644
--- a/src/encoding/asn1/marshal.go
+++ b/src/encoding/asn1/marshal.go
@@ -178,6 +178,19 @@ func base128IntLength(n int64) int {
 	return l
 }
 
+func base128IntLengthBigInt(n *big.Int) int {
+	if n.Sign() == 0 {
+		return 1
+	}
+
+	l := 0
+	for i := new(big.Int).Set(n); i.Sign() > 0; i.Rsh(i, 7) {
+		l++
+	}
+
+	return l
+}
+
 func appendBase128Int(dst []byte, n int64) []byte {
 	l := base128IntLength(n)
 
@@ -194,6 +207,28 @@ func appendBase128Int(dst []byte, n int64) []byte {
 	return dst
 }
 
+func appendBase128IntBigInt(dst []byte, n *big.Int) []byte {
+	l := base128IntLengthBigInt(n)
+
+	for i := l - 1; i >= 0; i-- {
+		b := new(big.Int).Rsh(n, uint(i*7))
+		var o byte
+		if b.Sign() == 0 {
+			o = 0
+		} else {
+			o = b.Bytes()[len(b.Bytes())-1]
+		}
+		o &= 0x7f
+		if i != 0 {
+			o |= 0x80
+		}
+
+		dst = append(dst, o)
+	}
+
+	return dst
+}
+
 func makeBigInt(n *big.Int) (encoder, error) {
 	if n == nil {
 		return nil, StructuralError{"empty integer"}
@@ -302,6 +337,40 @@ func (oid oidEncoder) Encode(dst []byte) {
 	}
 }
 
+type oidEncoderInt64 []int64
+
+func (oid oidEncoderInt64) Len() int {
+	l := base128IntLength(int64(oid[0]*40 + oid[1]))
+	for i := 2; i < len(oid); i++ {
+		l += base128IntLength(int64(oid[i]))
+	}
+	return l
+}
+
+func (oid oidEncoderInt64) Encode(dst []byte) {
+	dst = appendBase128Int(dst[:0], int64(oid[0]*40+oid[1]))
+	for i := 2; i < len(oid); i++ {
+		dst = appendBase128Int(dst, int64(oid[i]))
+	}
+}
+
+type oidEncoderBigInt []*big.Int
+
+func (oid oidEncoderBigInt) Len() int {
+	l := base128IntLengthBigInt(new(big.Int).Add(new(big.Int).Mul(oid[0], bigForty), oid[1]))
+	for i := 2; i < len(oid); i++ {
+		l += base128IntLengthBigInt(oid[i])
+	}
+	return l
+}
+
+func (oid oidEncoderBigInt) Encode(dst []byte) {
+	dst = appendBase128IntBigInt(dst[:0], new(big.Int).Add(new(big.Int).Mul(oid[0], bigForty), oid[1]))
+	for i := 2; i < len(oid); i++ {
+		dst = appendBase128IntBigInt(dst, oid[i])
+	}
+}
+
 func makeObjectIdentifier(oid []int) (e encoder, err error) {
 	if len(oid) < 2 || oid[0] > 2 || (oid[0] < 2 && oid[1] >= 40) {
 		return nil, StructuralError{"invalid object identifier"}
@@ -310,6 +379,21 @@ func makeObjectIdentifier(oid []int) (e encoder, err error) {
 	return oidEncoder(oid), nil
 }
 
+func makeObjectIdentifierInt64(oid []int64) (e encoder, err error) {
+	if len(oid) < 2 || oid[0] > 2 || (oid[0] < 2 && oid[1] >= 40) {
+		return nil, StructuralError{"invalid object identifier"}
+	}
+
+	return oidEncoderInt64(oid), nil
+}
+
+func makeObjectIdentifierBigInt(oid []*big.Int) (e encoder, err error) {
+	if len(oid) < 2 || oid[0].Cmp(bigTwo) > 0 || (oid[0].Cmp(bigTwo) < 0 && oid[1].Cmp(bigForty) >= 0) {
+		return nil, StructuralError{"invalid object identifier"}
+	}
+	return oidEncoderBigInt(oid), nil
+}
+
 func makePrintableString(s string) (e encoder, err error) {
 	for i := 0; i < len(s); i++ {
 		// The asterisk is often used in PrintableString, even though
@@ -472,6 +556,10 @@ func makeBody(value reflect.Value, params fieldParameters) (e encoder, err error
 		return bitStringEncoder(value.Interface().(BitString)), nil
 	case objectIdentifierType:
 		return makeObjectIdentifier(value.Interface().(ObjectIdentifier))
+	case objectIdentifierInt64Type:
+		return makeObjectIdentifierInt64(value.Interface().(ObjectIdentifierInt64))
+	case objectIdentifierBigIntType:
+		return makeObjectIdentifierBigInt(value.Interface().(ObjectIdentifierBigInt))
 	case bigIntType:
 		return makeBigInt(value.Interface().(*big.Int))
 	}
@@ -584,12 +672,11 @@ func makeField(v reflect.Value, params fieldParameters) (e encoder, err error) {
 	if v.Kind() == reflect.Interface && v.Type().NumMethod() == 0 {
 		return makeField(v.Elem(), params)
 	}
-
 	if v.Kind() == reflect.Slice && v.Len() == 0 && params.omitEmpty {
 		return bytesEncoder(nil), nil
 	}
 
-	if params.optional && params.defaultValue != nil && canHaveDefaultValue(v.Kind()) {
+	if params.optional && params.defaultValue != nil && canHaveDefaultValue(v) {
 		defaultValue := reflect.New(v.Type()).Elem()
 		defaultValue.SetInt(*params.defaultValue)
 
diff --git a/src/encoding/asn1/marshal_test.go b/src/encoding/asn1/marshal_test.go
index 529052285f5950..723e564e774bb5 100644
--- a/src/encoding/asn1/marshal_test.go
+++ b/src/encoding/asn1/marshal_test.go
@@ -134,6 +134,14 @@ var marshalTests = []marshalTest{
 	{ObjectIdentifier([]int{1, 2, 3, 4}), "06032a0304"},
 	{ObjectIdentifier([]int{1, 2, 840, 133549, 1, 1, 5}), "06092a864888932d010105"},
 	{ObjectIdentifier([]int{2, 100, 3}), "0603813403"},
+	// Sub-oid value 67006527840 exceeds 2^31-1 and less than 2^63-1
+	{ObjectIdentifierInt64([]int64{1, 2, 36, 67006527840, 666, 66, 1, 1}), "060d2a2481f9cf99f260851a420101"},
+	// Sub-oid value is near 2^62, which is close to max int64 value
+	{ObjectIdentifierInt64([]int64{1, 2, 1 << 62, 1}), "060b2ac0808080808080800001"},
+	// Same OID as above, implemented as big.Int
+	{ObjectIdentifierBigInt([]*big.Int{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 62), big.NewInt(1)}), "060b2ac0808080808080800001"},
+	// Sub-oid value is more than max int64 value
+	{ObjectIdentifierBigInt([]*big.Int{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 65), big.NewInt(1)}), "060c2a8480808080808080800001"},
 	{"test", "130474657374"},
 	{
 		"" +

From 35628c4caea233b6c39bd5e0deebf77e59c14a32 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Wed, 24 Jun 2020 11:50:41 -0700
Subject: [PATCH 3/8] Draft support for ASN.1 object identifiers with one sub
 oid more than 2^31-1

---
 src/encoding/asn1/asn1.go         | 269 ++++++++++++++++--------------
 src/encoding/asn1/asn1_test.go    |  46 +++--
 src/encoding/asn1/common.go       |   2 +-
 src/encoding/asn1/marshal.go      | 119 +++++++++----
 src/encoding/asn1/marshal_test.go |  10 +-
 5 files changed, 271 insertions(+), 175 deletions(-)

diff --git a/src/encoding/asn1/asn1.go b/src/encoding/asn1/asn1.go
index dc045dba610150..74438cd608d01e 100644
--- a/src/encoding/asn1/asn1.go
+++ b/src/encoding/asn1/asn1.go
@@ -225,8 +225,14 @@ var NullBytes = []byte{TagNull, 0}
 
 // An ObjectIdentifier represents an ASN.1 OBJECT IDENTIFIER.
 type ObjectIdentifier []int
-type ObjectIdentifierInt64 []int64
-type ObjectIdentifierBigInt []*big.Int
+
+// A SubOid represents a single INTEGER value in a ASN.1 OBJECT IDENTIFIER.
+// The type may be int, int64 or *big.Int.
+type SubOid interface{}
+
+// An ObjectIdentifierExt represents an ASN.1 OBJECT IDENTIFIER
+// with sub-oids that can be int, int64 or *big.Int.
+type ObjectIdentifierExt []SubOid
 
 // Equal reports whether oi and other represent the same identifier.
 func (oi ObjectIdentifier) Equal(other ObjectIdentifier) bool {
@@ -258,11 +264,7 @@ func (oi ObjectIdentifier) String() string {
 // parseObjectIdentifier parses an OBJECT IDENTIFIER from the given bytes and
 // returns it. An object identifier is a sequence of variable length integers
 // that are assigned in a hierarchy.
-// If all sub-oids are less than max int32, the return value is a ObjectIdentifier.
-// If at least one sub-oid is more than max int32, and all sub-oids are less than max int64,
-// the return value is a ObjectIdentifierInt64.
-// If at least one sub-oid is more than max int64, the return value is a ObjectIdentifierBigInt.
-func parseObjectIdentifier(bytes []byte) (s interface{}, err error) {
+func parseObjectIdentifier(bytes []byte) (s ObjectIdentifierExt, err error) {
 	if len(bytes) == 0 {
 		err = SyntaxError{"zero length OBJECT IDENTIFIER"}
 		return
@@ -270,7 +272,7 @@ func parseObjectIdentifier(bytes []byte) (s interface{}, err error) {
 
 	// In the worst case, we get two elements from the first byte (which is
 	// encoded differently) and then every varint is a single byte long.
-	s = ObjectIdentifier(make([]int, len(bytes)+1))
+	s = ObjectIdentifierExt(make([]SubOid, len(bytes)+1))
 
 	// The first varint is 40*value1 + value2:
 	// According to this packing, value1 can take the values 0, 1 and 2 only.
@@ -283,29 +285,27 @@ func parseObjectIdentifier(bytes []byte) (s interface{}, err error) {
 	switch v := val.(type) {
 	case int:
 		if v < 80 {
-			s.(ObjectIdentifier)[0] = v / 40
-			s.(ObjectIdentifier)[1] = v % 40
+			s[0] = v / 40
+			s[1] = v % 40
 		} else {
-			s.(ObjectIdentifier)[0] = 2
-			s.(ObjectIdentifier)[1] = v - 80
+			s[0] = 2
+			s[1] = v - 80
 		}
 	case int64:
-		s = ObjectIdentifierInt64(make([]int64, len(bytes)+1))
 		if v < 80 {
-			s.(ObjectIdentifierInt64)[0] = v / 40
-			s.(ObjectIdentifierInt64)[1] = v % 40
+			s[0] = v / 40
+			s[1] = v % 40
 		} else {
-			s.(ObjectIdentifierInt64)[0] = 2
-			s.(ObjectIdentifierInt64)[1] = v - 80
+			s[0] = 2
+			s[1] = v - 80
 		}
 	case *big.Int:
-		s = ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
 		if v.Cmp(bigEighty) == -1 {
-			s.(ObjectIdentifierBigInt)[0] = new(big.Int).Div(v, bigForty)
-			s.(ObjectIdentifierBigInt)[1] = new(big.Int).Mod(v, bigForty)
+			s[0] = new(big.Int).Div(v, bigForty)
+			s[1] = new(big.Int).Mod(v, bigForty)
 		} else {
-			s.(ObjectIdentifierBigInt)[0] = bigTwo
-			s.(ObjectIdentifierBigInt)[1] = new(big.Int).Sub(v, bigEighty)
+			s[0] = bigTwo
+			s[1] = new(big.Int).Sub(v, bigEighty)
 		}
 	}
 
@@ -315,111 +315,129 @@ func parseObjectIdentifier(bytes []byte) (s interface{}, err error) {
 		if err != nil {
 			return
 		}
-		switch v := val.(type) {
+		s[i] = val
+	}
+	s = s[0:i]
+	return
+}
+
+// GetObjectIdentifier returns the object identifier as a slice of int.
+// An error is returned if at least one of the sub oid is greater than math.MaxInt32.
+func (oi ObjectIdentifierExt) GetObjectIdentifier() (s ObjectIdentifier, err error) {
+	s = make(ObjectIdentifier, len(oi), len(oi))
+	for i, sub := range oi {
+		switch v := sub.(type) {
 		case int:
-			switch s.(type) {
-			case ObjectIdentifier:
-				s.(ObjectIdentifier)[i] = v
-			case ObjectIdentifierInt64:
-				s.(ObjectIdentifierInt64)[i] = int64(v)
-			case ObjectIdentifierBigInt:
-				s.(ObjectIdentifierBigInt)[i] = big.NewInt(int64(v))
-			}
+			s[i] = v
 		case int64:
-			switch s.(type) {
-			case ObjectIdentifier:
-				t := ObjectIdentifierInt64(make([]int64, len(bytes)+1))
-				for j := 0; j < i; j++ {
-					t[j] = int64(s.(ObjectIdentifier)[j])
-				}
-				s = t
-				s.(ObjectIdentifierInt64)[i] = int64(v)
-			case ObjectIdentifierInt64:
-				s.(ObjectIdentifierInt64)[i] = int64(v)
-			case []*big.Int:
-				s.(ObjectIdentifierBigInt)[i] = big.NewInt(int64(v))
+			if v > math.MaxInt32 {
+				err = StructuralError{"base 128 integer too large"}
+				return
 			}
+			s[i] = int(v)
 		case *big.Int:
-			switch s.(type) {
-			case ObjectIdentifier:
-				t := ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
-				for j := 0; j < i; j++ {
-					t[j] = big.NewInt(int64(s.(ObjectIdentifier)[j]))
-				}
-				s = t
-				s.(ObjectIdentifierBigInt)[i] = v
-			case ObjectIdentifierInt64:
-				t := ObjectIdentifierBigInt(make([]*big.Int, len(bytes)+1))
-				for j := 0; j < i; j++ {
-					t[j] = big.NewInt(s.(ObjectIdentifierInt64)[j])
-				}
-				s = t
-				s.(ObjectIdentifierBigInt)[i] = v
-			case []*big.Int:
-				s.(ObjectIdentifierBigInt)[i] = v
+			if !v.IsInt64() || v.Int64() > math.MaxInt32 {
+				err = StructuralError{"base 128 integer too large"}
+				return
 			}
+			s[i] = int(v.Int64())
 		}
 	}
-	switch t := s.(type) {
-	case ObjectIdentifier:
-		s = t[0:i]
-	case ObjectIdentifierInt64:
-		s = t[0:i]
-	case ObjectIdentifierBigInt:
-		s = t[0:i]
-	}
 	return
 }
 
 // Equal reports whether oi and other represent the same identifier.
-func (oi ObjectIdentifierInt64) Equal(other ObjectIdentifierInt64) bool {
-	if len(oi) != len(other) {
-		return false
+func (oi ObjectIdentifierExt) Equal(other interface{}) bool {
+	comp := func(i int, suboid interface{}) bool {
+		switch v1 := oi[i].(type) {
+		case int:
+			switch v2 := suboid.(type) {
+			case int:
+				if v1 != v2 {
+					return false
+				}
+			case int64:
+				if int64(v1) != v2 {
+					return false
+				}
+			case *big.Int:
+				if big.NewInt(int64(v1)).Cmp(v2) != 0 {
+					return false
+				}
+			}
+		case int64:
+			switch v2 := suboid.(type) {
+			case int:
+				if v1 != int64(v2) {
+					return false
+				}
+			case int64:
+				if v1 != v2 {
+					return false
+				}
+			case *big.Int:
+				if big.NewInt(v1).Cmp(v2) != 0 {
+					return false
+				}
+			}
+		case *big.Int:
+			switch v2 := suboid.(type) {
+			case int:
+				if v1.Cmp(big.NewInt(int64(v2))) != 0 {
+					return false
+				}
+			case int64:
+				if v1.Cmp(big.NewInt(v2)) != 0 {
+					return false
+				}
+			case *big.Int:
+				if v1.Cmp(v2) != 0 {
+					return false
+				}
+			}
+		}
+		return true
 	}
-	for i := 0; i < len(oi); i++ {
-		if oi[i] != other[i] {
+	switch v := other.(type) {
+	case ObjectIdentifier:
+		if len(oi) != len(v) {
 			return false
 		}
-	}
-
-	return true
-}
-
-func (oi ObjectIdentifierInt64) String() string {
-	var s string
-
-	for i, v := range oi {
-		if i > 0 {
-			s += "."
+		for i := 0; i < len(oi); i++ {
+			if !comp(i, v[i]) {
+				return false
+			}
 		}
-		s += strconv.FormatInt(v, 10)
-	}
-
-	return s
-}
-
-// Equal reports whether oi and other represent the same identifier.
-func (oi ObjectIdentifierBigInt) Equal(other ObjectIdentifierBigInt) bool {
-	if len(oi) != len(other) {
-		return false
-	}
-	for i := 0; i < len(oi); i++ {
-		if oi[i].Cmp(other[i]) != 0 {
+	case ObjectIdentifierExt:
+		if len(oi) != len(v) {
 			return false
 		}
+		for i := 0; i < len(oi); i++ {
+			if !comp(i, v[i]) {
+				return false
+			}
+		}
+	default:
+		return false
 	}
-
 	return true
 }
 
-func (oi ObjectIdentifierBigInt) String() string {
+func (oi ObjectIdentifierExt) String() string {
 	var s string
 
 	for i, v := range oi {
 		if i > 0 {
 			s += "."
 		}
-		s += v.String()
+		switch val := v.(type) {
+		case int:
+			s += strconv.FormatInt(int64(val), 10)
+		case int64:
+			s += strconv.FormatInt(val, 10)
+		case *big.Int:
+			s += val.String()
+		}
 	}
 
 	return s
@@ -438,7 +456,7 @@ type Flag bool
 // parseBase128Int parses a base-128 encoded int from the given offset in the
 // given byte slice. It returns the value and the new offset.
 // The return value may be a int, int64 or big.Int depending on the size of the input data.
-func parseBase128Int(bytes []byte, initOffset int) (ret interface{}, offset int, err error) {
+func parseBase128Int(bytes []byte, initOffset int) (ret SubOid, offset int, err error) {
 	offset = initOffset
 	var ret64 int64
 	var retBigInt *big.Int
@@ -806,16 +824,15 @@ func parseSequenceOf(bytes []byte, sliceType reflect.Type, elemType reflect.Type
 }
 
 var (
-	bitStringType              = reflect.TypeOf(BitString{})
-	objectIdentifierType       = reflect.TypeOf(ObjectIdentifier{})
-	objectIdentifierInt64Type  = reflect.TypeOf(ObjectIdentifierInt64{})
-	objectIdentifierBigIntType = reflect.TypeOf(ObjectIdentifierBigInt{})
-	enumeratedType             = reflect.TypeOf(Enumerated(0))
-	flagType                   = reflect.TypeOf(Flag(false))
-	timeType                   = reflect.TypeOf(time.Time{})
-	rawValueType               = reflect.TypeOf(RawValue{})
-	rawContentsType            = reflect.TypeOf(RawContent(nil))
-	bigIntType                 = reflect.TypeOf(new(big.Int))
+	bitStringType           = reflect.TypeOf(BitString{})
+	objectIdentifierType    = reflect.TypeOf(ObjectIdentifier{})
+	objectIdentifierExtType = reflect.TypeOf(ObjectIdentifierExt{})
+	enumeratedType          = reflect.TypeOf(Enumerated(0))
+	flagType                = reflect.TypeOf(Flag(false))
+	timeType                = reflect.TypeOf(time.Time{})
+	rawValueType            = reflect.TypeOf(RawValue{})
+	rawContentsType         = reflect.TypeOf(RawContent(nil))
+	bigIntType              = reflect.TypeOf(new(big.Int))
 )
 
 // invalidLength reports whether offset + length > sliceLength, or if the
@@ -870,6 +887,13 @@ func parseField(v reflect.Value, bytes []byte, initOffset int, params fieldParam
 				result, err = parseBitString(innerBytes)
 			case TagOID:
 				result, err = parseObjectIdentifier(innerBytes)
+				if err == nil {
+					var r ObjectIdentifier
+					r, err = result.(ObjectIdentifierExt).GetObjectIdentifier()
+					if err == nil {
+						result = r
+					}
+				}
 			case TagUTCTime:
 				result, err = parseUTCTime(innerBytes)
 			case TagGeneralizedTime:
@@ -1011,18 +1035,21 @@ func parseField(v reflect.Value, bytes []byte, initOffset int, params fieldParam
 		result := RawValue{t.class, t.tag, t.isCompound, innerBytes, bytes[initOffset:offset]}
 		v.Set(reflect.ValueOf(result))
 		return
-	case objectIdentifierType, objectIdentifierInt64Type, objectIdentifierBigIntType:
+	case objectIdentifierType:
 		newSlice, err1 := parseObjectIdentifier(innerBytes)
-		var l int
-		switch s := newSlice.(type) {
-		case ObjectIdentifier:
-			l = len(s)
-		case ObjectIdentifierInt64:
-			l = len(s)
-		case ObjectIdentifierBigInt:
-			l = len(s)
+		v.Set(reflect.MakeSlice(v.Type(), len(newSlice), len(newSlice)))
+		if err1 == nil {
+			var intSlice []int
+			intSlice, err1 = newSlice.GetObjectIdentifier()
+			if err1 == nil {
+				reflect.Copy(v, reflect.ValueOf(intSlice))
+			}
 		}
-		v.Set(reflect.MakeSlice(v.Type(), l, l))
+		err = err1
+		return
+	case objectIdentifierExtType:
+		newSlice, err1 := parseObjectIdentifier(innerBytes)
+		v.Set(reflect.MakeSlice(v.Type(), len(newSlice), len(newSlice)))
 		if err1 == nil {
 			reflect.Copy(v, reflect.ValueOf(newSlice))
 		}
diff --git a/src/encoding/asn1/asn1_test.go b/src/encoding/asn1/asn1_test.go
index f5c6ef9960500e..b1abf4c47a42a3 100644
--- a/src/encoding/asn1/asn1_test.go
+++ b/src/encoding/asn1/asn1_test.go
@@ -251,23 +251,24 @@ func TestCanHaveDefaultValue(t *testing.T) {
 }
 
 type objectIdentifierTest struct {
-	in  []byte
-	ok  bool
-	out interface{} // has base type []int, []int64 or []*big.Int
+	in         []byte
+	ok         bool
+	downcastOk bool                // True if the ObjectIdentifierExt can be downcast to ObjectIdentifier
+	out        ObjectIdentifierExt // has base type []int, []int64 or []*big.Int
 }
 
 var objectIdentifierTestData = []objectIdentifierTest{
-	{[]byte{}, false, ObjectIdentifier{}},
-	{[]byte{85}, true, ObjectIdentifier{2, 5}},
-	{[]byte{85, 0x02}, true, ObjectIdentifier{2, 5, 2}},
-	{[]byte{85, 0x02, 0xc0, 0x00}, true, ObjectIdentifier{2, 5, 2, 0x2000}},
-	{[]byte{0x81, 0x34, 0x03}, true, ObjectIdentifier{2, 100, 3}},
-	{[]byte{85, 0x02, 0xc0, 0x80, 0x80, 0x80, 0x80}, false, ObjectIdentifier{}},
+	{[]byte{}, false, true, ObjectIdentifierExt{}},
+	{[]byte{85}, true, true, ObjectIdentifierExt{2, 5}},
+	{[]byte{85, 0x02}, true, true, ObjectIdentifierExt{2, 5, 2}},
+	{[]byte{85, 0x02, 0xc0, 0x00}, true, true, ObjectIdentifierExt{2, 5, 2, 0x2000}},
+	{[]byte{0x81, 0x34, 0x03}, true, true, ObjectIdentifierExt{2, 100, 3}},
+	{[]byte{85, 0x02, 0xc0, 0x80, 0x80, 0x80, 0x80}, false, true, ObjectIdentifierExt{}},
 	// At least one sub-oid has a value higher than max int32 value, but less than max int64 value
-	{[]byte{0x2a, 0x24, 0x81, 0xf9, 0xcf, 0x99, 0xf2, 0x60, 0x85, 0x1a, 0x42, 0x01, 0x01}, true, ObjectIdentifierInt64{1, 2, 36, 67006527840, 666, 66, 1, 1}},
-	{[]byte{0x2a, 0xc0, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, ObjectIdentifierInt64{1, 2, 1 << 62, 1}},
+	{[]byte{0x2a, 0x24, 0x81, 0xf9, 0xcf, 0x99, 0xf2, 0x60, 0x85, 0x1a, 0x42, 0x01, 0x01}, true, false, ObjectIdentifierExt{1, 2, 36, int64(67006527840), 666, 66, 1, 1}},
+	{[]byte{0x2a, 0xc0, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, false, ObjectIdentifierExt{1, 2, int64(1 << 62), 1}},
 	// At least one sub-oid has a value higher than max int64 value
-	{[]byte{0x2a, 0x84, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, ObjectIdentifierBigInt{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 65), big.NewInt(1)}},
+	{[]byte{0x2a, 0x84, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x01}, true, false, ObjectIdentifierExt{1, 2, new(big.Int).Lsh(big.NewInt(1), 65), 1}},
 }
 
 func TestObjectIdentifier(t *testing.T) {
@@ -281,11 +282,32 @@ func TestObjectIdentifier(t *testing.T) {
 				t.Errorf("#%d: Bad result: %v (expected %v)", i, ret, test.out)
 			}
 		}
+		oid, err1 := ret.GetObjectIdentifier()
+		if test.downcastOk {
+			if err1 != nil {
+				t.Errorf("#%d: Bad result: %v should have been converted to []int", i, ret)
+			}
+			if !ret.Equal(oid) {
+				t.Errorf("#%d: Bad result: %v (expected %v)", i, ret, test.out)
+			}
+		}
+		if !test.downcastOk && err1 == nil {
+			t.Errorf("#%d: Bad result: %v should not be converted to []int", i, ret)
+		}
 	}
 
 	if s := ObjectIdentifier([]int{1, 2, 3, 4}).String(); s != "1.2.3.4" {
 		t.Errorf("bad ObjectIdentifier.String(). Got %s, want 1.2.3.4", s)
 	}
+	if s := (ObjectIdentifierExt{1, 2, 3, 4}).String(); s != "1.2.3.4" {
+		t.Errorf("bad ObjectIdentifierExt.String(). Got %s, want 1.2.3.4", s)
+	}
+	if (ObjectIdentifierExt{1, 2, 3, 4}).Equal(nil) {
+		t.Errorf("bad ObjectIdentifierExt.Equal().")
+	}
+	if (ObjectIdentifierExt{1, 2, 3, 4}).Equal("abc") {
+		t.Errorf("bad ObjectIdentifierExt.Equal().")
+	}
 }
 
 type timeTest struct {
diff --git a/src/encoding/asn1/common.go b/src/encoding/asn1/common.go
index 0d94d13d285dd6..e078e60b9ab9f8 100644
--- a/src/encoding/asn1/common.go
+++ b/src/encoding/asn1/common.go
@@ -150,7 +150,7 @@ func getUniversalType(t reflect.Type) (matchAny bool, tagNumber int, isCompound,
 	switch t {
 	case rawValueType:
 		return true, -1, false, true
-	case objectIdentifierType, objectIdentifierInt64Type, objectIdentifierBigIntType:
+	case objectIdentifierType, objectIdentifierExtType:
 		return false, TagOID, false, true
 	case bitStringType:
 		return false, TagBitString, false, true
diff --git a/src/encoding/asn1/marshal.go b/src/encoding/asn1/marshal.go
index 7735e3fc22a68d..76bed6e7a36faa 100644
--- a/src/encoding/asn1/marshal.go
+++ b/src/encoding/asn1/marshal.go
@@ -136,6 +136,7 @@ func (t *taggedEncoder) Len() int {
 
 func (t *taggedEncoder) Encode(dst []byte) {
 	t.tag.Encode(dst)
+
 	t.body.Encode(dst[t.tag.Len():])
 }
 
@@ -178,7 +179,7 @@ func base128IntLength(n int64) int {
 	return l
 }
 
-func base128IntLengthBigInt(n *big.Int) int {
+func base128BigIntLength(n *big.Int) int {
 	if n.Sign() == 0 {
 		return 1
 	}
@@ -207,8 +208,8 @@ func appendBase128Int(dst []byte, n int64) []byte {
 	return dst
 }
 
-func appendBase128IntBigInt(dst []byte, n *big.Int) []byte {
-	l := base128IntLengthBigInt(n)
+func appendBase128BigInt(dst []byte, n *big.Int) []byte {
+	l := base128BigIntLength(n)
 
 	for i := l - 1; i >= 0; i-- {
 		b := new(big.Int).Rsh(n, uint(i*7))
@@ -337,37 +338,55 @@ func (oid oidEncoder) Encode(dst []byte) {
 	}
 }
 
-type oidEncoderInt64 []int64
+type oidEncoderExt ObjectIdentifierExt
 
-func (oid oidEncoderInt64) Len() int {
-	l := base128IntLength(int64(oid[0]*40 + oid[1]))
-	for i := 2; i < len(oid); i++ {
-		l += base128IntLength(int64(oid[i]))
+func (oid oidEncoderExt) s() int64 {
+	var s int64
+	switch v := oid[0].(type) {
+	case int:
+		s = int64(v) * 40
+	case int64:
+		s = v * 40
+	case *big.Int:
+		s = new(big.Int).Mul(v, bigForty).Int64()
 	}
-	return l
-}
-
-func (oid oidEncoderInt64) Encode(dst []byte) {
-	dst = appendBase128Int(dst[:0], int64(oid[0]*40+oid[1]))
-	for i := 2; i < len(oid); i++ {
-		dst = appendBase128Int(dst, int64(oid[i]))
+	switch v := oid[1].(type) {
+	case int:
+		s += int64(v)
+	case int64:
+		s += v
+	case *big.Int:
+		s += v.Int64()
 	}
+	return s
 }
 
-type oidEncoderBigInt []*big.Int
-
-func (oid oidEncoderBigInt) Len() int {
-	l := base128IntLengthBigInt(new(big.Int).Add(new(big.Int).Mul(oid[0], bigForty), oid[1]))
+func (oid oidEncoderExt) Len() int {
+	l := base128IntLength(oid.s())
 	for i := 2; i < len(oid); i++ {
-		l += base128IntLengthBigInt(oid[i])
+		switch v := oid[i].(type) {
+		case int:
+			l += base128IntLength(int64(v))
+		case int64:
+			l += base128IntLength(v)
+		case *big.Int:
+			l += base128BigIntLength(v)
+		}
 	}
 	return l
 }
 
-func (oid oidEncoderBigInt) Encode(dst []byte) {
-	dst = appendBase128IntBigInt(dst[:0], new(big.Int).Add(new(big.Int).Mul(oid[0], bigForty), oid[1]))
+func (oid oidEncoderExt) Encode(dst []byte) {
+	dst = appendBase128Int(dst[:0], oid.s())
 	for i := 2; i < len(oid); i++ {
-		dst = appendBase128IntBigInt(dst, oid[i])
+		switch v := oid[i].(type) {
+		case int:
+			dst = appendBase128Int(dst, int64(v))
+		case int64:
+			dst = appendBase128Int(dst, v)
+		case *big.Int:
+			dst = appendBase128BigInt(dst, v)
+		}
 	}
 }
 
@@ -379,19 +398,47 @@ func makeObjectIdentifier(oid []int) (e encoder, err error) {
 	return oidEncoder(oid), nil
 }
 
-func makeObjectIdentifierInt64(oid []int64) (e encoder, err error) {
-	if len(oid) < 2 || oid[0] > 2 || (oid[0] < 2 && oid[1] >= 40) {
-		return nil, StructuralError{"invalid object identifier"}
+func makeObjectIdentifierExt(oid ObjectIdentifierExt) (e encoder, err error) {
+	isValid := true
+	if len(oid) < 2 {
+		isValid = false
+	} else {
+		switch v := oid[0].(type) {
+		case int:
+			if v > 2 {
+				isValid = false
+			}
+		case int64:
+			if v > 2 {
+				isValid = false
+			}
+		case *big.Int:
+			if v.Cmp(bigTwo) > 0 {
+				isValid = false
+			}
+		}
+		if isValid {
+			switch v := oid[1].(type) {
+			case int:
+				if v >= 40 {
+					isValid = false
+				}
+			case int64:
+				if v >= 40 {
+					isValid = false
+				}
+			case *big.Int:
+				if v.Cmp(bigForty) >= 0 {
+					isValid = false
+				}
+			}
+		}
 	}
-
-	return oidEncoderInt64(oid), nil
-}
-
-func makeObjectIdentifierBigInt(oid []*big.Int) (e encoder, err error) {
-	if len(oid) < 2 || oid[0].Cmp(bigTwo) > 0 || (oid[0].Cmp(bigTwo) < 0 && oid[1].Cmp(bigForty) >= 0) {
+	if !isValid {
 		return nil, StructuralError{"invalid object identifier"}
 	}
-	return oidEncoderBigInt(oid), nil
+
+	return oidEncoderExt(oid), nil
 }
 
 func makePrintableString(s string) (e encoder, err error) {
@@ -556,10 +603,8 @@ func makeBody(value reflect.Value, params fieldParameters) (e encoder, err error
 		return bitStringEncoder(value.Interface().(BitString)), nil
 	case objectIdentifierType:
 		return makeObjectIdentifier(value.Interface().(ObjectIdentifier))
-	case objectIdentifierInt64Type:
-		return makeObjectIdentifierInt64(value.Interface().(ObjectIdentifierInt64))
-	case objectIdentifierBigIntType:
-		return makeObjectIdentifierBigInt(value.Interface().(ObjectIdentifierBigInt))
+	case objectIdentifierExtType:
+		return makeObjectIdentifierExt(value.Interface().(ObjectIdentifierExt))
 	case bigIntType:
 		return makeBigInt(value.Interface().(*big.Int))
 	}
diff --git a/src/encoding/asn1/marshal_test.go b/src/encoding/asn1/marshal_test.go
index 723e564e774bb5..18d6538dbb750d 100644
--- a/src/encoding/asn1/marshal_test.go
+++ b/src/encoding/asn1/marshal_test.go
@@ -135,13 +135,15 @@ var marshalTests = []marshalTest{
 	{ObjectIdentifier([]int{1, 2, 840, 133549, 1, 1, 5}), "06092a864888932d010105"},
 	{ObjectIdentifier([]int{2, 100, 3}), "0603813403"},
 	// Sub-oid value 67006527840 exceeds 2^31-1 and less than 2^63-1
-	{ObjectIdentifierInt64([]int64{1, 2, 36, 67006527840, 666, 66, 1, 1}), "060d2a2481f9cf99f260851a420101"},
+	{ObjectIdentifierExt{1, 2, 36, 67006527840, 666, 66, 1, 1}, "060d2a2481f9cf99f260851a420101"},
 	// Sub-oid value is near 2^62, which is close to max int64 value
-	{ObjectIdentifierInt64([]int64{1, 2, 1 << 62, 1}), "060b2ac0808080808080800001"},
+	{ObjectIdentifierExt{1, 2, 1 << 62, 1}, "060b2ac0808080808080800001"},
 	// Same OID as above, implemented as big.Int
-	{ObjectIdentifierBigInt([]*big.Int{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 62), big.NewInt(1)}), "060b2ac0808080808080800001"},
+	{ObjectIdentifierExt{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 62), big.NewInt(1)}, "060b2ac0808080808080800001"},
+	// Same OID as above, with a mix of int, int64 and big.Int
+	{ObjectIdentifierExt{big.NewInt(1), int64(2), new(big.Int).Lsh(big.NewInt(1), 62), int(1)}, "060b2ac0808080808080800001"},
 	// Sub-oid value is more than max int64 value
-	{ObjectIdentifierBigInt([]*big.Int{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 65), big.NewInt(1)}), "060c2a8480808080808080800001"},
+	{ObjectIdentifierExt{big.NewInt(1), big.NewInt(2), new(big.Int).Lsh(big.NewInt(1), 65), big.NewInt(1)}, "060c2a8480808080808080800001"},
 	{"test", "130474657374"},
 	{
 		"" +

From 5505050f9bc06d834d465f0b0f493d0b5a4f0101 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Fri, 26 Jun 2020 08:54:55 -0700
Subject: [PATCH 4/8] Add code comments. fix formatting

---
 src/encoding/asn1/asn1.go    |  9 +++++++++
 src/encoding/asn1/marshal.go | 10 ++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/encoding/asn1/asn1.go b/src/encoding/asn1/asn1.go
index 74438cd608d01e..1ef2fb5e06ab39 100644
--- a/src/encoding/asn1/asn1.go
+++ b/src/encoding/asn1/asn1.go
@@ -321,6 +321,15 @@ func parseObjectIdentifier(bytes []byte) (s ObjectIdentifierExt, err error) {
 	return
 }
 
+// NewObjectIdentifierExt creates and returns a ObjectIdentifierExt from a ObjectIdentifier.
+func NewObjectIdentifierExt(oid ObjectIdentifier) (s ObjectIdentifierExt) {
+	s = make(ObjectIdentifierExt, len(oid), len(oid))
+	for i, o := range oid {
+		s[i] = o
+	}
+	return
+}
+
 // GetObjectIdentifier returns the object identifier as a slice of int.
 // An error is returned if at least one of the sub oid is greater than math.MaxInt32.
 func (oi ObjectIdentifierExt) GetObjectIdentifier() (s ObjectIdentifier, err error) {
diff --git a/src/encoding/asn1/marshal.go b/src/encoding/asn1/marshal.go
index 76bed6e7a36faa..bfae6dfffabde7 100644
--- a/src/encoding/asn1/marshal.go
+++ b/src/encoding/asn1/marshal.go
@@ -136,7 +136,6 @@ func (t *taggedEncoder) Len() int {
 
 func (t *taggedEncoder) Encode(dst []byte) {
 	t.tag.Encode(dst)
-
 	t.body.Encode(dst[t.tag.Len():])
 }
 
@@ -340,7 +339,10 @@ func (oid oidEncoder) Encode(dst []byte) {
 
 type oidEncoderExt ObjectIdentifierExt
 
-func (oid oidEncoderExt) s() int64 {
+// suboid12Encoding returns 40 * value1 + value2.
+// Overflow cannot happen since first sub-oid is limited to values 0, 1, and 2
+// and second sub-oid is limited to the range 0 to 39 when value1 is 0 or 1.
+func (oid oidEncoderExt) suboid12Encoding() int64 {
 	var s int64
 	switch v := oid[0].(type) {
 	case int:
@@ -362,7 +364,7 @@ func (oid oidEncoderExt) s() int64 {
 }
 
 func (oid oidEncoderExt) Len() int {
-	l := base128IntLength(oid.s())
+	l := base128IntLength(oid.suboid12Encoding())
 	for i := 2; i < len(oid); i++ {
 		switch v := oid[i].(type) {
 		case int:
@@ -377,7 +379,7 @@ func (oid oidEncoderExt) Len() int {
 }
 
 func (oid oidEncoderExt) Encode(dst []byte) {
-	dst = appendBase128Int(dst[:0], oid.s())
+	dst = appendBase128Int(dst[:0], oid.suboid12Encoding())
 	for i := 2; i < len(oid); i++ {
 		switch v := oid[i].(type) {
 		case int:

From 83840c52d12bc57163bc0560f0eb32e181fa9786 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Fri, 26 Jun 2020 08:58:15 -0700
Subject: [PATCH 5/8] Add code comments. fix formatting

---
 src/encoding/asn1/asn1_test.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/encoding/asn1/asn1_test.go b/src/encoding/asn1/asn1_test.go
index b1abf4c47a42a3..d0f15b5685f967 100644
--- a/src/encoding/asn1/asn1_test.go
+++ b/src/encoding/asn1/asn1_test.go
@@ -656,8 +656,8 @@ func TestRawStructs(t *testing.T) {
 }
 
 type oiEqualTest struct {
-	first  ObjectIdentifier
-	second ObjectIdentifier
+	first  interface{}
+	second interface{}
 	same   bool
 }
 
@@ -677,6 +677,11 @@ var oiEqualTests = []oiEqualTest{
 		ObjectIdentifier{10, 11, 12},
 		false,
 	},
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifierExt{10, 11, 12},
+		false,
+	},
 }
 
 func TestObjectIdentifierEqual(t *testing.T) {

From 0af06e3e7060a0cb1044e8b30b145ed101653322 Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Fri, 26 Jun 2020 09:02:50 -0700
Subject: [PATCH 6/8] Add unit tests

---
 src/encoding/asn1/asn1_test.go | 70 ++++++++++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 4 deletions(-)

diff --git a/src/encoding/asn1/asn1_test.go b/src/encoding/asn1/asn1_test.go
index d0f15b5685f967..c0b4b2203f4076 100644
--- a/src/encoding/asn1/asn1_test.go
+++ b/src/encoding/asn1/asn1_test.go
@@ -656,8 +656,8 @@ func TestRawStructs(t *testing.T) {
 }
 
 type oiEqualTest struct {
-	first  interface{}
-	second interface{}
+	first  ObjectIdentifier
+	second ObjectIdentifier
 	same   bool
 }
 
@@ -677,17 +677,79 @@ var oiEqualTests = []oiEqualTest{
 		ObjectIdentifier{10, 11, 12},
 		false,
 	},
+}
+
+func TestObjectIdentifierEqual(t *testing.T) {
+	for _, o := range oiEqualTests {
+		if s := o.first.Equal(o.second); s != o.same {
+			t.Errorf("ObjectIdentifier.Equal: got: %t want: %t", s, o.same)
+		}
+	}
+}
+
+type oiExtEqualTest struct {
+	first  ObjectIdentifierExt
+	second interface{}
+	same   bool
+}
+
+var oiExtEqualTests = []oiExtEqualTest{
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifierExt{1, 2, 3},
+		true,
+	},
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifier{1, 2, 3},
+		true,
+	},
+	{
+		ObjectIdentifierExt{1, 2, 1 << 61},
+		ObjectIdentifierExt{1, 2, 1 << 61},
+		true,
+	},
+	{
+		ObjectIdentifierExt{1, 2, new(big.Int).Lsh(big.NewInt(1), 80)},
+		ObjectIdentifierExt{1, 2, new(big.Int).Lsh(big.NewInt(1), 80)},
+		true,
+	},
+	{
+		ObjectIdentifierExt{1},
+		ObjectIdentifierExt{1, 2, 3},
+		false,
+	},
+	{
+		ObjectIdentifierExt{1},
+		ObjectIdentifier{1, 2, 3},
+		false,
+	},
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifierExt{10, 11, 12},
+		false,
+	},
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifier{10, 11, 12},
+		false,
+	},
 	{
 		ObjectIdentifierExt{1, 2, 3},
 		ObjectIdentifierExt{10, 11, 12},
 		false,
 	},
+	{
+		ObjectIdentifierExt{1, 2, 3},
+		ObjectIdentifier{10, 11, 12},
+		false,
+	},
 }
 
-func TestObjectIdentifierEqual(t *testing.T) {
+func TestObjectIdentifierExtEqual(t *testing.T) {
 	for _, o := range oiEqualTests {
 		if s := o.first.Equal(o.second); s != o.same {
-			t.Errorf("ObjectIdentifier.Equal: got: %t want: %t", s, o.same)
+			t.Errorf("ObjectIdentifierExt.Equal: got: %t want: %t", s, o.same)
 		}
 	}
 }

From 2663d818eb033bcf781460f9dc5d20b9296f6eec Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Fri, 26 Jun 2020 10:21:52 -0700
Subject: [PATCH 7/8] Add unit tests. Handle overflow when calculating 40*oid0
 + oid1

---
 src/encoding/asn1/marshal.go      | 58 ++++++++++++++++++++++++-------
 src/encoding/asn1/marshal_test.go | 30 ++++++++++++++++
 2 files changed, 76 insertions(+), 12 deletions(-)

diff --git a/src/encoding/asn1/marshal.go b/src/encoding/asn1/marshal.go
index bfae6dfffabde7..394436ccb68d60 100644
--- a/src/encoding/asn1/marshal.go
+++ b/src/encoding/asn1/marshal.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"math"
 	"math/big"
 	"reflect"
 	"sort"
@@ -339,32 +340,49 @@ func (oid oidEncoder) Encode(dst []byte) {
 
 type oidEncoderExt ObjectIdentifierExt
 
-// suboid12Encoding returns 40 * value1 + value2.
-// Overflow cannot happen since first sub-oid is limited to values 0, 1, and 2
-// and second sub-oid is limited to the range 0 to 39 when value1 is 0 or 1.
-func (oid oidEncoderExt) suboid12Encoding() int64 {
-	var s int64
+// suboid12Encoding returns 40 * value1 + value2, either as int64 or *big.Int.
+// First sub-oid is limited to values 0, 1, and 2.
+// Second sub-oid is limited to the range 0 to 39 when value1 is 0 or 1.
+func (oid oidEncoderExt) suboid12Encoding() interface{} {
+	var s interface{}
 	switch v := oid[0].(type) {
 	case int:
 		s = int64(v) * 40
 	case int64:
+		// This cannot overflow because sub-oid is limited to values 0, 1, and 2.
 		s = v * 40
 	case *big.Int:
-		s = new(big.Int).Mul(v, bigForty).Int64()
+		// This can be converted to int64 because sub-oid is limited to values 0, 1, and 2.
+		s = v.Int64() * 40
 	}
 	switch v := oid[1].(type) {
 	case int:
-		s += int64(v)
+		if math.MaxInt64-int64(v) >= s.(int64) {
+			s = s.(int64) + int64(v)
+		} else {
+			s = new(big.Int).Add(big.NewInt(s.(int64)), big.NewInt(int64(v)))
+		}
 	case int64:
-		s += v
+		if math.MaxInt64-int64(v) >= s.(int64) {
+			s = s.(int64) + int64(v)
+		} else {
+			s = new(big.Int).Add(big.NewInt(s.(int64)), big.NewInt(v))
+		}
 	case *big.Int:
-		s += v.Int64()
+		s = new(big.Int).Add(big.NewInt(s.(int64)), v)
 	}
 	return s
 }
 
 func (oid oidEncoderExt) Len() int {
-	l := base128IntLength(oid.suboid12Encoding())
+	s := oid.suboid12Encoding()
+	var l int
+	switch v := s.(type) {
+	case int64:
+		l = base128IntLength(v)
+	case *big.Int:
+		l = base128BigIntLength(v)
+	}
 	for i := 2; i < len(oid); i++ {
 		switch v := oid[i].(type) {
 		case int:
@@ -379,7 +397,13 @@ func (oid oidEncoderExt) Len() int {
 }
 
 func (oid oidEncoderExt) Encode(dst []byte) {
-	dst = appendBase128Int(dst[:0], oid.suboid12Encoding())
+	s := oid.suboid12Encoding()
+	switch v := s.(type) {
+	case int64:
+		dst = appendBase128Int(dst[:0], v)
+	case *big.Int:
+		dst = appendBase128BigInt(dst[:0], v)
+	}
 	for i := 2; i < len(oid); i++ {
 		switch v := oid[i].(type) {
 		case int:
@@ -405,21 +429,31 @@ func makeObjectIdentifierExt(oid ObjectIdentifierExt) (e encoder, err error) {
 	if len(oid) < 2 {
 		isValid = false
 	} else {
+		validateOid2Range := false
 		switch v := oid[0].(type) {
 		case int:
 			if v > 2 {
 				isValid = false
 			}
+			if v < 2 {
+				validateOid2Range = true
+			}
 		case int64:
 			if v > 2 {
 				isValid = false
 			}
+			if v < 2 {
+				validateOid2Range = true
+			}
 		case *big.Int:
 			if v.Cmp(bigTwo) > 0 {
 				isValid = false
 			}
+			if v.Cmp(bigTwo) < 0 {
+				validateOid2Range = false
+			}
 		}
-		if isValid {
+		if isValid && validateOid2Range {
 			switch v := oid[1].(type) {
 			case int:
 				if v >= 40 {
diff --git a/src/encoding/asn1/marshal_test.go b/src/encoding/asn1/marshal_test.go
index 18d6538dbb750d..4787e8ddb16176 100644
--- a/src/encoding/asn1/marshal_test.go
+++ b/src/encoding/asn1/marshal_test.go
@@ -7,6 +7,7 @@ package asn1
 import (
 	"bytes"
 	"encoding/hex"
+	"math"
 	"math/big"
 	"reflect"
 	"strings"
@@ -136,6 +137,11 @@ var marshalTests = []marshalTest{
 	{ObjectIdentifier([]int{2, 100, 3}), "0603813403"},
 	// Sub-oid value 67006527840 exceeds 2^31-1 and less than 2^63-1
 	{ObjectIdentifierExt{1, 2, 36, 67006527840, 666, 66, 1, 1}, "060d2a2481f9cf99f260851a420101"},
+	// Use cases that could cause overflow of (40 * value1 + value2)
+	{ObjectIdentifierExt{2, math.MaxInt64, 1, 1}, "060C8180808080808080804F0101"},
+	{ObjectIdentifierExt{2, math.MaxInt64 - 79, 1, 1}, "060C818080808080808080000101"},
+	{ObjectIdentifierExt{2, math.MaxInt64 - 80, 1, 1}, "060BFFFFFFFFFFFFFFFF7F0101"},
+	{ObjectIdentifierExt{2, math.MaxInt64 - 81, 1, 1}, "060BFFFFFFFFFFFFFFFF7E0101"},
 	// Sub-oid value is near 2^62, which is close to max int64 value
 	{ObjectIdentifierExt{1, 2, 1 << 62, 1}, "060b2ac0808080808080800001"},
 	// Same OID as above, implemented as big.Int
@@ -264,6 +270,30 @@ func TestInvalidUTF8(t *testing.T) {
 	}
 }
 
+func TestInvalidOID(t *testing.T) {
+	var marshalTestsOID = []interface{}{
+		// First sub-oid must be 0, 1 or 2.
+		ObjectIdentifier{-1, 999, 3},
+		ObjectIdentifier{3, 999, 3},
+		ObjectIdentifierExt{3, 999, 3},
+		ObjectIdentifierExt{math.MaxInt64, 999, 3},
+		ObjectIdentifierExt{big.NewInt(3), 999, 3},
+		// Second sub-oid is limited to the range 0 to 39 when first sub-oid is 0 or 1.
+		ObjectIdentifier{0, 40, 3},
+		ObjectIdentifier{1, 40, 3},
+		ObjectIdentifierExt{0, 40, 3},
+		ObjectIdentifierExt{1, 40, 3},
+		ObjectIdentifierExt{0, math.MaxInt64, 3},
+		ObjectIdentifierExt{1, math.MaxInt64, 3},
+	}
+	for i, oid := range marshalTestsOID {
+		_, err := Marshal(oid)
+		if err == nil || "asn1: structure error: invalid object identifier" != err.Error() {
+			t.Errorf("#%d failed: %s", i, err)
+		}
+	}
+}
+
 func TestMarshalOID(t *testing.T) {
 	var marshalTestsOID = []marshalTest{
 		{[]byte("\x06\x01\x30"), "0403060130"}, // bytes format returns a byte sequence \x04

From 5f541c3af1bcf8d480b760d3420b6704b331d5cb Mon Sep 17 00:00:00 2001
From: "Sebastien Rosset (serosset)" <serosset@cisco.com>
Date: Fri, 26 Jun 2020 10:31:04 -0700
Subject: [PATCH 8/8] Support parsing of x509 certificates that have large
 policy-identifier sub-oid values

---
 src/crypto/x509/x509.go      |  53 ++++++++++++-
 src/crypto/x509/x509_test.go | 141 +++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+), 4 deletions(-)

diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go
index 338b48861c92e0..1c8adb36da6d88 100644
--- a/src/crypto/x509/x509.go
+++ b/src/crypto/x509/x509.go
@@ -760,7 +760,16 @@ type Certificate struct {
 	// CRL Distribution Points
 	CRLDistributionPoints []string
 
+	// Policy identifiers with sub-oid values less than or equal to math.MaxInt32.
+	// When parsing a certificate, the certificate policy identifiers are unmarshaled into
+	// PolicyIdentifiers if all sub-oids are less than or equal to math.MaxInt32.
+	// If at least one sub-oid is greater than math.MaxInt32, policy identifiers are
+	// unmarshaled into PolicyIdentifiersExt.
+	// When generating a certificate, set either PolicyIdentifiers or PolicyIdentifiersExt
+	// but not both.
 	PolicyIdentifiers []asn1.ObjectIdentifier
+	// Policy identifiers with sub-oid values greater than math.MaxInt32.
+	PolicyIdentifiersExt []asn1.ObjectIdentifierExt
 }
 
 // ErrUnsupportedAlgorithm results from attempting to perform an operation that
@@ -943,7 +952,7 @@ type basicConstraints struct {
 
 // RFC 5280 4.2.1.4
 type policyInformation struct {
-	Policy asn1.ObjectIdentifier
+	Policy asn1.ObjectIdentifierExt
 	// policyQualifiers omitted
 }
 
@@ -1517,9 +1526,25 @@ func parseCertificate(in *certificate) (*Certificate, error) {
 				} else if len(rest) != 0 {
 					return nil, errors.New("x509: trailing data after X.509 certificate policies")
 				}
-				out.PolicyIdentifiers = make([]asn1.ObjectIdentifier, len(policies))
-				for i, policy := range policies {
-					out.PolicyIdentifiers[i] = policy.Policy
+				s := make([]asn1.ObjectIdentifier, 0, len(policies))
+				largeoids := false
+				for _, policy := range policies {
+					if oid, err1 := policy.Policy.GetObjectIdentifier(); err1 == nil {
+						// Add to PolicyIdentifiers if sub-oids are less than or equal to math.MaxInt32.
+						s = append(s, oid)
+					} else {
+						largeoids = true
+					}
+				}
+				if largeoids {
+					// The certificate contains at least one policy identifier that has a sub-oid
+					// value greater than math.MaxInt32.
+					out.PolicyIdentifiersExt = make([]asn1.ObjectIdentifierExt, len(policies))
+					for i, policy := range policies {
+						out.PolicyIdentifiersExt[i] = policy.Policy
+					}
+				} else {
+					out.PolicyIdentifiers = s
 				}
 
 			default:
@@ -1811,11 +1836,30 @@ func buildExtensions(template *Certificate, subjectIsEmpty bool, authorityKeyId
 		n++
 	}
 
+	if len(template.PolicyIdentifiers) > 0 && len(template.PolicyIdentifiersExt) > 0 {
+		err = errors.New("x509: invalid template, cannot specify both PolicyIdentifiers and PolicyIdentifiersExt")
+		return
+	}
+
 	if len(template.PolicyIdentifiers) > 0 &&
 		!oidInExtensions(oidExtensionCertificatePolicies, template.ExtraExtensions) {
 		ret[n].Id = oidExtensionCertificatePolicies
 		policies := make([]policyInformation, len(template.PolicyIdentifiers))
 		for i, policy := range template.PolicyIdentifiers {
+			policies[i].Policy = asn1.NewObjectIdentifierExt(policy)
+		}
+		ret[n].Value, err = asn1.Marshal(policies)
+		if err != nil {
+			return
+		}
+		n++
+	}
+
+	if len(template.PolicyIdentifiersExt) > 0 &&
+		!oidInExtensions(oidExtensionCertificatePolicies, template.ExtraExtensions) {
+		ret[n].Id = oidExtensionCertificatePolicies
+		policies := make([]policyInformation, len(template.PolicyIdentifiersExt))
+		for i, policy := range template.PolicyIdentifiersExt {
 			policies[i].Policy = policy
 		}
 		ret[n].Value, err = asn1.Marshal(policies)
@@ -2067,6 +2111,7 @@ var emptyASN1Subject = []byte{0x30, 0}
 //  - PermittedIPRanges
 //  - PermittedURIDomains
 //  - PolicyIdentifiers
+//  - PolicyIdentifiersExt
 //  - SerialNumber
 //  - SignatureAlgorithm
 //  - Subject
diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go
index 0141021504e137..052cc4d0759545 100644
--- a/src/crypto/x509/x509_test.go
+++ b/src/crypto/x509/x509_test.go
@@ -22,6 +22,7 @@ import (
 	"encoding/pem"
 	"fmt"
 	"internal/testenv"
+	"math"
 	"math/big"
 	"net"
 	"net/url"
@@ -686,6 +687,10 @@ func TestCreateSelfSignedCertificate(t *testing.T) {
 			t.Errorf("%s: failed to parse policy identifiers: got:%#v want:%#v", test.name, cert.PolicyIdentifiers, template.PolicyIdentifiers)
 		}
 
+		if len(cert.PolicyIdentifiersExt) > 0 {
+			t.Errorf("%s: unexpected PolicyIdentifiersExt value:%#v", test.name, template.PolicyIdentifiersExt)
+		}
+
 		if len(cert.PermittedDNSDomains) != 2 || cert.PermittedDNSDomains[0] != ".example.com" || cert.PermittedDNSDomains[1] != "example.com" {
 			t.Errorf("%s: failed to parse name constraints: %#v", test.name, cert.PermittedDNSDomains)
 		}
@@ -806,6 +811,82 @@ func TestCreateSelfSignedCertificate(t *testing.T) {
 	}
 }
 
+func TestCreateSelfSignedCertificatePolicyIdentifier(t *testing.T) {
+	random := rand.Reader
+
+	ecdsaPriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("Failed to generate ECDSA key: %s", err)
+	}
+	{
+		// Cannot have a certificate template with both PolicyIdentifiers and PolicyIdentifiersExt.
+		template := Certificate{
+			SerialNumber:         big.NewInt(-1),
+			SignatureAlgorithm:   ECDSAWithSHA256,
+			PolicyIdentifiers:    []asn1.ObjectIdentifier{[]int{1, 2, 3}},
+			PolicyIdentifiersExt: []asn1.ObjectIdentifierExt{asn1.ObjectIdentifierExt{1, 2, 3, 4}},
+		}
+		_, err := CreateCertificate(random, &template, &template, &ecdsaPriv.PublicKey, ecdsaPriv)
+		if err == nil {
+			t.Error("specifying PolicyIdentifiers and PolicyIdentifiersExt should fail")
+		}
+	}
+	{
+		// Certificate template with policy identifier that has sub-oids less than math.MaxInt32.
+		template := Certificate{
+			SerialNumber:       big.NewInt(-1),
+			SignatureAlgorithm: ECDSAWithSHA256,
+			PolicyIdentifiers:  []asn1.ObjectIdentifier{[]int{1, 2, 3}},
+		}
+		derBytes, err := CreateCertificate(random, &template, &template, &ecdsaPriv.PublicKey, ecdsaPriv)
+		if err != nil {
+			t.Errorf("failed to create certificate: %s", err)
+		}
+		cert, err := ParseCertificate(derBytes)
+		if err != nil {
+			t.Errorf("failed to parse certificate: %s", err)
+		}
+		if len(cert.PolicyIdentifiers) != 1 || !cert.PolicyIdentifiers[0].Equal(template.PolicyIdentifiers[0]) {
+			t.Errorf("failed to parse policy identifiers: got:%#v want:%#v", cert.PolicyIdentifiers, template.PolicyIdentifiers)
+		}
+		if len(cert.PolicyIdentifiersExt) > 0 {
+			t.Errorf("unexpected PolicyIdentifiersExt value:%#v", template.PolicyIdentifiersExt)
+		}
+	}
+	{
+		// Certificate template with policy identifier that has sub-oids greater than math.MaxInt32.
+		template := Certificate{
+			SerialNumber:       big.NewInt(-1),
+			SignatureAlgorithm: ECDSAWithSHA256,
+			PolicyIdentifiersExt: []asn1.ObjectIdentifierExt{
+				asn1.ObjectIdentifierExt{1, 2, math.MaxInt32},
+				asn1.ObjectIdentifierExt{1, 2, 1 << 60},
+				asn1.ObjectIdentifierExt{1, 2, new(big.Int).Lsh(big.NewInt(1), 80)},
+				asn1.ObjectIdentifierExt{1, 2, new(big.Int).Lsh(big.NewInt(1), 80), 1 << 60},
+			},
+		}
+		derBytes, err := CreateCertificate(random, &template, &template, &ecdsaPriv.PublicKey, ecdsaPriv)
+		if err != nil {
+			t.Errorf("failed to create certificate: %s", err)
+		}
+		cert, err := ParseCertificate(derBytes)
+		if err != nil {
+			t.Errorf("failed to parse certificate: %s", err)
+		}
+		if len(cert.PolicyIdentifiers) > 0 {
+			t.Errorf("unexpected PolicyIdentifiers value:%#v", template.PolicyIdentifiers)
+		}
+		if len(cert.PolicyIdentifiersExt) == 0 || len(cert.PolicyIdentifiersExt) != len(template.PolicyIdentifiersExt) {
+			t.Errorf("failed to parse policy identifiers: got:%#v want:%#v", cert.PolicyIdentifiersExt, template.PolicyIdentifiersExt)
+		}
+		for i, pi := range cert.PolicyIdentifiersExt {
+			if !pi.Equal(template.PolicyIdentifiersExt[i]) {
+				t.Errorf("failed to parse policy identifiers: got:%#v want:%#v", cert.PolicyIdentifiersExt, template.PolicyIdentifiersExt)
+			}
+		}
+	}
+}
+
 // Self-signed certificate using ECDSA with SHA1 & secp256r1
 var ecdsaSHA1CertPem = `
 -----BEGIN CERTIFICATE-----
@@ -2189,6 +2270,66 @@ func TestCriticalNameConstraintWithUnknownType(t *testing.T) {
 	}
 }
 
+const certWithLargeSubOidPEM = `
+-----BEGIN CERTIFICATE-----
+MIIFZjCCA06gAwIBAgITFgAAAAImoUeGgGDlrAAAAAAAAjANBgkqhkiG9w0BAQsF
+ADAYMRYwFAYDVQQDEw1DaG9ydXNSb290LUNBMB4XDTE0MDMyNTIxMjYxNFoXDTM0
+MDMxOTIzMjAwNlowYTESMBAGCgmSJomT8ixkARkWAm56MRIwEAYKCZImiZPyLGQB
+GRYCY28xFjAUBgoJkiaJk/IsZAEZFgZjaG9ydXMxHzAdBgNVBAMTFmNob3J1cy1D
+U01TUFJQS0kxNTgtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
+YrgjhkQJqYjL27DAbQim8c3wVldUURBWMLExycwGIbMCxyRFrQmMhqV3bBaKxixx
+jIAZTVB7hha6HCuR/fkfYlNo1suiu1g7WIPxdecV23CuvOiVfTbI7j8LlijsVbKW
+2jOy7LBSywaU58aPS95UqUfqtY53pWbFzQQu//hovqFFwk12mApu42SqmcupxS7/
+tmhkaC+wgliaiS8p+CJZGSBUekuVQNclLGqyYUeBlO3jjIwVZzh9qlLaEbO7NLG8
+k3A5w/9T3r195AmA4+sXKlj9nV9zS6Q8t6ygB6g6/Hr2sv8Xogi3AAR65HghSz2z
+kRbANOUVuVtCMHfiJUYHAgMBAAGjggFeMIIBWjAQBgkrBgEEAYI3FQEEAwIBADAd
+BgNVHQ4EFgQUPn4jsmFshpUupvUcLDmp2LpJCaowgYwGA1UdIASBhDCBgTB/Bg0q
+JIH5z5nyYIUaQgEBMG4wOgYIKwYBBQUHAgIwLh4sAEwAZQBnAGEAbAAgAFAAbwBs
+AGkAYwB5ACAAUwB0AGEAdABlAG0AZQBuAHQwMAYIKwYBBQUHAgEWJGh0dHA6Ly9j
+cmwuY2hvcnVzLmNvLm56L3BraS9jcHMudHh0ADAZBgkrBgEEAYI3FAIEDB4KAFMA
+dQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAW
+gBTPctdjhzmVPatJ73QufzslwP7q3DA+BgNVHR8ENzA1MDOgMaAvhi1odHRwOi8v
+Y3JsLmNob3J1cy5jby5uei9wa2kvQ2hvcnVzUm9vdC1DQS5jcmwwDQYJKoZIhvcN
+AQELBQADggIBAKFEeteUZqZXv95+hpjYFGj6NubVRmbmIH1DU2nydY+RdOZAhn6b
+0ozXoTtprEoo5POUjNZOz7btr08SCbtYQsm4nL5NHj3JSuMj0jDlnn8Qs4yadk5D
+3rTMOf6ZdwVqqZuctwfjlfXgOvPHnVsbUsK02x4b6yJqbbQu7KxxkVoSuneOWpHd
+ZPNqF8aigupfTn5wylKFz2zW39yRQbu1Xbbe31xjqN6g0T/57+myf1j6PtyntmcX
+8n31ZFLCtuC1uXEvN4Mlr0FGXoMpwzlysHzWejFWRQ7Oj7O9/pyzHFgxrlbZilp4
+7qDATM212smJDReEFaFTVR6CgA4xZC4xADL0SU/6MNa2vA4bg8bVlQ5XxBOyRBfq
+PEItYXN3dp7c9medpAh1QauNpFZL7n4DA63X2zB97o6N8fyNSzJXp6x1qGUUgSSz
+QSF65ypj/QDdRwczNmvBlSAFQoFEQpYJarJXPBj9859y1ZkDCctYz6lXUA1qjkCT
+/mM6UTdnDD7LR3vQmQo6t8ydr4sQVV8O1ZJmAxHt+4qYg/UpHdPt63mneHPZaoE9
+N9tF+yS8w1F2Mw5YP6OyjZJy6o8kXR3I/jao4hvDVjfEzo4eSrucAsqwr3Q4kUgl
+GYhu9NN9++fuqOoXuWBguh+3//dgMOXhgFVsWvx9fzLiQQqUc5ToGbJK
+-----END CERTIFICATE-----`
+
+// X.509 certificates may contain policy identifiers that have
+// sub-oid values greater than math.MaxInt32. ParseCertificate
+// must not return an error when parsing such certificates.
+func TestCertificateWithLargeSubOidInPolicyIdentifiers(t *testing.T) {
+	block, _ := pem.Decode([]byte(certWithLargeSubOidPEM))
+	c, err := ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Errorf("Failed to parse certificate: %v", err.Error())
+	}
+	if len(c.PolicyIdentifiersExt) != 1 {
+		// The Certificate policy identifier is 1.2.36.67006527840.666.66.1.1
+		// Because it does not fit in the PolicyIdentifiers field, it is
+		// unmarshaled in the PolicyIdentifiersExt field.
+		t.Errorf("PolicyIdentifiersExt expected 1 but got %d", len(c.PolicyIdentifiersExt))
+	}
+	expected := "1.2.36.67006527840.666.66.1.1"
+	if c.PolicyIdentifiersExt[0].String() != expected {
+		t.Errorf("PolicyIdentifiersExt expected %s but got %s", expected, c.PolicyIdentifiersExt[0].String())
+	}
+	if len(c.PolicyIdentifiers) > 0 {
+		// The Certificate policy identifier for this particular x509 certificate
+		// does not fit in the PolicyIdentifiers field, because suboid 67006527840
+		// is more than 2^31
+		t.Errorf("PolicyIdentifiers expected zero length but got %d", len(c.PolicyIdentifiers))
+	}
+}
+
 const badIPMaskPEM = `
 -----BEGIN CERTIFICATE-----
 MIICzzCCAbegAwIBAgICEjQwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAxMSQmFk