asn1parse -oid (OBJ_create_objects()) mishandles lines longer than 510 characters

The openssl asn1parse -oid flag accepts the name of a file containing additional OIDs to be potentially recognized in the ASN.1 input. As documented in the man page, the OID file has one OID record per line, in the format:

<numeric OID> <short name> <long name>

where spaces terminate the first two fields and a newline terminates the last. There is no documented limit on line length.

However, if a line is longer than 510 characters, it will be treated as an OID record consisting of the first 510 characters, then the 511th character is skipped, and the 512th character and beyond is treated as the start of another OID record. This is a silent misinterpretation of data conforming to the documented input format, hence I consider it a bug.

Example:

$ cat oid-file-with-long-line.txt
2.999.1 s 0xxxxyyyyy10xxxyyyyy20xxxyyyyy30xxxyyyyy40xxxyyyyy50xxxyyyyy60xxxyyyyy70xxxyyyyy80xxxyyyyy90xxxyyyyy100xxyyyyy110xxyyyyy120xxyyyyy130xxyyyyy140xxyyyyy150xxyyyyy160xxyyyyy170xxyyyyy180xxyyyyy190xxyyyyy200xxyyyyy210xxyyyyy220xxyyyyy230xxyyyyy240xxyyyyy250xxyyyyy260xxyyyyy270xxyyyyy280xxyyyyy290xxyyyyy300xxyyyyy310xxyyyyy320xxyyyyy330xxyyyyy340xxyyyyy350xxyyyyy360xxyyyyy370xxyyyyy380xxyyyyy390xxyyyyy400xxyyyyy410xxyyyyy420xxyyyyy430xxyyyyy440xxyyyyy450xxyyyyy460xxyyyyy470xxyyyyy480xxyyyyy490xxyyyyy 2.999.2 t 10xxyyyyy520xxyyyyy530xxyyyyy540xxyyyyy550xxyyyyy560xxyyyyy570xxyyyyy580xxyyyyy190xxyyyyy

$ cat oid-2.999.2.hex
06 03                                  # OBJECT IDENTIFIER with 3 octets
  88 37 02                               # 2.999.2

$ cat oid-2.999.2.hex | sed 's/#.*//' | xxd -r -p - | \
  openssl asn1parse -inform DER -i -oid oid-file-with-long-line.txt
    0:d=0  hl=2 l=   3 prim: OBJECT            :10xxyyyyy520xxyyyyy530xxyyyyy540xxyyyyy550xxyyyyy560xxyyyyy570xxyyyyy580xxyyyyy190xxyyyyy

According to the documented format, the OID file above defines 2.999.1 with a long name. But it is interpreted as also defining 2.999.2 because the characters starting at 512 look like a valid record. The input DER then refers to 2.999.2. asn1parse incorrecly prints a portion of what should have been the name of 2.999.1 as if it were the name of 2.999.2.

The correct (per documentation) output in this case would be to just print it as a number, like this:

    0:d=0  hl=2 l=   3 prim: OBJECT            :2.999.2

Alternatively, I think it would be fine to document the limit of 510 characters per line and enforce that limit with a sensible error message when violated.

I have observed this behavior with OpenSSL 1.1.1b and 1.1.1j running on Windows 10, built from source.

Start with the asn1parse -oid handling and OBJ_create_objects() named in the report, then reproduce the behavior using the supplied long-line OID file and DER input. Done means a line longer than 510 characters is handled consistently with the documented format, or rejected with a clear limit error, without creating an unintended second OID record.