{"record":{"id":"2231b1b521f6871c","repo":"gravitational/teleport","slug":"cannot-parse-oid-component-q-as-int-oid-q-w","errorCode":null,"errorMessage":"cannot parse OID component %q as int, OID=%q: %w","messagePattern":"cannot parse OID component %q as int, OID=%q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":211,"sourceCode":"\tcase \"L\":\n\t\tdst.Locality = append(dst.Locality, value)\n\tcase \"ST\":\n\t\tdst.Province = append(dst.Province, value)\n\tcase \"C\":\n\t\tdst.Country = append(dst.Country, value)\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"unknown attributeType %q, remaining tokens: %s\", attr, tokens)\n\t}\n\treturn attr, nil\n}\n\nfunc parseOIDExtraName(dst *pkix.Name, attr, value string) error {\n\tparts := strings.Split(attr, \".\")\n\toid := make(asn1.ObjectIdentifier, 0, len(parts))\n\tfor _, val := range parts {\n\t\tnum, err := strconv.Atoi(val)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"cannot parse OID component %q as int, OID=%q: %w\", val, attr, err)\n\t\t}\n\t\toid = append(oid, num)\n\t}\n\n\tdst.ExtraNames = append(dst.ExtraNames, pkix.AttributeTypeAndValue{\n\t\tType:  oid,\n\t\tValue: value,\n\t})\n\treturn nil\n}\n\nfunc requireTokenKind(wantKind tokenKind, tok *token, tokens tokenList) error {\n\tif tok.kind == wantKind {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\n\t\t\"found %s instead of %s, remaining tokens: %s\",","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L193-L229","documentation":"When an attribute type matches the OID shape (^\\d+(\\.\\d+)*$), parseOIDExtraName splits it on '.' and converts each component with strconv.Atoi. Although the regexp guarantees digits, a component that overflows int (e.g. a very long digit run) makes Atoi fail, producing this wrapped error. The original Atoi error is preserved via %w.","triggerScenarios":"An attribute type like '1.2.8401135494' style with a component exceeding int range (e.g. '1.99999999999999999999') — matches the digit regexp but fails Atoi on overflow.","commonSituations":"Hand-typed or concatenated OIDs with an oversized/typo'd arc, or programmatic generation of OIDs from big-number encodings that weren't re-split into per-arc integers.","solutions":["Fix the OID so every dot-separated component fits in a machine int (each arc is a small integer, typically < 2^31)","Use the standard short attribute name (CN, O, etc.) instead of a custom OID if one exists","Validate OID components are plain integers within range before building the DN string"],"exampleFix":"// before\nParseDistinguishedName(\"1.2.99999999999999999999=custom\")\n// after\nParseDistinguishedName(\"1.2.3.4=custom\")","handlingStrategy":"validation","validationCode":"func oidComponentsFit(oid string) error {\n\tfor _, c := range strings.Split(oid, \".\") {\n\t\tif _, err := strconv.Atoi(c); err != nil {\n\t\t\treturn fmt.Errorf(\"OID component %q out of int range\", c)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := oidComponentsFit(oidAttr); err != nil { return err }\nname, err := pkixname.ParseDistinguishedName(oidAttr + \"=value\")\nif err != nil { return fmt.Errorf(\"invalid DN: %w\", err) }","preventionTips":["Each dot-separated OID arc must be a plain integer within platform int range","Derive OIDs from a registry/constant, never from string concatenation of big numbers","Prefer known short attribute names over hand-built OIDs"],"tags":["x509","oid","asn1","parsing"],"backgroundTag":"invalid-oid-component","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}