What is the maximum length of a X.509 OID? I'm working on a feature for a project to determine if a given X.509 certificate is an EV Certificate, and if so, who is the authority behind that certificate.

To do this, I grabbed the list of EV OIDs from Wikipedia, and keep them in a hash of OID -> Authority Name. I get the certificate policy OID and convert it into a char array that I can use in my hash.

However I'm unsure about what the maximum length of a OID can be. I'm having trouble locating that information in the spec or anywhere else online.
OIDs don't have a maximal length / depth specified. There is no real value where you can safely cut them off - or rather reject them (raise an exception or error). Anything over 20 bytes seems ridiculous, so that should be plenty. Limiting to a measly 1 KB of RAM should be fine on a non-embedded platform (desktop / server) as well, if you must set a limit.

When planning to protect against DoS attacks from certificates it is more useful to limit the amount of bytes of the entire certificate. It's not very efficient to limit each and every component within the certificate.



When programming in C/unmanaged C++ it is more reasonable to bother about ASN.1 based buffer overruns; those are common enough and extremely dangerous.