GnuTLS certificates can be bigger than MAX_X509_CERT

[sergiodj]

I did this

We've received the following bug in Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076800

We are linking curl against GnuTLS, and the following error started happening:

# curl -w '%{size_header}' https://feeds2.feedburner.com/OreillyConferencesOSCON
curl: (100) Failed extracting certificate chain

I expected the following

When using curl linked against OpenSSL, I see:

$ curl -w '%{size_header}' https://feeds2.feedburner.com/OreillyConferencesOSCON
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:georss="http://www.georss.org/georss" xmlns:twitter="http://api.twitter.com" version="2.0" xmlns:atom="http://www.w3.org/2005/A
tom">
  <channel>
    <title>Twitter / oscon</title> 
    <link>http://twitter.com/oscon</link>
    <atom:link rel="self" href="http://api.twitter.com/1/statuses/user_timeline.rss?screen_name=oscon" type="application/rss+xml"/>
    <description>Twitter updates from O'Reilly OSCON / oscon.</description>
    <language>en-us</language>
    <ttl>40</ttl>
  <item>
    <title>oscon: Easily Invoke Common Protocols with Twisted - Spin up Python-friendly services with 0 lines of code http://t.co/29oTkk0i
sW</title>
...
  </channel>
</rss>
1494

The output above has been truncated for readability.

curl/libcurl version

curl 8.9.1

operating system

Debian unstable

[sergiodj]

After some investigation, I noticed that the problem is happening on Curl_extract_certinfo. Specifically, the following excerpts:

curl/lib/vtls/x509asn1.c

Line 1096 in 45246eb

Curl_dyn_init(&out, MAX_X509_STR);

curl/lib/vtls/x509asn1.c

Lines 1235 to 1252 in 45246eb

	result = Curl_dyn_add(&out, "-----BEGIN CERTIFICATE-----\n");
	if(!result) {
	size_t j = 0;
	while(!result && (j < clen)) {
	size_t chunksize = (clen - j) > 64 ? 64 : (clen - j);
	result = Curl_dyn_addn(&out, &certptr[j], chunksize);
	if(!result)
	result = Curl_dyn_addn(&out, "\n", 1);
	j += chunksize;
	}
	if(!result)
	result = Curl_dyn_add(&out, "-----END CERTIFICATE-----\n");
	}
	free(certptr);
	if(!result)
	if(data->set.ssl.certinfo)
	result = ssl_push_certinfo_dyn(data, certnum, "Cert", &out);

The certificate we get from the website has a size that's much bigger than MAX_X509_STR.

[icing]

Can reproduce. Analyzing the cause.

[icing]

I propose #14354 as fix for this. Could you verify?