GnuTLS certificates can be bigger than MAX_X509_CERT

I did this

We've received the following bug in Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076800

We are linking curl against GnuTLS, and the following error started happening:

# curl -w '%{size_header}' https://feeds2.feedburner.com/OreillyConferencesOSCON
curl: (100) Failed extracting certificate chain

I expected the following

When using curl linked against OpenSSL, I see:

$ curl -w '%{size_header}' https://feeds2.feedburner.com/OreillyConferencesOSCON
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:georss="http://www.georss.org/georss" xmlns:twitter="http://api.twitter.com" version="2.0" xmlns:atom="http://www.w3.org/2005/A
tom">
  <channel>
    <title>Twitter / oscon</title> 
    <link>http://twitter.com/oscon</link>
    <atom:link rel="self" href="http://api.twitter.com/1/statuses/user_timeline.rss?screen_name=oscon" type="application/rss+xml"/>
    <description>Twitter updates from O'Reilly OSCON / oscon.</description>
    <language>en-us</language>
    <ttl>40</ttl>
  <item>
    <title>oscon: Easily Invoke Common Protocols with Twisted - Spin up Python-friendly services with 0 lines of code http://t.co/29oTkk0i
sW</title>
...
  </channel>
</rss>
1494

The output above has been truncated for readability.

curl/libcurl version

curl 8.9.1

operating system

Debian unstable

After some investigation, I noticed that the problem is happening on Curl_extract_certinfo. Specifically, the following excerpts:

curl/lib/vtls/x509asn1.c

Line 1096 in 45246eb

Curl_dyn_init(&out, MAX_X509_STR);

curl/lib/vtls/x509asn1.c

Lines 1235 to 1252 in 45246eb

    
           result = Curl_dyn_add(&out, "-----BEGIN CERTIFICATE-----\n"); 
        
           if(!result) { 
        
             size_t j = 0; 
        
             while(!result && (j < clen)) { 
        
               size_t chunksize = (clen - j) > 64 ? 64 : (clen - j); 
        
               result = Curl_dyn_addn(&out, &certptr[j], chunksize); 
        
               if(!result) 
        
                 result = Curl_dyn_addn(&out, "\n", 1); 
        
               j += chunksize; 
        
             } 
        
             if(!result) 
        
               result = Curl_dyn_add(&out, "-----END CERTIFICATE-----\n"); 
        
           } 
        
           free(certptr); 
        
           if(!result) 
        
             if(data->set.ssl.certinfo) 
        
               result = ssl_push_certinfo_dyn(data, certnum, "Cert", &out);

The certificate we get from the website has a size that's much bigger than MAX_X509_STR.

x509asn1: initialize dynbuf with MAX_X509_CERT

Can reproduce. Analyzing the cause.

x509 certification information, raise limit

I propose #14354 as fix for this. Could you verify?

x509asn1: raise size limit for x509 certification information

Navigation Menu

Repository navigation

GnuTLS certificates can be bigger than `MAX_X509_CERT` #14352

I did this

I expected the following

curl/libcurl version

operating system

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	result = Curl_dyn_add(&out, "-----BEGIN CERTIFICATE-----\n");
	if(!result) {
	size_t j = 0;

	while(!result && (j < clen)) {
	size_t chunksize = (clen - j) > 64 ? 64 : (clen - j);
	result = Curl_dyn_addn(&out, &certptr[j], chunksize);
	if(!result)
	result = Curl_dyn_addn(&out, "\n", 1);
	j += chunksize;
	}
	if(!result)
	result = Curl_dyn_add(&out, "-----END CERTIFICATE-----\n");
	}
	free(certptr);
	if(!result)
	if(data->set.ssl.certinfo)
	result = ssl_push_certinfo_dyn(data, certnum, "Cert", &out);

GnuTLS certificates can be bigger than MAX_X509_CERT #14352

Description

I did this

I expected the following

curl/libcurl version

operating system

Activity

sergiodj commented on Aug 2, 2024

icing commented on Aug 2, 2024

icing commented on Aug 2, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

GnuTLS certificates can be bigger than `MAX_X509_CERT` #14352