CVE-2024-7264: libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized...

The vulnerability lies in the GTime2str() function in lib/vtls/x509asn1.c.

The commit 3c914bc680155b32178f1f15ca8d47c7f4640afe introduced a flaw in how the fracl (fractional seconds length) variable was calculated. Specifically, the line fracl = tzp - fracp - 1; could result in fracl being -1 if tzp == fracp (meaning no digits were found after the fractional seconds separator '.' or ','). This negative fracl value was then used in Curl_dyn_addf as a precision for a string, leading to strlen() being called on a non-null-terminated buffer, causing an out-of-bounds read.

The commit 27959ecce75cdb2809c0bdb3286e60e08fadb519 fixed this by changing the calculation to fracl = tzp - fracp; and ensuring fracl is not negative. It also correctly handles the timezone part of the string.

The function Curl_x509_GTime2str is a wrapper around GTime2str for unit testing purposes and is also affected by the same vulnerability.

The vulnerability was originally introduced in commit 3a24cb7bc456366cbc3a03f7ab6d2576105a1f2d when the GTime2str function was added.

Therefore, the vulnerable functions are GTime2str and Curl_x509_GTime2str.