Segfault in encodeDN

[Trzik]

I did this

The issue happens when curl tries to parse this structure, specifically the OID 1.2.840.113549.1.9.2 - unstructuredName

The segfault (nullptr dereference) happens on this line:

curl/lib/vtls/x509asn1.c

Line 694 in fd0d2ed

for(p3 = str; ISUPPER(*p3); p3++)

The issue comes from OID2str when searchOID is invoked. OIDtable is searched, entry 1.2.840.113549.1.9.2 is not found and the function returns NULL. However, the result stays CURLE_OK so the calling code assumes the dynbuf is perfectly valid when it is in fact still in unallocated state.

For the record, the issue started occurring with commit 623c3a8 since version 8.6.0.

I'm also attaching a patch that may be helpful.
x509asn1.patch

I expected the following

Not a crash

curl/libcurl version

curl 8.6.0

operating system

Windows 10 (x64, 22631)