Increased MBEDTLS_BEFORE_COLON (size of temporary buffer) to 32

[Mario-Klebsch]

Description

Fix for Ticket #4894:

• The buffer size is increased to 32
• An asseretion is added to check for buffer to small in development builds

PR checklist

• changelog not required because: I have no idea, what to write
• tests provided (as comment in mbedtls_x509_crt_info calls mbedtls_x509_key_size_helper with buffer that's too small #4894)

[mpg]

Thanks for your contribution!

However it needs to include an automated non-regression test, as part of test_suite_x509parse. See https://mbed-tls.readthedocs.io/en/latest/kb/development/test_suites/ and please feel free to ask questions if anything's not clear enough.

[mpg]

Why 32? And why update only this and not the corresponding _STR macro below?

[Mario-Klebsch]

Why 32?

Increasing the buffer size by 2 would have been sufficient. But I wanted to have some spara space, just in case someone changes mbedtls_x509_key_size_helper().

And why update only this and not the corresponding _STR macro below?

Changing the MBEDTLS_BEFORE_COLON enlarges the buffer and makes sure, that no MBEDTLS_ERR_X509_BUFFER_TOO_SMALL-error is generated.

Changing the MBEDTLS_BEFORE_COLON_STR macro changes the format string for printf in a way, that is does not match the other printf-statements. Here is a sample output:

cert. version     : 3
serial number     : F7:B9:58:6A:3B:C7:61:9A
issuer name       : CN=Intermediate CA
subject name      : CN=Server
issued  on        : 2025-10-02 08:48:33
expires on        : 2035-09-30 08:48:33
signed using      : ECDSA with SHA256
EC key size       : 256 bits
basic constraints : CA=false
key usage         : Digital Signature

When the MBEDTLS_BEFORE_COLON_STR-Macro is changed, the other printf format strings would need to be updated too.

I choose to not update the MBEDTLS_BEFORE_COLON_STR-Macro, because IMHO that is not a problem. In cases, when no MBEDTLS_ERR_X509_BUFFER_TOO_SMALL error is generated, the output of mbedtls_x509_crt_info() would be the same as before.

In case the current implementation fails with MBEDTLS_ERR_X509_BUFFER_TOO_SMALL, the colon in the info string would not be adjusted to the colons of the other lines.

To me, this seems like a reasonable compromize.

[mpg]

We don't use assert in the library.

[Mario-Klebsch]

The purpose of assert()ions is to signal errors in the internal logic of some software. In this case, supplying an insuffently sized buffer to mbedtls_x509_key_size_helper() in an error in the program logic. This is the reason, why I added an assertion.

Just remove it from my contribution, if you don't want to use this extra instrumentation in your code.