google/certificate-transparency — pull request #40 by rep (2014-06-11 11:14:32+00:00)
Title: ASN1 indefinite encoding (warning, ugly hack)

Basically the "indefinite" length encoding is not implemented and thus CT won't parse certain certificates that use it.

This patch is super ugly, in my excuse though I'm not familiar with pyasn1/CT too much, I hate ASN1 (from the bottom of my heart) and it is relatively hard to debug these sort of bugs within CT.

It handles a length of 0x80/128 correctly now, searching for the two 0-bytes. Then however depending on the order / mixing of tags/components in CT, it still needs special handling where the two 0-bytes appear again in the buffer. There probably is a cleaner one-line version of the change in the Sequence class.

Here is an example cert that does run into the issue with current upstream (used in the wild on HTTPS):
-----BEGIN CERTIFICATE-----
MIICOTCAoAMCAQICAQAwDQYJKoZIhvcNAQEEBQAwYjERMA8GA1UEBxMISW50ZXJu
ZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBD
bGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMB4XDTk2MDQwODEwMjAy
N1oXDTk3MDQwODEwMjAyN1owYjERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoT
DlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0g
SW5kaXZpZHVhbCBTdWJzY3JpYmVyMIAwDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
ALYUps9N0AUN2Moj0G+qtCmSY44s+G+W1y6ddksRsTaNV8nD/RzGuv4eCLozypXq
vuNbzQaot3kdRCrtc/KxUoNoEHBkkdc+a/n3XZ0UQ5tul0WYgUfRLcvdu3LXTD9x
quJA8lQ5vBbuz3zsuts/bCqzFrGGEp2ukzTVuNXQ9z6pAgMBAAEAAAAAMA0GCSqG
SIb3DQEBBAUAA4GBAD7WcmvI23xUFGNGvTsCsMBX/eMAfsaMNz2OyvFlLryiy32/
ToJO9M0oYv4shI2YUteX4leGAYHQln1+/JjM2AdDjocFSeDUfq+hqV8mBLYp0Sjn
TBbwQVlgwORPWTi7KfAmqRU3ZAkr/arj8D9UKi/mHpKUzwB9+DZb7VMuq+qT
-----END CERTIFICATE-----

I'd be happy to discuss more and get feedback.
-Mark