I e-mailed Marc and asked him to jump in.
https://github.com/bagder/curl/commit/15ca80c

I am able to reproduce what was reported and your patch works here.
Windows 7 SP1 x64
python-2.7.8.amd64.msi w/ pyOpenSSL-0.14
curl 7.39 built using 'DLL Debug - DLL Windows SSPI - DLL WinIDN'

---
** [bugs:#1462] SSL connection returns garbage data**
**Status:** open-confirmed
**Labels:** SSL winssl 
**Created:** Fri Dec 05, 2014 09:45 PM UTC by Tae Hyoung Ahn
**Last Updated:** Tue Dec 09, 2014 11:42 AM UTC
**Owner:** Daniel Stenberg
When curl receives encrypted data from ssl connection, schannel_recv() tries to decrypt.
If s_pSecFn->DecryptMessage() returns a error such as SEC_I_CONTEXT_EXPIRED, schannel_recv() returns ret variable that has the encrypted packet length not decrypted packet size.
So the last line of schannel_recv() should be changed to return size variable.
 
---
Sent from sourceforge.net because curl-tracker@cool.haxx.se is subscribed to https://sourceforge.net/p/curl/bugs/
To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/curl/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.