bin/57041: netpgp does not handle allocation failure correctly

[roland.illig%gmx.de@localhost]

>Number:         57041
>Category:       bin
>Synopsis:       netpgp does not handle allocation failure correctly
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 01 22:20:00 +0000 2022
>Originator:     Roland Illig
>Release:        9.99.100
>Organization:
>Environment:
NetBSD nbcurr.roland-illig.de 9.99.100 NetBSD 9.99.100 (GENERIC) #0: Fri Sep 30 14:32:45 UTC 2022  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
When pgp_memory_pad runs into an allocation failure, it prints a message on stderr but continues as if nothing bad had happened.

This can result in incomplete output, access to uninitialized memory, or anything worse.

$ MALLOC_CONF=junk:true netpgpkeys \
    --export-key \
    --keyring=/usr/pkg/etc/gnupg/pkgsrc.gpg \
    b5952cabdd765a20 \
| less

The above command outputs "<A5><A5><A5>..." because in pgp_export_key, the string is not properly terminated before calling netpgp_strdup. But even if that bug is fixed by calling pgp_memory_add(mem, "", 1), there is no guarantee that this '\0' is actually appended to the memory.

The error handling of netpgp probably needs to be rewritten completely.
>How-To-Repeat:

>Fix: