bin/57179: occasional pkg_add core dumps

[cmeerw%cmeerw.org@localhost]

>Number:         57179
>Category:       bin
>Synopsis:       occasional pkg_add core dumps
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 09 18:55:00 +0000 2023
>Originator:     Christof Meerwald
>Release:        10.0_BETA
>Organization:
>Environment:
NetBSD arm-netbsd 10.0_BETA NetBSD 10.0_BETA (GENERIC64) #0: Wed Jan  4 12:17:54 UTC 2023  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
>Description:
I am seeing occasional core dumps from pkg_add, e.g.

gdb /usr/sbin/pkg_add /usr/pkg/pkg_add.core 
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/pkg_add...
(No debugging symbols found in /usr/sbin/pkg_add)
[New process 1969]
Core was generated by `pkg_add'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000f05b79f80098 in free () from /usr/lib/libc.so.12
(gdb) where
#0  0x0000f05b79f80098 in free () from /usr/lib/libc.so.12
#1  0x0000f05b7a7996bc in fetch_close () from /usr/lib/libfetch.so.3
#2  0x0000f05b7a798e84 in fetch_cache_put () from /usr/lib/libfetch.so.3
#3  0x0000f05b7a794558 in ?? () from /usr/lib/libfetch.so.3
#4  0x0000f05b7a79a010 in fetchIO_close () from /usr/lib/libfetch.so.3
#5  0x000000000315eabc in fetch_archive_close ()
#6  0x0000f05b7a3d9214 in ?? () from /usr/lib/libarchive.so.4
#7  0x0000f05b7a3d9420 in ?? () from /usr/lib/libarchive.so.4
#8  0x0000f05b7a3d94bc in ?? () from /usr/lib/libarchive.so.4
#9  0x0000f05b7a3da1ac in ?? () from /usr/lib/libarchive.so.4
#10 0x0000000003156f40 in pkg_do ()
#11 0x0000000003158178 in check_dependencies ()
#12 0x0000000003157d78 in pkg_do ()
#13 0x00000000031583a4 in pkg_perform ()
#14 0x000000000316227c in main ()

This was from doing a "pkg_add groff" on an aarch64 system (Free Oracle Cloud instance, but also seen it on a local Raspberry Pi 3)

>How-To-Repeat:
Not sure if it's always reproducible, but have seen it on two separate systems, both when doing "pkg_add groff"

Note, that I had changed PKG_PATH to use http (instead of https, see PR #57124):

http://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/aarch64/10.0/All
>Fix: