Fix error checking in PKINIT authdata creation

In create_identifiers_from_stack: check for allocation errors from
PKCS7_ISSUER_AND_SERIAL_new and M_ASN1_INTEGER_dup.  Use
PKCS7_ISSUER_AND_SERIAL_free to more concisely clean up the OpenSSL
issuer variable, and make sure that any partially processed value is
cleaned up on error.  Use calloc to allocate krb5_cas so that all of
its pointers are initially nulled, so that
free_krb5_external_principal_identifier can operate on it safely in
case of error.  Eliminate the retval variable as it was not used
safely.  Rename the error label from "cleanup" to "oom" and separate
it from the successful return path (which has nothing to clean up).

ticket: 7943 (new)
target_version: 1.12.2
tags: pullup
Prevent a write-to-NULL in encrypt_credencpart()

If krb5_encrypt_helper() returns an error, the ciphertext structure
may contain a non-zero length, but it will already have freed the
pointer to its data, making encrypt_credencpart()'s subsequent attempt
to clear and free the memory fail.

If krb5_encrypt_helper() encounters an error, clear the memory
before freeing it, and make sure that we don't return a non-zero
ciphertext length.  Because we know that krb5_encrypt_helper()
will only return an empty ciphertext data structure on error, stop
trying to clean it up in encrypt_credencpart().

Make corresponding changes to krb5_encrypt_keyhelper().

Based on a patch from Jatin Nansi.