Backport 2.7: Add tests for buffer corruption after PEM write

[paul-elliott-arm]

Description

In order to remove some big (4k) buffers from being created on the stack, the output buffer was re-used - in this case the raw der data is written to the buffer prior to being base64 encoded into an allocated buffer, and then overwritten with the pem data. However, even though the pem data is zero terminated, usually der data will remain in the buffer after the terminator.

Should this buffer get passed into mbedtls_x509_crt_parse() then it will likely fail to parse, as it decides whether or not a buffer is pem by checking the last byte of the buffer for being zero - if it isn't zero, it will attempt to parse as der, which will obviously fail.

Please note that although this bug does not affect this branch, I wanted to add the tests anyway, to ensure this regression did not happen again. In order to get these tests to pass I would have had to add a memset to clear the buffers before two of the tests, so it seemed more clean just to backport the fix as well (i.e. zero the buffer after pem write)

This is a backport of #3898

Status

READY

Steps to test or reproduce

See #3682

[gilles-peskine-arm]

There are cosmetic differences with the 2.16 backport in the tests. In general it's better to avoid those, because they make backporting further patches more difficult, but we're unlikely to patch these tests any more until 2.7 goes out of support, so never mind.