Null pointer dereference in mbedtls_mpi_mod_exp

[gilles-peskine-arm]

In Mbed TLS 2.26.0, mbedtls_mpi_mod_exp(X, A, E, N, _) with A having zero limbs crashes with a null pointer dereference. The code works fine when A has the value 0 but is represented with at least one limb.

In Mbed TLS 2.26.0, this bug is hard to reach since most functions that construct an MPI value (including mbedtls_mpi_lset and mbedtls_mpi_read_xxx, as well as most arithmetic operation) result in 0 being represented with at least 1 limb. In the development branch, a side effect of a change to mbedtls_mpi_read_binary{,_le} made in #4276 caused these functions to allocate 0 limbs when the input is an empty string, which made the bug reachable from TLS, where it was found by OSS-Fuzz.