spotted while looking at the diff for the tag signing.  There we do a
buf_alloc and then buf_append in a loop.  If malloc fails and buf is
NULL, functions like buf_append will dereference it and... yeah.

diff /home/op/w/got
commit - ad8bd524a993d8634c1d1ac2253d5d64753125de
path + /home/op/w/got
blob - 05d16ce90ea867ddc912cd1321d68b0262228307
file + lib/buf.c
--- lib/buf.c
+++ lib/buf.c
@@ -57,7 +57,7 @@ buf_alloc(BUF **b, size_t len)
 
 	*b = malloc(sizeof(**b));
 	if (*b == NULL)
-		return NULL;
+		return got_error_from_errno("malloc");
 	/* Postpone creation of zero-sized buffers */
 	if (len > 0) {
 		(*b)->cb_buf = calloc(1, len);