add openssl hmac defensive test

[maage]

md_len might be uninitialized. It might not be set at HMAC if something
goes wrong. Later it is used at memory allocation and memcpy and
uninitialized variable breaks havoc there.

Stack trace:

(gdb) where
#0 0x00007f4e874d8548 in __memcpy_ssse3_back () from /lib64/libc.so.6
#1 0x00007f4e8b5abb1b in ngx_http_set_misc_set_hmac_sha1 (r=0x7f4e8d16d6b0, res=0x7fff50dbda70, v=0x7f4e8d16e3d8)

at ngx_http_set_misc/src/ngx_http_set_hmac.c:38

#2 0x00007f4e8b5a2a9c in ndk_set_var_multi_value_code (e=0x7f4e8d16e380) at ngx_devel_kit/src/ndk_set_var.c:191
#3 0x00007f4e8b571eb3 in ngx_http_rewrite_handler (r=0x7f4e8d16d6b0) at src/http/modules/ngx_http_rewrite_module.c:180
#4 0x00007f4e8b529701 in ngx_http_core_rewrite_phase (r=0x7f4e8d16d6b0, ph=0x7f4e8d1dc3e8)

at src/http/ngx_http_core_module.c:959

#5 0x00007f4e8b5254b6 in ngx_http_core_run_phases (r=r@entry=0x7f4e8d16d6b0) at src/http/ngx_http_core_module.c:905
#6 0x00007f4e8b5255cb in ngx_http_handler (r=r@entry=0x7f4e8d16d6b0) at src/http/ngx_http_core_module.c:888
#7 0x00007f4e8b530da5 in ngx_http_process_request (r=r@entry=0x7f4e8d16d6b0) at src/http/ngx_http_request.c:1901
#8 0x00007f4e8b531194 in ngx_http_process_request_headers (rev=rev@entry=0x7f4e8d121e28) at src/http/ngx_http_request.c:1332
#9 0x00007f4e8b5314cd in ngx_http_process_request_line (rev=rev@entry=0x7f4e8d121e28) at src/http/ngx_http_request.c:1012
#10 0x00007f4e8b531914 in ngx_http_wait_request_handler (rev=0x7f4e8d121e28) at src/http/ngx_http_request.c:499
#11 0x00007f4e8b51aa03 in ngx_epoll_process_events (cycle=0x7f4e8d11a7f0, timer=, flags=)

at src/event/modules/ngx_epoll_module.c:685

#12 0x00007f4e8b510db9 in ngx_process_events_and_timers (cycle=cycle@entry=0x7f4e8d11a7f0) at src/event/ngx_event.c:248
#13 0x00007f4e8b519d0a in ngx_single_process_cycle (cycle=cycle@entry=0x7f4e8d11a7f0) at src/os/unix/ngx_process_cycle.c:333
#14 0x00007f4e8b4f72e9 in main (argc=5, argv=) at src/core/nginx.c:404

(gdb) up
#1 0x00007f4e8b5abb1b in ngx_http_set_misc_set_hmac_sha1 (r=0x7f4e8d16d6b0, res=0x7fff50dbda70, v=0x7f4e8d16e3d8)

at ngx_http_set_misc/src/ngx_http_set_hmac.c:38

38 ngx_memcpy(res->data,
(gdb) print md_len
$30 = 32590

[agentzh]

@maage Thanks for the patch!