Fix buffer overreads on malformed inputs in sample programs

[felipereyesmurcia]

Fixes #10803.

Description

This fixes the two memory errors reported in #10803, both in sample programs (not in the library).

ssl_server2.c — dummy_ticket_parse() length underflow. Tickets written by dummy_ticket_write() start with a 4-byte lifetime header, so the parser called mbedtls_ssl_session_load(session, buf + 4, len - 4) unconditionally. A remote client can send a ticket shorter than 4 bytes; len is a size_t, so len - 4 underflows and the loader reads past the end of the ticket buffer. The fix rejects tickets shorter than 4 bytes with MBEDTLS_ERR_SSL_BAD_INPUT_DATA before the subtraction.

ssl_context_info.c — strlen() on non-null-terminated ALPN data. The tool called strlen() on the serialized ALPN name, which is stored as exactly alpn_len bytes with no terminator, so a crafted input file made it read past the decoded buffer. The fix reads exactly alpn_len bytes, using memchr() to detect an embedded null (still reported as "ALPN negotiation is incorrect") and printing with "%.*s".

Verified with Valgrind before and after each fix: the ALPN "uninitialised value ... strlen" error and the ticket "Invalid read of size 4 ... 3 bytes after a block of size 1" both disappear after the change. Both sample programs rebuild with no new warnings.

PR checklist

• changelog provided
• framework PR not required
• TF-PSA-Crypto development PR not required because this change only touches Mbed TLS sample programs
• TF-PSA-Crypto 1.1 PR not required because this change only touches Mbed TLS sample programs
• mbedtls development PR provided
• mbedtls 4.1 PR not required because this is a sample-program fix with no API/ABI change; a backport can follow if maintainers want one
• mbedtls 3.6 PR not required because this is a sample-program fix with no API/ABI change; a backport can follow if maintainers want one
• tests not required because the change is in sample programs, which are not covered by the project's automated test suites; the fixes were verified manually with Valgrind