Harden UnixPkcs12Reader AllocHGlobal

* Do not do the allocation and parsing in the constructor, since that prevents Dispose from running
* If something goes wrong between AllocHGlobal and moving the pointer into a PointerMemoryManager, call FreeHGlobal.
  * Past that point it will be correctly freed by Dispose.

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/AndroidCertificatePal.cs

@@ -118,8 +118,9 @@ ref MemoryMarshal.GetReference(rawData),
 
         private static AndroidCertificatePal ReadPkcs12(ReadOnlySpan<byte> rawData, SafePasswordHandle password, bool ephemeralSpecified)
         {
-            using (var reader = new AndroidPkcs12Reader(rawData))
+            using (var reader = new AndroidPkcs12Reader())
             {
+                reader.ParsePkcs12(rawData);
                 reader.Decrypt(password, ephemeralSpecified);
 
                 UnixPkcs12Reader.CertAndKey certAndKey = reader.GetSingleCert();

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/AndroidPkcs12Reader.cs

@@ -11,17 +11,17 @@ namespace System.Security.Cryptography.X509Certificates
 {
     internal sealed class AndroidPkcs12Reader : UnixPkcs12Reader
     {
-        internal AndroidPkcs12Reader(ReadOnlySpan<byte> data)
+        internal AndroidPkcs12Reader()
         {
-            ParsePkcs12(data);
         }
 
         public static bool IsPkcs12(ReadOnlySpan<byte> data)
         {
             try
             {
-                using (var reader = new AndroidPkcs12Reader(data))
+                using (var reader = new AndroidPkcs12Reader())
                 {
+                    reader.ParsePkcs12(data);
                     return true;
                 }
             }

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/AppleCertificatePal.Pkcs12.iOS.cs

@@ -14,8 +14,9 @@ private static AppleCertificatePal ImportPkcs12(
             SafePasswordHandle password,
             bool ephemeralSpecified)
         {
-            using (ApplePkcs12Reader reader = new ApplePkcs12Reader(rawData))
+            using (ApplePkcs12Reader reader = new ApplePkcs12Reader())
             {
+                reader.ParsePkcs12(rawData);
                 reader.Decrypt(password, ephemeralSpecified);
                 return ImportPkcs12(reader.GetSingleCert());
             }

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/AppleCertificatePal.Pkcs12.macOS.cs

@@ -15,8 +15,9 @@ private static AppleCertificatePal ImportPkcs12(
             bool exportable,
             SafeKeychainHandle keychain)
         {
-            using (ApplePkcs12Reader reader = new ApplePkcs12Reader(rawData))
+            using (ApplePkcs12Reader reader = new ApplePkcs12Reader())
             {
+                reader.ParsePkcs12(rawData);
                 reader.Decrypt(password, ephemeralSpecified: false);
 
                 UnixPkcs12Reader.CertAndKey certAndKey = reader.GetSingleCert();

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/ApplePkcs12Reader.iOS.cs

@@ -10,9 +10,8 @@ namespace System.Security.Cryptography.X509Certificates
 {
     internal sealed class ApplePkcs12Reader : UnixPkcs12Reader
     {
-        internal ApplePkcs12Reader(ReadOnlySpan<byte> data)
+        internal ApplePkcs12Reader()
         {
-            ParsePkcs12(data);
         }
 
         protected override ICertificatePalCore ReadX509Der(ReadOnlyMemory<byte> data)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/ApplePkcs12Reader.macOS.cs

@@ -11,9 +11,8 @@ namespace System.Security.Cryptography.X509Certificates
 {
     internal sealed class ApplePkcs12Reader : UnixPkcs12Reader
     {
-        internal ApplePkcs12Reader(ReadOnlySpan<byte> data)
+        internal ApplePkcs12Reader()
         {
-            ParsePkcs12(data);
         }
 
         protected override ICertificatePalCore ReadX509Der(ReadOnlyMemory<byte> data)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/OpenSslPkcs12Reader.cs

@@ -9,9 +9,8 @@ namespace System.Security.Cryptography.X509Certificates
 {
     internal sealed class OpenSslPkcs12Reader : UnixPkcs12Reader
     {
-        private OpenSslPkcs12Reader(ReadOnlySpan<byte> data)
+        private OpenSslPkcs12Reader()
         {
-            ParsePkcs12(data);
         }
 
         protected override ICertificatePalCore ReadX509Der(ReadOnlyMemory<byte> data)
@@ -89,7 +88,8 @@ private static bool TryRead(
 
             try
             {
-                pkcs12Reader = new OpenSslPkcs12Reader(data);
+                pkcs12Reader = new OpenSslPkcs12Reader();
+                pkcs12Reader.ParsePkcs12(data);
                 return true;
             }
             catch (CryptographicException e)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Android.cs

@@ -118,8 +118,9 @@ private static ICertificatePal[] ReadPkcs12Collection(
             SafePasswordHandle password,
             bool ephemeralSpecified)
         {
-            using (var reader = new AndroidPkcs12Reader(rawData))
+            using (var reader = new AndroidPkcs12Reader())
             {
+                reader.ParsePkcs12(rawData);
                 reader.Decrypt(password, ephemeralSpecified);
 
                 ICertificatePal[] certs = new ICertificatePal[reader.GetCertCount()];

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.iOS.cs

@@ -46,10 +46,11 @@ private static ILoaderPal FromBlob(ReadOnlySpan<byte> rawData, SafePasswordHandl
             if (contentType == X509ContentType.Pkcs12)
             {
                 X509Certificate.EnforceIterationCountLimit(ref rawData, readingFromFile, password.PasswordProvided);
-                ApplePkcs12Reader reader = new ApplePkcs12Reader(rawData);
+                ApplePkcs12Reader reader = new ApplePkcs12Reader();
 
                 try
                 {
+                    reader.ParsePkcs12(rawData);
                     reader.Decrypt(password, ephemeralSpecified);
                     return new ApplePkcs12CertLoader(reader, password);
                 }

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.macOS.cs

@@ -72,10 +72,11 @@ private static ApplePkcs12CertLoader ImportPkcs12(
             bool ephemeralSpecified,
             SafeKeychainHandle keychain)
         {
-            ApplePkcs12Reader reader = new ApplePkcs12Reader(rawData);
+            ApplePkcs12Reader reader = new ApplePkcs12Reader();
 
             try
             {
+                reader.ParsePkcs12(rawData);
                 reader.Decrypt(password, ephemeralSpecified);
                 return new ApplePkcs12CertLoader(reader, keychain, password, exportable);
             }

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/UnixPkcs12Reader.cs

@@ -30,7 +30,7 @@ internal abstract class UnixPkcs12Reader : IDisposable
         protected abstract ICertificatePalCore ReadX509Der(ReadOnlyMemory<byte> data);
         protected abstract AsymmetricAlgorithm LoadKey(ReadOnlyMemory<byte> safeBagBagValue);
 
-        protected void ParsePkcs12(ReadOnlySpan<byte> data)
+        internal void ParsePkcs12(ReadOnlySpan<byte> data)
         {
             try
             {
@@ -42,10 +42,24 @@ protected void ParsePkcs12(ReadOnlySpan<byte> data)
 
                 unsafe
                 {
-                    IntPtr tmpPtr = Marshal.AllocHGlobal(encodedData.Length);
-                    Span<byte> tmpSpan = new Span<byte>((byte*)tmpPtr, encodedData.Length);
-                    encodedData.CopyTo(tmpSpan);
-                    _tmpManager = new PointerMemoryManager<byte>((void*)tmpPtr, encodedData.Length);
+                    IntPtr tmpPtr = IntPtr.Zero;
+
+                    try
+                    {
+                        tmpPtr = Marshal.AllocHGlobal(encodedData.Length);
+                        Span<byte> tmpSpan = new Span<byte>((byte*)tmpPtr, encodedData.Length);
+                        encodedData.CopyTo(tmpSpan);
+                        _tmpManager = new PointerMemoryManager<byte>((void*)tmpPtr, encodedData.Length);
+                    }
+                    catch
+                    {
+                        if (tmpPtr != IntPtr.Zero)
+                        {
+                            Marshal.FreeHGlobal(tmpPtr);
+                        }
+
+                        throw;
+                    }
                 }
 
                 ReadOnlyMemory<byte> tmpMemory = _tmpManager.Memory;