Findings from https://issues.redhat.com/browse/RHEL-22390:

Error: UNINIT (CWE-457):
rpm-4.16.1.3/lib/rpmts.c:478: var_decl: Declaring variable "kd" without initializer.
rpm-4.16.1.3/lib/rpmts.c:537: uninit_use_in_call: Using uninitialized value "kd.signid" when calling "finiPgpData".
rpm-4.16.1.3/lib/rpmts.c:537: uninit_use_in_call: Using uninitialized value "kd.timestr" when calling "finiPgpData".
rpm-4.16.1.3/lib/rpmts.c:537: uninit_use_in_call: Using uninitialized value "kd.verid" when calling "finiPgpData".

1. 535| headerFree(h);
2. 536| pgpFreeDig(dig);
3. 537|-> finiPgpData(&kd);
4. 538| free(enc);
5. 539| free(d);

In the unlikely case that base64 encoding of a pubkey data fails, the code will try to free uninitialized pointers.