Make sure that ber in ber_scanf_elements is not NULL before parsing format

where ber is utilized. This also allows us to remove the ber->be_next
check, which can cause weird behaviour, because a NULL be_next would result
in parsing the last element twice.
OK claudio@ on previous version
OK rob@

src/lib/libutil/ber.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ber.c,v 1.11 2019/08/05 12:38:14 martijn Exp $ */
+/*	$OpenBSD: ber.c,v 1.12 2019/08/14 04:48:13 martijn Exp $ */
 
 /*
  * Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -684,6 +684,8 @@ ber_scanf_elements(struct ber_element *ber, char *fmt, ...)
 
 	va_start(ap, fmt);
 	while (*fmt) {
+		if (ber == NULL && *fmt != '}' && *fmt != ')')
+			goto fail;
 		switch (*fmt++) {
 		case 'B':
 			ptr = va_arg(ap, void **);
@@ -788,8 +790,6 @@ ber_scanf_elements(struct ber_element *ber, char *fmt, ...)
 			goto fail;
 		}
 
-		if (ber->be_next == NULL)
-			continue;
 		ber = ber->be_next;
 	}
 	va_end(ap);