When buffer_grow’s realloc call fails it frees the buffer:
https://github.com/mongodb/mongo-python-driver/blob/3.10.1/bson/buffer.c#L82

This causes a double free later on (for example in _write_dict_to_bson) because the buffer struct is not "owned" by buffer_grow. A fix should ensure that the caller of buffer_grow can always free the buffer, even on error.

Noticed by Coverity.