Free tmp_wNAF in all exit paths.

BUG=517495

Change-Id: I67c9c511d4ed558ab7a976d6708398e02194cd0f
Reviewed-on: https://boringssl-review.googlesource.com/5628
Reviewed-by: Adam Langley <agl@google.com>

crypto/ec/wnaf.c

@@ -464,6 +464,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
           numblocks = (tmp_len + blocksize - 1) / blocksize;
           if (numblocks > pre_comp->numblocks) {
             OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+            OPENSSL_free(tmp_wNAF);
             goto err;
           }
           totalnum = num + numblocks;
@@ -478,6 +479,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
             wNAF_len[i] = blocksize;
             if (tmp_len < blocksize) {
               OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+              OPENSSL_free(tmp_wNAF);
               goto err;
             }
             tmp_len -= blocksize;