Avoid calling BN_CTX_end without BN_CTX_start in ec_wNAF_precompute_mult.

Prior to this change, when EC_GROUP_get0_generator fails, BN_CTX_end
would get called even though BN_CTX_start hadn't been called yet, in
the case where the caller-supplied |ctx| is not NULL.

Change-Id: I6f728e74f0167193891cdb6f122b20b0770283dc
Reviewed-on: https://boringssl-review.googlesource.com/4271
Reviewed-by: Adam Langley <agl@google.com>

crypto/ec/wnaf.c

@@ -709,15 +709,15 @@ int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx) {
     group->pre_comp = NULL;
   }
 
-  pre_comp = ec_pre_comp_new();
-  if (pre_comp == NULL) {
-    return 0;
-  }
-
   generator = EC_GROUP_get0_generator(group);
   if (generator == NULL) {
     OPENSSL_PUT_ERROR(EC, ec_wNAF_precompute_mult, EC_R_UNDEFINED_GENERATOR);
-    goto err;
+    return 0;
+  }
+
+  pre_comp = ec_pre_comp_new();
+  if (pre_comp == NULL) {
+    return 0;
   }
 
   if (ctx == NULL) {