misc: Don't leak memory on ssh_path_expand_escape() on error.

src/misc.c

@@ -758,11 +758,13 @@ char *ssh_path_expand_escape(ssh_session session, const char *s) {
             default:
                 ssh_set_error(session, SSH_FATAL,
                         "Wrong escape sequence detected");
+                free(r);
                 return NULL;
         }
 
         if (x == NULL) {
             ssh_set_error_oom(session);
+            free(r);
             return NULL;
         }
 
@@ -770,6 +772,8 @@ char *ssh_path_expand_escape(ssh_session session, const char *s) {
         if (i > MAX_BUF_SIZE) {
             ssh_set_error(session, SSH_FATAL,
                     "String too long");
+            free(x);
+            free(r);
             return NULL;
         }
         l = strlen(buf);