dh: fix two leaks in ssh_get_pubkey_hash

Fix two memory leaks in `ssh_get_pubkey_hash` for some error paths.
The local `h` buffer and `ctx` MD5 context each must be free'd for
the SSH_ERROR cases.

Introduced with 16217454d5.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

src/dh.c

@@ -1008,15 +1008,20 @@ int ssh_get_pubkey_hash(ssh_session session, unsigned char **hash) {
     }
 
     rc = ssh_get_server_publickey(session, &pubkey);
-    if (rc != 0) {
+    if (rc != SSH_OK) {
+        md5_final(h, ctx);
         SAFE_FREE(h);
         return SSH_ERROR;
     }
 
     rc = ssh_pki_export_pubkey_blob(pubkey, &pubkey_blob);
     ssh_key_free(pubkey);
-    if (rc != 0) {
+    if (rc != SSH_OK) {
+        md5_final(h, ctx);
+        SAFE_FREE(h);
+        return SSH_ERROR;
     }
+
     md5_update(ctx, ssh_string_data(pubkey_blob), ssh_string_len(pubkey_blob));
     ssh_string_free(pubkey_blob);
     md5_final(h, ctx);