Fix leak or double free with OCSP_request_add0_id()

On success, OCSP_request_add0_id() transfers ownership of cid to
either 'one' or 'req' depending on whether the latter is NULL or
not.  On failure, the caller can't tell whether OCSP_ONEREQ_new()
failed (in which case cid needs to be freed) or whether it was a
failure to allocate memory in sk_insert() (in which case cid must
not be freed).

The caller is thus faced with the choice of leaving either a leak
or a potential double free.  Fix this by transferring ownership
only at the end of the function.

Found while reviewing an upcoming diff by beck.

ok jsing

0 files changed, 0 insertions, 0 deletions