This case is supposed to read from a page after after it is freed, but
it missed freeing val if we are not able to get a free page.
Signed-off-by: NSudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: NKees Cook <keescook@chromium.org>