Make sure bs is assigned NULL when it's free'd, or there will be an

(incorrect) attempt to free it once more...

crypto/asn1/d2i_dsap.c

@@ -84,6 +84,7 @@ DSA *d2i_DSAparams(DSA **a, const unsigned char **pp, long length)
 	if ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;
 
 	M_ASN1_BIT_STRING_free(bs);
+	bs = NULL;
 
 	M_ASN1_D2I_Finish_2(a);
 

crypto/asn1/d2i_r_pr.c

@@ -108,6 +108,7 @@ RSA *d2i_RSAPrivateKey(RSA **a, const unsigned char **pp, long length)
 		goto err_bn;
 
 	M_ASN1_INTEGER_free(bs);
+	bs = NULL;
 
 	M_ASN1_D2I_Finish_2(a);
 err_bn:

crypto/dsa/dsa_asn1.c

@@ -84,6 +84,7 @@ DSA_SIG *d2i_DSA_SIG(DSA_SIG **a, const unsigned char **pp, long length)
 	if ((ret->s=BN_bin2bn(bs->data,bs->length,ret->s)) == NULL)
 		goto err_bn;
 	M_ASN1_BIT_STRING_free(bs);
+	bs = NULL;
 	M_ASN1_D2I_Finish_2(a);
 
 err_bn: