Only patch I looked at in 68990cd8 was wrong.

x points to the terminating NUL in x64.  free()ing it would do wild
and crazy things depending on how paranoid the free() implementation
is.

free(x64) instead... at least Coverity was happy though!

src/sbbs3/js_cryptcon.c

@@ -131,7 +131,7 @@ static int js_ecc_to_prop(unsigned char *data, size_t len, size_t *off, JSContex
 			memcpy(y, z, zcnt);
 			y64 = malloc(zcnt*4/3+3);
 			if (y64 == NULL) {
-				free(x);
+				free(x64);
 				free(y);
 				return 0;
 			}