Use *_clear_free instead of *_free.

CVE-2014-4732
Constant time memory comparison.

CVE-2014-4731.

Non-constant time comparisons usually require millions of packets
in order to get enough statistics.  This is VERY hard to do with
WiFi or wired 802.1X.  The delays on switch port open / close
are on the order of seconds.
Check BN_rand_range return value

CVE-2014-4733.

In practice, the function should never fail.