Ensure that we do not process a ChangeCipherSpec with an empty master
secret. This is an additional safeguard against early ChangeCipherSpec
handling.

From OpenSSL.

ok deraadt@
ssl_sess_cert_new() can return NULL. Fix two cases where the return value
is unchecked, which would result in a later null pointer dereference.

While here, RSA_free, DH_free and EC_KEY_free all have implicit NULL
checks, so avoid repeating them here.

ok beck@