without overthinking it, replace a few memcmp calls with CRYPTO_memcmp
where it is feasible to do so. better safe than sorry.
Fix a leak that can occur when len == 0, and as a result we leak a \0 byte.

(From Frantisek Boranek)

OK from miod@
Sanitize use of client_opaque_prf_input: set it to NULL immediately after
free()ing it, rather than in conditional code.

Also do not bother setting server_opaque_prf_input (server, not client) to
NULL in conditional code 10 lines after explicitely free()ing it and setting
it to NULL (were the developers afraid of zombie pointers?)

ok guenther@