kx509: Prevent double free

Patchset 750a09bca2 introduced the
potential for a double free of 'name'.

Change-Id: I23bd4ddb7d9b41cbb3948ab06245f4052b309971

kdc/kx509.c

@@ -161,8 +161,6 @@ build_certificate(krb5_context context,
     if (ret)
 	goto out;
 
-    krb5_xfree(name);
-
     {
 	hx509_certs certs;
 	hx509_query *q;
@@ -264,6 +262,9 @@ build_certificate(krb5_context context,
     if (ret)
 	goto out;
 
+    /* cleanup on success */
+    krb5_xfree(name);
+
     return 0;
 out:
     if (name)