Fix possible out-of-bounds call to free()

The rl_filename_completion_function() may theoretically step out of
bounds and call free on random pointers.  Found by Coverity Scan.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

src/complete.c

@@ -273,13 +273,21 @@ char *rl_filename_completion_function(const char *text, int state)
 	}
     }
 
-    do {
+    while (i > 0)
 	free(av[--i]);
-    } while (i > 0);
 
-    free(av);
+    if (av) {
-    free(dir);
+	free(av);
-    free(file);
+	av = NULL;
+    }
+    if (dir) {
+	free(dir);
+	dir = NULL;
+    }
+    if (file) {
+	free(file);
+	file = NULL;
+    }
 
     return NULL;
 }