Fix double free in __printf_fp_l (bug 26214)

[Florian Weimer]

* Joseph Myers:

> __printf_fp_l has a double free bug in the case where it allocates
> memory with malloc internally, then has an I/O error while outputting
> trailing padding and tries to free that already-freed memory when the
> error occurs.  This patch fixes this by setting the relevant pointer
> to NULL after the first free (the only free of this pointer that isn't
> immediately followed by returning from the function).

Same question here: Should we treat this as a security bug?

Thanks,
Florian