Fix error handling in bn_exp

In the event of an error |rr| could be NULL. Therefore don't assume you can
use |rr| in the error handling code.

(Imported from upstream's 8c5a7b33c6269c3bd6bc0df6b4c22e4fba03b485.)

Change-Id: I0b392991ce8170dc418e93003af256d535d1e2e8
Reviewed-on: https://boringssl-review.googlesource.com/4005
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/bn/exponentiation.c b/crypto/bn/exponentiation.c
index 3a07704..57f319a 100644
--- a/crypto/bn/exponentiation.c
+++ b/crypto/bn/exponentiation.c
@@ -172,12 +172,13 @@
       }
     }
   }
-  ret = 1;
 
-err:
   if (r != rr) {
     BN_copy(r, rr);
   }
+  ret = 1;
+
+err:
   BN_CTX_end(ctx);
   return ret;
 }