[PATCH] Crash if $TMPPREFIX has invalid or read-only path

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

Easily seen with

zsh -fc 'TMPPREFIX=/tmp/xxx/zsh; echo =(<<<"")'

getoutputfile() calls free() on memory that was allocated on the heap
by gettempname().

diff --git a/Src/exec.c b/Src/exec.c
index 8f9d5a885..3a8b3e951 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4897,7 +4897,6 @@ getoutputfile(char *cmd, char **eptr)

     if ((fd = open(nam, O_WRONLY | O_CREAT | O_EXCL | O_NOCTTY, 0600)) < 0) {
        zerr("process substitution failed: %e", errno);
-       free(nam);
        if (!s)
            child_unblock();
        return NULL;