avoid potential spurious BN_free()