Free BN_MONT_CTX in generic code.

Although those are only created by code owned by RSA_METHOD, custom RSA_METHODs
shouldn't be allowed to squat our internal fields and then change how you free
things.

Remove 'method' from their names now that they're not method-specific.

Change-Id: I9494ef9a7754ad59ac9fba7fd463b3336d826e0b
Reviewed-on: https://boringssl-review.googlesource.com/6423
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/rsa/rsa.c b/crypto/rsa/rsa.c
index 2589c14..49ab27b 100644
--- a/crypto/rsa/rsa.c
+++ b/crypto/rsa/rsa.c
@@ -124,6 +124,7 @@
   BN_clear_free(ap->exp);
   BN_clear_free(ap->coeff);
   BN_clear_free(ap->r);
+  BN_MONT_CTX_free(ap->mont);
   OPENSSL_free(ap);
 }
 
@@ -138,9 +139,7 @@
     return;
   }
 
-  if (rsa->meth == &RSA_default_method) {
-    rsa_default_finish(rsa);
-  } else if (rsa->meth->finish) {
+  if (rsa->meth->finish) {
     rsa->meth->finish(rsa);
   }
   METHOD_unref(rsa->meth);
@@ -155,6 +154,9 @@
   BN_clear_free(rsa->dmp1);
   BN_clear_free(rsa->dmq1);
   BN_clear_free(rsa->iqmp);
+  BN_MONT_CTX_free(rsa->mont_n);
+  BN_MONT_CTX_free(rsa->mont_p);
+  BN_MONT_CTX_free(rsa->mont_q);
   for (u = 0; u < rsa->num_blindings; u++) {
     BN_BLINDING_free(rsa->blindings[u]);
   }