rpc_session_create leaks the session when /dev/urandom cannot be opened #44

In rpc_session_create (src/session.c), if rpc_random() fails after rpc_session_new(), the function returns NULL without calling free(ses).

rpc_random() returns -1 when /dev/urandom cannot be opened. The session has already been allocated with calloc and is not yet inserted into the tree, so the pointer is lost.

ses = rpc_session_new();

if (!ses)
return NULL;

if (rpc_random(ses->id))
return NULL;