Fixes spotted by Coverity.

A lenof() being applied to a non-array, a couple of missing frees on
an error path, and a case in pfd_receive() where we could have gone
round a loop again after freeing the port forwarding structure it was
working on.

psftp.c

@@ -1050,6 +1050,8 @@ int sftp_cmd_ls(struct sftp_command *cmd)
 
     if (dirh == NULL) {
 	printf("Unable to open %s: %s\n", dir, fxp_error());
+	sfree(cdir);
+	sfree(unwcdir);
 	return 0;
     } else {
 	nnames = namesize = 0;