ed: Avoid dangling pointer in getrhs()

If the string r.str is freed but error() is called then
next call will see a pointer that maybe it will try to free
because the call to error unwind the frame stack.

ed.c

@@ -1102,9 +1102,9 @@ getrhs(int delim)
 	}
 
 	if (!strcmp("%", s.str)) {
-		free(s.str);
 		if (!rhs)
 			error("no previous substitution");
+		free(s.str);
 	} else {
 		free(rhs);
 		rhs = s.str;