Use app_malloc; two missing cases.

Reviewed-by: Matt Caswell <matt@openssl.org>
2 files changed