Fixes spotted by Coverity.

A lenof() being applied to a non-array, a couple of missing frees on
an error path, and a case in pfd_receive() where we could have gone
round a loop again after freeing the port forwarding structure it was
working on.

config.c

@@ -1005,7 +1005,7 @@ static void ttymodes_handler(union control *ctrl, void *dlg,
 	    char type;
 
 	    {
-		const char *types = "ANV";
+                const char types[] = {'A', 'N', 'V'};
 		int button = dlg_radiobutton_get(td->valradio, dlg);
 		assert(button >= 0 && button < lenof(types));
 		type = types[button];

portfwd.c

@@ -359,6 +359,7 @@ static void pfd_receive(Plug plug, int urgent, char *data, int len)
 	     * close the connection rudely.
 	     */
 	    pfd_close(pf);
+            break;
 	}
 	return;
 

psftp.c

@@ -1050,6 +1050,8 @@ int sftp_cmd_ls(struct sftp_command *cmd)
 
     if (dirh == NULL) {
 	printf("Unable to open %s: %s\n", dir, fxp_error());
+	sfree(cdir);
+	sfree(unwcdir);
 	return 0;
     } else {
 	nnames = namesize = 0;