receive-pack: plug memory leak in update()