preproc: fix memory leak in %[...] processing

"Why dup_tlist() here? We should own it."

Yes, we own it, but we still need to advance the tail pointer. Create
steal_tlist() for this purpose.

Fixes: https://bugzilla.nasm.us/show_bug.cgi?id=3392774
Reported-and-Debugged-by: C. Masloch <pushbx@ulukai.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

Author: H. Peter Anvin

asm/preproc.c

@@ -962,6 +962,21 @@ static Token *dup_tlist_reverse(const Token *list, Token *tail)
     return tail;
 }
 
+/*
+ * Append an existing tlist to a tail pointer and returns the
+ * updated tail pointer.
+ */
+static Token **steal_tlist(Token *tlist, Token **tailp)
+{
+    *tailp = tlist;
+
+    if (!tlist)
+        return tailp;
+
+    list_last(tlist, tlist);
+    return &tlist->next;
+}
+
 /*
  * Free an MMacro
  */
@@ -5517,8 +5532,7 @@ static Token *expand_mmac_params(Token * tline)
             tt = tokenize(tok_text(t));
             tt = expand_mmac_params(tt);
             tt = expand_smacro(tt);
-            /* Why dup_tlist() here? We should own tt... */
-            dup_tlist(tt, &tail);
+            tail = steal_tlist(tt, tail);
             text = NULL;
             change = true;
             break;