Fix access-after-free with statement expressions

The return value of statement expressions might refer to local
symbols, so those can't be popped.  The old error message always
was just a band-aid, and since disabling it for pointer types it
wasn't effective anyway.  It also never considered that also the
vtop->sym member might have referred to such symbols (see the
testcase with the local static, that used to segfault).

For fixing this (can be seen better with valgrind and SYM_DEBUG)
simply leave local symbols of stmt exprs on the stack.

1 files changed, 2 insertions, 2 deletions

diff --git a/libtcc.c b/libtcc.c
index dac4bb9..1346fa6 100644
--- a/libtcc.c
+++ b/libtcc.c
@@ -677,8 +677,8 @@ static int tcc_compile(TCCState *s1)
     s1->error_set_jmp_enabled = 0;
 
     free_inline_functions(s1);
-    sym_pop(&global_stack, NULL);
-    sym_pop(&local_stack, NULL);
+    sym_pop(&global_stack, NULL, 0);
+    sym_pop(&local_stack, NULL, 0);
     return s1->nb_errors != 0 ? -1 : 0;
 }