Fixed #8154 (heap use after free in tokenlist)

lib/token.cpp

@@ -190,6 +190,11 @@ void Token::deleteNext(unsigned long index)
 {
     while (_next && index) {
         Token *n = _next;
+
+        // #8154 we are about to be unknown -> destroy the link to us
+        if (n->_link && n->_link->_link == n)
+            n->_link->link(nullptr);
+
         _next = n->next();
         delete n;
         --index;
@@ -254,6 +259,8 @@ void Token::deleteThis()
         if (_link)
             _link->link(this);
 
+        _next->link(nullptr); // mark as unlinked
+
         deleteNext();
     } else if (_previous && _previous->_previous) { // Copy previous to this and delete previous
         _str = _previous->_str;

test/testgarbage.cpp

@@ -310,7 +310,7 @@ private:
         } catch (InternalError& e) {
             ASSERT_EQUALS("Analysis failed. If the code is valid then please report this failure.", e.errorMessage);
             ASSERT_EQUALS("cppcheckError", e.id);
-            ASSERT_EQUALS(5, e.token->linenr());
+            ASSERT_EQUALS(4, e.token->linenr());
         }
     }