### Describe the issue

### Can you reliably reproduce the issue?
#### If so, please list the steps to reproduce below:
```c
CScript cs;
cs << ParseHex("04678afdb0fe5548271967f1a67130b7105cd6a828e03909a67962e0ea1f61deb649f6bc3f4cef38c4f35504e51ec112de5c384df7ba0b8d578a4c702b6bf11d5f")
<< OP_CHECKSIG;
cs += cs;
```

### Expected behaviour
Safe behaviour: no double free.

### Actual behaviour
Insecure behaviour: double-free.

### Screenshots.

### What version of bitcoin-core are you using?
bitcoin-0.14.2, self-compiled

### Machine specs:
- OS: Linux
- CPU:
- RAM:
- Disk size:
- Disk Type (HD/SDD):

### Any extra information that might be useful in the debugging process.
AddressSanitizer backtrace:

```
=================================================================
==3429==ERROR: AddressSanitizer: heap-use-after-free on address
0x60b000000040 at pc 0x0000004f919c bp 0x7ffe66520c30 sp
0x7ffe66520c28
READ of size 1 at 0x60b000000040 thread T0
    #0 0x4f919b in void prevector<28u, unsigned char, unsigned int,
int>::insert<prevector<28u, unsigned char, unsigned int,
int>::const_iterator>(prevector<28u, unsigned char, unsigned int,
int>::iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:378:52
    #1 0x4f919b in CScript::operator+=(CScript const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:403
    #2 0x4f919b in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:11
    #3 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
    #4 0x420d1f in _start
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x420d1f)

0x60b000000040 is located 0 bytes inside of 99-byte region
[0x60b000000040,0x60b0000000a3)
freed by thread T0 here:
    #0 0x4c9015 in realloc
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x4c9015)
    #1 0x4fe2b9 in prevector<28u, unsigned char, unsigned int,
int>::change_capacity(unsigned int)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:177:54
    #2 0x4f8a54 in void prevector<28u, unsigned char, unsigned int,
int>::insert<prevector<28u, unsigned char, unsigned int,
int>::const_iterator>(prevector<28u, unsigned char, unsigned int,
int>::iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:373:13
    #3 0x4f8a54 in CScript::operator+=(CScript const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:403
    #4 0x4f8a54 in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:11
    #5 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287

previously allocated by thread T0 here:
    #0 0x4c8c73 in __interceptor_malloc
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x4c8c73)
    #1 0x4fe0f1 in prevector<28u, unsigned char, unsigned int,
int>::change_capacity(unsigned int)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:181:57
    #2 0x4fb16c in void prevector<28u, unsigned char, unsigned int,
int>::insert<__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >
>(prevector<28u, unsigned char, unsigned int, int>::iterator,
__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >,
__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:373:13
    #3 0x4fb16c in CScript::operator<<(std::vector<unsigned char,
std::allocator<unsigned char> > const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:462
    #4 0x4f8503 in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:10:8
    #5 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
```
{
        if (b.size() < OP_PUSHDATA1)
        {
            insert(end(), (unsigned char)b.size());
        }
        else if (b.size() <= 0xff)
        {
            insert(end(), OP_PUSHDATA1);
            insert(end(), (unsigned char)b.size());
        }
        else if (b.size() <= 0xffff)
        {
            insert(end(), OP_PUSHDATA2);
            uint8_t _data[2];
            WriteLE16(_data, b.size());
            insert(end(), _data, _data + sizeof(_data));
        }
        else
        {
            insert(end(), OP_PUSHDATA4);
            uint8_t _data[4];
            WriteLE32(_data, b.size());
            insert(end(), _data, _data + sizeof(_data));
        }
        insert(end(), b.begin(), b.end());
        return *this;
    }
    CScript& operator<<(const CScript& b)