### Describe the issue

### Can you reliably reproduce the issue?
#### If so, please list the steps to reproduce below:
```c
CScript cs;
cs << ParseHex("04678afdb0fe5548271967f1a67130b7105cd6a828e03909a67962e0ea1f61deb649f6bc3f4cef38c4f35504e51ec112de5c384df7ba0b8d578a4c702b6bf11d5f")
<< OP_CHECKSIG;
cs += cs;
```

### Expected behaviour
Safe behaviour: no double free.

### Actual behaviour
Insecure behaviour: double-free.

### Screenshots.

### What version of bitcoin-core are you using?
bitcoin-0.14.2, self-compiled

### Machine specs:
- OS: Linux
- CPU:
- RAM:
- Disk size:
- Disk Type (HD/SDD):

### Any extra information that might be useful in the debugging process.
AddressSanitizer backtrace:

```
=================================================================
==3429==ERROR: AddressSanitizer: heap-use-after-free on address
0x60b000000040 at pc 0x0000004f919c bp 0x7ffe66520c30 sp
0x7ffe66520c28
READ of size 1 at 0x60b000000040 thread T0
    #0 0x4f919b in void prevector<28u, unsigned char, unsigned int,
int>::insert<prevector<28u, unsigned char, unsigned int,
int>::const_iterator>(prevector<28u, unsigned char, unsigned int,
int>::iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:378:52
    #1 0x4f919b in CScript::operator+=(CScript const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:403
    #2 0x4f919b in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:11
    #3 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
    #4 0x420d1f in _start
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x420d1f)

0x60b000000040 is located 0 bytes inside of 99-byte region
[0x60b000000040,0x60b0000000a3)
freed by thread T0 here:
    #0 0x4c9015 in realloc
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x4c9015)
    #1 0x4fe2b9 in prevector<28u, unsigned char, unsigned int,
int>::change_capacity(unsigned int)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:177:54
    #2 0x4f8a54 in void prevector<28u, unsigned char, unsigned int,
int>::insert<prevector<28u, unsigned char, unsigned int,
int>::const_iterator>(prevector<28u, unsigned char, unsigned int,
int>::iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator, prevector<28u, unsigned char, unsigned int,
int>::const_iterator)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:373:13
    #3 0x4f8a54 in CScript::operator+=(CScript const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:403
    #4 0x4f8a54 in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:11
    #5 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287

previously allocated by thread T0 here:
    #0 0x4c8c73 in __interceptor_malloc
(/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/a.out+0x4c8c73)
    #1 0x4fe0f1 in prevector<28u, unsigned char, unsigned int,
int>::change_capacity(unsigned int)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:181:57
    #2 0x4fb16c in void prevector<28u, unsigned char, unsigned int,
int>::insert<__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >
>(prevector<28u, unsigned char, unsigned int, int>::iterator,
__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >,
__gnu_cxx::__normal_iterator<unsigned char const*,
std::vector<unsigned char, std::allocator<unsigned char> > >)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/prevector.h:373:13
    #3 0x4fb16c in CScript::operator<<(std::vector<unsigned char,
std::allocator<unsigned char> > const&)
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/../src/script/script.h:462
    #4 0x4f8503 in main
/home/jhg/extrahd/bitcoin-fuzzer/bitcoin-0.14.2/fuzz-pr/cscript-test.cpp:10:8
    #5 0x7f3667db3b44 in __libc_start_main
/build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
```
{SCRIPT_ERR_CHECKSIGVERIFY, "CHECKSIGVERIFY"},
    {SCRIPT_ERR_NUMEQUALVERIFY, "NUMEQUALVERIFY"},
    {SCRIPT_ERR_BAD_OPCODE, "BAD_OPCODE"},
    {SCRIPT_ERR_DISABLED_OPCODE, "DISABLED_OPCODE"},
    {SCRIPT_ERR_INVALID_STACK_OPERATION, "INVALID_STACK_OPERATION"},
    {SCRIPT_ERR_INVALID_ALTSTACK_OPERATION, "INVALID_ALTSTACK_OPERATION"},
    {SCRIPT_ERR_UNBALANCED_CONDITIONAL, "UNBALANCED_CONDITIONAL"},
    {SCRIPT_ERR_NEGATIVE_LOCKTIME, "NEGATIVE_LOCKTIME"},
    {SCRIPT_ERR_UNSATISFIED_LOCKTIME, "UNSATISFIED_LOCKTIME"},
    {SCRIPT_ERR_SIG_HASHTYPE, "SIG_HASHTYPE"},
    {SCRIPT_ERR_SIG_DER, "SIG_DER"},
    {SCRIPT_ERR_MINIMALDATA, "MINIMALDATA"},
    {SCRIPT_ERR_SIG_PUSHONLY, "SIG_PUSHONLY"},
    {SCRIPT_ERR_SIG_HIGH_S, "SIG_HIGH_S"},
    {SCRIPT_ERR_SIG_NULLDUMMY, "SIG_NULLDUMMY"},
    {SCRIPT_ERR_PUBKEYTYPE, "PUBKEYTYPE"},
    {SCRIPT_ERR_CLEANSTACK, "CLEANSTACK"},
    {SCRIPT_ERR_MINIMALIF, "MINIMALIF"},
    {SCRIPT_ERR_SIG_NULLFAIL, "NULLFAIL"},
    {SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS, "DISCOURAGE_UPGRADABLE_NOPS"},
    {SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM, "DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM"},
    {SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH, "WITNESS_PROGRAM_WRONG_LENGTH"},
    {SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY, "WITNESS_PROGRAM_WITNESS_EMPTY"},
    {SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH, "WITNESS_PROGRAM_MISMATCH"},
    {SCRIPT_ERR_WITNESS_MALLEATED, "WITNESS_MALLEATED"},
    {SCRIPT_ERR_WITNESS_MALLEATED_P2SH, "WITNESS_MALLEATED_P2SH"},
    {SCRIPT_ERR_WITNESS_UNEXPECTED, "WITNESS_UNEXPECTED"},
    {SCRIPT_ERR_WITNESS_PUBKEYTYPE, "WITNESS_PUBKEYTYPE"},
};
const char *FormatScriptError(ScriptError_t err)