evaluate: use-after-free in meter

evaluate: use-after-free in meter

Similar to bbe139fdf5a5 ("evaluate: use-after-free in implicit set").

==12727== Invalid read of size 4
==12727==    at 0x72DB515: expr_free (expression.c:86)
==12727==    by 0x72D3092: set_free (rule.c:367)
==12727==    by 0x72DB555: expr_destroy (expression.c:79)
==12727==    by 0x72DB555: expr_free (expression.c:95)
==12727==    by 0x72D7A35: meter_stmt_destroy (statement.c:137)
==12727==    by 0x72D7A07: stmt_free (statement.c:50)
==12727==    by 0x72D7AD7: stmt_list_free (statement.c:60)
==12727==    by 0x72D32EF: rule_free (rule.c:610)
==12727==    by 0x72D3834: chain_free (rule.c:827)
==12727==    by 0x72D45D4: table_free (rule.c:1184)
==12727==    by 0x72D46A7: __cache_flush (rule.c:293)
==12727==    by 0x72D472C: cache_release (rule.c:313)
==12727==    by 0x72D4A79: cache_update (rule.c:264)
==12727==  Address 0x64f14c8 is 56 bytes inside a block of size 128 free'd
==12727==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==12727==    by 0x72D7A2C: meter_stmt_destroy (statement.c:136)
==12727==    by 0x72D7A07: stmt_free (statement.c:50)
==12727==    by 0x72D7AD7: stmt_list_free (statement.c:60)
==12727==    by 0x72D32EF: rule_free (rule.c:610)
==12727==    by 0x72D3834: chain_free (rule.c:827)
==12727==    by 0x72D45D4: table_free (rule.c:1184)
==12727==    by 0x72D46A7: __cache_flush (rule.c:293)
==12727==    by 0x72D472C: cache_release (rule.c:313)
==12727==    by 0x72D4A79: cache_update (rule.c:264)
==12727==    by 0x72F82CE: nft_evaluate (libnftables.c:388)
==12727==    by 0x72F8A8B: nft_run_cmd_from_buffer (libnftables.c:428)

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>