Memory corruption via dangling chain pointer

Use-after-free in buffer.c in Libevent before 2.1.13 and 2.2.2-alpha allows local users to corrupt memory or crash a process via crafted buffer operations. In evbuffer_add_buffer_reference, an empty output buffer is freed through evbuffer_free_all_chains, but outbuf->first, outbuf->last, and outbuf->last_with_datap are left pointing to freed memory before APPEND_CHAIN_MULTICAST reuses them. Exploitation requires control over a caller that can place the output buffer in the zero-length state and then append a referenced buffer, so exposure depends on application reachability to that API path.