Fix use-after-free if enum is used in multiple unions

Case label destructors deleted the const-expr as opposed to
unreferencing it causing a use-after-free if the same enum
was used in more than one union.

Fixes eclipse-cyclonedds#946.

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>

src/idl/src/tree.c

@@ -1877,7 +1877,7 @@ bool idl_is_case_label(const void *ptr)
 static void delete_case_label(void *ptr)
 {
   idl_case_label_t *node = ptr;
-  idl_delete_node(node->const_expr);
+  delete_const_expr(node, node->const_expr);
   free(node);
 }
 

src/idl/tests/union.c

@@ -576,3 +576,20 @@ CU_Test(idl_union, default_discriminator_enum)
   CU_ASSERT_PTR_NULL(pstate);
   idl_delete_pstate(pstate);
 }
+
+CU_Test(idl_union, two_unions_one_enum)
+{
+  idl_retcode_t ret;
+  idl_pstate_t *pstate = NULL;
+
+  const char str[] = "enum aap { noot, mies };\n"
+                     "union wim switch (aap) { case mies: double zus; };\n"
+                     "union jet switch (aap) { case noot: double zus; };";
+
+  ret = idl_create_pstate(0u, NULL, &pstate);
+  CU_ASSERT_EQUAL_FATAL(ret, IDL_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(pstate);
+  ret = idl_parse_string(pstate, str);
+  CU_ASSERT_EQUAL(ret, IDL_RETCODE_OK);
+  idl_delete_pstate(pstate);
+}