virsh: Fix segfault of snapshot-list

'snaps' is used after free()'ed.
(cherry picked from commit e0ad4669)

tools/virsh-snapshot.c

@@ -866,7 +866,7 @@ vshSnapshotListCollect(vshControl *ctl, virDomainPtr dom,
                     goto cleanup;
             }
             if (from) {
-                snaps[snaplist->nsnaps++] = from;
+                snaplist->snaps[snaplist->nsnaps++].snap = from;
                 virDomainSnapshotRef(from);
             }
         }