the data being used is released in method nsec3_hash_test_entry

[wenxuan70]

Describe the bug
In nsec3_hash_test_entry, the nsec3 variable is allocated through alloc and released through reply_info_parsedelete before the method returns. However, it will be inserted into the rbtree in the nsec3_hash_name method, causing the freed memory to be used in nsec3_hash_cmp later.

unbound/testcode/unitverify.c

Lines 421 to 461 in 733d5f7

	static void
	nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
	struct alloc_cache* alloc, struct regional* region,
	sldns_buffer* buf)
	{
	struct query_info qinfo;
	struct reply_info* rep = NULL;
	struct ub_packed_rrset_key* answer, *nsec3;
	struct nsec3_cached_hash* hash = NULL;
	int ret;
	uint8_t* qname;
	if(vsig) {
	char* s = sldns_wire2str_pkt(e->reply_list->reply_pkt,
	e->reply_list->reply_len);
	printf("verifying NSEC3 hash:\n%s\n", s?s:"outofmemory");
	free(s);
	}
	entry_to_repinfo(e, alloc, region, buf, &qinfo, &rep);
	nsec3 = find_rrset_type(rep, LDNS_RR_TYPE_NSEC3);
	answer = find_rrset_type(rep, LDNS_RR_TYPE_AAAA);
	qname = regional_alloc_init(region, qinfo.qname, qinfo.qname_len);
	/* check test is OK */
	unit_assert(nsec3 && answer && qname);
	ret = nsec3_hash_name(ct, region, buf, nsec3, 0, qname,
	qinfo.qname_len, &hash);
	if(ret < 1) {
	printf("Bad nsec3_hash_name retcode %d\n", ret);
	unit_assert(ret == 1 || ret == 2);
	}
	unit_assert(hash->dname && hash->hash && hash->hash_len &&
	hash->b32 && hash->b32_len);
	unit_assert(hash->b32_len == (size_t)answer->rk.dname[0]);
	/* does not do lowercasing. */
	unit_assert(memcmp(hash->b32, answer->rk.dname+1, hash->b32_len)
	== 0);
	reply_info_parsedelete(rep, alloc);
	query_info_clear(&qinfo);
	}

To reproduce
Steps to reproduce the behavior:

1. Execute unittest command

Expected behavior
A clear and concise description of what you expected to happen.

System:

• Unbound version: 1.17.1
• OS:
• unbound -V

output: Version 1.17.1
Configure line: LIBS=-ljemalloc --enable-subnet --with-libevent --with-pthreads --with-ssl
Linked libs: libevent 2.1.8-stable (it uses epoll), OpenSSL 1.1.1k  FIPS 25 Mar 2021
Linked modules: dns64 subnetcache respip validator iterator

Additional information
Add any other information that you may have gathered about the issue here.

[wcawijngaards]

The fix should keep the hash tree for the test file, and release the data when the test file is finished with the test. That should fix the deleted memory referenced by the tree. Thank you for reporting the release of data that is still in use.