the data being used is released in method nsec3_hash_test_entry

**Describe the bug**
In nsec3_hash_test_entry, the nsec3 variable is allocated through alloc and released through reply_info_parsedelete before the method returns. However, it will be inserted into the rbtree in the nsec3_hash_name method, causing the freed memory to be used in nsec3_hash_cmp later.

https://github.com/NLnetLabs/unbound/blob/733d5f7161c5675e66e39974b912a08eeb48140c/testcode/unitverify.c#L421-L461

**To reproduce**
Steps to reproduce the behavior:
1. Execute unittest command

**Expected behavior**
A clear and concise description of what you expected to happen.

**System:**
 - Unbound version: 1.17.1
 - OS:
 - `unbound -V` 
```shell
output: Version 1.17.1
Configure line: LIBS=-ljemalloc --enable-subnet --with-libevent --with-pthreads --with-ssl
Linked libs: libevent 2.1.8-stable (it uses epoll), OpenSSL 1.1.1k  FIPS 25 Mar 2021
Linked modules: dns64 subnetcache respip validator iterator
```

**Additional information**
Add any other information that you may have gathered about the issue here.

	static void
	nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
	struct alloc_cache* alloc, struct regional* region,
	sldns_buffer* buf)
	{
	struct query_info qinfo;
	struct reply_info* rep = NULL;
	struct ub_packed_rrset_key* answer, *nsec3;
	struct nsec3_cached_hash* hash = NULL;
	int ret;
	uint8_t* qname;

	if(vsig) {
	char* s = sldns_wire2str_pkt(e->reply_list->reply_pkt,
	e->reply_list->reply_len);
	printf("verifying NSEC3 hash:\n%s\n", s?s:"outofmemory");
	free(s);
	}
	entry_to_repinfo(e, alloc, region, buf, &qinfo, &rep);
	nsec3 = find_rrset_type(rep, LDNS_RR_TYPE_NSEC3);
	answer = find_rrset_type(rep, LDNS_RR_TYPE_AAAA);
	qname = regional_alloc_init(region, qinfo.qname, qinfo.qname_len);
	/* check test is OK */
	unit_assert(nsec3 && answer && qname);

	ret = nsec3_hash_name(ct, region, buf, nsec3, 0, qname,
	qinfo.qname_len, &hash);
	if(ret < 1) {
	printf("Bad nsec3_hash_name retcode %d\n", ret);
	unit_assert(ret == 1 \|\| ret == 2);
	}
	unit_assert(hash->dname && hash->hash && hash->hash_len &&
	hash->b32 && hash->b32_len);
	unit_assert(hash->b32_len == (size_t)answer->rk.dname[0]);
	/* does not do lowercasing. */
	unit_assert(memcmp(hash->b32, answer->rk.dname+1, hash->b32_len)
	== 0);

	reply_info_parsedelete(rep, alloc);
	query_info_clear(&qinfo);
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

the data being used is released in method nsec3_hash_test_entry #1183

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

the data being used is released in method nsec3_hash_test_entry #1183

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions