<div dir="ltr"><div class="gmail_extra">Sorry a bit short on time, thus brief :-(<br><br></div><div class="gmail_extra"><div class="gmail_quote">On Mon, Jul 15, 2013 at 5:07 PM, Champ Clark III <span dir="ltr"><<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
</div>Similar to how I was properly cleaning up when dealing with the<br>
"propName", I tried similar trick. However, it didn't work out.<br>
<br>
<br>
==16533== 892,776 bytes in 8,963 blocks are definitely lost in loss<br>
record 53 of 55<br>
==16533== at 0x4C2B6CD: malloc (in<br>
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>
==16533== by 0x5457CD9: es_newStr (string.c:105)<br>
==16533== by 0x5457D0E: es_newStrFromCStr (string.c:125)<br>
==16533== by 0x40C2DA: sagan_normalize_liblognorm<br>
(sagan-liblognorm.c:104)<br>
==16533== by 0x41466F: Sagan_Blacklist (sagan-blacklist.c:167)<br>
==16533== by 0x40BD37: Sagan_Processor (sagan-processor.c:123)<br>
==16533== by 0x595EE99: start_thread (pthread_create.c:308)<br>
<br>
<br>
This is the line:<br>
<br>
str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg ));<br>
<br>
Which I clear once near the end:<br>
<br>
es_deleteStr(str);<br>
<br>
I've cleaned up/sync'ed up the code here:<br>
<br>
<a href="https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c" target="_blank">https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c</a><br>
<br>
Should I be cleaning it up after every usage (for example, after "str<br>
= ee_getFieldValueAsStr(field, 0);"<br>
<br></blockquote><div><br></div><div>well, es_newStr() is like malloc.<br></div><div>so<br><br></div><div>char *s;<br></div><div>s=malloc();<br></div><div>s=malloc();<br>free(s);<br><br>creates a leak. You must free the str object before the ptr is overwritten.<br>
<br></div><div>Does that help?<br><br>Rainer <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm confused. Thanks again!<br>
<div class="im"><br>
<br>
- --<br>
- - Champ Clark III (<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>)<br>
Quadrant Information Security (<a href="http://quadrantsec.com" target="_blank">http://quadrantsec.com</a>)<br>
Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A<br>
GPG Key ID: 0381878A<br>
<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)<br>
Comment: GPGTools - <a href="http://gpgtools.org" target="_blank">http://gpgtools.org</a><br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
</div>iQEcBAEBAgAGBQJR5BA4AAoJENnmXt7Lmc3K86AH+wbIoTlstbI4C/R7ahTkeVtx<br>
OG37KOsze7tZNfjbBkL47vP+tWGF6goF9I7Dj+eTuzDlfAnLcSxKkmSA7P+xqbjD<br>
pAYrsiU9+ViJK3A2iZhjesK4DUfCKIojNTGTa2O++nyl3hv1Tq3fXpLCDdxeJDoq<br>
F7dphDxRsQxXpfJu7oiapC4JKHNhN3chFpJtbFwBurwDNruNHqBHBinLXNngzmQR<br>
nzmE7eZAoLJXSw+D89OiFydZRZs48DSV4if1EyZBYe/X6Y8PjFht2v+XCjiUYOIQ<br>
J3T+rKtEyau9dPoua4iGm/wK01z/IJAsUcVszR1zeWo6T8HYtZDc27HQUC2nvh0=<br>
=40DE<br>
<div class="HOEnZb"><div class="h5">-----END PGP SIGNATURE-----<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</div></div></blockquote></div><br></div></div>