<p dir="ltr">The fmt function creates a new string: <br>
<a href="http://git.adiscon.com/?p=libee.git;a=blob;f=src/syslog_enc.c;h=d559521581242ec73a5687aae1de83ba4f2fbbe3;hb=HEAD#l150">http://git.adiscon.com/?p=libee.git;a=blob;f=src/syslog_enc.c;h=d559521581242ec73a5687aae1de83ba4f2fbbe3;hb=HEAD#l150</a></p>
<p dir="ltr">So i think i need to see the full test code.</p>
<p dir="ltr">Sent from phone, thus brief. </p>
<div class="gmail_quote">Am 15.07.2013 22:10 schrieb "Champ Clark III" <<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Not yet, but that can be arranged :)<br>
<br>
I literally just commented out all the 80% of it. I'll throw it up
and let you know.<br>
<br>
<br>
On 07/15/2013 04:06 PM, Rainer Gerhards wrote:<br>
<span style="white-space:pre-wrap">><br>
> I forgot: is your test code available online?<br>
><br>
> Sent from phone, thus brief.<br>
><br>
> Am 15.07.2013 22:02 schrieb "Champ Clark III"
<<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>
<a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>>:<br>
><br>
><br>
> Sorry, but same results :( I'm using the same test code
below but with es_emptyStr(str) replaced with es_deleteStr(str)<br>
><br>
><br>
><br>
> On 07/15/2013 03:46 PM, Rainer Gerhards wrote:<br>
><br>
> > Use es_deleteStr instead of es_emptyStr. The latter just
resets it but does not free. More explanations follow tomorrow.
Please report back.<br>
><br>
> > Sent from phone, thus brief.<br>
><br>
> > Am 15.07.2013 21:06 schrieb "Champ Clark III"
<<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a> <a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>
<a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>
<a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>>:<br>
><br>
><br>
><br>
> > Hello,<br>
><br>
> > So - I've stripped down the code a good bit to see if I
can't isolate<br>
> > where I'm going wrong. Below is what I got:<br>
><br>
> > --<snip>--<br>
> > str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));<br>
> > ln_normalize(ctx, str, &lnevent);<br>
><br>
> > if(lnevent != NULL) {<br>
> > es_emptyStr(str);<br>
> > ee_fmtEventToRFC5424(lnevent, &str);<br>
> > }<br>
><br>
> > free(cstr);<br>
> > es_deleteStr(str);<br>
> > ee_deleteEvent(lnevent);<br>
> > }<br>
> > --<snip>--<br>
><br>
> > It appears as soon as I add the "ee_fmtEventToRFC5424",
valgrind starts<br>
> > to report the following:<br>
><br>
> > ==21979== 69,872 bytes in 614 blocks are definitely lost
in loss record<br>
> > 52 of 54<br>
> > ==21979== at 0x4C2B6CD: malloc (in<br>
> > /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>
> > ==21979== by 0x5457CD9: es_newStr (string.c:105)<br>
> > ==21979== by 0x5457D0E: es_newStrFromCStr
(string.c:125)<br>
> > ==21979== by 0x40C167: sagan_normalize_liblognorm<br>
> > (sagan-liblognorm.c:103)<br>
> > ==21979== by 0x41427F: Sagan_Blacklist
(sagan-blacklist.c:167)<br>
> > ==21979== by 0x40BC07: Sagan_Processor
(sagan-processor.c:123)<br>
> > ==21979== by 0x595EE99: start_thread
(pthread_create.c:308)<br>
><br>
> > If I remove the line, that goes away. Any thoughts?<br>
><br>
> > Thanks for your time.<br>
><br>
><br>
> > _______________________________________________<br>
> > Lognorm mailing list<br>
> > <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a><br>
> > <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
> > _______________________________________________<br>
> > Lognorm mailing list<br>
> > <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a><br>
> > <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a><br>
> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a></span><br>
<br>
- -- <br>
- - Quadrant Information Security<br>
Champ Clark III<br>
o: 800.538.9357 x 101<br>
c: 850.443.2440<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
iQEcBAEBAgAGBQJR5FciAAoJENnmXt7Lmc3KVHAH/3+MA7bDO/ejGiOU/2WX24fl<br>
3IXnZh/hmBFknXsiXQwWVy4X1Un/tQUJqYHtQ/TE+r3A7pp16WmJRhz0CzW9ySME<br>
oJof02TXJZgiweFTOg3+JdK5JwWBdU7iPXzvCOB/IKbtsEladMcYCxYkPlaYWNA1<br>
iQ37ZcHaUBej1FvW+qkCl0EMtcUdfolhcK2+NJMtPBxrxwfRDRcBRXDXuz2SzizE<br>
EvJ1pMelkRRLhi5UIGONYQkFMF8FBGxb8tBp4iCLSRAzQHuoSuhpUHOhT6NzaVIg<br>
GtQFscsYBHFDhl52E6Y3Rdv6/FZ2/C0yjrlHbGWACJPtvWLk47jsDiQxNQHodIw=<br>
=+1FU<br>
-----END PGP SIGNATURE-----<br>
<br>
</div>
<br>_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
<br></blockquote></div>