<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 15, 2013 at 11:19 PM, Champ Clark III <span dir="ltr"><<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><div class="im">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br></div>
So _far_ that seems to have done the trick. I'm still testing, so
I don't want to get to far out and jinx it :)<br>
<br></div></blockquote><div><br></div><div>believe me, that's the fix ;)<br><br></div><div>The core problem is probably that the API doc for that set of functions is virtually non-existent. I reviewed the situation and that part of the lib was written when CEE began to change object model and consequently the API would have been needed to change. That was when I stopped working on that part looking for what would come up. As we all now know, actually nothing came up later on and so we sticked with the state we currently have. :-( I spoke about changing the API to be more JSONish a couple of month ago. I should really do that and remove the CEE dependencies.<br>
<br>Anyhow, on the solution:<br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF">
I'm a bit confused, because now I have two es_deleteStr(str). My
thought was that it would be similar to a double free,<br>
but it's obviously not. That is, I added the es_deleteStr(str) at
line 109, but the one at 188 is still there as well!<br>
<br></div></blockquote><div><br></div><div>The key point to understand is that ee_fmtEventToRFC5424 returns a *new* estr into the result pointer you provide (str in your case). Have a look here, and carefully look at line 156, where it is created:<br>
<br><a href="http://git.adiscon.com/?p=libee.git;a=blob;f=src/syslog_enc.c;h=d559521581242ec73a5687aae1de83ba4f2fbbe3;hb=HEAD#l150">http://git.adiscon.com/?p=libee.git;a=blob;f=src/syslog_enc.c;h=d559521581242ec73a5687aae1de83ba4f2fbbe3;hb=HEAD#l150</a><br>
<br></div><div>So while you have just one variable, this one variable points to different objects at different points in time. So when you assign a new object to it (like you do with ee_fmtEventToRFC5424), you need to free the previous object, as you otherwise can never do that.<br>
<br>Coming back to my malloc example, this is absolutely equivalent to this code sequence:<br><br></div><div>char *str;<br></div><div>str = malloc(100);<br></div><div>str = strdup("a");<br>str = strdup("b");<br>
free(str);<br><br></div><div>This sequence will leak 102+ bytes of memory on each iteration: one for the 100-byte malloc block, one for the two byte string "a" (and the + is for the malloc memory block headers, so it will definitely leak more than 102 bytes). Correctly, this is done as follows:<br>
<br><div>char *str;<br></div><div>str = malloc(100);<br></div>free(str);<br>str = strdup("a");<br>free(str);<br>str = strdup("b");<br>free(str);<br><br></div><div>Here, you also supply the same variable to free, but each time it points to a different memory block. So no double-free.<br>
<br>It's exactly the same with libee functions that return strings (they do return new strings because the idea is that the caller would store and use them for further processing - I agree that's questionable).<br>
<br></div><div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF">
I've pulled back in the rest of the code that I had commented out
and I'm going to let it run a good bit longer on this<br>
busy box.<br>
<br></div></blockquote><div><br></div><div>You must make sure that you consistently free the pervious object if you re-use a variable to point to a new object (or alternatively have a single variable for each object - one that is not being reused).<br>
<br>As a side-note: things like the almost constant property name I tend to store in global variables and only create once and use the same set of variables all the time without re-creating them. Depending on what you do, this can make some performace diffrence. <br>
<br></div><div>I hope this clarifies now. Let me know any questions you may still have.<br><br>Rainer<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
Will let you know the results.<div class="im"><br>
<br>
<br>
<br>
On 07/15/2013 04:23 PM, Rainer Gerhards wrote:<br>
</div><span style="white-space:pre-wrap"><div class="im">><br>
> Ln 109 add es_deleteStr<br>
><br>
> Sent from phone, thus brief.<br>
><br></div>
> Am 15.07.2013 22:19 schrieb "Champ Clark III"
<<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>
<a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>>:<br>
></span><div class="im"><br>
=<br>
- -- <br>
- - Quadrant Information Security<br>
Champ Clark III<br>
o: 800.538.9357 x 101<br>
c: 850.443.2440<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br></div>
iQEcBAEBAgAGBQJR5GdgAAoJENnmXt7Lmc3KuHYH/1Y7vtf3aQjRBqsRBp4k5o8O<br>
6hB1/8IYr6246CmLWKXWnpewHk0v2CezXdbzPZdETLTHULq1wtBZBFcgU674pgOP<br>
tZ2t1tDL6PexCn3c0nNsBmEZoP2WAu79XqP2OzgeujlLLC+/YCVbz/jG6JPvg6tC<br>
DURyTq8gNcs4OvNMzEtlkLeTK/k9J9fkCxg7La/rzcmUwZkRxDvpGcKY+ur0R5Zq<br>
4xlMcf1gv51K3pS4OypbWZP5NfqFnZzCn4ePr3GVAhlmhUF6uhDn9Hc/vUzekUUh<br>
X1CBURCGPbBJ0chAkJ4n4D16IyZhqS48ogxrgpKasKKgJAy58d7WS+Oz4Wr66l4=<br>
=P6dm<br>
-----END PGP SIGNATURE-----<br>
<br>
</div>
<br>_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
<br></blockquote></div><br></div></div>