[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

any chance to get a valgrind log? That would be immensely helpful, as it
usually points out where memory was allocted...


On Sat, Jul 13, 2013 at 1:39 PM, Champ Clark III <cclark at quadrantsec.com>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Thank you John,
>
> I've added a es_deleteStr(str) and freed just about all I can think of
> and I'm seeing the same results.  Just to be on the safe side,  I ran
> two versions of Sagan last night.  One using liblognorm and the other
> without.  I let these run for about 8 hours.
>
> In the end,  the one without liblognorm used about 2.5 meg of RAM.
> The one with liblognorm eventually crept up to 128 meg of RAM (and
> still climbing).
>
> Like last time,  I pushed the code up to github
> (https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c).
> You where right about the es_deleteStr,  but it's still slowly
> leaking.  Essentially, this is what I did:
>
> free(cstr);
> free(field);
> es_deleteStr(str);
> es_deleteStr(propName);         /* Just to be safe? */
> ee_deleteEvent(lnevent);
>
>
> I should add that I'm using the liblognorm (and other require libs)
> from Rainer's git repo.
>
> I got my Ubuntu 12.04 box back up with the dev tools and valgrind last
> night,  but haven't had a chance to move over Sagan and test yet.   I
> hope to be able to do that today.
>
> I feel that I'm not handling something correctly,  so if you spot it
> let me know!  I really appreciate it.
>
>
>
>
>
> On 7/12/13 4:27 PM, John Hopper wrote:
> > Heya!
> >
> > I noticed in your code that you're calling the estr and ee library
> > to create events and strings but I don't see any calls to the
> > delete functions for either.
> >
> > As far as I know, every time you create a new estr, it copies the
> > content into a new buffer which will need to be freed. The same
> > applies for the events created - these will also need to be freed.
> >
> > -John
> >
>
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR4TxUAAoJENnmXt7Lmc3KnuEH/0JzCAiG9oMdtzp7KMejAkJh
> FbtJBVCq+vIHSs9LMmJPTgRkekZBG+DhobMp9sHDvr01Hh8fAFbKvuQAS0Qu5T8t
> ukxfoF2Ia0C9VPJttiZrMEtKpkAk9vRNpYGad9DdJWrrfh4VcX9zwXp2x32CBJlC
> ehXyjE4UqN8SfHtBY1XP1WR3YqitplN9HjR7FW48rxHcraNleFtn442mH/2cXJZ1
> +IllY7MoJf/VdoXWKCZzQhEQjdNek4bTxt0K9cdDg/TwD4yucm9XMO+lw1pSluBX
> 4Vkh1XCFlQsgWsG5Vf5pQPJdTx0qfOj3mRspz2v/UocnM0iv9aAA5iNEkn5Ouu4=
> =qMCp
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130713/b4e81365/attachment.htm>