[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

On Sun, Jul 14, 2013 at 1:38 AM, Champ Clark III <cclark at quadrantsec.com>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> I was with my family going to the beach when I blasted out that
> valgrind output.  That's what I meant by not getting a change to look.
>
>
No problem at all, I guess we have similiar constraints.


> I've had a short time to look now,  but man... I'm not seeing it...
> Later tonight I'm going to clean this up a little bit and see if it
> become more clear.
>
>
Well, it may take a short while to get used to reading the output. Take
this here for example:

==8756== 835,776 bytes in 52,236 blocks are definitely lost in loss record
56 of 60
so we lot 52,236 "object", alltogehter 835,776 bytes; now comes the
stacktrace where they were allocated

==8756==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==8756==    by 0x5457CD9: es_newStr (string.c:105)
so its about estr

==8756==    by 0x5457D5E: es_newStrFromBuf (string.c:139)
==8756==    by 0x40C35C: sagan_normalize_liblognorm (sagan-liblognorm.c:131)
This is where your code called it (sagan-liblognorm.c, line 131)

==8756==    by 0x41464F: Sagan_Blacklist (sagan-blacklist.c:167)
==8756==    by 0x40BD37: Sagan_Processor (sagan-processor.c:123)
==8756==    by 0x595EE99: start_thread (pthread_create.c:308



> I do use es_deleteStr() to clean that up,  correct?  Because I don't
> see where I'm not.
>
>
yup - you should now check the code what happens to that object that was
allocated in line 131.


> I appreciate the time Rainer.  I'll look a bit more later and see if I
> can't locate it.
>
>
side-note: there are many off-by-one errors mentioned in the valgrind log.
I highly suggest to work through them, as they may lead to "interesting"
effects. rsyslog stability greatly improved when I made sure there are no
valgrind exception and I highly recommend doing that.

Rainer

>
>
> On 7/13/13 5:35 PM, Rainer Gerhards wrote:
> > Das
> >
> > Sent from phone, thus brief. Am 13.07.2013 23:33 schrieb "Champ
> > Clark III" <cclark at quadrantsec.com
> > <mailto:cclark at quadrantsec.com>>:
> >>
> >> Just fyi... I havent even looked at the yet myself.
> >
> > You should ; ) it tells you precisely where the leak is. Its at
> > least one estr that's not destructed.  I can't get more in depth on
> > the phone.  Just look at the stack trace :)
> >
> > I have another run going with no error limit btw.
> >>
> >> Champ Clark III <cclark at quadrantsec.com
> > <mailto:cclark at quadrantsec.com>> wrote:
> >>>
> > Okay - this is from a short (45 minute) run..
> >
> > I'll send another in a bit...
> >
> > tell me if it sheds any light.
> >
> >
> > On 7/13/13 2:13 PM, Rainer Gerhards wrote:
> >>>>>
> >>>>> Sounds good. I am interested in the memleak stats that are
> >>>>> printed out at termination.
> >>>>>
> >>>>> Sent from phone, thus brief.
> >>>>>
> >>>>> Am 13.07.2013 19:12 schrieb "Champ Clark III"
> >>>>> <cclark at quadrantsec.com <mailto:cclark at quadrantsec.com>
> >> <mailto:cclark at quadrantsec.com
> >> <mailto:cclark at quadrantsec.com>>>:
> >>>>>
> >>>>> Hello Rainer,
> >>>>>
> >>>>> I got my Ubuntu test env up and configured.  I'm letting it
> >>>>> run for a good bit,  because it seems the leak doesn't
> >>>>> always immediately show up.   I'm running valgrind with the
> >>>>> following options:
> >>>>>
> >>>>> valgrind --tool=memcheck --leak-check=yes
> >>>>>
> >>>>> and
> >>>>>
> >>>>> valgrind --tool=memcheck --leak-check=full
> >>>>> --show-reachable=yes --error-limit=no
> >>>>>
> >>>>> Any other flags you want/need?
> >>>>>
> >>>>>
> >>>>> ________________________________ Lognorm mailing list
> >>>>> Lognorm at lists.adiscon.com
> >>>>> <mailto:Lognorm at lists.adiscon.com>
> >> <mailto:Lognorm at lists.adiscon.com
> >> <mailto:Lognorm at lists.adiscon.com>>
> >>>>> http://lists.adiscon.net/mailman/listinfo/lognorm
> >>>>>
> >>>>>
> >>>>>
> >>>>> ________________________________ Lognorm mailing list
> >>>>> Lognorm at lists.adiscon.com
> >>>>> <mailto:Lognorm at lists.adiscon.com>
> >>>>> http://lists.adiscon.net/mailman/listinfo/lognorm
> >
> >
> >
> >>>
> >>> ________________________________
> >>>
> >>> Lognorm mailing list Lognorm at lists.adiscon.com
> >>> <mailto:Lognorm at lists.adiscon.com>
> >>> http://lists.adiscon.net/mailman/listinfo/lognorm
> >>
> >>
> >> -- Quadrant Information Security Champ Clark III o: 904.296.9100
> >> x 101 c: 850.443.2440
> >>
> >> _______________________________________________ Lognorm mailing
> >> list Lognorm at lists.adiscon.com
> >> <mailto:Lognorm at lists.adiscon.com>
> >> http://lists.adiscon.net/mailman/listinfo/lognorm
> >>
> >
> >
> >
> > _______________________________________________ Lognorm mailing
> > list Lognorm at lists.adiscon.com
> > http://lists.adiscon.net/mailman/listinfo/lognorm
> >
>
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR4eUIAAoJENnmXt7Lmc3KEvUH/3GySdbJ0tvz4fEdK7lizUCS
> eyC20YUaPYMvdt7vJe5unpRAGzrczi1GyDgWMoxgKhjX71xuQnqEi8KWXxcx3Boj
> Cz8xjmPJUv0IcQWvzqVxw3H2qA0BNwGnyTD6OY5BIRE9RYR0N58iniULdEAU0zQT
> T2hhBq30/xKCWhQ54CDmmBpg4gwVHAfJtskNGa43H119jEOt0gisJ8IUT6QkkKQR
> jdl5CLgUaIoGW76oN8I86j4toditngHuviDD9nM8MIh0S+s5bFnCAM5lWlQYfo7t
> 70nSlAD1/bvdCfOfe1OwNMuoTDWFQOSbAHjITo2NuTJT8ggzVpqTf32z/oqTZKA=
> =+VQJ
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130714/e11193c2/attachment-0001.htm>