[Lognorm] Memory Leak in liblognorm?

Rainer Gerhards rgerhards at hq.adiscon.com
Sun Jul 14 14:52:26 CEST 2013 

ah, now it is easy to see (for me ;)). Look at line 125+. You do repeatedly:

 propName = es_newStrFromBuf(...);

but you never delete propName before you assign a new value to it ;)

There may be other problems, I had just focussed on the first valgrind
report. Let me know if this get's you going.

Rainer




On Sun, Jul 14, 2013 at 2:48 PM, Rainer Gerhards
<rgerhards at hq.adiscon.com>wrote:

>
> On Sun, Jul 14, 2013 at 1:38 AM, Champ Clark III <cclark at quadrantsec.com>wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>>
>> I was with my family going to the beach when I blasted out that
>> valgrind output.  That's what I meant by not getting a change to look.
>>
>>
> No problem at all, I guess we have similiar constraints.
>
>
>> I've had a short time to look now,  but man... I'm not seeing it...
>> Later tonight I'm going to clean this up a little bit and see if it
>> become more clear.
>>
>>
> Well, it may take a short while to get used to reading the output. Take
> this here for example:
>
> ==8756== 835,776 bytes in 52,236 blocks are definitely lost in loss record
> 56 of 60
> so we lot 52,236 "object", alltogehter 835,776 bytes; now comes the
> stacktrace where they were allocated
>
> ==8756==    at 0x4C2B6CD: malloc (in
> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==8756==    by 0x5457CD9: es_newStr (string.c:105)
> so its about estr
>
> ==8756==    by 0x5457D5E: es_newStrFromBuf (string.c:139)
> ==8756==    by 0x40C35C: sagan_normalize_liblognorm
> (sagan-liblognorm.c:131)
> This is where your code called it (sagan-liblognorm.c, line 131)
>
> ==8756==    by 0x41464F: Sagan_Blacklist (sagan-blacklist.c:167)
> ==8756==    by 0x40BD37: Sagan_Processor (sagan-processor.c:123)
> ==8756==    by 0x595EE99: start_thread (pthread_create.c:308
>
>
>
>> I do use es_deleteStr() to clean that up,  correct?  Because I don't
>> see where I'm not.
>>
>>
> yup - you should now check the code what happens to that object that was
> allocated in line 131.
>
>
>> I appreciate the time Rainer.  I'll look a bit more later and see if I
>> can't locate it.
>>
>>
> side-note: there are many off-by-one errors mentioned in the valgrind log.
> I highly suggest to work through them, as they may lead to "interesting"
> effects. rsyslog stability greatly improved when I made sure there are no
> valgrind exception and I highly recommend doing that.
>
> Rainer
>
>>
>>
>> On 7/13/13 5:35 PM, Rainer Gerhards wrote:
>> > Das
>> >
>> > Sent from phone, thus brief. Am 13.07.2013 23:33 schrieb "Champ
>> > Clark III" <cclark at quadrantsec.com
>> > <mailto:cclark at quadrantsec.com>>:
>> >>
>> >> Just fyi... I havent even looked at the yet myself.
>> >
>> > You should ; ) it tells you precisely where the leak is. Its at
>> > least one estr that's not destructed.  I can't get more in depth on
>> > the phone.  Just look at the stack trace :)
>> >
>> > I have another run going with no error limit btw.
>> >>
>> >> Champ Clark III <cclark at quadrantsec.com
>> > <mailto:cclark at quadrantsec.com>> wrote:
>> >>>
>> > Okay - this is from a short (45 minute) run..
>> >
>> > I'll send another in a bit...
>> >
>> > tell me if it sheds any light.
>> >
>> >
>> > On 7/13/13 2:13 PM, Rainer Gerhards wrote:
>> >>>>>
>> >>>>> Sounds good. I am interested in the memleak stats that are
>> >>>>> printed out at termination.
>> >>>>>
>> >>>>> Sent from phone, thus brief.
>> >>>>>
>> >>>>> Am 13.07.2013 19:12 schrieb "Champ Clark III"
>> >>>>> <cclark at quadrantsec.com <mailto:cclark at quadrantsec.com>
>> >> <mailto:cclark at quadrantsec.com
>> >> <mailto:cclark at quadrantsec.com>>>:
>> >>>>>
>> >>>>> Hello Rainer,
>> >>>>>
>> >>>>> I got my Ubuntu test env up and configured.  I'm letting it
>> >>>>> run for a good bit,  because it seems the leak doesn't
>> >>>>> always immediately show up.   I'm running valgrind with the
>> >>>>> following options:
>> >>>>>
>> >>>>> valgrind --tool=memcheck --leak-check=yes
>> >>>>>
>> >>>>> and
>> >>>>>
>> >>>>> valgrind --tool=memcheck --leak-check=full
>> >>>>> --show-reachable=yes --error-limit=no
>> >>>>>
>> >>>>> Any other flags you want/need?
>> >>>>>
>> >>>>>
>> >>>>> ________________________________ Lognorm mailing list
>> >>>>> Lognorm at lists.adiscon.com
>> >>>>> <mailto:Lognorm at lists.adiscon.com>
>> >> <mailto:Lognorm at lists.adiscon.com
>> >> <mailto:Lognorm at lists.adiscon.com>>
>> >>>>> http://lists.adiscon.net/mailman/listinfo/lognorm
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>> ________________________________ Lognorm mailing list
>> >>>>> Lognorm at lists.adiscon.com
>> >>>>> <mailto:Lognorm at lists.adiscon.com>
>> >>>>> http://lists.adiscon.net/mailman/listinfo/lognorm
>> >
>> >
>> >
>> >>>
>> >>> ________________________________
>> >>>
>> >>> Lognorm mailing list Lognorm at lists.adiscon.com
>> >>> <mailto:Lognorm at lists.adiscon.com>
>> >>> http://lists.adiscon.net/mailman/listinfo/lognorm
>> >>
>> >>
>> >> -- Quadrant Information Security Champ Clark III o: 904.296.9100
>> >> x 101 c: 850.443.2440
>> >>
>> >> _______________________________________________ Lognorm mailing
>> >> list Lognorm at lists.adiscon.com
>> >> <mailto:Lognorm at lists.adiscon.com>
>> >> http://lists.adiscon.net/mailman/listinfo/lognorm
>> >>
>> >
>> >
>> >
>> > _______________________________________________ Lognorm mailing
>> > list Lognorm at lists.adiscon.com
>> > http://lists.adiscon.net/mailman/listinfo/lognorm
>> >
>>
>> - --
>> - - Champ Clark III (cclark at quadrantsec.com)
>>   Quadrant Information Security (http://quadrantsec.com)
>>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>>   GPG Key ID: 0381878A
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
>> Comment: GPGTools - http://gpgtools.org
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iQEcBAEBAgAGBQJR4eUIAAoJENnmXt7Lmc3KEvUH/3GySdbJ0tvz4fEdK7lizUCS
>> eyC20YUaPYMvdt7vJe5unpRAGzrczi1GyDgWMoxgKhjX71xuQnqEi8KWXxcx3Boj
>> Cz8xjmPJUv0IcQWvzqVxw3H2qA0BNwGnyTD6OY5BIRE9RYR0N58iniULdEAU0zQT
>> T2hhBq30/xKCWhQ54CDmmBpg4gwVHAfJtskNGa43H119jEOt0gisJ8IUT6QkkKQR
>> jdl5CLgUaIoGW76oN8I86j4toditngHuviDD9nM8MIh0S+s5bFnCAM5lWlQYfo7t
>> 70nSlAD1/bvdCfOfe1OwNMuoTDWFQOSbAHjITo2NuTJT8ggzVpqTf32z/oqTZKA=
>> =+VQJ
>> -----END PGP SIGNATURE-----
>> _______________________________________________
>> Lognorm mailing list
>> Lognorm at lists.adiscon.com
>> http://lists.adiscon.net/mailman/listinfo/lognorm
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130714/3eca8bdb/attachment.htm>

More information about the Lognorm mailing list