[Lognorm] Memory Leak in liblognorm?

[Champ Clark III]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ahhh!  I wasn't aware I needed to do that!  I thought I could use it
then at the end call  es_deleteStr(propName) once and be done!

I now call after each usage and valgrind now no longer report the leak
there.  Woo! :)

There is one more report from valgrind that I don't quite get.  It is:

==10919== 323,832 bytes in 3,305 blocks are definitely lost in loss
record 53 of 55
==10919==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10919==    by 0x5457CD9: es_newStr (string.c:105)
==10919==    by 0x5457D0E: es_newStrFromCStr (string.c:125)
==10919==    by 0x40C2B6: sagan_normalize_liblognorm
(sagan-liblognorm.c:114)
==10919==    by 0x41467F: Sagan_Blacklist (sagan-blacklist.c:167)
==10919==    by 0x40BD37: Sagan_Processor (sagan-processor.c:123)
==10919==    by 0x595EE99: start_thread (pthread_create.c:308)


Here is sagan-liblognorm.c line 114+

- --<snip>--

str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));  /* Line 114 */
ln_normalize(ctx, str, &lnevent);

if(lnevent != NULL) {

  es_emptyStr(str);
  ee_fmtEventToRFC5424(lnevent, &str);
  cstr = es_str2cstr(str, NULL);
  es_deleteStr(str);             /* Thought this would clean it up! */

- --<snip>--


I agree with you and going through the rest of the valgrind report
with Sagan.  It's something I've been meaning to do for a while,  but
just go around to it.  I should have done it a long time again.

Thank again Mr Rainer! :)




On 7/14/13 8:52 AM, Rainer Gerhards wrote:
> ah, now it is easy to see (for me ;)). Look at line 125+. You do
> repeatedly:
> 
> propName = es_newStrFromBuf(...);
> 
> 
> but you never delete propName before you assign a new value to it
> ;)
> 
> There may be other problems, I had just focussed on the first
> valgrind report. Let me know if this get's you going.
> 
> 

- -- 
- - Champ Clark III (cclark at quadrantsec.com)
  Quadrant Information Security (http://quadrantsec.com)
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
  GPG Key ID: 0381878A
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJR4/O7AAoJENnmXt7Lmc3KT+8H/2P0/y5f2u5SQ/xt35mOlr6B
x5dj6qJSlKmoMGhOUc5wGz2YclrKEgBC+kF26qSNIe1YD8oSxRMbJxwSKY9iiCJg
PSNm39sQ5t9yOC5uqp0wjvsaELgeFjvlD96ArrU8dgfD21bNZrCAhBWz5+6ttA+z
Gner7Ic0t9EpgjXTsDPDoFchHm8J/QunQ3mcbqGonpl0GrlgZ0nYzNz8gosQiIV+
TazKVPaKp5pvafH1vdO3JDROEpnRbH++QQspj0+9nlDN0mgCL8YtjwkycFAt7++m
RWtWIfmQnpO+Xwx07a9HS2JmSk53+9wi058JHdTYHIwF16ns+4Y1iRJhegt7Pd4=
=cjvP
-----END PGP SIGNATURE-----