[Lognorm] Memory Leak in liblognorm?

[Champ Clark III]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Similar to how I was properly cleaning up when dealing with the
"propName",  I tried similar trick.  However,  it didn't work out.


==16533== 892,776 bytes in 8,963 blocks are definitely lost in loss
record 53 of 55
==16533==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16533==    by 0x5457CD9: es_newStr (string.c:105)
==16533==    by 0x5457D0E: es_newStrFromCStr (string.c:125)
==16533==    by 0x40C2DA: sagan_normalize_liblognorm
(sagan-liblognorm.c:104)
==16533==    by 0x41466F: Sagan_Blacklist (sagan-blacklist.c:167)
==16533==    by 0x40BD37: Sagan_Processor (sagan-processor.c:123)
==16533==    by 0x595EE99: start_thread (pthread_create.c:308)


This is the line:

str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg ));

Which I clear once near the end:

es_deleteStr(str);

I've cleaned up/sync'ed up the code here:

https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c

Should I be cleaning it up after every usage (for example,  after "str
= ee_getFieldValueAsStr(field, 0);"

I'm confused.    Thanks again!


- -- 
- - Champ Clark III (cclark at quadrantsec.com)
  Quadrant Information Security (http://quadrantsec.com)
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
  GPG Key ID: 0381878A


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJR5BA4AAoJENnmXt7Lmc3K86AH+wbIoTlstbI4C/R7ahTkeVtx
OG37KOsze7tZNfjbBkL47vP+tWGF6goF9I7Dj+eTuzDlfAnLcSxKkmSA7P+xqbjD
pAYrsiU9+ViJK3A2iZhjesK4DUfCKIojNTGTa2O++nyl3hv1Tq3fXpLCDdxeJDoq
F7dphDxRsQxXpfJu7oiapC4JKHNhN3chFpJtbFwBurwDNruNHqBHBinLXNngzmQR
nzmE7eZAoLJXSw+D89OiFydZRZs48DSV4if1EyZBYe/X6Y8PjFht2v+XCjiUYOIQ
J3T+rKtEyau9dPoua4iGm/wK01z/IJAsUcVszR1zeWo6T8HYtZDc27HQUC2nvh0=
=40DE
-----END PGP SIGNATURE-----