[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

Sorry a bit short on time, thus brief :-(

On Mon, Jul 15, 2013 at 5:07 PM, Champ Clark III <cclark at quadrantsec.com>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Similar to how I was properly cleaning up when dealing with the
> "propName",  I tried similar trick.  However,  it didn't work out.
>
>
> ==16533== 892,776 bytes in 8,963 blocks are definitely lost in loss
> record 53 of 55
> ==16533==    at 0x4C2B6CD: malloc (in
> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==16533==    by 0x5457CD9: es_newStr (string.c:105)
> ==16533==    by 0x5457D0E: es_newStrFromCStr (string.c:125)
> ==16533==    by 0x40C2DA: sagan_normalize_liblognorm
> (sagan-liblognorm.c:104)
> ==16533==    by 0x41466F: Sagan_Blacklist (sagan-blacklist.c:167)
> ==16533==    by 0x40BD37: Sagan_Processor (sagan-processor.c:123)
> ==16533==    by 0x595EE99: start_thread (pthread_create.c:308)
>
>
> This is the line:
>
> str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg ));
>
> Which I clear once near the end:
>
> es_deleteStr(str);
>
> I've cleaned up/sync'ed up the code here:
>
> https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c
>
> Should I be cleaning it up after every usage (for example,  after "str
> = ee_getFieldValueAsStr(field, 0);"
>
>
well, es_newStr() is like malloc.
so

char *s;
s=malloc();
s=malloc();
free(s);

creates a leak. You must free the str object before the ptr is overwritten.

Does that help?

Rainer

> I'm confused.    Thanks again!
>
>
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR5BA4AAoJENnmXt7Lmc3K86AH+wbIoTlstbI4C/R7ahTkeVtx
> OG37KOsze7tZNfjbBkL47vP+tWGF6goF9I7Dj+eTuzDlfAnLcSxKkmSA7P+xqbjD
> pAYrsiU9+ViJK3A2iZhjesK4DUfCKIojNTGTa2O++nyl3hv1Tq3fXpLCDdxeJDoq
> F7dphDxRsQxXpfJu7oiapC4JKHNhN3chFpJtbFwBurwDNruNHqBHBinLXNngzmQR
> nzmE7eZAoLJXSw+D89OiFydZRZs48DSV4if1EyZBYe/X6Y8PjFht2v+XCjiUYOIQ
> J3T+rKtEyau9dPoua4iGm/wK01z/IJAsUcVszR1zeWo6T8HYtZDc27HQUC2nvh0=
> =40DE
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130715/c7f0c815/attachment.htm>