[Lognorm] Memory Leak in liblognorm?

[Champ Clark III]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello,

So - I've stripped down the code a good bit to see if I can't isolate
where I'm going wrong.  Below is what I got:

- --<snip>--
str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));
ln_normalize(ctx, str, &lnevent);

       if(lnevent != NULL) {
                es_emptyStr(str);
                ee_fmtEventToRFC5424(lnevent, &str);
                }

free(cstr);
es_deleteStr(str);
ee_deleteEvent(lnevent);
}
- --<snip>--

It appears as soon as I add the "ee_fmtEventToRFC5424",  valgrind starts
to report the following:

==21979== 69,872 bytes in 614 blocks are definitely lost in loss record
52 of 54
==21979==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21979==    by 0x5457CD9: es_newStr (string.c:105)
==21979==    by 0x5457D0E: es_newStrFromCStr (string.c:125)
==21979==    by 0x40C167: sagan_normalize_liblognorm
(sagan-liblognorm.c:103)
==21979==    by 0x41427F: Sagan_Blacklist (sagan-blacklist.c:167)
==21979==    by 0x40BC07: Sagan_Processor (sagan-processor.c:123)
==21979==    by 0x595EE99: start_thread (pthread_create.c:308)

If I remove the line,  that goes away.    Any thoughts?

Thanks for your time.

- -- 
- - Quadrant Information Security
  Champ Clark III
  o: 800.538.9357 x 101
  c: 850.443.2440
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJR5EgaAAoJENnmXt7Lmc3K6qMH/2ohomzUEQr+yi6pwNRUbM6P
P3LfzxqccDSsJkDyY5EYY611S8ohHP0ZRdFyzQmRger1KXfSgvEGbs+brZC8rKYb
OINB89GzG7A/Wu3SHnDwNSeLC2OKT+e14FslgBH0PqPgLy7PWnUmXbLxVAs58DXH
3XydPkLumZC2K/vQwYFfxMxGTM90+cE8QRUXdaQ5ihndUg/9zI5BPeOvrOOffR69
ZscCxZhob/qWMlCuOZd37iAayMROnzg8dWFq1SoWiITFn+PazhyXVsXvbA823VYJ
vztu09FeH3LkcKt0XNgY8a+ITBmSTZ65ioMnJ4sXRjk2Sh1M94fWl8NV2sDX1qk=
=oOrC
-----END PGP SIGNATURE-----