[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

Use es_deleteStr instead of es_emptyStr. The latter just resets it but does
not free.  More explanations follow tomorrow.  Please report back.

Sent from phone, thus brief.
Am 15.07.2013 21:06 schrieb "Champ Clark III" <cclark at quadrantsec.com>:

>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hello,
>
> So - I've stripped down the code a good bit to see if I can't isolate
> where I'm going wrong.  Below is what I got:
>
> - --<snip>--
> str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));
> ln_normalize(ctx, str, &lnevent);
>
>        if(lnevent != NULL) {
>                 es_emptyStr(str);
>                 ee_fmtEventToRFC5424(lnevent, &str);
>                 }
>
> free(cstr);
> es_deleteStr(str);
> ee_deleteEvent(lnevent);
> }
> - --<snip>--
>
> It appears as soon as I add the "ee_fmtEventToRFC5424",  valgrind starts
> to report the following:
>
> ==21979== 69,872 bytes in 614 blocks are definitely lost in loss record
> 52 of 54
> ==21979==    at 0x4C2B6CD: malloc (in
> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==21979==    by 0x5457CD9: es_newStr (string.c:105)
> ==21979==    by 0x5457D0E: es_newStrFromCStr (string.c:125)
> ==21979==    by 0x40C167: sagan_normalize_liblognorm
> (sagan-liblognorm.c:103)
> ==21979==    by 0x41427F: Sagan_Blacklist (sagan-blacklist.c:167)
> ==21979==    by 0x40BC07: Sagan_Processor (sagan-processor.c:123)
> ==21979==    by 0x595EE99: start_thread (pthread_create.c:308)
>
> If I remove the line,  that goes away.    Any thoughts?
>
> Thanks for your time.
>
> - --
> - - Quadrant Information Security
>   Champ Clark III
>   o: 800.538.9357 x 101
>   c: 850.443.2440
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR5EgaAAoJENnmXt7Lmc3K6qMH/2ohomzUEQr+yi6pwNRUbM6P
> P3LfzxqccDSsJkDyY5EYY611S8ohHP0ZRdFyzQmRger1KXfSgvEGbs+brZC8rKYb
> OINB89GzG7A/Wu3SHnDwNSeLC2OKT+e14FslgBH0PqPgLy7PWnUmXbLxVAs58DXH
> 3XydPkLumZC2K/vQwYFfxMxGTM90+cE8QRUXdaQ5ihndUg/9zI5BPeOvrOOffR69
> ZscCxZhob/qWMlCuOZd37iAayMROnzg8dWFq1SoWiITFn+PazhyXVsXvbA823VYJ
> vztu09FeH3LkcKt0XNgY8a+ITBmSTZ65ioMnJ4sXRjk2Sh1M94fWl8NV2sDX1qk=
> =oOrC
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130715/a8c31d49/attachment-0001.htm>