[Snort-devel] Segfault, massive memory usage in 1.8.1beta3 build 47

Bill Gercken bgercken at ...351...
Mon Jul 23 22:29:18 EDT 2001


Sorry about that. That was my mistake. I was hoping that the change would be
verified before it was committed.

ver 1.37					ver 1.38
/*freetag(root->tag[x]);*/      /* this needs to be recursive, otherwise
memory will leak */
free(root->tag[x]);              freetag(root->tag[x]);

I have been experiencing severe crashes while using the spo_xml code and
that was the only way that the code would run for more then 30 seconds. I
will test the new build tomorrow, is it OK to send core dumps/traces
directly to you  if I experience problems?


-----Original Message-----
From: snort-devel-admin at lists.sourceforge.net
[mailto:snort-devel-admin at lists.sourceforge.net]On Behalf Of Jed Pickel
Sent: Monday, July 23, 2001 10:05 PM
To: Seth Leger
Cc: Snort-devel at lists.sourceforge.net
Subject: Re: [Snort-devel] Segfault, massive memory usage in 1.8.1beta3
build 47

I just committed a fix for the XML plugin memory leak. Apparently it
was introduced in a commit on July 8th. Let me know if you have any
more problems.

* Jed

On Fri, Jul 20, 2001 at 03:59:47PM -0400, Seth Leger wrote:
> 	Ok, after looking at it some more, it looks like the memory usage is all
> in the XML plugin when it is using file output mode. It seems like I
> looked at this code some time ago and it never flushes the memory for
> each alert XML tree after the file is written. Instead, it maintains a
> sort of memory copy of the entire XML log file.
> 	I might be able to work on a patch for this one of these days (if that's
> even really what's happening...) but until then I'm happy running TCP
> output mode for the plugin.
> 	Thanks for the tips. Those frag2 and stream4 plugins seem to be terribly
> efficient with memory; after I dropped the XML plugin, the memory usage
> hovered around 4 MB and dropped after heavy scans completed their runs.
> Looking good!

Snort-devel mailing list
Snort-devel at lists.sourceforge.net

More information about the Snort-devel mailing list