[Snort-devel] Re: Big memory leaks in snort 2.0.2

Steve G linux_4ever at ...398...
Sun Sep 21 19:56:02 EDT 2003


>This has been in Snort for almost 5 years and is well known, 
>since it's in the parsing/startup code it's never been 
>something that's been on the "fix now" list.  

Maybe so...but 5 years ago, there weren't as many rules getting
parsed. :)  From a 2.0.1 installation with current rules &
nothing fancy in the preprocessors:

==904== 347392 bytes in 1357 blocks are definitely lost in loss
record 454 of 463
==904==    at 0x40025394: malloc (vg_replace_malloc.c:153)
==904==    by 0x804F79C: mSplit (../../../src/mstring.c:143)
==904==    by 0x8050FCC: ParseRuleOptions
(../../../src/parser.c:1486)
==904==    by 0x8050781: ParseRule (../../../src/parser.c:709)
==904==    by 0x804FE99: ParseRulesFile
(../../../src/parser.c:251)
==904==    by 0x80504F6: ParseRule (../../../src/parser.c:523)
==904==    by 0x804FE99: ParseRulesFile
(../../../src/parser.c:251)
==904==    by 0x8055802: SnortMain (../../../src/snort.c:460)
==904==
==904== LEAK SUMMARY:
==904==    definitely lost: 762310 bytes in 34737 blocks.
==904==    possibly lost:   19459 bytes in 242 blocks.
==904==    still reachable: 9544688 bytes in 60926 blocks.
==904==         suppressed: 0 bytes in 0 blocks.
==904== Reachable blocks (those to which a pointer was found) are
not shown.
==904== To see them, rerun with: --show-reachable=yes
=

Just that one spot is leaking almost 350k of memory. As you can
see, more than 740k of memory is lost...total. That's a lot by
any measure. The fix is simple, but its widespread.

>We're looking at fixing it once and for all right now, 
>stay tuned and we should have it worked out this week.

If no one else appreciates this, I do. Thanks !

-Steve Grubb

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com




More information about the Snort-devel mailing list