[Snort-devel] Snort - probably memleak in HttpInspect

Bhagya Bantwal (bbantwal) bbantwal at ...3461...
Tue Dec 9 12:42:54 EST 2014

Hello Jul,

Thanks for sending this valgrind report. Were you using a specific conf or


On 12/9/14 3:54 AM, "souber at ...3541..." <souber at ...3541...> wrote:

>valgrind reports me some issue:
>==17108== 1,664 (520 direct, 1,144 indirect) bytes in 13 blocks are
>definitely lost in loss record 27 of 33
>==17108==    at 0x4C272B8: calloc (vg_replace_malloc.c:566)
>==17108==    by 0x4922AB: setApplicationData (util.h:239)
>==17108==    by 0x485F53: SetNewHttpSessionData (snort_httpinspect.c:4495)
>==17108==    by 0x487763: SnortHttpInspect (snort_httpinspect.c:3924)
>==17108==    by 0x4805C8: HttpInspect (spp_httpinspect.c:211)
>==17108==    by 0x43D69D: Preprocess (detect.c:136)
>==17108==    by 0x4B344E: _flush_to_seq.isra.77 (snort_stream_tcp.c:4336)
>==17108==    by 0x4B9950: StreamFlushTalker (snort_stream_tcp.c:4883)
>==17108==    by 0x490837: StreamResponseFlushStream (spp_stream6.c:913)
>==17108==    by 0x492373: freeSessionApplicationData (spp_session.c:1756)
>==17108==    by 0x4BE475: ProcessTcp (snort_stream_tcp.c:8629)
>==17108==    by 0x4C0182: StreamProcessTcp (snort_stream_tcp.c:5639)
>The report is after about 15 hours work, so the leak is not big.
>Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>with Interactivity, Sharing, Native Excel Exports, App Integration & more
>Get technology previously reserved for billion-dollar corporations, FREE
>Snort-devel mailing list
>Snort-devel at lists.sourceforge.net
>Please visit http://blog.snort.org for the latest news about Snort!

More information about the Snort-devel mailing list