[Snort-devel] Snort 2.9.7.0 - probably memleak in HttpInspect

Bhagya Bantwal (bbantwal) bbantwal at ...3461...
Tue Dec 9 12:42:54 EST 2014


Hello Jul,

Thanks for sending this valgrind report. Were you using a specific conf or
pcap?

Thanks!

On 12/9/14 3:54 AM, "souber at ...3541..." <souber at ...3541...> wrote:

>Hi,
>
>valgrind reports me some issue:
>
>==17108== 1,664 (520 direct, 1,144 indirect) bytes in 13 blocks are
>definitely lost in loss record 27 of 33
>==17108==    at 0x4C272B8: calloc (vg_replace_malloc.c:566)
>==17108==    by 0x4922AB: setApplicationData (util.h:239)
>==17108==    by 0x485F53: SetNewHttpSessionData (snort_httpinspect.c:4495)
>==17108==    by 0x487763: SnortHttpInspect (snort_httpinspect.c:3924)
>==17108==    by 0x4805C8: HttpInspect (spp_httpinspect.c:211)
>==17108==    by 0x43D69D: Preprocess (detect.c:136)
>==17108==    by 0x4B344E: _flush_to_seq.isra.77 (snort_stream_tcp.c:4336)
>==17108==    by 0x4B9950: StreamFlushTalker (snort_stream_tcp.c:4883)
>==17108==    by 0x490837: StreamResponseFlushStream (spp_stream6.c:913)
>==17108==    by 0x492373: freeSessionApplicationData (spp_session.c:1756)
>==17108==    by 0x4BE475: ProcessTcp (snort_stream_tcp.c:8629)
>==17108==    by 0x4C0182: StreamProcessTcp (snort_stream_tcp.c:5639)
>
>The report is after about 15 hours work, so the leak is not big.
>
>HTH,
>Regards,
>Jul.
>--------------------------------------------------------------------------
>----
>Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>with Interactivity, Sharing, Native Excel Exports, App Integration & more
>Get technology previously reserved for billion-dollar corporations, FREE
>http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clkt
>rk
>_______________________________________________
>Snort-devel mailing list
>Snort-devel at lists.sourceforge.net
>https://lists.sourceforge.net/lists/listinfo/snort-devel
>Archive:
>http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
>Please visit http://blog.snort.org for the latest news about Snort!





More information about the Snort-devel mailing list