Project

General

Profile

Actions

Bug #1092

closed

HTTP: Memory Leak

Added by Jack Flemming about 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Version: Pulled from Github 1/25/2014. Advertised version is "Suricata 2.0dev (rev a77b9b3)"
Issue: Valgrind flags a memory leak coming from HTTP and/or libHTP. I'm not really confident on who is in charge of this memory:

==23665== 532 (152 direct, 380 indirect) bytes in 1 blocks are definitely lost in loss record 529 of 565
==23665==    at 0x4C2CD7B: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==23665==    by 0x4415DB: HTPMalloc (app-layer-htp-mem.c:106)
==23665==    by 0x43CD04: HTPCallbackResponseHeaderData (app-layer-htp.c:2099)
==23665==    by 0x4031C39: htp_hook_run_all (htp_hooks.c:125)
==23665==    by 0x4035C4B: htp_connp_res_receiver_send_data (htp_response.c:98)
==23665==    by 0x4035CAA: htp_connp_res_receiver_finalize_clear (htp_response.c:116)
==23665==    by 0x403AFFC: htp_tx_state_response_headers (htp_transaction.c:1088)
==23665==    by 0x4036ED9: htp_connp_RES_BODY_DETERMINE (htp_response.c:627)
==23665==    by 0x4037A9C: htp_connp_res_data (htp_response.c:980)
==23665==    by 0x436956: HTPHandleResponseData (app-layer-htp.c:775)
==23665==    by 0x44418A: AppLayerParserParse (app-layer-parser.c:778)
==23665==    by 0x415D56: AppLayerHandleTCPData (app-layer.c:288)

How to recreate:
1. Make an unoptimized build of HTP / Suricata
2. Run like so:

valgrind --leak-check=full --trace-children=yes ./src/suricata -c ./suricata.yaml -r <attached pcap> -k none --runmode single -l ./output/


Files

callback_leak.pcap (4.38 KB) callback_leak.pcap Jack Flemming, 01/27/2014 07:38 PM
Actions #1

Updated by Victor Julien about 10 years ago

  • Target version changed from 2.0rc1 to 2.0rc2
Actions #2

Updated by Victor Julien about 10 years ago

  • Assignee set to Victor Julien
Actions #3

Updated by J.Y dong about 10 years ago

We met the same issue.
The version is 1.4.5 and it works in IPS mode.
We decrease some parameters and the issue is still.
------------------
flow:
memcap: 1000mb
hash_size: 102400
prealloc: 100000 <----decrease
emergency_recovery: 30

thanks

Actions #4

Updated by Victor Julien about 10 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF