Project

General

Profile

Actions

Bug #1092

closed

HTTP: Memory Leak

Added by Jack Flemming over 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Version: Pulled from Github 1/25/2014. Advertised version is "Suricata 2.0dev (rev a77b9b3)"
Issue: Valgrind flags a memory leak coming from HTTP and/or libHTP. I'm not really confident on who is in charge of this memory:

==23665== 532 (152 direct, 380 indirect) bytes in 1 blocks are definitely lost in loss record 529 of 565
==23665==    at 0x4C2CD7B: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==23665==    by 0x4415DB: HTPMalloc (app-layer-htp-mem.c:106)
==23665==    by 0x43CD04: HTPCallbackResponseHeaderData (app-layer-htp.c:2099)
==23665==    by 0x4031C39: htp_hook_run_all (htp_hooks.c:125)
==23665==    by 0x4035C4B: htp_connp_res_receiver_send_data (htp_response.c:98)
==23665==    by 0x4035CAA: htp_connp_res_receiver_finalize_clear (htp_response.c:116)
==23665==    by 0x403AFFC: htp_tx_state_response_headers (htp_transaction.c:1088)
==23665==    by 0x4036ED9: htp_connp_RES_BODY_DETERMINE (htp_response.c:627)
==23665==    by 0x4037A9C: htp_connp_res_data (htp_response.c:980)
==23665==    by 0x436956: HTPHandleResponseData (app-layer-htp.c:775)
==23665==    by 0x44418A: AppLayerParserParse (app-layer-parser.c:778)
==23665==    by 0x415D56: AppLayerHandleTCPData (app-layer.c:288)

How to recreate:
1. Make an unoptimized build of HTP / Suricata
2. Run like so:

valgrind --leak-check=full --trace-children=yes ./src/suricata -c ./suricata.yaml -r <attached pcap> -k none --runmode single -l ./output/


Files

callback_leak.pcap (4.38 KB) callback_leak.pcap Jack Flemming, 01/27/2014 07:38 PM
Actions

Also available in: Atom PDF