Project

General

Profile

Actions
Copy link

Bug #5204

open
YZ PA

ippair: Memory leak caused by ippair processing

Bug #5204: ippair: Memory leak caused by ippair processing

Added by yida zhang over 4 years ago. Updated 9 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Affected Versions:
5.0.3
Effort:
Difficulty:
medium
Label:
C

Description

The IPPairGetIPPairFromHash() will increase the ippair->use_cnt by IPPairIncrUsecnt(). Other functions do the same.
But the IPPairDecrUsecnt() will be executed a few times less. This causes IPPair->use_cnt to never be 0. Eventually the memory runs out.

How to reproduce the problem:
1. Reduce the configured ：ippair.memcap;

2. tcpreplay a ftp.pcacp with --unique-ip opt;
3. AppLayerExpectationCreate() return error !!!

Please check the changes in version 5.0.3
https://github.com/OISF/suricata/compare/suricata-5.0.2...suricata-5.0.3

Files

Download all files
clipboard-202203231906-wgt1j.png (9.47 KB) clipboard-202203231906-wgt1j.png yida zhang, 03/23/2022 11:06 AM
clipboard-202203231906-sebox.png (11.2 KB) clipboard-202203231906-sebox.png yida zhang, 03/23/2022 11:06 AM
clipboard-202203231911-nwncp.png (19.4 KB) clipboard-202203231911-nwncp.png yida zhang, 03/23/2022 11:11 AM

Subtasks 1 (1 open — 0 closed)

Bug #8869: ippair: Memory leak caused by ippair processing (8.0.x backport)AssignedPhilippe AntoineActions

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #1

  • Assignee deleted (Philippe Antoine)

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #2

  • Assignee set to OISF Dev

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #3

  • Status changed from New to Feedback

Is there still the issue in Suricata 8 ?

PA Updated by Philippe Antoine 17 days ago Actions
Copy link
 #4

  • Status changed from Feedback to In Review
  • Assignee changed from OISF Dev to Philippe Antoine
  • Target version changed from TBD to 9.0.0-beta1

VJ Updated by Victor Julien 9 days ago Actions
Copy link
 #6

  • Subject changed from Memory leak caused by ippair processing to ippair: Memory leak caused by ippair processing
  • Status changed from In Review to Resolved
  • Label Needs backport to 8.0 added

OT Updated by OISF Ticketbot 9 days ago Actions
Copy link
 #7

  • Subtask #8869 added

OT Updated by OISF Ticketbot 9 days ago Actions
Copy link
 #8

  • Label deleted (Needs backport to 8.0)
Actions
Copy link

Also available in: PDF Atom