Snort mailing list archives

Re: Potential Memory leak in function 'sfthd_create_threshold_local' in file 'sfthd.c'


From: "Kaushal Bhandankar (kbhandan)" <kbhandan () cisco com>
Date: Wed, 14 Oct 2015 08:38:41 +0000

Hi Bill,

In function sfthd_create_threshold_local, hash table sfthd_hash for gen_id is created using sfghash_new or initialized 
from thd_objs->sfthd_array[config->gen_id]. When this hash table is created a callback function is set to free the hash 
table (sfthd_item_free).
sfthd_item_free  function calls sflist_free_all . sflist_free_all  accepts a callback function sfthd_node_free.
sflist_free_all  does sflist_remove_head, and calls the callback function sfthd_node_free to free the THD_NODE.

Note: sfthd_create_threshold_local function adds a ThresholdObjects and sfthd_objs_free frees the ThresholdObjects.

Regards,
Kaushal

From: Bill Parker [mailto:wp02855 () gmail com]
Sent: Monday, October 12, 2015 10:24 PM
To: snort-devel () lists sourceforge net<mailto:snort-devel () lists sourceforge net>
Subject: [Snort-devel] Potential Memory leak in function 'sfthd_create_threshold_local' in file 'sfthd.c'

Hello All,

    In doing some review of memory allocation calls (2.9.8.0 Beta/RC),
it would appear that in function 'sfthd_create_threshold_local', a call
to calloc() is made at line 428:

sfthd_node = (THD_NODE*)calloc(1,sizeof(THD_NODE));

but it would appear that even after the node is added with 'sflist_add_head',
or 'sflist_add_before', or 'sflist_add_tail', it would appear that the
memory allocated at line 428 is never released via free() before a return 0
is encountered in this function, or does this not matter given how the
function builds the nodes in question?

Bill
------------------------------------------------------------------------------
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread: