argus 3.0.0 rc.28 memory leaks

[carter at qosient.com]

Hey Gabriel,
This is plenty for me to trace it down!!!
Can you share the packet file if it doesn't leap out when I look at the source?

Carter

Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: "Gabriel L. Somlo" <somlo at cmu.edu>
Date: Thu, 21 Sep 2006 16:44:14 
To:carter at qosient.com
Cc:Argus <argus-info at lists.andrew.cmu.edu>
Subject: Re: argus 3.0.0 rc.28 memory leaks

On Wed, Sep 20, 2006 at 09:27:33PM +0000, carter at qosient.com wrote:
> Hey Gabriel,
> I have incorporated some of it, so all is not lost!  I noticed tha the
> valgrind output you sent earlier indicated that it couldn't figure out
> if a chunk of memory was uninitialized (it did seem to lose track?). I've
> run into this as well from valgrind and couldn't find the cause.
> 
> I think the chunk is in the user data buffer.  If you configure argus to
> not capture user data, does valgrind quit complaining?


Carter,

I'm running it on an existing capture file (for repeatability). I
don't think it captures user data by default unless told to do so on
the command line (or am I mistaken ?)


I ran it with '-r foo.cap -w foo.rec' as the only arguments to argus.

i.e., 'valgrind --tool=memcheck --leak-check=full argus-3.0.0.rc.29/bin/argus -r foo.cap -w foo.rec'


So, after a bunch of strategically placed printf's (  :)  ) it turns
out valgrind sometimes complains after ArgusGenerateRecord() has
processed an ARGUS_MAR record (not always, but sometimes).

The other times, it's while writing 32 bytes from a flow's
ARGUS_ICMP_INDEX via the default branch of the main switch(i) in
ArgusGenerateRecord() (i == 14) ; the problem happens after 28 valid
bytes...

Hope this means more to you than it does to me :)

Thanks,
Gabriel

> 
> Carter
> 
> Carter Bullard
> QoSient LLC
> 150 E. 57th Street Suite 12D
> New York, New York 10022
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax  
> 
> -----Original Message-----
> From: "Gabriel L. Somlo" <somlo at cmu.edu>
> Date: Wed, 20 Sep 2006 09:27:17 
> To:Carter Bullard <carter at qosient.com>
> Cc:Argus <argus-info at lists.andrew.cmu.edu>
> Subject: Re: argus 3.0.0 rc.28 memory leaks
> 
> On Wed, Sep 20, 2006 at 01:28:05AM -0400, Carter Bullard wrote:
> > Hmmmm,
> > So, I'm not going to implement your memory alignment patch, as you
> > remove the entire ARGUSMEMDEBUG support, which is not
> > something I'm going to do.  And because there isn't a problem with the
> > existing code, I'm probably not going to change it, unless there is a real
> > reason to do it?  So, whats the problem?
> 
> That's OK, no biggie. I was going for legibility, and assumed that
> we'd want to use something like Valgrind for debugging memory problems
> anyway.
> 
> Retards,,
> Gabriel
>