[Oisf-devel] [PATCH] memory leak cleanup in alerts

[Victor Julien]

Applied, thanks Steve!

Steve Grubb wrote:
> Hello,
> 
> I ran the code through an analysis program and found several memory leaks
> in the alert code.
> 
> *In src/alert-fastlog.c at line 178, aft was not being freed
> *In src/alert-debuglog.c at line 205, aftwas not being freed
> *In src/alert-unified-log.c at lines 234 and 243, aun was not being freed
> *In src/alert-unified-alert.c at lines 219 and 230, aun was not being freed
> *In src/alert-unified2-alert.c at line 505, aun was not being freed
> 
> The patch below fixes this.
> 
> -Steve
> 
> 
> 
> diff -urp suricata-0.8.1.orig/src/alert-debuglog.c suricata-0.8.1/src/alert-debuglog.c
> --- suricata-0.8.1.orig/src/alert-debuglog.c	2010-01-24 09:08:23.000000000 -0500
> +++ suricata-0.8.1/src/alert-debuglog.c	2010-01-24 13:52:48.000000000 -0500
> @@ -202,6 +202,7 @@ TmEcode AlertDebugLogThreadInit(ThreadVa
>      if(initdata == NULL)
>      {
>          SCLogDebug("Error getting context for DebugLog.  \"initdata\" argument NULL");
> +        free(aft);
>          return TM_ECODE_FAILED;
>      }
>      /** Use the Ouptut Context (file pointer and mutex) */
> diff -urp suricata-0.8.1.orig/src/alert-fastlog.c suricata-0.8.1/src/alert-fastlog.c
> --- suricata-0.8.1.orig/src/alert-fastlog.c	2010-01-24 09:08:23.000000000 -0500
> +++ suricata-0.8.1/src/alert-fastlog.c	2010-01-24 13:51:52.000000000 -0500
> @@ -175,6 +175,7 @@ TmEcode AlertFastLogThreadInit(ThreadVar
>      if(initdata == NULL)
>      {
>          SCLogDebug("Error getting context for AlertFastLog.  \"initdata\" argument NULL");
> +        free(aft);
>          return TM_ECODE_FAILED;
>      }
>      /** Use the Ouptut Context (file pointer and mutex) */
> diff -urp suricata-0.8.1.orig/src/alert-unified2-alert.c suricata-0.8.1/src/alert-unified2-alert.c
> --- suricata-0.8.1.orig/src/alert-unified2-alert.c	2010-01-24 09:08:23.000000000 -0500
> +++ suricata-0.8.1/src/alert-unified2-alert.c	2010-01-24 13:56:36.000000000 -0500
> @@ -502,6 +502,7 @@ TmEcode Unified2AlertThreadInit(ThreadVa
>      if(initdata == NULL)
>      {
>          SCLogDebug("Error getting context for Unified2Alert.  \"initdata\" argument NULL");
> +        free(aun);
>          return TM_ECODE_FAILED;
>      }
>      /** Use the Ouptut Context (file pointer and mutex) */
> diff -urp suricata-0.8.1.orig/src/alert-unified-alert.c suricata-0.8.1/src/alert-unified-alert.c
> --- suricata-0.8.1.orig/src/alert-unified-alert.c	2010-01-24 09:08:23.000000000 -0500
> +++ suricata-0.8.1/src/alert-unified-alert.c	2010-01-24 13:55:49.000000000 -0500
> @@ -216,6 +216,7 @@ TmEcode AlertUnifiedAlertThreadInit(Thre
>      if(initdata == NULL)
>      {
>          SCLogDebug("Error getting context for UnifiedAlert.  \"initdata\" argument NULL");
> +        free(aun);
>          return TM_ECODE_FAILED;
>      }
>      /** Use the Ouptut Context (file pointer and mutex) */
> @@ -227,6 +228,7 @@ TmEcode AlertUnifiedAlertThreadInit(Thre
>      if (ret != 0) {
>          SCLogError(SC_ERR_UNIFIED_ALERT_GENERIC_ERROR,
>                     "Error: AlertUnifiedLogWriteFileHeader failed");
> +        free(aun);
>          return TM_ECODE_FAILED;
>      }
>  
> diff -urp suricata-0.8.1.orig/src/alert-unified-log.c suricata-0.8.1/src/alert-unified-log.c
> --- suricata-0.8.1.orig/src/alert-unified-log.c	2010-01-24 09:08:23.000000000 -0500
> +++ suricata-0.8.1/src/alert-unified-log.c	2010-01-24 13:54:22.000000000 -0500
> @@ -231,6 +231,7 @@ TmEcode AlertUnifiedLogThreadInit(Thread
>      if(initdata == NULL)
>      {
>          SCLogDebug("Error getting context for UnifiedLog.  \"initdata\" argument NULL");
> +        free(aun);
>          return TM_ECODE_FAILED;
>      }
>      /** Use the Ouptut Context (file pointer and mutex) */
> @@ -240,6 +241,7 @@ TmEcode AlertUnifiedLogThreadInit(Thread
>      int ret = AlertUnifiedLogWriteFileHeader(t, aun);
>      if (ret != 0) {
>          printf("Error: AlertUnifiedLogWriteFileHeader failed.\n");
> +        free(aun);
>          return TM_ECODE_FAILED;
>      }
>  
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel


-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------