Project

General

Profile

Actions
Copy link

Bug #5204

open

Memory leak caused by ippair processing

Added by yida zhang over 2 years ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
5.0.3
Effort:
Difficulty:
medium
Label:
C

Description

The IPPairGetIPPairFromHash() will increase the ippair->use_cnt by IPPairIncrUsecnt(). Other functions do the same.
But the IPPairDecrUsecnt() will be executed a few times less. This causes IPPair->use_cnt to never be 0. Eventually the memory runs out.

How to reproduce the problem:
1. Reduce the configured ：ippair.memcap;

2. tcpreplay a ftp.pcacp with --unique-ip opt;
3. AppLayerExpectationCreate() return error !!!

Please check the changes in version 5.0.3
https://github.com/OISF/suricata/compare/suricata-5.0.2...suricata-5.0.3

Files

Download all files
clipboard-202203231906-wgt1j.png (9.47 KB) clipboard-202203231906-wgt1j.png yida zhang, 03/23/2022 11:06 AM
clipboard-202203231906-sebox.png (11.2 KB) clipboard-202203231906-sebox.png yida zhang, 03/23/2022 11:06 AM
clipboard-202203231911-nwncp.png (19.4 KB) clipboard-202203231911-nwncp.png yida zhang, 03/23/2022 11:11 AM
Actions
Copy link

Also available in: Atom PDF