Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2375] Wireshark memory leak with each file open and/or dis

Date: Sat, 10 Oct 2009 15:59:09 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2375





--- Comment #2 from Bill Meier <wmeier@xxxxxxxxxxx>  2009-10-10 15:59:05 PDT ---
Thanks for your report !!

After some amount of digging and debugging:

I have found one reason for memory leaking when a capture file is reloaded (or
when certain other actions are done which effectively reloads and redissects
the capture file).

To wit: 

There are certain dissectors which use a GLib data type called GMemChunks when
allocating/freeing memory as needed.

The use of GMemChunks was deprecated as of GLib 2.10 and apparently as of that
GLib version "freeing" GMemChunk memory doesn't actually free up the memory.

This particular issue is the same on both Windows and Linux.

Currently the following dissectors use GMemChunks (without checking the GLib
version).

   isakmp
   mgcp
   ncp
   radius
   sbus
   teamspeak2
   irda

(There are also currently a few other usages of GMemChunks in Wireshark).

So far, I've fixed the ncp dissector.

For this dissector for a particular capture file with mostly ncp frames, and
before the fix, the memory usage would grow by 20 Meg each time the file was
reloaded.

----

So:  two questions:

1. (If you know 1 1/2 years later) What version of GLib were you using on
Linux?

2. Any idea as to the protocols being dissected for a typical capture file for
which you noticed the memory increase ? (Statistics ! Protocol Hierarchy).

Might they have been one or more in the list above ?


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.