Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5069] New: Massive memory leak with 1.2.10.

Date: Sat, 31 Jul 2010 18:53:28 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5069

           Summary: Massive memory leak with 1.2.10.
           Product: Wireshark
           Version: 1.2.10
          Platform: x86
        OS/Version: Windows XP
            Status: NEW
          Severity: Major
          Priority: High
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: christopher.maynard@xxxxxxxxx


Build Information:
Version 1.2.10

Compiled with GTK+ 2.16.6, (32-bit) with GLib 2.22.4, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with
SMI 0.4.8, with c-ares 1.7.0, with Lua 5.1, with GnuTLS 2.8.5, with Gcrypt
1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Jul 30
2010), with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2
(packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, with AirPcap 4.1.1 build 1838.

Built using Microsoft Visual C++ 9.0 build 30729
--
Captured about 100MB of traffic comprising Wireshark downloads from
http://www.wireshark.org/download.html and video from
http://www.wireshark.org/docs/.  Saved capture file and quit Wireshark.

Start up Wireshark again and notice Windows Task Manager Mem Usage reports
~84MB before any file is loaded.  Load the 100MB file and watch memory usage
climb to about 419MB.  Close file expecting memory usage to drop back to 84MB
again, but it only drops to ~375MB.  Load same file again and memory usage
climbs to ~555MB.  Close file and memory usage only drops to 509MB.  Load
again, usage climbs to 690MB.  Close and it only drops to 645MB.  You get the
idea.

To see if it was related to the TCP and/or IP reassembly, I disabled those
protocols.  In fact, I even disabled Ethernet too.  Then I repeated the above
procedure.  Wireshark starts up using 84MB.  After the file is loaded, memory
usage goes up to about 229MB.  After closing the file, memory usage barely
changed at all.

Repeated test with SVN33682 and Ethernet, IP and TCP dissectors disabled: 
Wireshark loads using 104MB, usage climbs to 139MB when the file is loaded and
drops to 138MB when the file is closed, so still leaking in the trunk.

I can post the capture file if needed.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.