ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Memory leaks when using epan

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 20 Aug 2010 14:53:01 -0400
Thierry Emmanuel wrote:
Hello,

As I wrote in some of my mails, I work on a project which made me to use the epan as a dissecting library, independently from the rest of the wireshark source.

I have some troubles with memory handling. I have huge memory leaks when I decode multicast streams (because there are lots of packets to dissect of course :) ).

This kind of use isn't common, nor documented, so I must have made some errors in my implementation or even in the structure of my wrappers.

So I have some questions to the wireshark gurus :

Do you see some reason, for example in my code, that could cause such memory leaks ?

I have supposed that the whole memory used to build the proto_tree wasn't free'd when I called proto_tree_free, do you free its content by another way ?

Is there a way to force dissectors and the rest of Wireshark code to release this memory ?

The valgrind output shows that Valgrind thinks the ep_ and se_ allocated memory is being leaked. Sounds like you need to call ep_free_all() (after each packet) and se_free_all() (when the file is closed).

Normally the former is done in epan_dissect_run() and the latter is done in cleanup_dissection() (or init_dissection()). Not sure how that relates to your code.