Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Bug 7775] Wireshark leaks memory when selecting packets

From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Wed, 10 Oct 2012 13:34:33 +0200
On Wed, Oct 10, 2012 at 12:47:16AM +0200, Jakub Zawadzki wrote:
> On Mon, Oct 08, 2012 at 06:29:33PM -0400, Evan Huus wrote:
> > It doesn't crash, yes, but it leaks again. I've added
> > emem_destroy_chunk() for now in revision 45412, 
> 
> I forgot to note that emem_destroy_chunk() works only with chunks
> created with emem_create_chunk()
> 
> emem_create_chunk_gp() changes npc->buf, and amount_free_init
> So it leaks 2 * page_size (8KiB) per packet ;|
> 
> Still I don't understand why it fails assertion when doing mprotect()
> [bug #7814].

Probably linux kernel limit: 

$ cat /proc/sys/vm/max_map_count 
65530

Quoting Documentation/sysctl/vm.txt
#v+ 
max_map_count:

This file contains the maximum number of memory map areas a process
may have. Memory map areas are used as a side-effect of calling
malloc, directly by mmap and mprotect, and also when loading shared
libraries.

While most applications need less than a thousand maps, certain
programs, particularly malloc debuggers, may consume lots of them,
e.g., up to one or two maps per allocation.

The default value is 65536.
#v-

So we really need to pass pointer got from mmap() ;|