From: Victor Julien <victor@inliniac.net>
Date: Fri, 17 Jan 2014 17:58:21 +0000 (+0100)
Subject: Bug 980: fix HTTP memory cleanup at shutdown
X-Git-Tag: suricata-2.0rc1~190
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=84f14438c36e070860cb11b693463f5aea4ed851;p=thirdparty%2Fsuricata.git

Bug 980: fix HTTP memory cleanup at shutdown

Buffers in per thread HTTP header, client body and server body storage
would be freed based on the usage indicator instead of the size
indicator.

As the usage indicator (e.g. hsbd_buffers_list_len) could be reset
while leaving the memory untouched for later reuse, the free function
would not iterate over all memory blocks.

Removed DrMemory suppressions as well.

Bug #980.
---

diff --git a/qa/drmemory.suppress b/qa/drmemory.suppress
index f6a79e5338..323e57e401 100644
--- a/qa/drmemory.suppress
+++ b/qa/drmemory.suppress
@@ -22,40 +22,6 @@ suricata!TmThreadsSlotPktAcqLoop
 libpthread.so.0!start_thread
 libc.so.6!__clone 
 
-LEAK
-name=bug 980 (1)
-*
-suricata!DetectEngineHSBDGetBufferForTX
-suricata!DetectEngineRunHttpServerBodyMpm
-suricata!DetectMpmPrefilter
-suricata!SigMatchSignatures
-suricata!Detect
-suricata!TmThreadsSlotVarRun
-*
-
-LEAK
-name=bug 980 (2)
-*
-suricata!HHDCreateSpace
-suricata!DetectEngineHHDGetBufferForTX
-suricata!DetectEngineRunHttpHeaderMpm
-suricata!DetectMpmPrefilter
-suricata!SigMatchSignatures
-suricata!Detect
-suricata!TmThreadsSlotVarRun
-*
-
-LEAK
-name=bug 980 (3)
-*
-suricata!DetectEngineHCBDGetBufferForTX
-suricata!DetectEngineRunHttpClientBodyMpm
-suricata!DetectMpmPrefilter
-suricata!SigMatchSignatures
-suricata!Detect
-suricata!TmThreadsSlotVarRun
-*
-
 LEAK
 name=useless warning, likely DrMemory bug
 *
diff --git a/src/detect-engine.c b/src/detect-engine.c
index 094efd830a..ebf6202212 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -1408,18 +1408,32 @@ TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data) {
     if (det_ctx->bj_values != NULL)
         SCFree(det_ctx->bj_values);
 
+    /* HHD temp storage */
+    for (i = 0; i < det_ctx->hhd_buffers_size; i++) {
+        if (det_ctx->hhd_buffers[i] != NULL)
+            SCFree(det_ctx->hhd_buffers[i]);
+    }
+    if (det_ctx->hhd_buffers)
+        SCFree(det_ctx->hhd_buffers);
+    det_ctx->hhd_buffers = NULL;
+    if (det_ctx->hhd_buffers_len)
+        SCFree(det_ctx->hhd_buffers_len);
+    det_ctx->hhd_buffers_len = NULL;
+
+    /* HSBD */
     if (det_ctx->hsbd != NULL) {
-        SCLogDebug("det_ctx hsbd %u", det_ctx->hsbd_buffers_list_len);
-        for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
+        SCLogDebug("det_ctx hsbd %u", det_ctx->hsbd_buffers_size);
+        for (i = 0; i < det_ctx->hsbd_buffers_size; i++) {
             if (det_ctx->hsbd[i].buffer != NULL)
                 SCFree(det_ctx->hsbd[i].buffer);
         }
         SCFree(det_ctx->hsbd);
     }
 
+    /* HSCB */
     if (det_ctx->hcbd != NULL) {
-        SCLogDebug("det_ctx hcbd %u", det_ctx->hcbd_buffers_list_len);
-        for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
+        SCLogDebug("det_ctx hcbd %u", det_ctx->hcbd_buffers_size);
+        for (i = 0; i < det_ctx->hcbd_buffers_size; i++) {
             if (det_ctx->hcbd[i].buffer != NULL)
                 SCFree(det_ctx->hcbd[i].buffer);
             SCLogDebug("det_ctx->hcbd[i].buffer_size %u", det_ctx->hcbd[i].buffer_size);