[Bro-Dev] Memory leaks on git eds2245

[Martin Holste]

I'm finding that Bro leaks memory heavily whenever it drops packets,
such that if overwhelmed, it will consume all memory on a beefy box in
minutes.  Even under a slight load, there appears to be memory
leakage.  Here's the tail end of a valgrind:

==4477== 479,944 (128 direct, 479,816 indirect) bytes in 1 blocks are
definitely lost in loss record 5,304 of 5,306
==4477==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==4477==    by 0x554FF21: CRYPTO_malloc (in /lib/libcrypto.so.0.9.8)
==4477==    by 0x55E3D96: X509_STORE_new (in /lib/libcrypto.so.0.9.8)
==4477==    by 0x5AAED4: BifFunc::bro_x509_verify(Frame*, ValPList*)
(bro.bif:3449)
==4477==    by 0x59B88E: BuiltinFunc::Call(ValPList*, Frame*) const
(Func.cc:463)
==4477==    by 0x5888BD: CallExpr::Eval(Frame*) const (Expr.cc:4649)
==4477==    by 0x578169: AssignExpr::Eval(Frame*) const (Expr.cc:2598)
==4477==    by 0x63AFAF: ExprStmt::Exec(Frame*, stmt_flow_type&) const
(Stmt.cc:369)
==4477==    by 0x633E00: StmtList::Exec(Frame*, stmt_flow_type&) const
(Stmt.cc:1404)
==4477==    by 0x59C9A0: BroFunc::Call(ValPList*, Frame*) const (Func.cc:320)
==4477==    by 0x553A45: EventHandler::Call(ValPList*, bool)
(EventHandler.cc:73)
==4477==    by 0x5531B4: EventMgr::Dispatch() (Event.h:46)
==4477==
==4477== 974,513 (5,760 direct, 968,753 indirect) bytes in 72 blocks
are definitely lost in loss record 5,306 of 5,306
==4477==    at 0x4C27CC1: operator new(unsigned long) (vg_replace_malloc.c:261)
==4477==    by 0x4FD9AD: yyparse() (parse.y:610)
==4477==    by 0x50D437: main (main.cc:745)
==4477==
==4477== LEAK SUMMARY:
==4477==    definitely lost: 285,262 bytes in 14,318 blocks
==4477==    indirectly lost: 2,282,276 bytes in 39,468 blocks
==4477==      possibly lost: 139,163 bytes in 2,955 blocks
==4477==    still reachable: 9,741,975 bytes in 133,386 blocks
==4477==         suppressed: 0 bytes in 0 blocks
==4477== Reachable blocks (those to which a pointer was found) are not shown.
==4477== To see them, rerun with: --leak-check=full --show-reachable=yes
==4477==
==4477== For counts of detected and suppressed errors, rerun with: -v
==4477== Use --track-origins=yes to see where uninitialised values come from
==4477== ERROR SUMMARY: 222225 errors from 373 contexts (suppressed: 4 from 4)