[Bro-Dev] dfa_state does not free its cache

Martina Balintova balint.martina at gmail.com
Wed May 13 08:26:02 PDT 2015


Hi,

Dfa_state_cache does not follow its max size limit and it can run over this
limit quite easily. I am not sure what kind of data are stored in the
cache, so I am hesitant to fix the bug. Could you please take a look at it
with relation to file analyzer?

I use bro 2.3-397. In one of the protocol analyzers, I call
file_mgr->DataIn() and later file_mgr->EndOfFile(). Valgrind shows that if
you run it on traffic with a lot of files to analyze, memory builds (and is
not freed) at this path:

file_analysis::File::DetectMime() (File.cc:304)
file_analysis::Manager::DetectMime
RuleMatcher::Match
RE_Match_State::Match
DFa_State::Xtion
DFA_State::ComputeXtion
DFA_Machine::StateSetToDFA_State
DFA_State::DFA_State

Any hint how to fix DFA_State and RE.cc?
Thank you,
Martina
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20150513/81bb44dc/attachment.html 


More information about the bro-dev mailing list