liblber/i.o.c ber_realloc() memory leak (ITS#1064)

[ariel@yahoo-inc.com]

Full_Name: Ariel Faigon
Version: 1.2.11
OS: FreeBSD 2.x 3.x 4.x
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (206.251.16.64)


Forwarding from an earlier message to Kurt.  I just verified
that a diff between the version of io.c I'm using and the latest
source has no related fix, so I'm pretty certain this bug still
lurks in there.

>In several cases it seems that when ber_write() calls
>ber_realloc() the malloc'ed buffer of 1024 chars is left dangling.
>
>Looking at the source, I suspect they are not marked as 'need free'
>so they are not released later by ber_flush(). ???
>
>Another case is BerThing::GetBerElement -> ber_alloc_t -> calloc(),
>never freed.
>
>For your convenience, here are the "always malloc, never free"
>code-paths we're seeing (note the sizes and number of frees vs mallocs):
>
>Could you take a look?   Thanks!
>
>+-- leako: potential memory leak: 4 allocs, 0 frees
>|   allocation size per-call (min max avg): 1024 1024 1024
>|   most recent stack trace:
>#0  0x282f3aad in malloc () from /usr/lib/compat/libc.so.3
>#1  0x281bcff1 in ber_realloc () from /usr/lib/libInt.so
>#2  0x281bce9a in ber_write () from /usr/lib/libInt.so
>#3  0x281bd999 in ber_put_tag () from /usr/lib/libInt.so
>#4  0x281bdc28 in ber_put_ostring () from /usr/lib/libInt.so
>#5  0x281be355 in ber_printf () from /usr/lib/libInt.so
>[bottom of stack deleted]
>
>+-- leako: potential memory leak: 18 allocs, 0 frees
>|   allocation size per-call (min max avg): 44 44 44
>|   most recent stack trace:
>#0  0x282f3aad in malloc () from /usr/lib/compat/libc.so.3
>#1  0x282ec25f in calloc () from /usr/lib/compat/libc.so.3
>#2  0x281bd2d0 in ber_alloc_t () from /usr/lib/libInt.so
>#3  0x281c3221 in BerThing::GetBerElement (this=0x8254110, nc=@0x819da04)
>    at BerThing.C:142
>[bottom of stack deleted]
>
>
>+-- leako: potential memory leak: 5 allocs, 0 frees
>|   allocation size per-call (min max avg): 1024 1024 1024
>|   most recent stack trace:
>#0  0x282f3aad in malloc () from /usr/lib/compat/libc.so.3
>#1  0x281bcff1 in ber_realloc () from /usr/lib/libInt.so
>#2  0x281bcf09 in ber_write () from /usr/lib/libInt.so
>#3  0x281bd999 in ber_put_tag () from /usr/lib/libInt.so
>#4  0x281bdb3e in ber_put_int_or_enum () from /usr/lib/libInt.so
>#5  0x281bdbf1 in ber_put_int () from /usr/lib/libInt.so
>#6  0x281be302 in ber_printf () from /usr/lib/libInt.so
>[bottom of stack deleted]
>  
>+-- leako: potential memory leak: 18 allocs, 0 frees
>|   allocation size per-call (min max avg): 1024 1024 1024
>|   most recent stack trace:
>#0  0x282f3aad in malloc () from /usr/lib/compat/libc.so.3
>#1  0x281bcff1 in ber_realloc () from /usr/lib/libInt.so
>#2  0x281bce9a in ber_write () from /usr/lib/libInt.so
>#3  0x281bd999 in ber_put_tag () from /usr/lib/libInt.so
>#4  0x281bdc28 in ber_put_ostring () from /usr/lib/libInt.so
>#5  0x281be355 in ber_printf () from /usr/lib/libInt.so
>[bottom of stack deleted]
>
>
>+-- leako: potential memory leak: 4 allocs, 0 frees
>|   allocation size per-call (min max avg): 44 44 44
>|   most recent stack trace:
>#0  0x282f3aad in malloc () from /usr/lib/compat/libc.so.3
>#1  0x282ec25f in calloc () from /usr/lib/compat/libc.so.3
>#2  0x281bd2d0 in ber_alloc_t () from /usr/lib/libInt.so
>#3  0x281c3221 in BerThing::GetBerElement (this=0x8254110, nc=@0x819dc74)
>    at BerThing.C:142
>[bottom of stack deleted]