0

This is Valgrind output for my program which I use for parsing .pcap files.

I may not paste the source of the program here, unfortunately... The thing is, that I do not have any memcpy(...) call in plugin_input_get_flow(...) When I run the program without valgrind, It works perfectly. Is this possible? Does it indicate, I am using libpcap library in wrong way

Invalid write of size 1
==18228==    at 0x4A08877: memcpy (mc_replace_strmem.c:587)
==18228==    by 0x5229E9A: plugin_input_get_flow (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x409EA0: sw_get_flow_thread (in /usr/bin/flowmonexp)
==18228==    by 0x363600673C: start_thread (in /lib64/libpthread-2.5.so)
==18228==    by 0x36354D3D1C: clone (in /lib64/libc-2.5.so)
==18228==  Address 0xc3d2d5f is 1 bytes before a block of size 568 alloc'd
==18228==    at 0x4A0610C: malloc (vg_replace_malloc.c:195)
==18228==    by 0x3635461709: __fopen_internal (in /lib64/libc-2.5.so)
==18228==    by 0x3635C13A5C: pcap_open_offline (in /usr/lib64/libpcap.so.0.9.4)
==18228==    by 0x5229A3A: plugin_input_init (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x40974C: sw_init (in /usr/bin/flowmonexp)
==18228==    by 0x4115B5: main (in /usr/bin/flowmonexp)
==18228== 
==18228== Invalid write of size 1
==18228==    at 0x4A0887D: memcpy (mc_replace_strmem.c:587)
==18228==    by 0x5229E9A: plugin_input_get_flow (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x409EA0: sw_get_flow_thread (in /usr/bin/flowmonexp)
==18228==    by 0x363600673C: start_thread (in /lib64/libpthread-2.5.so)
==18228==    by 0x36354D3D1C: clone (in /lib64/libc-2.5.so)
==18228==  Address 0xc3d2d5e is 2 bytes before a block of size 568 alloc'd
==18228==    at 0x4A0610C: malloc (vg_replace_malloc.c:195)
==18228==    by 0x3635461709: __fopen_internal (in /lib64/libc-2.5.so)
==18228==    by 0x3635C13A5C: pcap_open_offline (in /usr/lib64/libpcap.so.0.9.4)
==18228==    by 0x5229A3A: plugin_input_init (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x40974C: sw_init (in /usr/bin/flowmonexp)
==18228==    by 0x4115B5: main (in /usr/bin/flowmonexp)
==18228== 
==18228== Invalid write of size 1
==18228==    at 0x4A08884: memcpy (mc_replace_strmem.c:587)
==18228==    by 0x5229E9A: plugin_input_get_flow (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x409EA0: sw_get_flow_thread (in /usr/bin/flowmonexp)
==18228==    by 0x363600673C: start_thread (in /lib64/libpthread-2.5.so)
==18228==    by 0x36354D3D1C: clone (in /lib64/libc-2.5.so)
==18228==  Address 0xc3d2d5d is 3 bytes before a block of size 568 alloc'd
==18228==    at 0x4A0610C: malloc (vg_replace_malloc.c:195)
==18228==    by 0x3635461709: __fopen_internal (in /lib64/libc-2.5.so)
==18228==    by 0x3635C13A5C: pcap_open_offline (in /usr/lib64/libpcap.so.0.9.4)
==18228==    by 0x5229A3A: plugin_input_init (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x40974C: sw_init (in /usr/bin/flowmonexp)
==18228==    by 0x4115B5: main (in /usr/bin/flowmonexp)
==18228== 
==18228== Invalid write of size 1
==18228==    at 0x4A0888F: memcpy (mc_replace_strmem.c:587)
==18228==    by 0x5229E9A: plugin_input_get_flow (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x409EA0: sw_get_flow_thread (in /usr/bin/flowmonexp)
==18228==    by 0x363600673C: start_thread (in /lib64/libpthread-2.5.so)
==18228==    by 0x36354D3D1C: clone (in /lib64/libc-2.5.so)
==18228==  Address 0xc3d2d5c is 4 bytes before a block of size 568 alloc'd
==18228==    at 0x4A0610C: malloc (vg_replace_malloc.c:195)
==18228==    by 0x3635461709: __fopen_internal (in /lib64/libc-2.5.so)
==18228==    by 0x3635C13A5C: pcap_open_offline (in /usr/lib64/libpcap.so.0.9.4)
==18228==    by 0x5229A3A: plugin_input_init (in /home/flowmon/ipfix/flowmon-http-plugins-1.0/src/input-http/.libs/flowmon-input-http.so)
==18228==    by 0x40974C: sw_init (in /usr/bin/flowmonexp)
==18228==    by 0x4115B5: main (in /usr/bin/flowmonexp)
Tomáš Šíma
  • 834
  • 7
  • 26
  • 1
    The compiler can call memcpy if it wants to do some sort of structure to structure copy. I've seen that before. I'm not a valgrind expert, but seeing all those 1 byte before buffer writes would scare me and I'd start looking at all array accesses - looking for array over or underwrites. – Michael Dorgan Feb 21 '13 at 23:54
  • Can you post the source for `mc_replace_strmem.c:587` and surrounding lines? – Austin Phillips Feb 22 '13 at 00:28
  • I respect that you can't provide code for commercial or sensitive packages, but you could at least derive a minimal compilable testcase that demonstrates these symptoms, and post that. "Minimal" means you'd be stripping away anything that isn't required to demonstrate the problem. "Compilable" means that we can compile it on our systems without having to fill in blanks or fix errors. When you want help, sometimes you have to help the helpers to identify the problem. – autistic Feb 22 '13 at 03:28
  • Michael : Thanks for hint! Austin : I do not know, how to find it. I don't even call `memcpy(...)` in my code! modifiable lvalue : I would do this, but I am writing a library for greater (non public) framework, so I cant give you example just by stripping my code. The core of my question is, how to debug memory leak in `memcpy` as reported, when I do not call `memcpy(...)` anywhere in my source... – Tomáš Šíma Feb 23 '13 at 15:21

0 Answers0