[gmime-devel] Possible memory leakage in gmime

[Vsevolod Stakhov <vsevolod highsecure ru>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I'm using gmime (ver 2.2.21) for writing spam filter and found that I
have strange memory issues with it. I wrote a simple test, that can be
found here:
http://cebka.pp.ru/stuff/test_gmime_mem.c

In short words it process in infinite cycle messages from command line
(using mmapped memory to repeat conditions in my filter). When I run
this test it uses more and more memory (memory usage increasing rate is
not very high but it is definitely exists).

Then I ran this test with valgrind and got such results:

==9026== 11,592 bytes in 23 blocks are still reachable in loss record
456 of 459
==9026==    at 0x4023C4A: memalign (vg_replace_malloc.c:460)
==9026==    by 0x4023CFE: posix_memalign (vg_replace_malloc.c:569)
==9026==    by 0x4094352: slab_allocator_alloc_chunk (gslice.c:1136)
==9026==    by 0x4095B32: g_slice_alloc (gslice.c:666)
==9026==    by 0x4095C34: g_slice_alloc0 (gslice.c:833)
==9026==    by 0x41AAE0A: g_type_create_instance (gtype.c:1654)
==9026==    by 0x418F3D4: g_object_constructor (gobject.c:1334)
==9026==    by 0x418FC05: g_object_newv (gobject.c:1211)
==9026==    by 0x41907D6: g_object_new_valist (gobject.c:1274)
==9026==    by 0x419094D: g_object_new (gobject.c:1056)
==9026==    by 0x4129C2A: g_mime_stream_mem_new (gmime-stream-mem.c:301)
==9026==    by 0x8048FF4: mime_foreach_callback (test_gmime_mem.c:49)
==9026==    by 0x4115BD5: g_mime_multipart_foreach (gmime-multipart.c:767)
==9026==    by 0x4112F93: g_mime_message_foreach_part (gmime-message.c:1621)
==9026==    by 0x80492DE: main (test_gmime_mem.c:115)
....
==9026== 4,536 bytes in 9 blocks are still reachable in loss record 455
of 459
==9026==    at 0x4023C4A: memalign (vg_replace_malloc.c:460)
==9026==    by 0x4023CFE: posix_memalign (vg_replace_malloc.c:569)
==9026==    by 0x4094352: slab_allocator_alloc_chunk (gslice.c:1136)
==9026==    by 0x4095B32: g_slice_alloc (gslice.c:666)
==9026==    by 0x4095C34: g_slice_alloc0 (gslice.c:833)
==9026==    by 0x41AAE0A: g_type_create_instance (gtype.c:1654)
==9026==    by 0x418F3D4: g_object_constructor (gobject.c:1334)
==9026==    by 0x418FC05: g_object_newv (gobject.c:1211)
==9026==    by 0x41907D6: g_object_new_valist (gobject.c:1274)
==9026==    by 0x419094D: g_object_new (gobject.c:1056)
==9026==    by 0x4129B85: stream_substream (gmime-stream-mem.c:279)
==9026==    by 0x4122DD4: g_mime_stream_substream (gmime-stream.c:433)
==9026==    by 0x411DDCE: parser_scan_mime_part_content
(gmime-parser.c:1300)
==9026==    by 0x411E1A9: parser_construct_leaf_part (gmime-parser.c:1388)
==9026==    by 0x411E4DF: parser_scan_multipart_subparts
(gmime-parser.c:1492)
==9026==    by 0x411E718: parser_construct_multipart (gmime-parser.c:1546)
==9026==    by 0x411EB55: parser_construct_message (gmime-parser.c:1655)
==9026==    by 0x411EC4E: g_mime_parser_construct_message
(gmime-parser.c:1683)
==9026==    by 0x80492B5: main (test_gmime_mem.c:110)
....
==9026== 4,464 bytes in 18 blocks are possibly lost in loss record 454
of 459
==9026==    at 0x4023C4A: memalign (vg_replace_malloc.c:460)
==9026==    by 0x4023CFE: posix_memalign (vg_replace_malloc.c:569)
==9026==    by 0x4094352: slab_allocator_alloc_chunk (gslice.c:1136)
==9026==    by 0x4095B32: g_slice_alloc (gslice.c:666)
==9026==    by 0x404F8AE: g_array_sized_new (garray.c:86)
==9026==    by 0x404F999: g_byte_array_new (garray.c:635)
==9026==    by 0x411E26E: parser_scan_multipart_face (gmime-parser.c:1425)
==9026==    by 0x411E770: parser_construct_multipart (gmime-parser.c:1552)
==9026==    by 0x411EB55: parser_construct_message (gmime-parser.c:1655)
==9026==    by 0x411EC4E: g_mime_parser_construct_message
(gmime-parser.c:1683)
==9026==    by 0x80492B5: main (test_gmime_mem.c:110)
....
==9026== 1,512 bytes in 3 blocks are still reachable in loss record 445
of 459
==9026==    at 0x4023C4A: memalign (vg_replace_malloc.c:460)
==9026==    by 0x4023CFE: posix_memalign (vg_replace_malloc.c:569)
==9026==    by 0x4094352: slab_allocator_alloc_chunk (gslice.c:1136)
==9026==    by 0x4095B32: g_slice_alloc (gslice.c:666)
==9026==    by 0x4095C34: g_slice_alloc0 (gslice.c:833)
==9026==    by 0x41AAE0A: g_type_create_instance (gtype.c:1654)
==9026==    by 0x418F3D4: g_object_constructor (gobject.c:1334)
==9026==    by 0x418FC05: g_object_newv (gobject.c:1211)
==9026==    by 0x41907D6: g_object_new_valist (gobject.c:1274)
==9026==    by 0x419094D: g_object_new (gobject.c:1056)
==9026==    by 0x4129B85: stream_substream (gmime-stream-mem.c:279)
==9026==    by 0x4122DD4: g_mime_stream_substream (gmime-stream.c:433)
==9026==    by 0x411DDCE: parser_scan_mime_part_content
(gmime-parser.c:1300)
==9026==    by 0x411E1A9: parser_construct_leaf_part (gmime-parser.c:1388)
==9026==    by 0x411E4DF: parser_scan_multipart_subparts
(gmime-parser.c:1492)
==9026==    by 0x411E718: parser_construct_multipart (gmime-parser.c:1546)
==9026==    by 0x411E4C1: parser_scan_multipart_subparts
(gmime-parser.c:1490)
==9026==    by 0x411E718: parser_construct_multipart (gmime-parser.c:1546)
==9026==    by 0x411EB55: parser_construct_message (gmime-parser.c:1655)
==9026==    by 0x411EC4E: g_mime_parser_construct_message
(gmime-parser.c:1683)
==9026==    by 0x80492B5: main (test_gmime_mem.c:110)


Also during run I got sometimes this error:
==9214== Conditional jump or move depends on uninitialised value(s)
==9214==    at 0x411D82F: check_boundary (gmime-parser.c:1130)
==9214==    by 0x411DAD3: parser_scan_content (gmime-parser.c:1222)
==9214==    by 0x411DC8A: parser_scan_mime_part_content
(gmime-parser.c:1284)
==9214==    by 0x411E1A9: parser_construct_leaf_part (gmime-parser.c:1388)
==9214==    by 0x411EB73: parser_construct_message (gmime-parser.c:1657)
==9214==    by 0x411EC4E: g_mime_parser_construct_message
(gmime-parser.c:1683)
==9214==    by 0x80492B5: main (test_gmime_mem.c:110)

I can do same test on the recent gmime24, but I'd like to use gmime22 in
production.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAknLT+sACgkQ4Gg1vsCGe4uNyQCfYyg5G/gGA6xXb1n3i0IL30Nz
rTQAnRzG5p9/3/QBA234Yo8lneoI54ST
=ff+Q
-----END PGP SIGNATURE-----