["phishjam78@xxxxxxxxx" <phishjam78@xxxxxxxxx>]

Still no luck fixing this memory leak...  I am using Wireshark v 1.2.0 code as a base.  I have looked into tshark, file, and rawshark very closely and I believe I am actually freeing more memory than they are, but still have not been able to figure out why field_info associated with "ti" below is not being free'd.  

Thoughts?  Anyone?

________________________________
From: "phishjam78@xxxxxxxxx" <phishjam78@xxxxxxxxx>
To: wireshark-dev@xxxxxxxxxxxxx
Sent: Thursday, July 30, 2009 7:38:15 PM
Subject: Memory Leak?


I have been rolling my own version of "tshark" for a project.  I needed to do a few things differently, but wanted all the awesomness of the dissectors to work for me.  I have been looking at a few reported memory leaks (via Valgrind) and there are two that are really stumping me.  I am wondering if I am setting up someting wrong or not freeing something properly.

I build my edt pointer by:


edt = epan_dissect_new(create_proto_tree, TRUE);


Then I fill out requisite information, call the ep_free_all() and then dissect_ip.  Within dissect_ip()...

if (tree) {
    ti = proto_tree_add_item(tree, proto_ip, tvb, offset, hlen, FALSE);


the "ti" pointer has a frame_info that never seems to get free'd.  If I manually try to free it after dissection, bad things happen.
Then, once dissect_ip returns, I get my data out, and call the contents of epan_dissect_free().


/* Free the data sources list. */
    free_data_sources(&edt->pi);

    /* Free all tvb's created from this tvb, unless dissector
     * wanted to store the pointer (in which case, the dissector
     * would have incremented the usage count on that tvbuff_t*) */
    tvb_free_chain(edt->tvb);

    if (edt->tree) {
        proto_tree_free(edt->tree);
    }

    g_free(edt);

>From there, edt->tree doesn't seem to have its members properly deleted.  The "rest" of the tree seems to go away, but not the "root" node itself.


When running for only a few minutes, I can see the memory creep up and multiple controlled valgrind runs confirmed what I am seeing.  I am a bit stumped.  


Could I not be setting up the edt pointer correctly or fillint out its members correctly?  


Is there something else I need to do when cleaning up?  

Do I HAVE to use the tap_queue_init(edt) and tap_push_tapped_queue(edt) functions?


Overall, the app works perfectly...except for some pesky memory leaks.  Any and all help/ideas would be greatly appreciated!

- John