FreeTDS Development Group

[<Mitchell_Freed AT McAfee.com>]

Here is the debug log, backtrace from gdb and output from valgrind.

- Mitch

On 03/01/2012 02:31 PM, Frediano Ziglio wrote:

Tried to reproduce without success. Valgrind is always happy too :(
Can you try to enable logging?

Frediano


2012/3/1  <Mitchell_Freed AT mcafee.com><mailto:Mitchell_Freed AT mcafee.com>:
> I'll see if I can track down exactly where it's getting confused.
>
> - Mitch
>
> On 02/29/2012 06:44 PM, James K. Lowden wrote:
>
> On Wed, 29 Feb 2012 08:58:39 -0800
> <Mitchell_Freed AT McAfee.com><mailto:Mitchell_Freed AT McAfee.com><mailto:Mitchell_Freed AT McAfee.com>
>  wrote:
>
>> The error occurs in mem.c when trying to free the TDSLOGIN*. I
>> noticed that the TDSLOGIN* allocated in tds_alloc_login is a
>> different pointer than the one being passed to tds_free_login.
>> Looking into it a bit closer the tds_free_login is failing on the
>> TDSLOGIN* allocated from tds_alloc_connection -- if that helps.
>
> On the error path from a connection failure, ct_connect() calls a host
> of free_* routines, some of which call other freers, some through
> pointers.  It's possible something goes wrong.  Not obvious, but
> possible.
>
> You could attack it through your malloc(3).  Most C standard libraries
> have ways to make invalid frees fail in a noisy way.
>
> Thanks for reporting the problem...
>
> --jkl
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org<mailto:FreeTDS AT lists.ibiblio.org><mailto:FreeTDS AT lists.ibiblio.org>
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org<mailto:FreeTDS AT lists.ibiblio.org>
> http://lists.ibiblio.org/mailman/listinfo/freetds
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org<mailto:FreeTDS AT lists.ibiblio.org>
http://lists.ibiblio.org/mailman/listinfo/freetds
log.c:194:Starting log file for FreeTDS 0.92.dev.20120227
	on 2012-03-02 20:33:23 with debug flags 0x4fff.
iconv.c:328:tds_iconv_open(0x8064180, ISO-8859-1)
iconv.c:185:local name for ISO-8859-1 is ISO-8859-1
iconv.c:185:local name for UTF-8 is UTF-8
iconv.c:185:local name for UCS-2LE is UCS-2LE
iconv.c:185:local name for UCS-2BE is UCS-2BE
iconv.c:347:setting up conversions for client charset "ISO-8859-1"
iconv.c:349:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
iconv.c:389:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
iconv.c:392:tds_iconv_open: done
net.c:203:Connecting to 10.0.2.231 port 1296500121 (TDS version 7.0)
net.c:269:tds_open_socket: connect(2) returned "Operation now in progress"
net.c:309:tds_open_socket() succeeded
util.c:159:Changed query state from DEAD to IDLE
login.c:790:quietly sending TDS 7+ login packet
token.c:312:tds_process_login_tokens()
net.c:567:Received header
0000 04 01 00 72 00 35 01 00-                        |...r.5..|

net.c:621:Received packet
0000 04 01 00 72 00 35 01 00-aa 5e 00 18 48 00 00 01 |...r.5.. .^..H...|
0010 0e 21 00 4c 00 6f 00 67-00 69 00 6e 00 20 00 66 |.!.L.o.g .i.n. .f|
0020 00 61 00 69 00 6c 00 65-00 64 00 20 00 66 00 6f |.a.i.l.e .d. .f.o|
0030 00 72 00 20 00 75 00 73-00 65 00 72 00 20 00 27 |.r. .u.s .e.r. .'|
0040 00 77 00 65 00 62 00 73-00 65 00 6e 00 73 00 65 |.w.e.b.s .e.n.s.e|
0050 00 27 00 2e 00 08 57 00-45 00 42 00 53 00 45 00 |.'....W. E.B.S.E.|
0060 4e 00 53 00 45 00 00 01-00 fd 02 00 00 00 00 00 |N.S.E... ........|
0070 00 00                  -                        |..|

token.c:321:looking for login token, got  aa(ERROR)
token.c:107:tds_process_default_tokens() marker is aa(ERROR)
token.c:2180:tds_process_msg() reading message 18456 from server
token.c:2253:tds_process_msg() calling client msg handler
ctutil.c:150:_ct_handle_server_message(0x8063250, 0x8064180, 0xf4175e38)
ct.c:1861:ct_close(0x8063648, 301)
mem.c:594:tds_free_all_results()
util.c:159:Changed query state from IDLE to DEAD
token.c:2266:tds_process_msg() returning TDS_SUCCESS
token.c:321:looking for login token, got  fd(DONE)
token.c:107:tds_process_default_tokens() marker is fd(DONE)
token.c:1931:tds_process_end: more_results = 0
		was_cancelled = 0
		error = 1
		done_count_valid = 0
token.c:1947:                rows_affected = 24117248
token.c:1950:tds_process_end() state set to TDS_IDLE
util.c:159:Changed query state from DEAD to IDLE
token.c:423:tds_process_login_tokens() returning TDS_FAIL
login.c:465:login packet accepted
util.c:315:tdserror(0x8063250, 0x8064180, 20056, 9)
ctutil.c:96:_ct_handle_client_message(0x8063250, 0x8064180, 0xf4175edc)
util.c:345:tdserror: client library returned TDS_INT_CANCEL(2)
util.c:368:tdserror: returning TDS_INT_CANCEL(2)
util.c:159:Changed query state from IDLE to DEAD
util.c:315:tdserror(0x8063250, 0x8064180, 20002, 0)
ctutil.c:96:_ct_handle_client_message(0x8063250, 0x8064180, 0xf4175f0c)
util.c:345:tdserror: client library returned TDS_INT_CANCEL(2)
util.c:368:tdserror: returning TDS_INT_CANCEL(2)
(gdb) bt
#0  0xf7fdf430 in __kernel_vsyscall ()
#1  0xf7d9c870 in *__GI_raise (sig=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xf7d9e0a8 in *__GI_abort () at abort.c:88
#3  0xf7dd8165 in __libc_message (do_abort=2, fmt=0xf7e973e8 "*** glibc 
detected *** %s: %s: 0x%s ***\n") at 
../sysdeps/unix/sysv/linux/libc_fatal.c:170
#4  0xf7dddfd4 in malloc_printerr (action=2, str=0xf7e942b1 "corrupted 
double-linked list", ptr=0x8064320) at malloc.c:5994
#5  0xf7ddf697 in _int_free (av=0xf7eb2140, mem=0x8064500) at malloc.c:4717
#6  0xf7ddf8ac in *__GI___libc_free (mem=0x8064500) at malloc.c:3625
#7  0xf7f59f97 in tds_free_login (login=0x8064500) at mem.c:1066
#8  0xf7f4930a in ct_connect (con=0x8063648, servername=0x8063688 
"10.0.2.231", snamelen=-9) at ct.c:657
==2770== Memcheck, a memory error detector
==2770== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==2770== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==2770== Command: ./gsql
==2770== 
Mar 02 20:35:18 Server message; number 18456 severity 14 state 1 line 1; 
server: WEBSENSE; Login failed for user 'websense'.
==2770== Thread 5:
==2770== Invalid read of size 4
==2770==    at 0x494739C: tds_get_byte (read.c:70)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c9a0 is 80 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x49473A2: tds_get_byte (read.c:70)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c9a8 is 88 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x49473AC: tds_get_byte (read.c:74)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c994 is 68 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x49473B2: tds_get_byte (read.c:74)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c9a0 is 80 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 1
==2770==    at 0x49473B8: tds_get_byte (read.c:74)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7b0a529 is 105 bytes inside a block of size 114 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B27F: tds_free_socket (mem.c:1138)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid write of size 4
==2770==    at 0x49473C4: tds_get_byte (read.c:74)
==2770==    by 0x493E0C2: tds_process_login_tokens (token.c:320)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c9a0 is 80 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x493D966: tds_process_default_tokens (token.c:109)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c950 is 0 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x49611BB: tds_close_socket (net.c:324)
==2770==    by 0x493D9A8: tds_process_default_tokens (token.c:111)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c950 is 0 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x49611BB: tds_close_socket (net.c:324)
==2770==    by 0x4945B9C: tds_connect (login.c:466)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c950 is 0 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x4945BA0: tds_connect (login.c:467)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c960 is 16 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x4938E6A: _ct_handle_client_message (ctutil.c:98)
==2770==    by 0x4944D2D: tdserror (util.c:344)
==2770==    by 0x4945BC1: tds_connect (login.c:467)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c95c is 12 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
==2770== Invalid read of size 4
==2770==    at 0x4938E74: _ct_handle_client_message (ctutil.c:99)
==2770==    by 0x4944D2D: tdserror (util.c:344)
==2770==    by 0x4945BC1: tds_connect (login.c:467)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770==    by 0x804C58C: client_connect (client.c:100)
==2770==    by 0x8052025: connect_client (main.c:163)
==2770==    by 0x8052143: process_client (main.c:215)
==2770==    by 0x490F10E: start_thread (pthread_create.c:297)
==2770==    by 0x6E38BED: clone (clone.S:133)
==2770==  Address 0x7a9c95c is 12 bytes inside a block of size 244 free'd
==2770==    at 0x48CBC0C: free (vg_replace_malloc.c:427)
==2770==    by 0x493B2E3: tds_free_socket (mem.c:1148)
==2770==    by 0x492CC56: ct_close (ct.c:1863)
==2770==    by 0x805B55D: servermsg_cb (tdsclient.c:363)
==2770==    by 0x493925A: _ct_handle_server_message (ctutil.c:182)
==2770==    by 0x4942C30: tds_process_msg (token.c:2254)
==2770==    by 0x493DAED: tds_process_default_tokens (token.c:142)
==2770==    by 0x493E4E7: tds_process_login_tokens (token.c:407)
==2770==    by 0x4945B2D: tds_connect (login.c:464)
==2770==    by 0x4945D9C: tds_connect_and_login (login.c:506)
==2770==    by 0x492A294: ct_connect (ct.c:646)
==2770==    by 0x805A6FE: tdsclient_connect (tdsclient.c:148)
==2770== 
Mar 02 20:35:18 Server message; number 18456 severity 14 state 1 line 1; 
server: WEBSENSE; Login failed for user 'websense'.
Mar 02 20:35:18 Server message; number 18456 severity 14 state 1 line 1; 
server: WEBSENSE; Login failed for user 'websense'.
Mar 02 20:35:18 Server message; number 18456 severity 14 state 1 line 1; 
server: WEBSENSE; Login failed for user 'websense'.
Mar 02 20:35:18 Server message; number 18456 severity 14 state 1 line 1; 
server: WEBSENSE; Login failed for user 'websense'.
























































76
==2770== 
==2770== HEAP SUMMARY:
==2770==     in use at exit: 220 bytes in 6 blocks
==2770==   total heap usage: 3,105 allocs, 3,099 frees, 923,421 bytes 
allocated
==2770== 
==2770== LEAK SUMMARY:
==2770==    definitely lost: 0 bytes in 0 blocks
==2770==    indirectly lost: 0 bytes in 0 blocks
==2770==      possibly lost: 0 bytes in 0 blocks
==2770==    still reachable: 220 bytes in 6 blocks
==2770==         suppressed: 0 bytes in 0 blocks
==2770== Rerun with --leak-check=full to see details of leaked memory
==2770== 
==2770== For counts of detected and suppressed errors, rerun with: -v
==2770== ERROR SUMMARY: 60 errors from 12 contexts (suppressed: 47 from 8)