radius segv some time after HUP?

Running under valgrind Line 484 in request_proccess.c reads rcode = proxy_send(request); I havent really started debugging this yet, but thought I would give valgrind a try after all the recent suggestions. If this is usefull or I can make it more so, Id be glad to. ==23224== Memcheck, a memory error detector for x86-linux. ==23224== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al. ==23224== Using valgrind-2.4.0, a program supervision framework for x86-linux. ==23224== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al. ==23224== ==23224== My PID = 23224, parent PID = 3602. Prog and args are: ==23224== ./src/main/.libs/radiusd ==23224== -fxx ==23224== For more details, rerun with: -v ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8ECB13: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E631C: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E631C: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8EC6B6: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8EC6C2: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8ECB13: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC24BA: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC2B85: _dl_open (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BCC407C: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC41DD: __libc_dlopen_mode (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC9EE68: __nss_lookup_function (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC9F00E: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1BCA0BCF: __nss_passwd_lookup (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC4D1BB: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==23224== ==23224== Conditional jump or move depends on uninitialised value(s) ==23224== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC24BA: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC2B85: _dl_open (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BCC407C: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==23224== by 0x1BCC41DD: __libc_dlopen_mode (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC9EE68: __nss_lookup_function (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC9F00E: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1BCA0BCF: __nss_passwd_lookup (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC4D1BB: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==23224== ==23224== Thread 2: ==23224== Use of uninitialised value of size 4 ==23224== at 0x1B909FA4: ??? ==23224== by 0x1B90AD8B: ??? ==23224== by 0x8056974: call_modsingle (modcall.c:254) ==23224== by 0x805707A: modcall (modcall.c:590) ==23224== by 0x8056A24: call_one (modcall.c:287) ==23224== by 0x8056B1E: call_modgroup (modcall.c:342) ==23224== by 0x8056FE9: modcall (modcall.c:575) ==23224== by 0x80559B1: indexed_modcall (modules.c:428) ==23224== by 0x8056527: module_accounting (modules.c:960) ==23224== by 0x804F6E6: rad_accounting (acct.c:68) ==23224== by 0x8065FFC: rad_respond (request_process.c:453) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== ==23224== Thread 5: ==23224== Invalid read of size 4 ==23224== at 0x80514B8: proxy_send (proxy.c:531) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659F9: listen_free (listen.c:2123) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Invalid read of size 4 ==23224== at 0x8051539: proxy_send (proxy.c:544) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659F9: listen_free (listen.c:2123) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Invalid read of size 4 ==23224== at 0x80632AC: proxy_socket_send (listen.c:635) ==23224== by 0x805154A: proxy_send (proxy.c:544) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5EBC is 36 bytes inside a block of size 40 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659F9: listen_free (listen.c:2123) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Invalid read of size 4 ==23224== at 0x80632D5: proxy_socket_send (listen.c:638) ==23224== by 0x805154A: proxy_send (proxy.c:544) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659F9: listen_free (listen.c:2123) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Invalid read of size 4 ==23224== at 0x806330A: proxy_socket_send (listen.c:640) ==23224== by 0x805154A: proxy_send (proxy.c:544) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5EF0 is 0 bytes inside a block of size 28 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659EB: listen_free (listen.c:2122) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Invalid read of size 4 ==23224== at 0x8063315: proxy_socket_send (listen.c:641) ==23224== by 0x805154A: proxy_send (proxy.c:544) ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x1BFE5F04 is 20 bytes inside a block of size 28 free'd ==23224== at 0x1B904B04: free (vg_replace_malloc.c:152) ==23224== by 0x80659EB: listen_free (listen.c:2122) ==23224== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== Thread 6: ==23224== Jump to the invalid address stated on the next line ==23224== at 0x48: ??? ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== Address 0x48 is not stack'd, malloc'd or (recently) free'd ==23224== ==23224== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==23224== Access not within mapped region at address 0x48 ==23224== at 0x48: ??? ==23224== by 0x8066081: rad_respond (request_process.c:484) ==23224== by 0x805AF10: request_handler_thread (threads.c:590) ==23224== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==23224== ==23224== ERROR SUMMARY: 794 errors from 15 contexts (suppressed: 0 from 0) ==23224== malloc/free: in use at exit: 1222706 bytes in 28495 blocks. ==23224== malloc/free: 48871 allocs, 20376 frees, 9806171 bytes allocated. ==23224== For counts of detected errors, rerun with: -v ==23224== searching for pointers to 28495 not-freed blocks. ==23224== checked 102635084 bytes. ==23224== ==23224== ==23224== 3 bytes in 1 blocks are definitely lost in loss record 1 of 39 ==23224== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==23224== by 0x1BC29D4F: strdup (in /lib/tls/libc-2.3.5.so) ==23224== by 0x8053783: cf_item_parse (conffile.c:747) ==23224== by 0x8053C40: cf_section_parse (conffile.c:896) ==23224== by 0x1C2C8E9E: ??? ==23224== by 0x80556C1: find_module_instance (modules.c:314) ==23224== by 0x80573D4: do_compile_modsingle (modcall.c:1038) ==23224== by 0x8057720: compile_modsingle (modcall.c:1142) ==23224== by 0x8055CA2: load_component_section (modules.c:554) ==23224== by 0x8056462: setup_modules (modules.c:908) ==23224== by 0x806230F: read_mainconfig (mainconfig.c:1088) ==23224== by 0x804D05B: main (radiusd.c:281) ==23224== ==23224== ==23224== 78 bytes in 3 blocks are definitely lost in loss record 5 of 39 ==23224== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==23224== by 0x1C0F13E7: ??? ==23224== by 0x1C0F1296: ??? ==23224== by 0x1C0CC145: ??? ==23224== by 0x1C0C49E2: ??? ==23224== by 0x1C0C4982: ??? ==23224== by 0x1C02E62D: ??? ==23224== by 0x1C02E717: ??? ==23224== by 0x1C02DEC5: ??? ==23224== by 0x1C02E0EF: ??? ==23224== by 0x1BCA5142: getservbyname_r (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BCA4FD8: getservbyname (in /lib/tls/libc-2.3.5.so) ==23224== ==23224== ==23224== 492 (108 direct, 384 indirect) bytes in 3 blocks are definitely lost in loss record 9 of 39 ==23224== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==23224== by 0x1BC9F179: (within /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC9F7C1: __nss_database_lookup (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1C00A139: ??? ==23224== by 0x1C00B8F4: ??? ==23224== by 0x1BC4D0B9: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==23224== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==23224== by 0x80610A1: radlogdir_iswritable (mainconfig.c:480) ==23224== by 0x8062175: read_mainconfig (mainconfig.c:1010) ==23224== by 0x804D05B: main (radiusd.c:281) ==23224== ==23224== ==23224== 528 bytes in 1 blocks are definitely lost in loss record 12 of 39 ==23224== at 0x1B904F75: calloc (vg_replace_malloc.c:175) ==23224== by 0x805E5D5: clients_init (client.c:143) ==23224== by 0x805EAD6: clients_parse_section (client.c:395) ==23224== by 0x80622BD: read_mainconfig (mainconfig.c:1071) ==23224== by 0x804D05B: main (radiusd.c:281) ==23224== ==23224== ==23224== 816 bytes in 12 blocks are possibly lost in loss record 15 of 39 ==23224== at 0x1B904F75: calloc (vg_replace_malloc.c:175) ==23224== by 0x1B8F16A7: (within /lib/ld-2.3.5.so) ==23224== by 0x1B8F197B: _dl_allocate_tls (in /lib/ld-2.3.5.so) ==23224== by 0x1B9434F0: pthread_create@@GLIBC_2.1 (in /lib/tls/libpthread-2.3.5.so) ==23224== by 0x805B1AD: spawn_thread (threads.c:720) ==23224== by 0x805B75D: thread_pool_clean (threads.c:1007) ==23224== by 0x804D88C: main (radiusd.c:735) ==23224== ==23224== ==23224== 816 bytes in 34 blocks are definitely lost in loss record 16 of 39 ==23224== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==23224== by 0x1B95FFA4: rbtree_create (rbtree.c:99) ==23224== by 0x805E81C: client_add (client.c:234) ==23224== by 0x805EDC9: clients_parse_section (client.c:487) ==23224== by 0x80622BD: read_mainconfig (mainconfig.c:1071) ==23224== by 0x804D50A: main (radiusd.c:549) ==23224== ==23224== LEAK SUMMARY: ==23224== definitely lost: 1533 bytes in 42 blocks. ==23224== indirectly lost: 384 bytes in 32 blocks. ==23224== possibly lost: 816 bytes in 12 blocks. ==23224== still reachable: 1219973 bytes in 28409 blocks. ==23224== suppressed: 0 bytes in 0 blocks. ==23224== Reachable blocks (those to which a pointer was found) are not shown. ==23224== To see them, rerun with: --show-reachable=yes ==13538== Memcheck, a memory error detector for x86-linux. ==13538== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al. ==13538== Using valgrind-2.4.0, a program supervision framework for x86-linux. ==13538== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al. ==13538== ==13538== My PID = 13538, parent PID = 3602. Prog and args are: ==13538== ./src/main/.libs/radiusd ==13538== -fxx ==13538== For more details, rerun with: -v ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8ECB13: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E631C: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E631C: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8EC6B6: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8EC6C2: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E6376: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F2BDD: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E7675: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8E47C6: (within /lib/ld-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8ECB13: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC24BA: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC2B85: _dl_open (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BCC407C: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC41DD: __libc_dlopen_mode (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC9EE68: __nss_lookup_function (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC9F00E: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1BCA0BCF: __nss_passwd_lookup (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC4D1BB: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==13538== ==13538== Conditional jump or move depends on uninitialised value(s) ==13538== at 0x1B8EC7D3: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC24BA: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC2B85: _dl_open (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BCC407C: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1B8EF026: (within /lib/ld-2.3.5.so) ==13538== by 0x1BCC41DD: __libc_dlopen_mode (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC9EE68: __nss_lookup_function (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC9F00E: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1BCA0BCF: __nss_passwd_lookup (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC4D1BB: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==13538== ==13538== Thread 3: ==13538== Use of uninitialised value of size 4 ==13538== at 0x1B909FA4: ??? ==13538== by 0x1B90AD8B: ??? ==13538== by 0x8056974: call_modsingle (modcall.c:254) ==13538== by 0x805707A: modcall (modcall.c:590) ==13538== by 0x8056A24: call_one (modcall.c:287) ==13538== by 0x8056B1E: call_modgroup (modcall.c:342) ==13538== by 0x8056FE9: modcall (modcall.c:575) ==13538== by 0x80559B1: indexed_modcall (modules.c:428) ==13538== by 0x8056527: module_accounting (modules.c:960) ==13538== by 0x804F6E6: rad_accounting (acct.c:68) ==13538== by 0x8065FFC: rad_respond (request_process.c:453) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== ==13538== Thread 8: ==13538== Invalid read of size 4 ==13538== at 0x80514B8: proxy_send (proxy.c:531) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x8051539: proxy_send (proxy.c:544) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x80632AC: proxy_socket_send (listen.c:635) ==13538== by 0x805154A: proxy_send (proxy.c:544) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5EBC is 36 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x80632D5: proxy_socket_send (listen.c:638) ==13538== by 0x805154A: proxy_send (proxy.c:544) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x806330A: proxy_socket_send (listen.c:640) ==13538== by 0x805154A: proxy_send (proxy.c:544) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5EF0 is 0 bytes inside a block of size 28 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659EB: listen_free (listen.c:2122) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x8063315: proxy_socket_send (listen.c:641) ==13538== by 0x805154A: proxy_send (proxy.c:544) ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x1BFE5F04 is 20 bytes inside a block of size 28 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659EB: listen_free (listen.c:2122) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Thread 1: ==13538== Invalid read of size 4 ==13538== at 0x80608FC: refresh_request (request_list.c:1283) ==13538== by 0x1B958537: lrad_hash_table_walk (hash.c:408) ==13538== by 0x806098A: rl_clean_list (request_list.c:1324) ==13538== by 0x80648D5: generic_update (listen.c:1513) ==13538== by 0x804D829: main (radiusd.c:719) ==13538== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x80632AC: proxy_socket_send (listen.c:635) ==13538== by 0x806090D: refresh_request (request_list.c:1283) ==13538== by 0x1B958537: lrad_hash_table_walk (hash.c:408) ==13538== by 0x806098A: rl_clean_list (request_list.c:1324) ==13538== by 0x80648D5: generic_update (listen.c:1513) ==13538== by 0x804D829: main (radiusd.c:719) ==13538== Address 0x1BFE5EBC is 36 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x80632D5: proxy_socket_send (listen.c:638) ==13538== by 0x806090D: refresh_request (request_list.c:1283) ==13538== by 0x1B958537: lrad_hash_table_walk (hash.c:408) ==13538== by 0x806098A: rl_clean_list (request_list.c:1324) ==13538== by 0x80648D5: generic_update (listen.c:1513) ==13538== by 0x804D829: main (radiusd.c:719) ==13538== Address 0x1BFE5EB0 is 24 bytes inside a block of size 40 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659F9: listen_free (listen.c:2123) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x806330A: proxy_socket_send (listen.c:640) ==13538== by 0x806090D: refresh_request (request_list.c:1283) ==13538== by 0x1B958537: lrad_hash_table_walk (hash.c:408) ==13538== by 0x806098A: rl_clean_list (request_list.c:1324) ==13538== by 0x80648D5: generic_update (listen.c:1513) ==13538== by 0x804D829: main (radiusd.c:719) ==13538== Address 0x1BFE5EF0 is 0 bytes inside a block of size 28 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659EB: listen_free (listen.c:2122) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Invalid read of size 4 ==13538== at 0x8063315: proxy_socket_send (listen.c:641) ==13538== by 0x806090D: refresh_request (request_list.c:1283) ==13538== by 0x1B958537: lrad_hash_table_walk (hash.c:408) ==13538== by 0x806098A: rl_clean_list (request_list.c:1324) ==13538== by 0x80648D5: generic_update (listen.c:1513) ==13538== by 0x804D829: main (radiusd.c:719) ==13538== Address 0x1BFE5F04 is 20 bytes inside a block of size 28 free'd ==13538== at 0x1B904B04: free (vg_replace_malloc.c:152) ==13538== by 0x80659EB: listen_free (listen.c:2122) ==13538== by 0x8062226: read_mainconfig (mainconfig.c:1045) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== Thread 30: ==13538== Jump to the invalid address stated on the next line ==13538== at 0x4: ??? ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== Address 0x4 is not stack'd, malloc'd or (recently) free'd ==13538== ==13538== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==13538== Access not within mapped region at address 0x4 ==13538== at 0x4: ??? ==13538== by 0x8066081: rad_respond (request_process.c:484) ==13538== by 0x805AF10: request_handler_thread (threads.c:590) ==13538== by 0x1B943CCC: start_thread (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x1BC8DB0D: clone (in /lib/tls/libc-2.3.5.so) ==13538== ==13538== ERROR SUMMARY: 15178 errors from 20 contexts (suppressed: 0 from 0) ==13538== malloc/free: in use at exit: 1228480 bytes in 28534 blocks. ==13538== malloc/free: 795431 allocs, 766897 frees, 330805373 bytes allocated. ==13538== For counts of detected errors, rerun with: -v ==13538== searching for pointers to 28534 not-freed blocks. ==13538== checked 77486988 bytes. ==13538== ==13538== ==13538== 3 bytes in 1 blocks are definitely lost in loss record 1 of 40 ==13538== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==13538== by 0x1BC29D4F: strdup (in /lib/tls/libc-2.3.5.so) ==13538== by 0x8053783: cf_item_parse (conffile.c:747) ==13538== by 0x8053C40: cf_section_parse (conffile.c:896) ==13538== by 0x1C2C8E9E: ??? ==13538== by 0x80556C1: find_module_instance (modules.c:314) ==13538== by 0x80573D4: do_compile_modsingle (modcall.c:1038) ==13538== by 0x8057720: compile_modsingle (modcall.c:1142) ==13538== by 0x8055CA2: load_component_section (modules.c:554) ==13538== by 0x8056462: setup_modules (modules.c:908) ==13538== by 0x806230F: read_mainconfig (mainconfig.c:1088) ==13538== by 0x804D05B: main (radiusd.c:281) ==13538== ==13538== ==13538== 78 bytes in 3 blocks are definitely lost in loss record 5 of 40 ==13538== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==13538== by 0x1C0F13E7: ??? ==13538== by 0x1C0F1296: ??? ==13538== by 0x1C0CC145: ??? ==13538== by 0x1C0C49E2: ??? ==13538== by 0x1C0C4982: ??? ==13538== by 0x1C02E62D: ??? ==13538== by 0x1C02E717: ??? ==13538== by 0x1C02DEC5: ??? ==13538== by 0x1C02E0EF: ??? ==13538== by 0x1BCA5142: getservbyname_r (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BCA4FD8: getservbyname (in /lib/tls/libc-2.3.5.so) ==13538== ==13538== ==13538== 492 (108 direct, 384 indirect) bytes in 3 blocks are definitely lost in loss record 8 of 40 ==13538== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==13538== by 0x1BC9F179: (within /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC9F7C1: __nss_database_lookup (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1C00A139: ??? ==13538== by 0x1C00B8F4: ??? ==13538== by 0x1BC4D0B9: getpwnam_r (in /lib/tls/libc-2.3.5.so) ==13538== by 0x1BC4CB41: getpwnam (in /lib/tls/libc-2.3.5.so) ==13538== by 0x80610A1: radlogdir_iswritable (mainconfig.c:480) ==13538== by 0x8062175: read_mainconfig (mainconfig.c:1010) ==13538== by 0x804D05B: main (radiusd.c:281) ==13538== ==13538== ==13538== 324 bytes in 1 blocks are definitely lost in loss record 12 of 40 ==13538== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==13538== by 0x1B96501D: pairmake (valuepair.c:1131) ==13538== by 0x1C2DDB41: ??? ==13538== by 0x1C2DDF7C: ??? ==13538== by 0x1C2DE74D: ??? ==13538== by 0x1C2DAC16: ??? ==13538== by 0x8056974: call_modsingle (modcall.c:254) ==13538== by 0x805707A: modcall (modcall.c:590) ==13538== by 0x8056A24: call_one (modcall.c:287) ==13538== by 0x8056B1E: call_modgroup (modcall.c:342) ==13538== by 0x8056FE9: modcall (modcall.c:575) ==13538== by 0x80559B1: indexed_modcall (modules.c:428) ==13538== ==13538== ==13538== 528 bytes in 1 blocks are definitely lost in loss record 13 of 40 ==13538== at 0x1B904F75: calloc (vg_replace_malloc.c:175) ==13538== by 0x805E5D5: clients_init (client.c:143) ==13538== by 0x805EAD6: clients_parse_section (client.c:395) ==13538== by 0x80622BD: read_mainconfig (mainconfig.c:1071) ==13538== by 0x804D05B: main (radiusd.c:281) ==13538== ==13538== ==13538== 612 bytes in 9 blocks are possibly lost in loss record 15 of 40 ==13538== at 0x1B904F75: calloc (vg_replace_malloc.c:175) ==13538== by 0x1B8F16A7: (within /lib/ld-2.3.5.so) ==13538== by 0x1B8F197B: _dl_allocate_tls (in /lib/ld-2.3.5.so) ==13538== by 0x1B9434F0: pthread_create@@GLIBC_2.1 (in /lib/tls/libpthread-2.3.5.so) ==13538== by 0x805B1AD: spawn_thread (threads.c:720) ==13538== by 0x805B75D: thread_pool_clean (threads.c:1007) ==13538== by 0x804D88C: main (radiusd.c:735) ==13538== ==13538== ==13538== 816 bytes in 34 blocks are definitely lost in loss record 16 of 40 ==13538== at 0x1B90459D: malloc (vg_replace_malloc.c:130) ==13538== by 0x1B95FFA4: rbtree_create (rbtree.c:99) ==13538== by 0x805E81C: client_add (client.c:234) ==13538== by 0x805EDC9: clients_parse_section (client.c:487) ==13538== by 0x80622BD: read_mainconfig (mainconfig.c:1071) ==13538== by 0x804D50A: main (radiusd.c:549) ==13538== ==13538== LEAK SUMMARY: ==13538== definitely lost: 1857 bytes in 43 blocks. ==13538== indirectly lost: 384 bytes in 32 blocks. ==13538== possibly lost: 612 bytes in 9 blocks. ==13538== still reachable: 1225627 bytes in 28450 blocks. ==13538== suppressed: 0 bytes in 0 blocks. ==13538== Reachable blocks (those to which a pointer was found) are not shown. ==13538== To see them, rerun with: --show-reachable=yes