[Winpcap-users] pcap_compile leak?

[Guy Harris]

On Sep 25, 2007, at 3:52 PM, Paul Heil wrote:

> I have a pcap application that uses a filter (as below). The 15th  
> time I call pcap_compile(), it fails with the error "too many  
> registers needed to evaluate expression".

Wow.  I thought I fixed that one in *2001*:

	revision 1.161
	date: 2001-12-18 01:10:49 -0800;  author: guy;  state: Exp;  lines:  
+2 -1
	Free up both "registers" (scratch memory locations, really) used by an
	arithmetic expression in a filter; otherwise, we leak registers when
	compiling arithmetic expressions.

> I'm using PCAP v4.0.1 and developer pack 4.0.1.

WinPcap 4.0.1 should be based on a version of libpcap with that fix  
(which first showed up in libpcap 0.8); perhaps there's another place  
where the code generator leaks registers.

> Is there a call other than pcap_freecode() I should be using to free  
> the memory allocated in the pcap_compile() command?

No.  This leak isn't a memory leak, so pcap_freecode() won't help.