Memory leak on vxworks.

首先，将报告的 VxWorks 工作负载缩减为一个可复现的案例，并跟踪示例中显示的每个分配和每个 cJSON_Print 结果的所有权。检查重复构造和删除 cfgDataItem 与 root 是否会留下可测量的分配，然后将最小复现程序和观察到的泄漏位置记录为完成定义。

I use cJSON that version is 1.7.11.My cJSON code run on vxWorks. When my device run about 24h, a memory leak occurs. I use memory analyser tool, I find out that it may be wrong way in cJSON. My code are as follows:

char timestamp_str[64];
char terminal_type_str[16];    
char *in_buff = NULL;
char *out_buff = NULL;   
uint32_t b_num = 0;
uint32_t msg_total_len = 0;
uint64_t timestamp = 0;
int rc = 0, in_len = 0, out_len = 0, ret = 0, i = 0, bIndex = 0;	
char pub_topic[64] = "dts/device/data/report";	
cJSON *root = NULL, *item = NULL, *cfgDataItem = NULL, *gps_item = NULL, *b_info_item = NULL;
cJSON *b_item = NULL, *s_info_item = NULL;
cJSON *fs_rssi_item = NULL, *ts_rssi_item =NULL;
cJSON *tmp_item = NULL;
MQTTMessage pub_msg;
GPSINFO gpsInfo;
rep_dsp1tocpu_t *rep;
rep_zd_normal_topn_userlist_toweb_t msg;

out_buff = (char *)calloc(1, MAX_MSG_LEN);	

memset(out_buff, 0, MAX_MSG_LEN);
memset(timestamp_str, 0, 64);	
memset(terminal_type_str, 0, 16);	
memset(&gpsInfo, 0, sizeof(GPSINFO));

sprintf(terminal_type_str, "%d", CARRIER_TERMINA_ID);

b_num = common_frame_get_b_num((uint8_t *)frame);
msg_total_len = sizeof(rep_dsp1tocpu_t) + b_num*sizeof(b_info_list_t);
rep = (rep_dsp1tocpu_t *)malloc(msg_total_len);
memset(rep, 0, msg_total_len);
memcpy(rep, frame, msg_total_len);


root = cJSON_CreateObject();
item = cJSON_CreateObject();
cfgDataItem = cJSON_CreateObject();

gps_item = cJSON_CreateObject();

cJSON_AddStringToObject(gps_item, "data", gpsInfo.gps);		
cJSON_AddNumberToObject(gps_item, "validFlag", gpsInfo.validFlag);
cJSON_AddItemToObject(cfgDataItem, "curGpsInfo", gps_item);

cJSON_AddNumberToObject(cfgDataItem, "timeStamp", timestamp);//进行base64发送
cJSON_AddStringToObject(cfgDataItem, "deviceId", msg.rep_common.device_id);
cJSON_AddStringToObject(cfgDataItem, "terminalType", terminal_type_str);	
cJSON_AddNumberToObject(cfgDataItem, "channelId", msg.rep_common.channel_id);
cJSON_AddNumberToObject(cfgDataItem, "type", 2);
cJSON_AddNumberToObject(cfgDataItem, "bNum", msg.b_num);	

b_info_item = cJSON_CreateArray();

for(bIndex = 0; bIndex < 16; bIndex++)
{
b_item = cJSON_CreateObject();

   fs_rssi_item = cJSON_CreateFloatArray(rep->b_info_list[bIndex].fs_rssi, 56);
   cJSON_AddItemToObject(b_item, "fsRssi", fs_rssi_item);

   ts_rssi_item = cJSON_CreateFloatArray(rep->b_info_list[bIndex].ts_rssi, 52);
   cJSON_AddItemToObject(b_item, "tsRssi", ts_rssi_item);
   
   s_info_item = cJSON_CreateObject();
   cJSON_AddNumberToObject(s_info_item, "validFlag", rep->b_info_list[bIndex].info.validFlag);
   cJSON_AddNumberToObject(s_info_item, "id", rep->b_info_list[bIndex].info.id);
   cJSON_AddNumberToObject(s_info_item, "xyzType", rep->b_info_list[bIndex].info.xyzType);
   cJSON_AddNumberToObject(s_info_item, "x", rep->b_info_list[bIndex].info.x);
   cJSON_AddNumberToObject(s_info_item, "y", rep->b_info_list[bIndex].info.y);
   cJSON_AddNumberToObject(s_info_item, "z", rep->b_info_list[bIndex].info.z);
   cJSON_AddItemToObject(b_item, "sInfo", s_info_item);	 
   
   cJSON_AddItemToArray(b_info_item,b_item);

}
cJSON_AddItemToObject(cfgDataItem, "bList", b_info_item);

in_buff = cJSON_Print(cfgDataItem);
in_len = strlen(in_buff);   

ret = base64_encode(in_buff, in_len, out_buff, &out_len);
if(ret < 0 )
	printf("failed to base64_encode.");

cJSON_AddNumberToObject(item, "msgLen", msg.rep_common.msg_len);
cJSON_AddStringToObject(item, "cfgData", out_buff);
cJSON_AddItemToObject(root, "data", item);

cJSON_AddStringToObject(root, "deviceId", msg.rep_common.device_id);	
cJSON_AddStringToObject(root, "commandType", msg.rep_common.commnad_type);	
cJSON_AddStringToObject(root, "tickTimeStamp", timestamp_str);
cJSON_AddStringToObject(root, "testPlanId", interface_mission_id.mission_id);

pub_msg.payload = cJSON_Print(root);
pub_msg.payloadlen = (int)strlen(pub_msg.payload);
pub_msg.qos = QOS2;
pub_msg.retained = 1;

rc = MQTTPublish(&meassage_process_c, pub_topic, &pub_msg);
if(!rc)
    printf("gather_publish_func MQTTPublish %d, id = %d MQTTPublish MQTT IoT Cloud Success! \n", rc, pub_msg.id);
else
    printf("gather_publish_func MQTTPublish %d, MQTTPublish ERR!\n", rc);
free(in_buff);    
free(out_buff);
free(rep);
free(pub_msg.payload);		

cJSON_Delete(cfgDataItem);
cJSON_Delete(root);

I'm looking forward to your replay.Best regards.