It can be difficult to track down memory leaks when using malloc especially in large projects.
Tmalloc should be used for that purpose.
Generally, call report_heap() just before your app terminates, this will report any allocated memory blocks that were not released, giving the file/module name and line number where the memory was allocated.
TMalloc was originally developed solely to check for memory leaks when using malloc-ed memory. Since then it has expanded to check for buffer over-runs for various string functions.
See tmalloc.h for further comments regarding malloc and family functions.
(I'd just fixed a bug in Tmalloc and thought of contributing it here)
EDIT: found another bug so removed the attachment.
John