From 34d23c8b5c3cc2f2661d20a34fe8da06f13868fe Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Tue, 16 Jul 2024 09:26:36 +0200
Subject: [PATCH] Fix memory leak in ASN code

Contrary to retrieving country code / country name, the AS organisation
name that was returned needs to be freed by *US*. Makes sense, though
a bit inconsistent, heh.

[skip ci]
---
 src/modules/geoip_classic.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/modules/geoip_classic.c b/src/modules/geoip_classic.c
index 08cbbf6ef..2b6306123 100644
--- a/src/modules/geoip_classic.c
+++ b/src/modules/geoip_classic.c
@@ -358,7 +358,8 @@ void geoip_classic_free(void)
 GeoIPResult *geoip_lookup_classic(char *ip)
 {
 	static char buf[256];
-	const char *country_code, *country_name, *isp=NULL;
+	const char *country_code, *country_name;
+	char *isp=NULL;
 	GeoIPLookup gl, asn_gl;
 	GeoIP *gi;
 	int geoid;
@@ -408,17 +409,21 @@ GeoIPResult *geoip_lookup_classic(char *ip)
 	 * r->asn becomes the ##### number
 	 * r->asname becomes "Name Of Autonomous System"
 	 */
-	if (isp && (isp[0] == 'A') && (isp[1] == 'S') && isdigit(isp[2]))
+	if (isp)
 	{
-		char *p;
-		r->asn = strtoul(isp+2, NULL, 10);
-		p = strchr(isp, ' ');
-		if (p)
+		if ((isp[0] == 'A') && (isp[1] == 'S') && isdigit(isp[2]))
 		{
-			skip_whitespace(&p);
-			if (*p)
-				safe_strdup(r->asname, p);
+			char *p;
+			r->asn = strtoul(isp+2, NULL, 10);
+			p = strchr(isp, ' ');
+			if (p)
+			{
+				skip_whitespace(&p);
+				if (*p)
+					safe_strdup(r->asname, p);
+			}
 		}
+		safe_free(isp);
 	}
 	return r;
 }