From 7cda4eab534d142a7d591b9481bbf6d501686c34 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Mon, 19 Aug 2019 15:26:15 +0200
Subject: [PATCH] Fix memory leaks in the new tkldb and channeldb modules.

---
 src/modules/channeldb.c |  4 ++--
 src/modules/tkldb.c     | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/modules/channeldb.c b/src/modules/channeldb.c
index 9a11c766c..0bb31152b 100644
--- a/src/modules/channeldb.c
+++ b/src/modules/channeldb.c
@@ -457,13 +457,13 @@ int read_channeldb(void)
 		if (!read_listmode(fd, &chptr->invexlist))
 			break;
 		R_SAFE(read_data(fd, &magic, sizeof(magic)));
+		FreeChannelEntry();
+		added++;
 		if (magic != MAGIC_CHANNEL_END)
 		{
 			config_error("[channeldb] Corrupt database (%s) - channel magic end is 0x%x. Further reading aborted.", cfg.database, magic);
 			break;
 		}
-		FreeChannelEntry();
-		added++;
 	}
 
 	fclose(fd);
diff --git a/src/modules/tkldb.c b/src/modules/tkldb.c
index d256da215..6242c29b5 100644
--- a/src/modules/tkldb.c
+++ b/src/modules/tkldb.c
@@ -43,7 +43,9 @@
 		safefree(reason); \
 		safefree(setby); \
 		safefree(spamf_check); \
+		safefree(spamf_expr); \
 		safefree(spamf_matchtype); \
+		safefree(spamf_tkl_reason); \
 	} while(0)
 
 #define R_SAFE(x) \
@@ -409,7 +411,9 @@ int read_tkldb(void)
 
 	// Some stuff related to spamfilters
 	char *spamf_check = NULL;
+	char *spamf_expr = NULL;
 	char *spamf_matchtype = NULL;
+	char *spamf_tkl_reason = NULL;
 
 #ifdef BENCHMARK
 	struct timeval tv_alpha, tv_beta;
@@ -476,10 +480,10 @@ int read_tkldb(void)
 		int spamf = 0;
 		char spamf_action;
 		unsigned short spamf_actionval;
-		char *spamf_tkl_reason = NULL;
+		spamf_tkl_reason = NULL;
 		TS spamf_tkl_duration_tkl1000;
 		uint64_t spamf_tkl_duration;
-		char *spamf_expr = NULL;
+		spamf_expr = NULL;
 		MatchType matchtype;
 		spamf_matchtype = NULL;
 
@@ -544,6 +548,7 @@ int read_tkldb(void)
 			if (cfg.backport_tkl1000)
 			{
 				R_SAFE(read_data(fd, &spamf_actionval, sizeof(spamf_actionval)));
+				// FIXME: BUG: spamf_action is not set
 			} else {
 				R_SAFE(read_data(fd, &spamf_action, sizeof(spamf_action)));
 				spamf_actionval = banact_chartoval(spamf_action);
@@ -727,6 +732,9 @@ static int read_str(FILE *fd, char **x)
 		return 1;
 	}
 
+	if (len > 10000)
+		return 0;
+
 	size = len;
 	*x = MyMallocEx(size + 1);
 	if (!read_data(fd, *x, size))