Project

General

Profile

Actions
Copy link

Bug #4948

closed

SMTP assertion triggered

Added by Philippe Antoine almost 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
7.0.0-beta1
Affected Versions:
6.0.4
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Getting
Assertion failed: (!((state->curr_tx == ((void*)0)))), function SMTPTransactionComplete, file app-layer-smtp.c, line 887.

Reproducer is suricata -r lola.pcap -c suricata.yaml -k none
Need to craft a Suricata-verify test out of this
The pcap comes from S-V test smtp-rset
+ fuzzpcap tcptofpc.py
+ easy hex editing to have multiple RSET in one packet
+ add a packet starting a command but not ending it (ie no end of line)
+ easy hex editing to have multiple 250 in different packets
+ fuzzpcap back to pcap

Found by CIFuzz in https://github.com/OISF/suricata/pull/6751
Not found by oss-fuzz even if it seems reachable by fuzz_sigpcap_aware...

Files

Download all files
lola.pcap (1.9 KB) lola.pcap Philippe Antoine, 01/11/2022 07:38 PM
ossfuzz.pcap (720 Bytes) ossfuzz.pcap Philippe Antoine, 01/21/2022 11:32 AM

Related issues 2 (0 open — 2 closed)

Copied to Suricata - Bug #4956: SMTP assertion triggeredClosedShivani BhardwajActions
Copied to Suricata - Bug #4957: SMTP assertion triggeredClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Jeff Lucovsky almost 3 years ago

  • Copied to Bug #4956: SMTP assertion triggered added
Actions
Copy link
 #2

Updated by Jeff Lucovsky almost 3 years ago

  • Copied to Bug #4957: SMTP assertion triggered added
Actions
Copy link
 #5

Updated by Philippe Antoine almost 3 years ago

  • Status changed from New to In Review
Actions
Copy link
 #7

Updated by Philippe Antoine almost 3 years ago

Another variant by oss-fuzz :
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44305

rset then starttls
and 250 then 220 as reponses

Actions
Copy link
 #8

Updated by Philippe Antoine almost 3 years ago

  • Status changed from Closed to In Progress
Actions
Copy link
 #9

Updated by Philippe Antoine almost 3 years ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #10

Updated by Philippe Antoine almost 3 years ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF