Bug #5443: ftp-data: failed assertion - Suricata - Open Information Security Foundation

Took me some time to figure out that I was needing --runmode=single to reproduce due to #5205 (fuzz target runs in single thread and so ftp-data detection goes alright)

Actions

Copy link

Updated by Victor Julien over 2 years ago

Status changed from New to Assigned
Priority changed from Normal to High

Actions

Copy link

Updated by Philippe Antoine about 2 years ago

My analysis :
- we have a FTP flow which expects a ftp-data flow
- we use stream.midstream=true
- the ftp-data flow has a first packet with data
- the ftp-data flow has then a second packet in same direction with RST flag (and no ACK flag)
- RST triggers the parse of all available data, even if it has never been acked

Should we process any of these data that has never been acked ?

Actions

Copy link

Updated by Victor Julien about 2 years ago

Target version changed from 7.0.0-beta1 to 8.0.0-beta1

Actions

Copy link

Updated by Philippe Antoine about 2 years ago

Why not 7.0.rc1 ?

Actions

Copy link

Updated by Victor Julien about 2 years ago

Target version changed from 8.0.0-beta1 to 7.0.0-rc1

Accident during mass retargeting, thanks for catching this.

Actions

Copy link

Updated by Philippe Antoine almost 2 years ago

I would disable the debug assertion if we cannot have a better fix quickly.
This would allow to have fuzzing going on and we would still have the issue to investigate...

Actions

Copy link

#10