Project

General

Profile

Actions

Bug #4948

closed

SMTP assertion triggered

Added by Philippe Antoine 11 months ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Getting
Assertion failed: (!((state->curr_tx == ((void*)0)))), function SMTPTransactionComplete, file app-layer-smtp.c, line 887.

Reproducer is suricata -r lola.pcap -c suricata.yaml -k none
Need to craft a Suricata-verify test out of this
The pcap comes from S-V test smtp-rset
+ fuzzpcap tcptofpc.py
+ easy hex editing to have multiple RSET in one packet
+ add a packet starting a command but not ending it (ie no end of line)
+ easy hex editing to have multiple 250 in different packets
+ fuzzpcap back to pcap

Found by CIFuzz in https://github.com/OISF/suricata/pull/6751
Not found by oss-fuzz even if it seems reachable by fuzz_sigpcap_aware...


Files

lola.pcap (1.9 KB) lola.pcap Philippe Antoine, 01/11/2022 07:38 PM
ossfuzz.pcap (720 Bytes) ossfuzz.pcap Philippe Antoine, 01/21/2022 11:32 AM

Related issues 2 (0 open2 closed)

Copied to Bug #4956: SMTP assertion triggeredClosedShivani BhardwajActions
Copied to Bug #4957: SMTP assertion triggeredClosedVictor JulienActions
Actions #1

Updated by Jeff Lucovsky 11 months ago

  • Copied to Bug #4956: SMTP assertion triggered added
Actions #2

Updated by Jeff Lucovsky 11 months ago

  • Copied to Bug #4957: SMTP assertion triggered added
Actions #4

Updated by Philippe Antoine 11 months ago

Actions #5

Updated by Philippe Antoine 10 months ago

  • Status changed from New to In Review
Actions #7

Updated by Philippe Antoine 10 months ago

Another variant by oss-fuzz :
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44305

rset then starttls
and 250 then 220 as reponses

Actions #8

Updated by Philippe Antoine 10 months ago

  • Status changed from Closed to In Progress
Actions #9

Updated by Philippe Antoine 9 months ago

  • Status changed from In Progress to In Review
Actions #10

Updated by Philippe Antoine 8 months ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF