Suricata

Found by oss-fuzz:
https://issues.oss-fuzz.com/u/0/issues/533699240

Testcase:
https://oss-fuzz.com/testcase?key=5498180758994944

OSS-Fuzz classifies this issue as Security: NO.

Fuzz target: fuzz_sigpcap_aware
Crash type: ASSERT

!((tx == ((void*)0)))
SMTPTransactionCompleteTC
SMTPParse

A queued SMTP DATA_MODE command can still reference a transaction after an
earlier RSET reply completes it and cleanup reclaims it. When the later DATA
reply is parsed, SMTPGetReplyTx correctly returns NULL, but SMTPProcessReply
passes it to SMTPTransactionCompleteTC, triggering the debug-validation
assertion.

A minimized 13-packet reproducer pipelines the following client commands in
one packet and receives separate 250, 354, and 250 replies:

RSET
DATA
.

This is a short-lived regression introduced by:

e2a62dd1c086fa2ed6ddf544366d5f2a1d6d4c93
smtp: handle pipelined replies on owning tx

No stable release contains this commit.

Proposed fix: only call SMTPTransactionCompleteTC for DATA_MODE when owner
lookup returns a transaction. Do not fall back to curr_tx, since it may refer
to another SMTP transaction.

Regression coverage is in suricata-verify commit
44a9a36347d9fb936a8a80d71afa00b5d8639e88:

tests: add pipelined rset and data reply regression test

The original fuzz testcase and the minimized pcap both pass with the proposed
fix under debug validation. SMTP parser unit tests pass 9/9, and the focused
suricata-verify test passes.