mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
ae2a5c83a4
OSS-Fuzz found that providing an invalid BDAT line would tickle an assert in UpdateState(). The BDAT state was never initialized, but within UpdateState() that was expected. This also removes the AnalyzerViolation() call for bad BDAT commands and instead raises a weird. The SMTP analyzer is very lax and not triggering the violation allows to parse the server's response to such an invalid command. PCAP files produced by a custom Python SMTP client against Postfix.
13 lines
829 B
Text
13 lines
829 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path weird
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
|
|
#types time string addr port addr port string string bool string string
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 33472 127.0.0.1 25 smtp_invalid_bdat_command BDAT not followed by a valid chunk-size F zeek SMTP
|
|
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 52364 127.0.0.1 25 smtp_invalid_bdat_command BDAT chunk-size followed by junk F zeek SMTP
|
|
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 127.0.0.1 46862 127.0.0.1 25 smtp_invalid_bdat_command BDAT not followed by a valid chunk-size F zeek SMTP
|
|
#close XXXX-XX-XX-XX-XX-XX
|