From 5e262ab92f3fac7877ce09d096fe698de13cba04 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Mon, 13 Jul 2026 11:16:17 -0600 Subject: [PATCH] smtp: check transaction before to-client completion Make sure the transaction still exists before completing it in the to-client direction. A pipelined RSET reply may already have completed and freed it while a later end-of-DATA marker still refers to it. Found by OSS-Fuzz testcase 5498180758994944. Bug #8739. --- src/app-layer-smtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c index 67e2524df701..8210ea0f9d01 100644 --- a/src/app-layer-smtp.c +++ b/src/app-layer-smtp.c @@ -1081,7 +1081,7 @@ static int SMTPProcessReply( } else if (IsReplyToCommand(state, SMTP_COMMAND_BDAT)) { SMTPSetProgressTC(reply_tx, SMTP_RESPONSE_DATA); } else if (IsReplyToCommand(state, SMTP_COMMAND_DATA_MODE)) { - if (!(state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY)) { + if (reply_tx && !(state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY)) { SMTPTransactionCompleteTC(reply_tx); } } else if (IsReplyToCommand(state, SMTP_COMMAND_RSET)) {