suricata

Author	SHA1	Message	Date
Eric Leblond	10e2e2a8b6	app-layer-smtp: fix mem leak and add new alert If SMTP session is weird then we may reach a state where a field like MAIL FROM is seen as duplicated. Valgrind output is: 30 bytes in 1 blocks are definitely lost in loss record 96 of 399 at 0x4C29C0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) by 0x4A5803: SMTPParseCommandWithParam (app-layer-smtp.c:996) by 0x4A4DCE: SMTPParseCommandMAILFROM (app-layer-smtp.c:1016) by 0x4A3F55: SMTPProcessRequest (app-layer-smtp.c:1127) by 0x4A1F8C: SMTPParse (app-layer-smtp.c:1191) by 0x493AD7: SMTPParseClientRecord (app-layer-smtp.c:1214) by 0x4878A6: AppLayerParserParse (app-layer-parser.c:908) by 0x42384E: AppLayerHandleTCPData (app-layer.c:444) by 0x8D7EAD: DoReassemble (stream-tcp-reassemble.c:2635) by 0x8D795F: StreamTcpReassembleAppLayer (stream-tcp-reassemble.c:3028) by 0x8D8BE0: StreamTcpReassembleHandleSegmentUpdateACK (stream-tcp-reassemble.c:3404) by 0x8D8F6E: StreamTcpReassembleHandleSegment (stream-tcp-reassemble.c:3432)	9 years ago
Victor Julien	6d170cadd7	smtp: fix mime boundary parsing issue If a boundary was longer than 254 bytes a stack overflow would result in mime decoding. Ticket #1449 Reported-by: Kostya Kortchinsky of the Google Security Team	10 years ago
David Abarbanel	c2dc686742	SMTP MIME Email Message decoder	10 years ago
Victor Julien	5a1a443701	Add example smtp decoding events rules file.	13 years ago