smtp: don't read uninitialized value

If a reply would be seen before a command, a read of a uninitialized
value could happen.

This patch adds a check for this.

Bug #1089.

diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index c23ef8ac90fd6385b571ed3274f8dd08858f0cf5..fc3b9f7dadb4511eebb3eb9b80a070705e9b5c49 100644 (file)
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -570,7 +570,9 @@ static int SMTPProcessReply(SMTPState *state, Flow *f,
         }
     }
 
-    if (state->cmds[state->cmds_idx] == SMTP_COMMAND_STARTTLS) {
+    if (state->cmds_cnt == 0) {
+        /* reply but not a command we have stored, fall through */
+    } else if (state->cmds[state->cmds_idx] == SMTP_COMMAND_STARTTLS) {
         if (reply_code == SMTP_REPLY_220) {
             /* we are entering STARRTTLS data mode */
             state->parser_state |= SMTP_PARSER_STATE_COMMAND_DATA_MODE;