From 15b67dd475fd44ea81d3c8b9d34eeec99dd2111b Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Mon, 13 Jul 2026 11:04:14 -0600
Subject: [PATCH] tests: add pipelined rset and data reply regression test

Add a minimized capture for OSS-Fuzz testcase 5498180758994944.

Ticket: #8739
---
 .../README.md                                 |  34 ++++++++++++++++++
 .../input.pcap                                | Bin 0 -> 931 bytes
 .../test.yaml                                 |  25 +++++++++++++
 3 files changed, 59 insertions(+)
 create mode 100644 tests/smtp-pipelined-rset-data-replies/README.md
 create mode 100644 tests/smtp-pipelined-rset-data-replies/input.pcap
 create mode 100644 tests/smtp-pipelined-rset-data-replies/test.yaml

diff --git a/tests/smtp-pipelined-rset-data-replies/README.md b/tests/smtp-pipelined-rset-data-replies/README.md
new file mode 100644
index 000000000..7eebd2be5
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/README.md
@@ -0,0 +1,34 @@
+# Description
+
+Protocol-minimized regression test for Redmine Bug #8739:
+
+https://redmine.openinfosecfoundation.org/issues/8739
+
+Originally found by OSS-Fuzz testcase 5498180758994944:
+
+https://oss-fuzz.com/testcase?key=5498180758994944
+
+# PCAP
+
+The 13-packet capture is a protocol-minimized derivative of the original
+`fuzz_sigpcap_aware` input. The fuzzpcap stream was converted to a regular
+pcap and reduced to this SMTP dialog (`--->` client, `<---` server):
+
+```
+<--- 220 mail.example ESMTP ready
+
+---> EHLO client.example
+<--- 250-PIPELINING
+<--- 250 OK
+
+---> RSET
+---> DATA
+---> .
+
+<--- 250 reset
+<--- 354 continue
+<--- 250 queued
+```
+
+The `RSET`, `DATA`, and `.` lines are pipelined in one client packet. Each
+server reply is sent separately.
diff --git a/tests/smtp-pipelined-rset-data-replies/input.pcap b/tests/smtp-pipelined-rset-data-replies/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..061a6563a1d860a7f752fb2030ad2753447f346d
GIT binary patch
literal 931
zc-p&ic+)~A1{MYw`2Qb5OMR6|0MR;7%ml=)3=A3!3=RwqYzz$b3=E7QeCa2HqySWJ
z024$vNG~H1dKn}y{Zs(T0rfKm2qE+`5pOS}0!Xg_LN7Cr_JU%lUN;=}G72E+H8L_#
z$W6@5(MzpJ%q_@CRd5aV4GB;vN=;0u<mCdH3<@JhD2AGBi^o;+Fq2(9eEb!Xb23x&
zN??XV3}gjLx<E11KnEO7l?NIs26w8dfo_0jfUA$EpQoQYFBg!n;O`AF6R4HJ8j7K2
zn&WV!7|>jEn3+Mrt|7c!E{-9Nyj*$^qu3e1dchcKlrawHnFEbeMRFc6*osq2AjWVI
zADOB^qnwZ<lM_f=K`~UX84f2nAv?j?)I=dUKd&S+uM`^AT%@@o0NEAXK-vO|p?Xbl
YxFP^OAPP%UOH)%IZr~x!4KXlt05vt3X8-^I

literal 0
Hc-jL100001

diff --git a/tests/smtp-pipelined-rset-data-replies/test.yaml b/tests/smtp-pipelined-rset-data-replies/test.yaml
new file mode 100644
index 000000000..4ca96b356
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 9
+
+pcap: input.pcap
+
+# Disable checksum validation for the generated capture.
+args:
+  - -k none
+
+checks:
+  # The pipelined sequence produces one completed SMTP transaction object.
+  - filter:
+      count: 1
+      match:
+        event_type: smtp
+        tx_id: 0
+        smtp.helo: client.example
+        email.status: PARSE_DONE
+
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.app_proto: smtp
+        anomaly.event: INVALID_PIPELINED_SEQUENCE
-- 
2.47.3