Error: vsnprintf returned -1 in log_vwrite

[jah <jah () zadkiel plus com>]

Greetings.

I've seen an error several times over the last couple of months:

Host 192.168.1.5 appears to be up ... good.
Interesting ports on 192.168.1.5:
vsnprintf returned -1 in log_vwrite -- bizarre. Quitting.
QUITTING!

and I've gradually pinned down the command line parameters that, almost 
regardless of accompanying ones, cause the error.

If more than 239 ports are scanned and
any level of debugging is specified and
output in Normal format is specified

for instance:

This will fail:  nmap 192.168.1.5 -sS -p1-240 -d1 -oA results
This will not:  nmap 192.168.1.5 -sS -p1-239 -d1 -oA results

This will fail:  nmap 192.168.1.5 -sS -p1-240 -d1 -oN results.nmap
This will not:  nmap 192.168.1.5 -sS -p1-240 -vv -oN results.nmap 
--log-errors --packet-trace

This will fail:  nmap 192.168.1.5 -sT -p1000-1240 -d9 -oA results
This will not:  nmap 192.168.1.5 -sT -p1000-1240 -d9 -oG results.gnmap 
-oX results.xml


This has happened using nmap 4.21ALPHA 4.21ALPHA/SOC1/SOC2 (installers 
and compiled source)
on Win XP SP2 32bit

At the time it fails, the last item written to a normal output file is:
Interesting ports on 192.168.1.5:

The xml file: </ports> (doesn't close <host> or <nmaprun>)

The grepable file is nearly complete save for the last line "# Nmap run 
completed at.."

It seems to be down to static int writebuflen = 8192;
in log_vwrite of output.cc not being big enough.
Increasing writebuflen allows more ports to be specified before the 
error occurs.

Has anyone seen this before or is it just me?

Regards,

jah




_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org