Re: 4.22SOC6 Crash With Connect() Scan

[David Fifield <david () bamsoftware com>]

On Fri, Sep 14, 2007 at 12:41:40AM +0200, majek04 wrote:
> On 9/13/07, David Fifield <david () bamsoftware com> wrote:
> > On Thu, Sep 13, 2007 at 05:37:24PM +0100, Rob Nicholls wrote:
> > > I finally got around to testing the new 4.22SOC6 win32 binary (using the
> > > zip file) and spotted that it crashed when I asked it to perform a
> > > Connect() Scan.
> >
> > I was able to reproduce this on Windows XP, both the "Unknown error" and
> > the crash. I'll investigate it and let you know what I find.
> >
> > The big change between 4.22SOC5 and 4.22SOC6 was the massping migration,
> > which changes the way host discovery is done. That shouldn't affect port
> > scans, but you never know.
>
> I was also able to reproduce this bug. It crashes during connect scan,
> in scan_engine.cc:3050 in
>
> static bool do_one_select_round(UltraScanInfo *USI, struct timeval *stime)
> [...]
>   for(hostI = USI->incompleteHosts.begin();
>       hostI != USI->completedHosts.end() && numGoodSD < selectres; hostI++) {
> [...]

Thanks for this. It helped me find the problem right away. The bug was
that the hostI iterator was being used to iterate over two separate
lists, which I guess is not allowed, but worked for me on Linux. I've
committed a fix.

I don't remember seeing the "Unknown error" thing, but from an old
checkout it appears to have been around a while. The error code that's
being returned is 10035, WSAEWOULDBLOCK, which corresponds to EAGAIN in
nbase/nbase_winunix.h, but is not supported by strerror. So it's not a
real error, just a little weird from a UI point of view.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org