Re: Nmap 5.50 crashing: Assertion `timeout_msecs >= 0' failed

[David Fifield <david () bamsoftware com>]

On Mon, Jan 31, 2011 at 12:36:33PM +0100, Vlatko Kosturjak wrote:
> I run nmap scan on Linux/Ubuntu host against 5 hosts:
>
> nmap -P0 --script=all -sS -sV --traceroute -v -O -iL 5hosts.txt -oA output.txt
>
> and this is what I got:
>
> Initiating Service scan at 12:13
> Scanning 10 services on 5 hosts
> Completed Service scan at 12:13, 18.92s elapsed (10 services on 5 hosts)
> Initiating OS detection (try #1) against 5 hosts
> Retrying OS detection (try #2) against 5 hosts
> Initiating Traceroute at 12:13
> Completed Traceroute at 12:13, 3.28s elapsed
> Initiating Parallel DNS resolution of 22 hosts. at 12:13
> Completed Parallel DNS resolution of 22 hosts. at 12:13, 0.20s elapsed
> NSE: Script scanning 5 hosts.
> NSE: Starting runlevel 1 (of 4) scan.
> Initiating NSE at 12:13
> NSE: FIREWALK: can't run without one of the script args firewalk.gateway or firewalk.ttl
> NSE: FIREWALK: can't run without one of the script args firewalk.gateway or firewalk.ttl
> NSE: FIREWALK: can't run without one of the script args firewalk.gateway or firewalk.ttl
> NSE: FIREWALK: can't run without one of the script args firewalk.gateway or firewalk.ttl
> NSE: FIREWALK: can't run without one of the script args firewalk.gateway or firewalk.ttl
> Stats: 0:04:41 elapsed; 0 hosts completed (5 up), 5 undergoing Script Scan
> NSE: Active NSE Script Threads: 10 (4 waiting)
>
> NSE Timing: About 96.06% done; ETC: 12:16 (0:00:08 remaining)
> nmap: nsock_event.c:375: msevent_new: Assertion `timeout_msecs >= 0' failed.
> Aborted
>
> Sorry, currently can't provide more right now, but can provide debug output later if you think you need more info...? 
>  

Please try with this patch. It will do a controlled Lua error so we see
a stack trace and find out which script is responsible. For example,

NSE: 'path-mtu' (thread: 0x99555c0) against 192.168.0.2 threw an error!
./scripts/path-mtu.nse:320: NEGATIVE TIMEOUT: -150
stack traceback:
        [C]: in function 'set_timeout'
        ./scripts/path-mtu.nse:320: in function <./scripts/path-mtu.nse:295>
        (tail call): ?

The fact that a script can halt Nmap in this way is another bug, but
let's first fix whatever script is setting a negative timeout.

David Fifield

Attachment: nse-negative-timeout.diff
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/