Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Nmap Development: Re: 4.22SOC6 Crash With Connect() Scan

Re: 4.22SOC6 Crash With Connect() Scan

From: David Fifield <david_at_bamsoftware.com>
Date: Fri, 14 Sep 2007 14:01:44 -0600

On Fri, Sep 14, 2007 at 12:41:40AM +0200, majek04 wrote:
> On 9/13/07, David Fifield <david_at_bamsoftware.com> wrote:
> > On Thu, Sep 13, 2007 at 05:37:24PM +0100, Rob Nicholls wrote:
> > > I finally got around to testing the new 4.22SOC6 win32 binary (using the
> > > zip file) and spotted that it crashed when I asked it to perform a
> > > Connect() Scan.
> >
> > I was able to reproduce this on Windows XP, both the "Unknown error" and
> > the crash. I'll investigate it and let you know what I find.
> >
> > The big change between 4.22SOC5 and 4.22SOC6 was the massping migration,
> > which changes the way host discovery is done. That shouldn't affect port
> > scans, but you never know.
>
> I was also able to reproduce this bug. It crashes during connect scan,
> in scan_engine.cc:3050 in
>
> static bool do_one_select_round(UltraScanInfo *USI, struct timeval *stime)
> [...]
> for(hostI = USI->incompleteHosts.begin();
> hostI != USI->completedHosts.end() && numGoodSD < selectres; hostI++) {
> [...]

Thanks for this. It helped me find the problem right away. The bug was
that the hostI iterator was being used to iterate over two separate
lists, which I guess is not allowed, but worked for me on Linux. I've
committed a fix.

I don't remember seeing the "Unknown error" thing, but from an old
checkout it appears to have been around a while. The error code that's
being returned is 10035, WSAEWOULDBLOCK, which corresponds to EAGAIN in
nbase/nbase_winunix.h, but is not supported by strerror. So it's not a
real error, just a little weird from a UI point of view.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org
Received on Sep 14 2007

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos