Re: possible bug

[David Fifield <david () bamsoftware com>]

On Thu, Mar 08, 2012 at 12:21:55PM -0500, David Hingos wrote:
> I am reporting an issue as directed by the output of my installation of
> nmap.
>
> I get the following error:
>
> log_vwrite: vsnprintf failed.  Even after increasing bufferlen to 4096000,
> Vsnprintf returned -1 (logt == 8).  Please report this as a bug to nmap-dev
> (including this whole error message) as described at
> http://nmap.org/book/man-bugs.html.  Quitting.
>
> QUITTING!
>
> Assertion failed: !xml.tag_open, file ..\xml.cc, line 401
>
> I am trying to use nmap to dump all the LDAP data from an anonymous
> connection to an open LDAP service.  I keep expanding the maxobjects value
> to get more data, but once I get to maxobjects=3090, it crashes.
>
> I am using the following command:
>
> nmap -sS -sU -p 389 -T4 -v -v -v -v -v -v -v -v -v -v -Pn --script
> ldap-rootdse,ldap-search --script-args ldap.maxobjects=3090 <system address>
>
> This is happening under nmap 5.51 on Windows XP, also utilizing the Zenmap
> GUI.  I have not tried it using the latest developmental release.
>
> A quick search did not come up with anyone else having this issue under
> these circumstances.  I will attempt to troubleshoot some more and examine
> the code, but I figured I'd at least report the issue first.

Thanks for the nice specific report. There are two things going on here.

The first is that log_vwrite should be smarter about reallocating its
buffer. It only tries once and then gives up. This works for platforms
other than Windows where the first failed vsnprintf returns the number
of bytes needed. We should use alloc_vsprintf from xml.cc here.

The second is the assertion error that happens in xml.cc after the
log_vwrite error. This is caused by an atexit handler that attempts to
close elements and make well-formed XML before exiting. You've found a
case that wasn't accounted for (I think it's when a tag has been started
but its '>' hasn't been written yet.) I don't think the error that you
saw has anything specifically to do with XML output.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/