From 785855e3acb475d964c9ce3d118716338b73d2b3 Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Fri, 22 Feb 2013 01:14:32 +0000
Subject: [PATCH] Limit maxSocketsAllowed to FD_SETSIZE.

At high scan rates, there was nothing to prevent trying to set or clear
socket descriptors above FD_SETSIZE, which is usually around 1024. I got
a reliable assertion failures with the command
	nmap -sT -p- --min-rate 100000 scanme.nmap.org
The problem only affected -sT scans. A similar protection was added to
Nsock in r15808.
---
 CHANGELOG      | 7 +++++++
 scan_engine.cc | 1 +
 2 files changed, 8 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 6218c038e..6076a73aa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,12 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o Limited the number of open sockets in ultra_scan to FD_SETSIZE. Very
+  fast connect scans could write past the end of an fd_set and cause a
+  variety of crashes:
+    nmap: scan_engine.cc:978: bool ConnectScanInfo::clearSD(int): Assertion `numSDs > 0' failed.
+    select failed in do_one_select_round(): Bad file descriptor (9)
+  [David Fifield]
+
 o Fixed a bug that prevented Nmap from finding any interfaces when one
   of them had the type ARP_HDR_APPLETALK; this was the case for
   AppleTalk interfaces. However, This support is not complete
diff --git a/scan_engine.cc b/scan_engine.cc
index 4d973bcf3..bda44265b 100644
--- a/scan_engine.cc
+++ b/scan_engine.cc
@@ -960,6 +960,7 @@ ConnectScanInfo::ConnectScanInfo() {
     if (maxSocketsAllowed < 5)
       maxSocketsAllowed = 5;
   }
+  maxSocketsAllowed = MIN(maxSocketsAllowed, FD_SETSIZE - 10);
   FD_ZERO(&fds_read);
   FD_ZERO(&fds_write);
   FD_ZERO(&fds_except);