Stop parsing on a zero-length packet option

Fixes #3368. Closes #3373.

CHANGELOG

@@ -1,5 +1,8 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when parsing a
+  zero-length TCP header option. [Maxim Suhanov]
+
 o Fixed an issue where Nmap OS scan trusts a packet's ip_len to size a CRC32
   computation over TCP RST payload data, which may result in reading arbitrary
   heap data. Reported by Michael Bommarito.

nselib/packet.lua

@@ -686,10 +686,7 @@ function Packet:parse_options(offset, length)
   local opt_ptr = 0
   while opt_ptr < length do
     local t, l, d
-    options[op] = {}
-
     t = self:u8(offset + opt_ptr)
-    options[op].type = t
     if t==0 or t==1 then
       l = 1
       d = nil
@@ -699,6 +696,11 @@ function Packet:parse_options(offset, length)
         d = self:raw(offset + opt_ptr + 2, l-2)
       end
     end
+    if l==0 then
+      break
+    end
+    options[op] = {}
+    options[op].type = t
     options[op].len  = l
     options[op].data = d
     opt_ptr = opt_ptr + l