From 9b468484c21dd4bb2805729f57da6af13fb89766 Mon Sep 17 00:00:00 2001 From: david Date: Thu, 14 Jan 2010 01:07:49 +0000 Subject: [PATCH] o Fixed a bug in traceroute that could lead to a crash: terminate called after throwing an instance of 'std::out_of_range' what(): bitset::test It happened when the preliminary distance guess for a target was greater than 30, the size of an internal data structure. David and Brandon tracked down the problem. --- CHANGELOG | 7 +++++++ traceroute.cc | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 6bbb4d9e7..b2611aaf7 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,12 @@ # Nmap Changelog ($Id$); -*-text-*- +o Fixed a bug in traceroute that could lead to a crash: + terminate called after throwing an instance of 'std::out_of_range' + what(): bitset::test + It happened when the preliminary distance guess for a target was + greater than 30, the size of an internal data structure. David and + Brandon tracked down the problem. + o Added a service probe and match lines for the Logitech/SlimDevices SqueezeCenter music server. [Patrik Karlsson] diff --git a/traceroute.cc b/traceroute.cc index 02ca2f37c..787414ccb 100644 --- a/traceroute.cc +++ b/traceroute.cc @@ -333,7 +333,7 @@ static unsigned int hop_cache_size(); HostState::HostState(Target *target) { this->target = target; - current_ttl = MAX(1, HostState::distance_guess(target)); + current_ttl = MIN(MAX(1, HostState::distance_guess(target)), MAX_TTL); state = HostState::COUNTING_DOWN; reached_target = 0; pspec = HostState::get_probe(target); @@ -1203,7 +1203,7 @@ void TracerouteState::read_replies(long timeout) { actual distance is. */ int distance = get_initial_ttl_guess(reply.ttl) - reply.ttl + 1; if (distance > 0 && distance < host->current_ttl) - host->current_ttl = distance; + host->current_ttl = MIN(distance, MAX_TTL); } num_active_probes -= host->cancel_probes_above(probe->ttl); }