Ncat uses 100% cpu with --lua-exec

[dmiller-nmap]

Possibly not catching that the connection was closed? Used the following lua script from this nmap-dev thread:

print "HEAD /index.html HTTP/1.1"
print "Host: www.bing.com"
print ""

repeat
  l=io.stdin:read("*line")
until l == "foobar"

-- just a check mark
print "stop"

Backtrace:

#0  0x00007f239ef42810 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007f239eed16a0 in _IO_new_file_underflow (fp=0x7f239f216640 <_IO_2_1_stdin_>) at fileops.c:613
#2  0x00007f239eed262e in __GI__IO_default_uflow (fp=0x7f239f216640 <_IO_2_1_stdin_>) at genops.c:435
#3  0x00007f239eec6344 in __GI__IO_getline_info (fp=0x7f239f216640 <_IO_2_1_stdin_>, buf=0x7ffd0dcf7cb0 "\r\n", n=8191, delim=10, extract_delim=1, eof=0x0) at iogetline.c:69
#4  0x00007f239eec52c6 in _IO_fgets (buf=0x7ffd0dcf7cb0 "\r\n", n=0, fp=0x7f239f216640 <_IO_2_1_stdin_>) at iofgets.c:56
#5  0x0000000000437391 in fgets (__stream=0x7f239f216640 <_IO_2_1_stdin_>, __n=8192, __s=0x7ffd0dcf7cb0 "\r\n") at /usr/include/x86_64-linux-gnu/bits/stdio2.h:263
#6  read_line (L=L@entry=0xadfb40, f=f@entry=0x7f239f216640 <_IO_2_1_stdin_>, chop=chop@entry=1) at liolib.c:377
#7  0x00000000004375f0 in g_read (L=0xadfb40, f=0x7f239f216640 <_IO_2_1_stdin_>, first=2) at liolib.c:449
#8  0x0000000000424345 in luaD_precall (L=L@entry=0xadfb40, func=<optimized out>, func@entry=0xce1290, nresults=nresults@entry=1) at ldo.c:319
#9  0x000000000042e464 in luaV_execute (L=L@entry=0xadfb40) at lvm.c:709
#10 0x0000000000424699 in luaD_call (L=0xadfb40, func=<optimized out>, nResults=<optimized out>, allowyield=0) at ldo.c:402
#11 0x0000000000423cc9 in luaD_rawrunprotected (L=L@entry=0xadfb40, f=f@entry=0x420ef0 <f_call>, ud=ud@entry=0x7ffd0dcf9fa0) at ldo.c:131
#12 0x00000000004248d1 in luaD_pcall (L=L@entry=0xadfb40, func=func@entry=0x420ef0 <f_call>, u=u@entry=0x7ffd0dcf9fa0, old_top=32, ef=<optimized out>) at ldo.c:603
#13 0x00000000004223bb in lua_pcallk (L=0xadfb40, nargs=nargs@entry=0, nresults=nresults@entry=0, errfunc=<optimized out>, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:949
#14 0x0000000000413d90 in lua_run () at ncat_lua.c:171
#15 0x000000000040b5c9 in netexec (info=info@entry=0x7ffd0dcfc0f0, cmdexec=0x7ffd0dcfd00f "bing.lua") at ncat_posix.c:239
#16 0x0000000000408cae in post_connect (nsp=0xae6090, iod=0xcca860) at ncat_connect.c:1132
#17 0x00000000004196f8 in event_dispatch_and_delete (nsp=nsp@entry=0xae6090, nse=nse@entry=0xc92980, notify=notify@entry=1) at nsock_event.c:373
#18 0x0000000000416b0c in process_event (nsp=nsp@entry=0xae6090, evlist=evlist@entry=0xae60a8, nse=nse@entry=0xc92980, ev=ev@entry=1) at nsock_core.c:1067
#19 0x0000000000416f95 in process_iod_events (nsp=nsp@entry=0xae6090, nsi=nsi@entry=0xcca860, ev=ev@entry=1) at nsock_core.c:1132
#20 0x000000000041ba47 in iterate_through_event_lists (nsp=0xae6090) at engine_select.c:382
#21 select_loop (nsp=0xae6090, msec_timeout=<optimized out>) at engine_select.c:324
#22 0x0000000000416963 in nsock_engine_loop (msec_timeout=-1, nsp=0xae6090) at nsock_internal.h:414
#23 nsock_loop (nsp=nsp@entry=0xae6090, msec_timeout=msec_timeout@entry=-1) at nsock_core.c:934
#24 0x0000000000409ada in ncat_connect () at ncat_connect.c:1056
#25 0x0000000000407155 in ncat_connect_mode () at ncat_main.c:922
#26 main (argc=7, argv=0x7ffd0dcfcbe8) at ncat_main.c:899

User-reported script, so I don't know if it's an appropriate use of calls, but I certainly didn't expect it to happen.

[dmiller-nmap]

From the user who reported the issue:

Please , let me explain what is going on.

With that part:

repeat
  l=io.stdin:read("*line")
until l == "foobar"

you make Ncat wait infinitely for a line which contains "foobar" (what never happens), so it looks like it hangs. But it is not!

When you connect over SSL it seams that reading stdin:

l=io.stdin:read("*line")

just instantly stops the process and jumps to prompt.
And that's wrong!

That's all. :-)