Avoid assertion failure when unsolicited ARP response received

We probably want a more explicit handling of the case where we get an
ARP response to a request that we did not send (system's own, or another
Nmap scan running at the same time). In any case, this ought to solve
the crashes reported as #1797 and #1764.

scan_engine.cc

@@ -1275,9 +1275,14 @@ int UltraScanInfo::removeCompletedHosts() {
       }
       if (timedout)
         gstats->num_hosts_timedout++;
+      /* We may have received an ARP response before we sent a probe, which
+       * would mean the timeout clock is not running. Avoid an assertion
+       * failure here by checking first.  */
+      if (hss->target->timeOutClockRunning()) {
         hss->target->stopTimeOutClock(&now);
       }
     }
+  }
   return hostsRemoved;
 }