o [NSE] Fixed a bug in http.lua that could lead to an assertion

failure. It happened when there was an error getting the a response
  at the beginning of a batch in http.pipeline. The symptoms of the
  bug were:
    NSE: Received only 0 of 1 expected reponses.
    Decreasing max pipelined requests to 0.
    NSOCK (0.1870s) Write request for 0 bytes...
    nmap: nsock_core.c:516: handle_write_result: Assertion `bytesleft > 0' failed.
  The error was reported by Brandon Enright and pyllyukko.

CHANGELOG

@@ -1,5 +1,15 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE] Fixed a bug in http.lua that could lead to an assertion
+  failure. It happened when there was an error getting the a response
+  at the beginning of a batch in http.pipeline. The symptoms of the
+  bug were:
+    NSE: Received only 0 of 1 expected reponses.
+    Decreasing max pipelined requests to 0.
+    NSOCK (0.1870s) Write request for 0 bytes...
+    nmap: nsock_core.c:516: handle_write_result: Assertion `bytesleft > 0' failed.
+  The error was reported by Brandon Enright and pyllyukko.
+
 o [NSE] Added the new dns-service-discovery script which uses DNS-SD
   to identify services. DNS-SD is one part of automatic configuration
   technologies known by names such as Bonjour, Rendezvous, and

nselib/http.lua

@@ -1115,7 +1115,6 @@ pipeline = function(host, port, allReqs)
   local responses
   local response
   local partial
-  local j, batch_end
 
   responses = {}
 
@@ -1145,16 +1144,18 @@ pipeline = function(host, port, allReqs)
   stdnse.print_debug("Number of requests allowed by pipeline: " .. limit)
 
   while #responses < #allReqs do
+    local j, batch_begin, batch_end
     -- we build a big string with many requests, upper limited by the var "limit"
     local requests = ""
 
+    batch_begin = #responses + 1
     if #responses + limit < #allReqs then
       batch_end = #responses + limit
     else
       batch_end = #allReqs
     end
 
-    j = #responses + 1
+    j = batch_begin
     while j <= batch_end do
       if j == batch_end then
         allReqs[j].opts.header["Connection"] = "close"
@@ -1182,9 +1183,12 @@ pipeline = function(host, port, allReqs)
     socket:close()
     partial = ""
 
-    if #responses < batch_end then
+    if #responses + 1 == batch_begin then
-      stdnse.print_debug("Received only %d of %d expected reponses.\nDecreasing max pipelined requests to %d.", limit - (batch_end - #responses), limit, limit - (batch_end - #responses))
+      stdnse.print_debug("Received 0 of %d expected reponses.\nGiving up on pipeline.", limit);
-      limit = limit - (batch_end - #responses)
+      break
+    elseif #responses < batch_end then
+      stdnse.print_debug("Received only %d of %d expected reponses.\nDecreasing max pipelined requests to %d.", #responses + 1 - batch_begin, limit, #responses + 1 - batch_begin)
+      limit = #responses + 1 - batch_begin
     end
   end