Close an open start tag before a fatal error.

This is part of the error handler that attempts to close open XML tags
at a fatal error. The case wasn't handled where a fatal error happened
while a start tag was still open (didn't have its '>' written yet). This
came from a bug report from David Hingos.

http://seclists.org/nmap-dev/2012/q1/514

nmap_error.cc

@@ -122,6 +122,8 @@ void fatal(const char *fmt, ...) {
   }
   log_write(o.log_errors? LOG_NORMAL|LOG_STDERR : LOG_STDERR, "\nQUITTING!\n");
 
+  if (xml_tag_open())
+    xml_close_start_tag();
   if (!xml_root_written())
     xml_start_tag("nmaprun");
   /* Close all open XML elements but one. */
@@ -198,6 +200,8 @@ void pfatal(const char *fmt, ...) {
   log_write(o.log_errors? LOG_NORMAL|LOG_STDERR : LOG_STDERR, "%s: %s (%d)\n", 
 	    errbuf, strerror_s, error_number);
 
+  if (xml_tag_open())
+    xml_close_start_tag();
   if (!xml_root_written())
     xml_start_tag("nmaprun");
   /* Close all open XML elements but one. */

xml.cc

@@ -412,6 +412,11 @@ int xml_depth() {
   return xml.element_stack.size();
 }
 
+/* Return true iff a root element has been started. */
+bool xml_tag_open() {
+  return xml.tag_open;
+}
+
 /* Return true iff a root element has been started. */
 bool xml_root_written() {
   return xml.root_written;

xml.h

@@ -118,6 +118,7 @@ int xml_attribute(const char *name, const char *fmt, ...) __attribute__ ((format
 int xml_newline();
 
 int xml_depth();
+bool xml_tag_open();
 bool xml_root_written();
 
 #endif