Bug Hunter Diary

8180 /*8181 * Null terminate the string to protect against buffer8182 * overrun. String was generated by user code and may not8183 * be trusted.8184 */8185 ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';81868187 connp = Q_TO_CONN(q);8188 isv6 = connp->conn_af_isv6;8189 ipst = connp->conn_netstack->netstack_ip;81908191 /* Disallows implicit create */8192 ipif = ipif_lookup_on_name(ta->ifta_lifr_name,8193 mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,8194 connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);[..]In line 8178, a linked STREAMS message block is referenced,and on line 8179, the structure ta is filled with the user-controlledIOCTL data. Later on, the function ipif_lookup_on_name() is called(see line 8192). The first two parameters of ipif_lookup_on_name()derive from the user-controllable data of structure ta.Source code file uts/common/inet/ip/ip_if.cFunction ipif_lookup_on_name()[..]19116 /*19117 * Find an IPIF based on the name passed in. Names can be of the19118 * form (e.g., le0), : (e.g., le0:1),19119 * The string can have forms like (e.g., le0),19120 * . (e.g. le0.foo), or . (e.g. ip.tun3).19121 * When there is no colon, the implied unit id is zero. must19122 * correspond to the name of an ILL. (May be called as writer.)19123 */19124 static ipif_t *19125 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,19126 boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,19127 mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)19128 {[..]19138 if (error != NULL)19139 *error = 0;[..]19154 /* Look for a colon in the name. */19155 endp = &name[namelen];19156 for (cp = endp; --cp > name; ) {19157 if (*cp == IPIF_SEPARATOR_CHAR)19158 break;19159 }1916019161 if (*cp == IPIF_SEPARATOR_CHAR) {19162 /*19163 * Reject any non-decimal aliases for logical19164 * interfaces. Aliases with leading zeroes30 Chapter 3