Bug Hunter Diary

19165 * are also rejected as they introduce ambiguity19166 * in the naming of the interfaces.19167 * In order to confirm with existing semantics,19168 * and to not break any programs/script relying19169 * on that behaviour, if:0 is considered to be19170 * a valid interface.19171 *19172 * If alias has two or more digits and the first19173 * is zero, fail.19174 */19175 if (&cp[2] < endp && cp[1] == '0')19176 return (NULL);19177 }[..]In line 19139, the value of error is explicitly set to 0. Then inline 19161, the interface name provided by the user-controlled IOCTLdata is checked for the presence of a colon (IPIF_SEPARATOR_CHAR isdefined as a colon). If a colon is found in the name, the bytes after thecolon are treated as an interface alias. If an alias has two or more digitsand the first is zero (ASCII zero or hexadecimal 0x30; see line 19175),the function ipif_lookup_on_name() returns to ip_extract_tunreq() witha return value of NULL, and the variable error is still set to 0 (seelines 19139 and 19176).Source code file uts/common/inet/ip/ip_if.cFunction ip_extract_tunreq()[..]8192 ipif = ipif_lookup_on_name(ta->ifta_lifr_name,8193 mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,8194 connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);8195 if (ipif == NULL)8196 return (error);[..]Back in ip_extract_tunreq(), the pointer ipif is set to NULL if ipif_lookup_on_name() returns that value (see line 8192). Since ipif is NULL,the if statement in line 8195 returns TRUE, and line 8196 is executed.The ip_extract_tunreq() function then returns to ip_process_ioctl()with error as a return value, which is still set to 0.Source code file uts/common/inet/ip/ip.cFunction ip_process_ioctl()[..]26717 ci.ci_ipif = NULL;[..]26735 case TUN_CMD:Escape from the WWW Zone 31