Bug Hunter Diary

19165 * are also rejected as they introduce ambiguity19166 * in the naming of the interfaces.19167 * In order to confirm with existing semantics,19168 * and to not break any programs/script relying19169 * on that behaviour, if:0 is considered to be19170 * a valid interface.19171 *19172 * If alias has two or more digits and the first19173 * is zero, fail.19174 */19175 if (&cp[2] < endp && cp[1] == '0')19176 return (NULL);19177 }[..]In line 19139, the value of error, which holds one of the errorconditions, is explicitly set to 0. Error condition 0 means that noerror has occurred so far. By supplying a colon directly followed byan ASCII zero and an arbitrary digit in the interface name, it is possibleto trigger the code in line 19176, which leads to a return to thecaller function. The problem is that no valid error condition is set forerror before the function returns. So ipif_lookup_on_name() returns toip_extract_tunreq() with error still set to 0.Source code file uts/common/inet/ip/ip_if.cFunction ip_extract_tunreq()[..]8192 ipif = ipif_lookup_on_name(ta->ifta_lifr_name,8193 mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,8194 connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);8195 if (ipif == NULL)8196 return (error);[..]Back in ip_extract_tunreq(), the error condition is returned to itscaller function ip_process_ioctl() (see line 8196).Source code file uts/common/inet/ip/ip.cFunction ip_process_ioctl()[..]26735 case TUN_CMD:26736 /*26737 * SIOC[GS]TUNPARAM appear here. ip_extract_tunreq returns26738 * a refheld ipif in ci.ci_ipif26739 */26740 err = ip_extract_tunreq(q, mp, &ci.ci_ipif, ip_process_ioctl);26741 if (err != 0) {26742 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);26743 return;26744 }34 Chapter 3