Arslan8 opened a new issue, #20010:
URL: https://github.com/apache/nuttx/issues/20010
### Description / Steps to reproduce the issue
`checksum()` can read from a zero-length input buffer when the carry-over
`odd` flag is set.
The function uses `odd` to track whether the previously processed fragment
ended with an unpaired byte. If a fragment with an odd number of bytes is
processed, `odd` becomes true and is carried into the next `checksum()` call.
If the next fragment has `len == 0`, `odd` is still true, but the function
enters the odd-byte handling path and reads `dataptr[0]` without first checking
that the current fragment contains at least one byte.
A minimal reproduction is:
```c
bool odd = false;
uint16_t sum = 0;
uint8_t first[] = {0xaa, 0xbb, 0xcc};
uint8_t empty[1] = {0};
sum = checksum(sum, first, 3, &odd);
/* odd is now true */
sum = checksum(sum, empty, 0, &odd);
```
The second call has `len == 0` and therefore provides no valid input bytes,
but because `odd == true`, `checksum()` accesses `empty[0]`.
The same condition can occur while checksumming a chain of I/O buffers when
an odd-length fragment is followed by a zero-length fragment.
### On which OS does this issue occur?
[OS: Linux]
### What is the version of your OS?
Ubuntu 24.04
### NuttX Version
master / revision 2b1cf423
### Issue Architecture
[Arch: all]
### Issue Area
[Area: Networking]
### Host information
_No response_
### Verification
- [x] I have verified before submitting the report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
