#24 ip_checksum() segfaults when payload is 0 or 1 bytes

[Anonymous]

The ip_cksum_add() function (called by the exported function "ip_checksum()") has a bug: Duff's device, used here for loop unrolling, assumes at least 1 iteration.
In the case of the length of the payload being 0 or 1 bytes, the number of iterations will be 0. This will cause "cksum += *sp++" 16 times, whereas it should not have been executed at all. Thus, the code will walk off the end of the buffer, and possibly onto another memory page.

The worst is that a segfault will occur. The best is that an incorrect checsksum will be generated. The absolute best is if the 16 bytes of memory following the passed-in buffer are mapped, and zero, then the correct checksum will be generated.

The fix is to add a conditional around the switch() statement such that the cases are not executed unless len > 1.