Fix 203 (#204)

pavel-kirienko · web-flow · commit 989124d0b9bd · 2022-10-30T20:58:28.000+02:00
* Fix #203 * Update the changelog
diff --git a/README.md b/README.md
@@ -240,6 +240,10 @@ If you find the examples to be unclear or incorrect, please, open a ticket.
   `CANARD_UAVCAN_SPECIFICATION_VERSION_MAJOR` -> `CANARD_CYPHAL_SPECIFICATION_VERSION_MAJOR`
   `CANARD_UAVCAN_SPECIFICATION_VERSION_MINOR` -> `CANARD_CYPHAL_SPECIFICATION_VERSION_MINOR`
 
+#### v3.0.1
+
+- Remove UB as described in [203](https://github.com/OpenCyphal/libcanard/issues/203).
+
 ### v2.0
 
 - Dedicated transmission queues per redundant CAN interface with depth limits.
diff --git a/libcanard/canard.c b/libcanard/canard.c
@@ -410,7 +410,9 @@ CANARD_PRIVATE TxChain txGenerateMultiFrameChain(CanardInstance* const   ins,
         }
         else
         {
-            out.tail->base.next_in_transfer = &tqi->base;
+            // C std, 6.7.2.1.15: A pointer to a structure object <...> points to its initial member, and vice versa.
+            // Can't just read tqi->base because tqi may be NULL; https://github.com/OpenCyphal/libcanard/issues/203.
+            out.tail->base.next_in_transfer = (CanardTxQueueItem*) tqi;
         }
         out.tail = tqi;
         if (NULL == out.tail)

Original file line number	Diff line number	Diff line change
`@@ -410,7 +410,9 @@ CANARD_PRIVATE TxChain txGenerateMultiFrameChain(CanardInstance* const ins,`
`410`	`410`	`}`
`411`	`411`	`else`
`412`	`412`	`{`
`413`		`- out.tail->base.next_in_transfer = &tqi->base;`
	`413`	`+ // C std, 6.7.2.1.15: A pointer to a structure object <...> points to its initial member, and vice versa.`
	`414`	`+ // Can't just read tqi->base because tqi may be NULL; https://github.com/OpenCyphal/libcanard/issues/203.`
	`415`	`+ out.tail->base.next_in_transfer = (CanardTxQueueItem*) tqi;`
`414`	`416`	`}`
`415`	`417`	`out.tail = tqi;`
`416`	`418`	`if (NULL == out.tail)`