Fix 203 (#204)

* Fix #203 * Update the changelog
OpenCyphal · Oct 30, 2022 · 989124d · 989124d
1 parent f85103b
commit 989124d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -240,6 +240,10 @@ If you find the examples to be unclear or incorrect, please, open a ticket.
   `CANARD_UAVCAN_SPECIFICATION_VERSION_MAJOR` -> `CANARD_CYPHAL_SPECIFICATION_VERSION_MAJOR`
   `CANARD_UAVCAN_SPECIFICATION_VERSION_MINOR` -> `CANARD_CYPHAL_SPECIFICATION_VERSION_MINOR`
 
+#### v3.0.1
+
+- Remove UB as described in [203](https://github.com/OpenCyphal/libcanard/issues/203).
+
 ### v2.0
 
 - Dedicated transmission queues per redundant CAN interface with depth limits.

diff --git a/libcanard/canard.c b/libcanard/canard.c
@@ -410,7 +410,9 @@ CANARD_PRIVATE TxChain txGenerateMultiFrameChain(CanardInstance* const   ins,
         }
         else
         {
-            out.tail->base.next_in_transfer = &tqi->base;
+            // C std, 6.7.2.1.15: A pointer to a structure object <...> points to its initial member, and vice versa.
+            // Can't just read tqi->base because tqi may be NULL; https://github.com/OpenCyphal/libcanard/issues/203.
+            out.tail->base.next_in_transfer = (CanardTxQueueItem*) tqi;
         }
         out.tail = tqi;
         if (NULL == out.tail)