OpenCyphal / libcanard / 28606296795

100%

master: 100%

Pull #260

github

Fix RX behavioral defects: reassembly asserts, filter config, callback re-entrancy

Adversarial review of the v5 RX pipeline surfaced several behavioral defects,
each fixed here with a regression test that fails on the pre-fix code:

- rx_subscribe: accumulate filters_dirty instead of overwriting it, so a duplicate
  subscribe (returning the incumbent) can no longer cancel a hardware acceptance
  filter reconfiguration requested by a prior subscribe/unsubscribe/set_node_id.

- rx_session_accept / rx_session_complete_slot: drop the false
  (slot->iface_index == ses->iface_index) assertion. Session interface affinity
  legitimately migrates on a stale&&fresh admission while an in-flight slot at a
  different priority keeps its own affinity, so the assertion aborted on valid
  redundant-interface traffic. Per-slot affinity is still enforced at admission.

- rx_parse: mask the anonymous UAVCAN v0 message data-type-ID to its 2 low bits
  ((can_id>>8)&0x3) per the DroneCAN spec; the upper CAN-ID bits carry a random
  discriminator, not the data-type-ID. rx_filter_for_subscription emits a weak
  filter for v0 messages with data-type-ID <= 3 so anonymous frames are admitted
  by hardware, keeping one filter entry per subscription.

- rx_session_update: do not dereference the session after dispatching on_message
  (it may unsubscribe and free the session -> use-after-free). Documented that a
  callback may unsubscribe itself but must not otherwise reenter the library.

- canard_new: mark filters dirty when filter_count > 0 so the forced occupancy
  filters are programmed on the first poll even before any subscription.

- Forced Heartbeat/NodeStatus occupancy dedup now uses a filter-coverage (subset)
  test (rx_filter_covered) instead of a single representative-frame probe, which
  could be aliased by a subscription filter and silently suppress the occupancy
  filter for some priorities/sources.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

217 of 217 branches covered (100.0%)

Branch coverage included in aggregate %.

21 of 21 new or added lines in 1 file covered. (100.0%)

874 of 874 relevant lines covered (100.0%)

14754.18 hits per line