Fix panda: dangling pointer problem in can_receive (#19892)

* refactor can_receive

* still send empty msg

selfdrive/boardd/boardd.cc

@@ -193,11 +193,10 @@ void usb_retry_connect() {
 }
 
 void can_recv(PubMaster &pm) {
-  // create message
-  MessageBuilder msg;
-  auto event = msg.initEvent();
-  panda->can_receive(event);
-  pm.send("can", msg);
+  kj::Array<capnp::word> can_data;
+  panda->can_receive(can_data);
+  auto bytes = can_data.asBytes();
+  pm.send("can", bytes.begin(), bytes.size());
 }
 
 void can_send_thread() {

selfdrive/boardd/panda.cc

@@ -7,6 +7,7 @@
 #include "common/swaglog.h"
 #include "common/gpio.h"
 #include "common/util.h"
+#include "messaging.hpp"
 #include "panda.h"
 
 #ifdef QCOM2
@@ -324,7 +325,7 @@ void Panda::can_send(capnp::List<cereal::CanData>::Reader can_data_list){
   delete[] send;
 }
 
-int Panda::can_receive(cereal::Event::Builder &event){
+int Panda::can_receive(kj::Array<capnp::word>& out_buf) {
   uint32_t data[RECV_SIZE/4];
   int recv = usb_bulk_read(0x81, (unsigned char*)data, RECV_SIZE);
 
@@ -336,7 +337,8 @@ int Panda::can_receive(cereal::Event::Builder &event){
   }
 
   size_t num_msg = recv / 0x10;
-  auto canData = event.initCan(num_msg);
+  MessageBuilder msg;
+  auto canData = msg.initEvent().initCan(num_msg);
 
   // populate message
   for (int i = 0; i < num_msg; i++) {
@@ -353,6 +355,6 @@ int Panda::can_receive(cereal::Event::Builder &event){
     canData[i].setDat(kj::arrayPtr((uint8_t*)&data[i*4+2], len));
     canData[i].setSrc((data[i*4+1] >> 4) & 0xff);
   }
-
+  out_buf = capnp::messageToFlatArray(msg);
   return recv;
 }

selfdrive/boardd/panda.h

@@ -78,6 +78,5 @@ class Panda {
   void set_usb_power_mode(cereal::HealthData::UsbPowerMode power_mode);
   void send_heartbeat();
   void can_send(capnp::List<cereal::CanData>::Reader can_data_list);
-  int can_receive(cereal::Event::Builder &event);
-
+  int can_receive(kj::Array<capnp::word>& out_buf);
 };