aljaz/lightning
1
0
Fork 0
mirror of https://github.com/aljazceru/lightning.git synced 2026-01-06 07:34:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

peer_control: Fix a use-after-free bug. (#1237)

Browse Source 
This bug is a classic case of being lazy:
1. peer_accept_channel() allocated its return off the input message,
   rather than taking an explicit allocation context.  This concealed the
   lifetime nature of the return.
2. The context for sanitize_error was the error itself, rather than the
   more obvious tmpctx (connect_failed does not take).

The global tmpctx removes the "efficiency" excuse for grabbing a random
object to use as context, and is also nice and explicit.

All-the-hard-work-by: @ZmnSCPxj
This commit is contained in:
ZmnSCPxj, ZmnSCPxj jxPCSmnZ
2018-03-19 17:27:09 +08:00
committed by Rusty Russell
parent e56eee50c8
commit 044705a547
4 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lightningd/opening_control.h
View File

@@ -16,9 +16,10 @@ void json_add_uncommitted_channel(struct json_result *response,
/* Peer has spontaneously exited from gossip due to open msg. Return
* NULL if we took over, otherwise hand back to gossipd with this
* error.
* error (allocated off @ctx).
*/
u8 *peer_accept_channel(struct lightningd *ld,
u8 *peer_accept_channel(const tal_t *ctx,
struct lightningd *ld,
const struct pubkey *peer_id,
const struct wireaddr *addr,
const struct crypto_state *cs,