aljaz/lightning
1
0
Fork 0
mirror of https://github.com/aljazceru/lightning.git synced 2025-12-19 15:14:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

pay: Fix use-after-free issue with routehints in shortlived payments

Browse Source 
This was triggered by having some part being started after the overall
command already gave up, cleaning up the `cmd` context from which the
routehints were allocated. The early exit of the command, as a result
from a terminal state does not guarantee that no later attempt will
try to find a route, especially if the attempt was started before we
knew that it is doomed.
This commit is contained in:
Christian Decker
2021-05-28 11:53:41 +02:00
committed by Rusty Russell
parent e619bf00fb
commit 05a3be15a3
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/pay.c
View File

@@ -2026,7 +2026,7 @@ static struct command_result *json_paymod(struct command *cmd,
if (!bolt12_has_prefix(b11str)) { if (!bolt12_has_prefix(b11str)) {
b11 = b11 =
bolt11_decode(cmd, b11str, plugin_feature_set(cmd->plugin), bolt11_decode(p, b11str, plugin_feature_set(cmd->plugin),
NULL, chainparams, &b11_fail); NULL, chainparams, &b11_fail);
if (b11 == NULL) if (b11 == NULL)
return command_fail(cmd, JSONRPC2_INVALID_PARAMS, return command_fail(cmd, JSONRPC2_INVALID_PARAMS,
@@ -2054,7 +2054,7 @@ static struct command_result *json_paymod(struct command *cmd,
"Invalid bolt11:" "Invalid bolt11:"
" sets feature var_onion with no secret"); " sets feature var_onion with no secret");
} else { } else {
b12 = invoice_decode(cmd, b11str, strlen(b11str), b12 = invoice_decode(p, b11str, strlen(b11str),
plugin_feature_set(cmd->plugin), plugin_feature_set(cmd->plugin),
chainparams, &b12_fail); chainparams, &b12_fail);
if (b12 == NULL) if (b12 == NULL)