aljaz/lightning
1
0
Fork 0
mirror of https://github.com/aljazceru/lightning.git synced 2025-12-20 07:34:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

lightningd: fix temporary onion_message leak:

Browse Source 
This is fixed when payload is freed, but I noted a leak in the case of
an invalid payload:

```
E           ValueError: 
E           Node errors:
E           Global errors:
E            - Node /tmp/ltests-ipt6ab_y/test_sendinvoice_1/lightning-2/ has memory leaks: [
E               {
E                   "backtrace": [
E                       "ccan/ccan/tal/tal.c:442 (tal_alloc_)",
E                       "ccan/ccan/tal/tal.c:471 (tal_alloc_arr_)",
E                       "gossipd/gossipd_wiregen.c:925 (fromwire_gossipd_got_onionmsg_to_us)",
E                       "lightningd/onion_message.c:99 (handle_onionmsg_to_us)",
E                       "lightningd/gossip_control.c:166 (gossip_msg)",
E                       "lightningd/subd.c:480 (sd_msg_read)",
E                       "ccan/ccan/io/io.c:59 (next_plan)",
E                       "ccan/ccan/io/io.c:407 (do_plan)",
E                       "ccan/ccan/io/io.c:417 (io_ready)",
E                       "ccan/ccan/io/poll.c:445 (io_loop)",
E                       "lightningd/io_loop_with_timers.c:24 (io_loop_with_timers)",
E                       "lightningd/lightningd.c:1016 (main)"
E                   ],
E                   "label": "gossipd/gossipd_wiregen.c:925:u8[]",
E                   "parents": [
E                       "lightningd/onion_message.c:96:struct onion_message_hook_payload",
E                       "lightningd/plugin_hook.c:87:struct hook_instance *[]"
E                   ],
E                   "value": "0x560779438db8"
E               }
E           ]
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Rusty Russell
2021-01-08 05:19:47 +10:30
parent c08ff167b2
commit 8cf4bd902b
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lightningd/onion_message.c
View File

@@ -92,6 +92,7 @@ void handle_onionmsg_to_us(struct lightningd *ld, const u8 *msg)
struct onion_message_hook_payload *payload; struct onion_message_hook_payload *payload;
u8 *submsg; u8 *submsg;
size_t submsglen; size_t submsglen;
const u8 *subptr;
payload = tal(ld, struct onion_message_hook_payload); payload = tal(ld, struct onion_message_hook_payload);
payload->om = tlv_onionmsg_payload_new(payload); payload->om = tlv_onionmsg_payload_new(payload);
@@ -106,12 +107,15 @@ void handle_onionmsg_to_us(struct lightningd *ld, const u8 *msg)
return; return;
} }
submsglen = tal_bytelen(submsg); submsglen = tal_bytelen(submsg);
if (!fromwire_onionmsg_payload(cast_const2(const u8 **, &submsg), subptr = submsg;
if (!fromwire_onionmsg_payload(&subptr,
&submsglen, payload->om)) { &submsglen, payload->om)) {
tal_free(payload);
log_broken(ld->log, "bad got_onionmsg_tous om: %s", log_broken(ld->log, "bad got_onionmsg_tous om: %s",
tal_hex(tmpctx, msg)); tal_hex(tmpctx, msg));
return; return;
} }
tal_free(submsg);
if (payload->reply_path && !payload->reply_blinding) { if (payload->reply_path && !payload->reply_blinding) {
log_broken(ld->log, log_broken(ld->log,