In line channeld/channeld_wiregen.c:832 `*added+i` is not a tal object hence the instruction in common/htlc_wire.c:200 `tal_arr(ctx, struct tlv_field, 0);` crashes CLN. This is fixed by stating that added_htlc is a a varsize_type. Logs: 2025-08-16T02:25:28.640Z **BROKEN** lightningd: FATAL SIGNAL 6 (version v25.05-200-g79b959b)V ... 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:95 (call_error) 0x54f6bc 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:169 (check_bounds) 0x54f75a 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:178 (to_tal_hdr) 0x54f782 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:193 (to_tal_hdr_or_null) 0x54f7c7 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:471 (tal_alloc_) 0x54ffe4 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/tal/tal.c:517 (tal_alloc_arr_) 0x5500c4 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: common/htlc_wire.c:200 (fromwire_len_and_tlvstream) 0x48d63d 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: common/htlc_wire.c:234 (fromwire_added_htlc) 0x48dd23 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: channeld/channeld_wiregen.c:832 (fromwire_channeld_got_commitsig) 0x4c61fa 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: lightningd/peer_htlcs.c:2377 (peer_got_commitsig) 0x4549cb 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: lightningd/channel_control.c:1552 (channel_msg) 0x4140fe 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: lightningd/subd.c:560 (sd_msg_read) 0x461513 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x544885 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x544cea 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x544d9d 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:455 (io_loop) 0x54665d 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x42d220 2025-08-16T02:25:28.640Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1487 (main) 0x43280f gdb inspection: 830 *added = num_added ? tal_arr(ctx, struct added_htlc, num_added) : NULL; 831 for (size_t i = 0; i < num_added; i++) 832 fromwire_added_htlc(&cursor, &plen, *added + i); (gdb) p i $3 = 1 Changelog-None: crash introduced this release. Signed-off-by: Lagrang3 <lagrang3@protonmail.com> [ Added test, removed Changelog --RR ]
103 lines
3.4 KiB
C
103 lines
3.4 KiB
C
#ifndef LIGHTNING_COMMON_HTLC_WIRE_H
|
|
#define LIGHTNING_COMMON_HTLC_WIRE_H
|
|
#include "config.h"
|
|
#include <bitcoin/preimage.h>
|
|
#include <common/htlc.h>
|
|
#include <common/sphinx.h>
|
|
|
|
struct bitcoin_tx;
|
|
struct shachain;
|
|
|
|
/* These are how we communicate about HTLC state to the master daemon */
|
|
struct added_htlc {
|
|
u64 id;
|
|
struct amount_msat amount;
|
|
struct sha256 payment_hash;
|
|
u32 cltv_expiry;
|
|
u8 onion_routing_packet[TOTAL_PACKET_SIZE(ROUTING_INFO_SIZE)];
|
|
bool fail_immediate;
|
|
struct pubkey *path_key;
|
|
struct tlv_field *extra_tlvs;
|
|
};
|
|
|
|
/* This is how lightningd tells us about HTLCs which already exist at startup */
|
|
struct existing_htlc {
|
|
u64 id;
|
|
enum htlc_state state;
|
|
struct amount_msat amount;
|
|
struct sha256 payment_hash;
|
|
u32 cltv_expiry;
|
|
u8 onion_routing_packet[TOTAL_PACKET_SIZE(ROUTING_INFO_SIZE)];
|
|
/* If this is non-NULL, this is path_key to send with (outgoing) HTLC */
|
|
struct pubkey *path_key;
|
|
/* If fulfilled, this is non-NULL */
|
|
struct preimage *payment_preimage;
|
|
/* If failed, this is set */
|
|
const struct failed_htlc *failed;
|
|
struct tlv_field *extra_tlvs;
|
|
};
|
|
|
|
struct fulfilled_htlc {
|
|
u64 id;
|
|
struct preimage payment_preimage;
|
|
};
|
|
|
|
struct failed_htlc {
|
|
u64 id;
|
|
|
|
/* If this is non-NULL, then the onion was malformed and this is the
|
|
* SHA256 of what we got: send update_fail_malformed_htlc, using
|
|
* failcode. */
|
|
struct sha256 *sha256_of_onion;
|
|
/* WIRE_INVALID_ONION_VERSION, WIRE_INVALID_ONION_KEY or
|
|
* WIRE_INVALID_ONION_HMAC (ie. must have BADONION) */
|
|
enum onion_wire badonion;
|
|
|
|
/* Otherwise, this is the onion ready to send to them. */
|
|
const struct onionreply *onion;
|
|
};
|
|
|
|
struct changed_htlc {
|
|
enum htlc_state newstate;
|
|
u64 id;
|
|
};
|
|
|
|
/* Helper to duplicate an array of tlv_field (vs an array of tlv_field *) */
|
|
struct tlv_field *tlv_field_arr_dup(const tal_t *ctx,
|
|
const struct tlv_field *arr TAKES);
|
|
|
|
struct existing_htlc *new_existing_htlc(const tal_t *ctx,
|
|
u64 id,
|
|
enum htlc_state state,
|
|
struct amount_msat amount,
|
|
const struct sha256 *payment_hash,
|
|
u32 cltv_expiry,
|
|
const u8 onion_routing_packet[TOTAL_PACKET_SIZE(ROUTING_INFO_SIZE)],
|
|
const struct pubkey *path_key TAKES,
|
|
const struct preimage *preimage TAKES,
|
|
const struct failed_htlc *failed TAKES,
|
|
const struct tlv_field *extra_tlvs TAKES);
|
|
|
|
void towire_added_htlc(u8 **pptr, const struct added_htlc *added);
|
|
void towire_existing_htlc(u8 **pptr, const struct existing_htlc *existing);
|
|
void towire_fulfilled_htlc(u8 **pptr, const struct fulfilled_htlc *fulfilled);
|
|
void towire_failed_htlc(u8 **pptr, const struct failed_htlc *failed);
|
|
void towire_changed_htlc(u8 **pptr, const struct changed_htlc *changed);
|
|
void towire_side(u8 **pptr, const enum side side);
|
|
void towire_shachain(u8 **pptr, const struct shachain *shachain);
|
|
|
|
struct added_htlc *fromwire_added_htlc(const tal_t *ctx, const u8 **cursor,
|
|
size_t *max);
|
|
struct existing_htlc *fromwire_existing_htlc(const tal_t *ctx,
|
|
const u8 **cursor, size_t *max);
|
|
void fromwire_fulfilled_htlc(const u8 **cursor, size_t *max,
|
|
struct fulfilled_htlc *fulfilled);
|
|
struct failed_htlc *fromwire_failed_htlc(const tal_t *ctx, const u8 **cursor,
|
|
size_t *max);
|
|
void fromwire_changed_htlc(const u8 **cursor, size_t *max,
|
|
struct changed_htlc *changed);
|
|
enum side fromwire_side(const u8 **cursor, size_t *max);
|
|
void fromwire_shachain(const u8 **cursor, size_t *max,
|
|
struct shachain *shachain);
|
|
#endif /* LIGHTNING_COMMON_HTLC_WIRE_H */
|