Rusty Russell 9c6430c076 plugins/pay: don't crash if erring index is past route array end. ...

I assume this happens with multi-hop routehints?

```
1768169599027	2026-01-11T22:13:19.027Z	pay: plugins/libplugin-pay.c:1199: payment_result_infer: Assertion `i <= len' failed.
1768169599027	2026-01-11T22:13:19.027Z	pay: FATAL SIGNAL 6 (version 25.12)
1768169599036	2026-01-11T22:13:19.036Z	0x5562816bcaa4 send_backtrace
1768169599036	2026-01-11T22:13:19.036Z		common/daemon.c:38
1768169599036	2026-01-11T22:13:19.036Z	0x5562816bcb40 crashdump
1768169599036	2026-01-11T22:13:19.036Z		common/daemon.c:83
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca29d32f ???
1768169599036	2026-01-11T22:13:19.036Z		???:0
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca2f6b2c ???
1768169599036	2026-01-11T22:13:19.036Z		pthread_kill+0x11c:0
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca29d27d ???
1768169599036	2026-01-11T22:13:19.036Z		gsignal+0x1d:0
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca2808fe ???
1768169599036	2026-01-11T22:13:19.036Z		abort+0xde:0
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca28081a ???
1768169599036	2026-01-11T22:13:19.036Z		???:0
1768169599036	2026-01-11T22:13:19.036Z	0x7f5fca293516 ???
1768169599036	2026-01-11T22:13:19.036Z		__assert_fail+0x46:0
1768169599037	2026-01-11T22:13:19.037Z	0x5562816ae9f6 payment_result_infer
1768169599037	2026-01-11T22:13:19.037Z		plugins/libplugin-pay.c:1199
1768169599037	2026-01-11T22:13:19.037Z	0x5562816b4acd payment_waitsendpay_finished
1768169599037	2026-01-11T22:13:19.037Z		plugins/libplugin-pay.c:1653
1768169599037	2026-01-11T22:13:19.037Z	0x5562816aca60 handle_rpc_reply
1768169599037	2026-01-11T22:13:19.037Z		plugins/libplugin.c:1062
1768169599037	2026-01-11T22:13:19.037Z	0x5562816acc86 rpc_conn_read_response
1768169599037	2026-01-11T22:13:19.037Z		plugins/libplugin.c:1377
1768169599037	2026-01-11T22:13:19.037Z	0x5562816f0e87 next_plan
1768169599037	2026-01-11T22:13:19.037Z		ccan/ccan/io/io.c:60
1768169599037	2026-01-11T22:13:19.037Z	0x5562816f1358 do_plan
1768169599037	2026-01-11T22:13:19.037Z		ccan/ccan/io/io.c:422
1768169599037	2026-01-11T22:13:19.037Z	0x5562816f1415 io_ready
1768169599037	2026-01-11T22:13:19.037Z		ccan/ccan/io/io.c:439
1768169599037	2026-01-11T22:13:19.037Z	0x5562816f2e23 io_loop
1768169599037	2026-01-11T22:13:19.037Z		ccan/ccan/io/poll.c:470
1768169599037	2026-01-11T22:13:19.037Z	0x5562816ae114 plugin_main
1768169599037	2026-01-11T22:13:19.037Z		plugins/libplugin.c:2429
1768169599037	2026-01-11T22:13:19.037Z	0x5562816a894c main
1768169599037	2026-01-11T22:13:19.037Z		plugins/pay.c:1581
1768169599037	2026-01-11T22:13:19.037Z	0x7f5fca2821c9 ???
1768169599037	2026-01-11T22:13:19.037Z		???:0
1768169599037	2026-01-11T22:13:19.037Z	0x7f5fca28228a ???
1768169599037	2026-01-11T22:13:19.037Z		__libc_start_main+0x8a:0
1768169599037	2026-01-11T22:13:19.037Z	0x5562816a4eb4 ???
1768169599037	2026-01-11T22:13:19.037Z		_start+0x24:0
1768169599037	2026-01-11T22:13:19.037Z	0xffffffffffffffff ???
1768169599037	2026-01-11T22:13:19.037Z		???:0
1768169599136	2026-01-11T22:13:19.136Z	2026-01-11T22:13:19.136Z INFO    plugin-pay: Killing plugin: exited during normal operation
69599136	2026-01-11T22:13:19.136Z	2026-01-11T22:13:19.136Z **BROKEN** plugin-pay: Plugin marked as important, shutting down lightningd!
```

Reported-by: michael1011
Fixes: https://github.com/ElementsProject/lightning/issues/8828
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: plugins: `pay` can crash on errors returned from deep inside routehints.

2026-01-14 17:06:02 +10:30

121 KiB

Raw Permalink Blame History

View Raw