splice-script: Memleak fix on failure
What the developer wrote
Authored by Dusty Daemon
splice-script: Memleak fix on failure
In some splice script failure modes, some memory is leaked.
These don’t occur in normal operation — just when an error occurs.
This cleans up those memory leaks.
What changed, and why it matters
This commit fixes two small memory leaks that occur only when a Bitcoin channel-splicing operation fails. The leaks happen in error-handling paths, not during normal successful operation. There is no indication this can be exploited to attack the node or steal funds; it is a cleanup fix for resource management.
Treat as a routine bug-fix commit. Apply during normal maintenance; no urgent security response is warranted based on the diff alone.
Security signals we found
Memory leak cleanup in error-handling paths
No input validation, parsing, or cryptographic changes
No privilege boundary or remote-triggerable behavior evident from diff
Evidence from the diff
In plugins/spender/splice.c, two error helper functions (splice_error_pkg and splice_signed_error_pkg) previously returned without freeing the struct splice_index_pkg allocated in pkg. The patch adds tal_free(pkg) before returning in both paths, preventing memory leaks on failure branches. The change is defensive and local; no other logic is altered.
Changed components
plugins/spender/splice.csplice_error_pkg functionsplice_signed_error_pkg functionInspect captured patch +7 / −1
diff --git a/plugins/spender/splice.c b/plugins/spender/splice.c
index 89705e21..e5000709 100644
--- a/plugins/spender/splice.c
+++ b/plugins/spender/splice.c
@@ -182,7 +182,11 @@ static struct command_result *splice_error_pkg(struct command *cmd,
const jsmntok_t *error,
struct splice_index_pkg *pkg)
{
- return splice_error(cmd, methodname, buf, error, pkg->splice_cmd);
+ struct command_result *res = splice_error(cmd, methodname, buf, error, pkg->splice_cmd);
+
+ tal_free(pkg);
+
+ return res;
}
static struct command_result *calc_in_ppm_and_fee(struct command *cmd,
@@ -750,6 +754,8 @@ static struct command_result *splice_signed_error_pkg(struct command *cmd,
error->end - error->start);
abort_pkg->code = -1;
+ tal_free(pkg);
+
return make_error(cmd, abort_pkg, "splice_signed_error");
}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.