pay: don't notify using uninitialized hint field.
What the developer wrote
Authored by Rusty Russell
pay: don't notify using uninitialized hint field.
Rather than break the API, use total capacity here.
```
Valgrind error file: valgrind-errors.5880
==5880== Use of uninitialised value of size 8
==5880== at 0x4A390BB: _itoa_word (_itoa.c:183)
==5880== by 0x4A43C9B: __printf_buffer (vfprintf-process-arg.c:155)
==5880== by 0x4A69D90: vsnprintf (vsnprintf.c:96)
==5880== by 0x1875E6: json_out_addv (json_out.c:239)
==5880== by 0x14471E: json_add_primitive_fmt (json_stream.c:170)
==5880== by 0x144BA2: json_add_u64 (json_stream.c:282)
==5880== by 0x145E33: json_add_amount_msat (json_stream.c:619)
==5880== by 0x11DDE2: channel_hint_to_json (channel_hint.c:33)
==5880== by 0x11FE9F: channel_hint_notify_core (libplugin-pay.c:394)
==5880== by 0x11FF7A: channel_hint_notify (libplugin-pay.c:412)
==5880== by 0x1201EA: channel_hints_update (libplugin-pay.c:455)
==5880== by 0x122DAF: handle_intermediate_failure (libplugin-pay.c:1437)
==5880==
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a bug where a payment plugin could accidentally read and report an uninitialized (never-set) capacity value when serializing a disabled channel hint to JSON. The fix makes the plugin report the channel's total capacity instead when the more precise 'estimated capacity' field has not been filled in. It is a correctness/bug-fix change rather than an intentional security vulnerability, though reading uninitialized memory is generally undesirable and could leak stale data or produce incorrect payment decisions.
Apply the patch. It is a low-risk bug fix that removes an uninitialized-memory read in the payment plugin's JSON notification path. No additional hardening is required beyond the patch, but consider initializing all channel_hint fields at allocation time as defense in depth.
Security signals we found
Use of uninitialized struct field (estimated_capacity) in JSON serialization
Valgrind-reported use-of-uninitialized-value in payment plugin notification path
Potential information disclosure or incorrect routing hints from stale stack/register data
API compatibility maintained by reusing existing field name
Evidence from the diff
In plugins/channel_hint.c, channel_hint_to_json() unconditionally serialized hint->estimated_capacity_msat even when hint->enabled was false and hint->estimated_capacity had never been initialized. The patch branches on hint->enabled: if enabled it uses estimated_capacity; otherwise it falls back to hint->capacity. The Valgrind trace shows the uninitialized value being passed through json_add_amount_msat and ultimately into printf formatting. The fix preserves the existing JSON field name to avoid an API break.
Changed components
plugins/channel_hint.cchannel_hint_to_json()libplugin-pay.c channel hint notification/update pathInspect captured patch +8 / −2
diff --git a/plugins/channel_hint.c b/plugins/channel_hint.c
index 4862832d..299c605d 100644
--- a/plugins/channel_hint.c
+++ b/plugins/channel_hint.c
@@ -30,8 +30,14 @@ void channel_hint_to_json(const char *name, const struct channel_hint *hint,
json_object_start(dest, name);
json_add_u32(dest, "timestamp", hint->timestamp);
json_add_short_channel_id_dir(dest, "scid", hint->scid);
- json_add_amount_msat(dest, "estimated_capacity_msat",
- hint->estimated_capacity);
+ /* The estimated_capacity is unset if it's not enabled; use total_capacity */
+ if (hint->enabled) {
+ json_add_amount_msat(dest, "estimated_capacity_msat",
+ hint->estimated_capacity);
+ } else {
+ json_add_amount_msat(dest, "estimated_capacity_msat",
+ hint->capacity);
+ }
json_add_amount_msat(dest, "total_capacity_msat", hint->capacity);
json_add_bool(dest, "enabled", hint->enabled);
json_object_end(dest);
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.