channel: Fix channel state max value
What the developer wrote
Authored by Dusty Daemon
channel: Fix channel state max value
What changed, and why it matters
This commit corrects a C header file constant called CHANNEL_STATE_MAX so that it points to the last entry in the channel-state list. Previously it pointed to an older, no-longer-last state. This kind of off-by-one bookkeeping bug can cause array overruns or missing state handling in code that uses the constant to size loops or tables, but the diff itself only changes one macro and does not show any actual crash or exploit path.
Review all consumers of CHANNEL_STATE_MAX (state-name arrays, loop bounds, database migration logic, and state-machine assertions) to ensure they now cover every defined state and that no out-of-bounds access existed before this fix. Consider adding a static assertion that CHANNEL_STATE_MAX equals the last enumerator.
Security signals we found
Off-by-one / stale maximum value for an enum used as an array bound
Potential out-of-bounds read/write or missing state handling in state tables
Fix is partial: only the macro is updated; no related array/table changes are shown
Evidence from the diff
In lightningd/channel_state.h the CHANNEL_STATE_MAX macro was updated from CHANNELD_AWAITING_SPLICE to DUALOPEND_OPEN_COMMIT_READY, the actual last enumerator in enum channel_state. Any code that iterates channel_state values 0..CHANNEL_STATE_MAX, indexes state-name tables, or performs bounds checks was using a stale maximum. The patch is a one-line fix; no caller sites are shown, so the concrete failure mode is not visible in the diff.
Changed components
lightningd/channel_state.hAny code depending on CHANNEL_STATE_MAXInspect captured patch +1 / −1
diff --git a/lightningd/channel_state.h b/lightningd/channel_state.h
index 8ef3da3b..26d12d81 100644
--- a/lightningd/channel_state.h
+++ b/lightningd/channel_state.h
@@ -50,7 +50,7 @@ enum channel_state {
DUALOPEND_OPEN_COMMIT_READY,
};
-#define CHANNEL_STATE_MAX CHANNELD_AWAITING_SPLICE
+#define CHANNEL_STATE_MAX DUALOPEND_OPEN_COMMIT_READY
/* These are in the database, so don't renumber them! */
enum state_change {
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.