AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 33 Bitcoin

plugins/bcli: use -stdin to feed arguments, in case we have a giant tx.

Public commit record

What the developer wrote

Authored by Rusty Russell

81/100 · Strong
plugins/bcli: use -stdin to feed arguments, in case we have a giant tx.

```
lightningd-1 2025-10-27T11:26:04.285Z **BROKEN** plugin-bcli: bitcoin-cli exec failed: Argument list too long
```

Use -stdin to bitcoin-cli: we can then handle arguments of arbitrary length.

Fixes: https://github.com/ElementsProject/lightning/issues/8634
Changelog-Fixed: plugins: `bcli` would fail with "Argument list too long" when sending a giant tx.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit fixes a bug in Core Lightning's bitcoin-cli plugin (bcli) where very large transactions could make the plugin crash with an 'Argument list too long' error. The fix passes large arguments through standard input instead of the command line, which avoids operating system limits on command-line length. It is a reliability fix rather than a security vulnerability that can be exploited by an attacker.

Recommended action

Treat as a routine reliability fix. No urgent security response is required. Reviewers may want to verify that stdin argument ordering matches bitcoin-cli's expectations and that no secrets are logged by args_string.

Security signals we found

01

Fixes a denial-of-service-like failure condition (plugin crash) triggered by large transaction data

02

Uses -stdin to avoid command-line length limits and potential argument exposure

03

Does not change authentication or authorization logic

04

No memory safety fixes, cryptographic changes, or input validation changes observed

Risk score

Why this scored 33/100

Our methodology →
Potential impact 8/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.