tests/fuzz/fuzz-open_channel: fix bad local variable access after longjmp
What the developer wrote
Authored by Matt Whitlock
tests/fuzz/fuzz-open_channel: fix bad local variable access after longjmp
You can't access a local variable from a point before it was initialized and
expect it to have the initialized value. Move the setjmp() call to after
run_ctx is initialized so that the tal_free() call at cleanup will see the
correct address and not crash.
Fixes: https://github.com/ElementsProject/lightning/issues/9131
Changelog-None
What changed, and why it matters
This commit fixes a crash bug inside a fuzz test, not in the main Core Lightning software. A fuzz test is an automated testing tool that feeds random data to a program to find crashes. The bug occurred because a safety net (setjmp/longjmp) could jump to cleanup code before a local variable (run_ctx) was initialized, causing the cleanup code to use an invalid memory address and crash. The fix simply moves the safety-net setup to after the variable is initialized. This does not affect real Lightning nodes or their users.
No action required for operators. Developers can merge the fix to keep fuzz tests stable. Treat as a test-quality fix, not a security patch.
Security signals we found
Use of uninitialized local variable in cleanup path
setjmp/longjmp control-flow hazard
Crash-only impact in fuzzing harness
No production code or network-facing change
Evidence from the diff
In tests/fuzz/fuzz-open_channel.c, setjmp(fuzz_env) was called before run_ctx was initialized. If a longjmp back to fuzz_env occurred, the cleanup path would call tal_free(run_ctx), but run_ctx held an indeterminate stack value because its declaration had not yet been reached. The patch moves the setjmp call below the run_ctx initialization so that the cleanup path always sees a valid tal pointer. This is a test-only robustness fix; the production fundee_channel() code is unchanged.
Changed components
tests/fuzz/fuzz-open_channel.cInspect captured patch +3 / −3
### tests/fuzz/fuzz-open_channel.c
@@ -439,14 +439,14 @@ void init(int *argc, char ***argv)
void run(const u8 *data, size_t size)
{
- if (setjmp(fuzz_env) != 0)
- goto cleanup;
-
/* The function under test: fundee_channel(), calls
* clean_tmpctx() mid-run, so create a separate context.
*/
const tal_t *run_ctx = tal(NULL, tal_t);
+ if (setjmp(fuzz_env) != 0)
+ goto cleanup;
+
/* Initialize the global pointers to the fuzz data. */
cursor = &data;
max = &size;Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.