What the developer wrote
Authored by Rusty Russell
common: tal_wally_discard()
In several places we were using tal_wally_end(tmpctx), which assumes
that libwally isn't using any of those allocations.
Make an explicit "tal_wally_discard" which asserts that there are no
outstanding libwally allocations.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit adds a new helper function, tal_wally_discard(), to safely clean up temporary memory used by the libwally library. Previously, code used a different cleanup function that assumed libwally had not made any long-lived allocations. The new function explicitly checks that assumption and will crash the program if it is wrong, turning a potential silent memory bug into an obvious failure. It is a defensive hardening change, not a fix for an actively exploitable vulnerability.
Review existing tal_wally_end(tmpctx) call sites and convert appropriate ones to tal_wally_discard() to enforce the temporary-allocation invariant. Monitor CI and runtime for assertion failures after deployment.
Security signals we found
Defensive assertion added to detect unexpected libwally allocation state
Prevents potential use-after-free or double-free from incorrect tal_wally_end(tmpctx) usage
Memory-management hardening in Bitcoin/Lightning cryptographic helper layer
Evidence from the diff
The patch introduces tal_wally_discard() in common/utils.c/.h. It asserts that wally_tal_ctx is active and has no child allocations (tal_first(wally_tal_ctx) == NULL), then frees it. This is intended for call sites that previously used tal_wally_end(tmpctx) when libwally was expected to use only temporary allocations. The change makes the expectation explicit and aborts on violation, preventing accidental freeing of live libwally objects. No call sites are converted in this commit, so the patch is partial.
Changed components
common/utils.ccommon/utils.hlibwally integration / tal memory wrapperInspect captured patch +10 / −0
diff --git a/common/utils.c b/common/utils.c
index e467c19d..053e09a7 100644
--- a/common/utils.c
+++ b/common/utils.c
@@ -33,6 +33,13 @@ void tal_wally_start(void)
wally_tal_ctx = tal_arr(NULL, char, 0);
}
+void tal_wally_discard(void)
+{
+ assert(wally_tal_ctx);
+ assert(tal_first(wally_tal_ctx) == NULL);
+ wally_tal_ctx = tal_free(wally_tal_ctx);
+}
+
void tal_wally_end(const tal_t *parent)
{
tal_t *p;
diff --git a/common/utils.h b/common/utils.h
index a4f3ed97..550748b2 100644
--- a/common/utils.h
+++ b/common/utils.h
@@ -145,6 +145,9 @@ void tal_wally_end_onto_(const tal_t *parent,
tal_t *from_wally,
const char *from_wally_name);
+/* ... or this if libwally only used temporary allocations. */
+void tal_wally_discard(void);
+
/* Define sha256_eq. */
STRUCTEQ_DEF(sha256, 0, u);
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.