plugin: fix feature_set allocation
What the developer wrote
Authored by Peter Neuroth
plugin: fix feature_set allocation
Using `tal_dup_or_null` does not set the tal context to the included
bytes array. Luckily we already have a function tha deeply duplicates
a `feature_set`: `feature_set_dup`
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
What changed, and why it matters
This commit fixes a memory-management bug in Core Lightning's plugin handling. The old code used a shallow copy (`tal_dup_or_null`) to duplicate a plugin's feature set, which did not properly copy the underlying byte arrays. The fix switches to `feature_set_dup`, which performs a deep copy. The bug could lead to use-after-free or memory corruption if the original feature set's data was freed while the plugin still held a reference. There is no direct evidence in the commit or supplied references of an exploitable security vulnerability, remote trigger, or disclosed incident.
Treat as a routine bug fix with latent security implications. Review whether the shallow-copy bug was reachable in released versions and whether it could cause crashes or memory corruption. No immediate emergency response is indicated by the commit alone, but backporting the one-line fix to stable branches is reasonable.
Security signals we found
Memory-management bug: shallow copy of struct containing pointer arrays
Potential use-after-free on feature bit byte arrays
Fix uses existing deep-copy helper `feature_set_dup`
No vendor security framing, CVE, or advisory referenced in commit
Evidence from the diff
In lightningd/plugin.c, plugin_parse_getmanifest_response previously assigned plugin->fset = tal_dup_or_null(plugin, struct feature_set, fset). tal_dup_or_null copies only the struct feature_set itself, not the separately allocated u8 * arrays inside it. The replacement feature_set_dup(plugin, fset) creates a deep copy with correct tal parents. This resolves a potential use-after-free / dangling-pointer situation when the original fset context is freed. The commit message frames this as a bug fix, not a security fix, and no CVE, advisory, or researcher attribution is present.
Changed components
lightningd/plugin.cplugin feature set handling during getmanifest response parsingInspect captured patch +1 / −1
diff --git a/lightningd/plugin.c b/lightningd/plugin.c
index 5d031e73..42718c27 100644
--- a/lightningd/plugin.c
+++ b/lightningd/plugin.c
@@ -1821,7 +1821,7 @@ static const char *plugin_parse_getmanifest_response(const char *buffer,
}
/* Store fset to allow to remove feature bits when init returns disabled */
- plugin->fset = tal_dup_or_null(plugin, struct feature_set, fset);
+ plugin->fset = feature_set_dup(plugin, fset);
} else {
plugin->fset = NULL;
}
Why this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.