splice script: Fix rare memleak in plugin
What the developer wrote
Authored by Dusty Daemon
splice script: Fix rare memleak in plugin
Fix leaking of the `abort_pkg` if our peer does not support splicing.
What changed, and why it matters
This is a one-line memory leak fix in a rarely-used error path of the splicing plugin. When a splice attempt fails because the peer does not support splicing, a small helper object was allocated against the plugin's long-lived context instead of the short-lived command context. That means the memory is not freed until the plugin restarts, rather than when the command finishes. It is a resource-cleanup bug, not a code-execution or funds-loss vulnerability.
No urgent security action. Apply the patch as part of normal maintenance to prevent slow memory growth on nodes that frequently encounter non-splicing peers.
Security signals we found
memory leak in error path
incorrect talloc parent context
plugin resource cleanup issue
Evidence from the diff
In plugins/spender/splice.c, do_fail() creates an abort_pkg using tal(cmd->plugin, struct abort_pkg). Because cmd->plugin outlives the individual RPC command, the package leaks if the command completes before the callback chain finishes cleaning it up. The patch changes the allocation parent to cmd, so the package is freed with the command context. This only triggers when the peer does not support splicing, making it a rare, low-volume leak.
Changed components
plugins/spender/splice.cdo_fail() functionsplicing pluginInspect captured patch +1 / −1
diff --git a/plugins/spender/splice.c b/plugins/spender/splice.c
index 986380dd..a0ca725d 100644
--- a/plugins/spender/splice.c
+++ b/plugins/spender/splice.c
@@ -187,7 +187,7 @@ static struct command_result *do_fail(struct command *cmd,
"splice_error(psbt:%p, splice_cmd:%p, str: %s)",
splice_cmd->psbt, splice_cmd, str ?: "");
- abort_pkg = tal(cmd->plugin, struct abort_pkg);
+ abort_pkg = tal(cmd, struct abort_pkg);
abort_pkg->splice_cmd = tal_steal(abort_pkg, splice_cmd);
abort_pkg->str = tal_strdup(abort_pkg, str);
abort_pkg->code = code;
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.