plugins/pay: don't crash if erring index is past route array end.
What the developer wrote
Authored by Rusty Russell
plugins/pay: don't crash if erring index is past route array end.
I assume this happens with multi-hop routehints?
```
1768169599027 2026-01-11T22:13:19.027Z pay: plugins/libplugin-pay.c:1199: payment_result_infer: Assertion `i <= len' failed.
1768169599027 2026-01-11T22:13:19.027Z pay: FATAL SIGNAL 6 (version 25.12)
1768169599036 2026-01-11T22:13:19.036Z 0x5562816bcaa4 send_backtrace
1768169599036 2026-01-11T22:13:19.036Z common/daemon.c:38
1768169599036 2026-01-11T22:13:19.036Z 0x5562816bcb40 crashdump
1768169599036 2026-01-11T22:13:19.036Z common/daemon.c:83
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca29d32f ???
1768169599036 2026-01-11T22:13:19.036Z ???:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca2f6b2c ???
1768169599036 2026-01-11T22:13:19.036Z pthread_kill+0x11c:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca29d27d ???
1768169599036 2026-01-11T22:13:19.036Z gsignal+0x1d:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca2808fe ???
1768169599036 2026-01-11T22:13:19.036Z abort+0xde:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca28081a ???
1768169599036 2026-01-11T22:13:19.036Z ???:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca293516 ???
1768169599036 2026-01-11T22:13:19.036Z __assert_fail+0x46:0
1768169599037 2026-01-11T22:13:19.037Z 0x5562816ae9f6 payment_result_infer
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin-pay.c:1199
1768169599037 2026-01-11T22:13:19.037Z 0x5562816b4acd payment_waitsendpay_finished
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin-pay.c:1653
1768169599037 2026-01-11T22:13:19.037Z 0x5562816aca60 handle_rpc_reply
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:1062
1768169599037 2026-01-11T22:13:19.037Z 0x5562816acc86 rpc_conn_read_response
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:1377
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f0e87 next_plan
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:60
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f1358 do_plan
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:422
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f1415 io_ready
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:439
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f2e23 io_loop
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/poll.c:470
1768169599037 2026-01-11T22:13:19.037Z 0x5562816ae114 plugin_main
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:2429
1768169599037 2026-01-11T22:13:19.037Z 0x5562816a894c main
1768169599037 2026-01-11T22:13:19.037Z plugins/pay.c:1581
1768169599037 2026-01-11T22:13:19.037Z 0x7f5fca2821c9 ???
1768169599037 2026-01-11T22:13:19.037Z ???:0
1768169599037 2026-01-11T22:13:19.037Z 0x7f5fca28228a ???
1768169599037 2026-01-11T22:13:19.037Z __libc_start_main+0x8a:0
1768169599037 2026-01-11T22:13:19.037Z 0x5562816a4eb4 ???
1768169599037 2026-01-11T22:13:19.037Z _start+0x24:0
1768169599037 2026-01-11T22:13:19.037Z 0xffffffffffffffff ???
1768169599037 2026-01-11T22:13:19.037Z ???:0
1768169599136 2026-01-11T22:13:19.136Z 2026-01-11T22:13:19.136Z INFO plugin-pay: Killing plugin: exited during normal operation
69599136 2026-01-11T22:13:19.136Z 2026-01-11T22:13:19.136Z **BROKEN** plugin-pay: Plugin marked as important, shutting down lightningd!
```
Reported-by: michael1011
Fixes: https://github.com/ElementsProject/lightning/issues/8828
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: plugins: `pay` can crash on errors returned from deep inside routehints.
What changed, and why it matters
This commit fixes a crash in Core Lightning's `pay` plugin. When processing a payment failure, the plugin assumed that the reported error location was always within the known payment route. In some cases—likely involving multi-hop route hints—the reported index could be larger than the route array, causing an assertion failure that killed the plugin and, because the plugin is marked as important, shut down the entire `lightningd` node. The fix replaces the crash with a safe early return.
Apply the patch. Because the crash can be triggered by a payment failure response, operators should upgrade nodes that process untrusted payments. Consider reviewing other assertion-based bounds checks in plugin error paths for similar assumptions.
Security signals we found
Denial-of-service vector: remote-triggered assertion failure in important plugin
Crash in payment error-handling path
Out-of-bounds index validation hardened from assert to runtime check
Plugin marked important; crash causes `lightningd` shutdown
Evidence from the diff
In plugins/libplugin-pay.c, payment_result_infer() previously used assert(i <= len) to validate r->erring_index against tal_count(route). The commit changes this to a runtime check: if i > len, the function returns early. This prevents an abort when an error index points past the end of the route array, which the author hypothesizes may occur with multi-hop routehints. The rest of the function then safely dereferences route[i-1] and route[i] only when the index is in bounds.
Changed components
plugins/libplugin-pay.cpayment_result_infer()pay pluginInspect captured patch +5 / −2
diff --git a/plugins/libplugin-pay.c b/plugins/libplugin-pay.c
index 2792bc1b..a1895605 100644
--- a/plugins/libplugin-pay.c
+++ b/plugins/libplugin-pay.c
@@ -1196,12 +1196,15 @@ static void payment_result_infer(struct route_hop *route,
len = tal_count(route);
i = *r->erring_index;
- assert(i <= len);
+ /* This can actually be greater than the route length? Perhaps
+ * multi-hop routehints? Ignore. */
+ if (i > len)
+ return;
if (r->erring_node == NULL)
r->erring_node = &route[i-1].node_id;
- /* The above assert was enough for the erring_node, but might be off
+ /* The above check was enough for the erring_node, but might be off
* by one on channel and direction, in case the destination failed on
* us. */
if (i == len)
Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.