channeld: initialize tx_sigs_allowed on startup
What the developer wrote
Authored by Erick Cestari
channeld: initialize tx_sigs_allowed on startup
peer->tx_sigs_allowed was only set in peer_reconnect() and when we
receive channel_ready, so on a fresh channeld start a stray
tx_signatures arriving before the peer's channel_ready made
handle_unexpected_tx_sigs() read an uninitialized bool. UBSan flags
this as a load of an invalid bool value, and in normal builds the
"warn and disconnect" branch was effectively taken at random.
Default it to false: we only allow an unexpected tx_signatures when
reconnecting.
Changelog-None
What changed, and why it matters
This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program would read an uninitialized value. In practice this usually caused a random, harmless disconnection, but under undefined-behavior detection it was flagged as a serious bug. The fix simply sets the value to false at startup.
Apply the patch. It is a one-line initialization fix with low risk and removes undefined behavior on a network-triggered path. Consider running UBSan/ASan builds in CI against protocol fuzzers to catch similar uninitialized-field issues.
Security signals we found
use of uninitialized variable
undefined behavior (invalid bool load)
network-triggered code path
peer-to-peer protocol state machine issue
randomized branch outcome in production builds
Evidence from the diff
peer->tx_sigs_allowed is a boolean that gates whether handle_unexpected_tx_sigs() tolerates an unsolicited tx_signatures message. It was previously assigned only in peer_reconnect() and on receipt of channel_ready, leaving it uninitialized on a fresh channeld startup. A stray tx_signatures message arriving before channel_ready could therefore read an uninitialized bool. UBSan reports this as loading an invalid bool value; in normal builds the branch outcome was effectively random. The patch initializes the field to false in main(), so unexpected signatures are rejected except during reconnection, matching the intended policy.
Changed components
channeld/channeld.chandle_unexpected_tx_sigs()peer_reconnect()channel_ready handlingInspect captured patch +1 / −0
### channeld/channeld.c
@@ -7032,6 +7032,7 @@ int main(int argc, char *argv[])
peer->commit_timer = NULL;
peer->from_master = msg_queue_new(peer, true);
peer->shutdown_sent[LOCAL] = false;
+ peer->tx_sigs_allowed = false;
peer->shutdown_wrong_funding = NULL;
peer->last_update_timestamp = 0;
peer->last_empty_commitment = 0;Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.