getroutes: don't crash on source==destination
What the developer wrote
Authored by Lagrang3
getroutes: don't crash on source==destination
```
cln-askrene: plugins/askrene/child/child.c:40: final_hop: Assertion `tal_count(hops) > 0' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06-19-g46b039d)
lightningd-1 2026-06-15T12:34:26.296Z DEBUG plugin-cln-askrene: notify msg debug: Final answer has 1 flows
0x55ab65429902 send_backtrace
common/daemon.c:38
0x55ab6542998c crashdump
common/daemon.c:83
0x7fbc84a8bdef ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fbc84ae095c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7fbc84a8bcc1 __GI_raise
../sysdeps/posix/raise.c:26
0x7fbc84a744ab __GI_abort
./stdlib/abort.c:77
0x7fbc84a7441f __assert_fail_base
./assert/assert.c:118
0x55ab6541b60c final_hop
plugins/askrene/child/child.c:40
0x55ab6541b70d fmt_route
plugins/askrene/child/child.c:48
0x55ab6541ba5b convert_flows_to_routes
plugins/askrene/child/child.c:135
0x55ab6541c037 run_child
plugins/askrene/child/child.c:265
0x55ab65416caa do_getroutes
plugins/askrene/askrene.c:711
0x55ab65416d28 begin_request
plugins/askrene/askrene.c:887
0x55ab654170a2 json_getroutes
plugins/askrene/askrene.c:968
0x55ab654285ec ld_command_handle
plugins/libplugin.c:2206
0x55ab654287f6 ld_read_json
plugins/libplugin.c:2282
0x55ab65439261 next_plan
ccan/ccan/io/io.c:60
0x55ab65439580 do_plan
ccan/ccan/io/io.c:422
0x55ab65439639 io_ready
ccan/ccan/io/io.c:439
0x55ab6543a5fc io_loop
ccan/ccan/io/poll.c:470
0x55ab65428bc4 plugin_main
plugins/libplugin.c:2481
0x55ab65417491 main
plugins/askrene/askrene.c:1551
0x7fbc84a75ca7 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7fbc84a75d64 __libc_start_main_impl
../csu/libc-start.c:360
0x55ab65413920 ???
_start+0x20:0
0xffffffffffffffff ???
???:0
```
Changelog-Fixed: askrene-getroutes: don't crash on invalid user input, source==destination
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
What changed, and why it matters
This commit fixes a crash in Core Lightning's routing plugin (cln-askrene). When a user called the getroutes command with the same node as both source and destination, the plugin hit an internal assertion and aborted. The fix adds a simple input check that rejects source==destination with a normal RPC error instead of crashing the plugin.
Apply the patch to add the source/destination equality check and enable the regression test. No further immediate action is required; this is a straightforward input-validation hardening fix.
Security signals we found
Denial-of-service via malformed RPC input causing plugin abort
Assertion failure in routing plugin child process
Input validation gap in JSON-RPC command handler
Evidence from the diff
The askrene child process crashed in final_hop() because tal_count(hops) was 0 when source and destination were identical. The patch adds an explicit node_id_eq(source, dest) validation in json_getroutes() before processing, returning JSONRPC2_INVALID_PARAMS. A test that was previously marked as expected-to-fail (xfail) is now enabled, confirming the crash is resolved.
Changed components
plugins/askrene/askrene.cplugins/askrene/child/child.ccln-askrene pluginInspect captured patch +5 / −1
diff --git a/plugins/askrene/askrene.c b/plugins/askrene/askrene.c
index 736054eb..70247c1e 100644
--- a/plugins/askrene/askrene.c
+++ b/plugins/askrene/askrene.c
@@ -943,6 +943,11 @@ static struct command_result *json_getroutes(struct command *cmd,
maxdelay_allowed);
}
+ if (node_id_eq(source, dest)) {
+ return command_fail(cmd, JSONRPC2_INVALID_PARAMS,
+ "source and destination must be different");
+ }
+
if (command_check_only(cmd))
return command_check_done(cmd);
diff --git a/tests/test_askrene.py b/tests/test_askrene.py
index 6d05583f..4474ec32 100644
--- a/tests/test_askrene.py
+++ b/tests/test_askrene.py
@@ -2669,7 +2669,6 @@ def test_impossible_payment(node_factory):
)
-@pytest.mark.xfail(strict=True)
def test_bad_user_entries(node_factory):
"""Test bad user entries that should result in an RPC error and not crash
lightningd."""
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.