common: assert that they don't call setup_tmpctx() twice.
What the developer wrote
Authored by Rusty Russell
common: assert that they don't call setup_tmpctx() twice.
Otherwise, leaks will occur. And fix up dualopend and devtool/route,
which do this!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit adds a safety check to prevent a temporary memory context from being created twice, which would leak memory. It also fixes two places in the code that were accidentally doing so. The change is defensive and improves reliability, but it does not appear to be a directly exploitable security vulnerability.
Treat as a routine code-quality and robustness improvement. Review whether any other daemons or tools also call common_setup() and then setup_tmpctx()/setup_locale() separately, and ensure CI or static analysis catches duplicate tmpctx initialization.
Security signals we found
Memory leak prevention via assertion on global tmpctx initialization
Removal of duplicate tmpctx setup in devtools/route.c
Replacement of common_setup() with setup_locale() in openingd/dualopend.c to avoid double tmpctx creation
No explicit security framing by the vendor
Evidence from the diff
The commit inserts an assertion in setup_tmpctx() that fails if tmpctx is already initialized, preventing repeated allocations that would leak memory. It then removes duplicate setup_tmpctx()/setup_locale() calls from devtools/route.c and replaces common_setup() with setup_locale() in openingd/dualopend.c, because common_setup() itself calls setup_tmpctx(). The patch is a correctness and leak-prevention fix rather than a patch for an active exploit path.
Changed components
common/utils.cdevtools/route.copeningd/dualopend.cInspect captured patch +4 / −4
diff --git a/common/utils.c b/common/utils.c
index f51094f4..01047ea5 100644
--- a/common/utils.c
+++ b/common/utils.c
@@ -1,4 +1,5 @@
#include "config.h"
+#include <assert.h>
#include <bitcoin/chainparams.h>
#include <ccan/list/list.h>
#include <ccan/mem/mem.h>
@@ -99,6 +100,8 @@ void setup_locale(void)
/* Initial creation of tmpctx. */
void setup_tmpctx(void)
{
+ /* Don't call me twice! */
+ assert(!tmpctx);
tmpctx = tal_arr_label(NULL, char, 0, "tmpctx");
}
diff --git a/devtools/route.c b/devtools/route.c
index d13e3cf9..90a7de05 100644
--- a/devtools/route.c
+++ b/devtools/route.c
@@ -28,9 +28,6 @@ static struct route_hop *least_cost(struct gossmap *map,
struct route_hop *path;
struct timemono tstart, tstop;
- setup_locale();
- setup_tmpctx();
-
tstart = time_mono();
dij = dijkstra(tmpctx, map, dst,
sent, riskfactor, route_can_carry,
diff --git a/openingd/dualopend.c b/openingd/dualopend.c
index 9ac43d87..159a418a 100644
--- a/openingd/dualopend.c
+++ b/openingd/dualopend.c
@@ -4334,7 +4334,7 @@ static void fetch_per_commitment_point(u32 point_count,
int main(int argc, char *argv[])
{
- common_setup(argv[0]);
+ setup_locale();
struct pollfd pollfd[2];
struct state *state = tal(NULL, struct state);
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.