plugins: remove unused json_buffer / json_toks members from libplugin-pay.
What the developer wrote
Authored by Rusty Russell
plugins: remove unused json_buffer / json_toks members from libplugin-pay.
They were never referenced, and saving the toks is questionable since their
lifetime is not guaranteed to live beyond this call (at least the buffer was
duplicated, but that also assumed it was at the start of the object).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit removes two unused data fields from the payment-handling code in Core Lightning's plugins. The fields stored a copy of the incoming JSON command buffer and a pointer to its parsed tokens, but nothing in the code actually read them. The commit message notes that keeping the parsed token pointer was especially questionable because the tokens could become invalid after the call. This is a code cleanup with no direct security fix; it eliminates a latent risk of future misuse but does not change any active behavior.
No immediate action required. Treat as routine cleanup. If auditing, verify that no other plugin code still references `json_buffer` or `json_toks` on `struct payment`.
Security signals we found
Removal of unused pointer members whose lifetime was not guaranteed
Commit message explicitly calls out questionable lifetime assumptions for stored JSON tokens
No functional change; no active vulnerability is patched
Evidence from the diff
The patch deletes json_buffer and json_toks members from struct payment in plugins/libplugin-pay.h and removes the assignments in plugins/pay.c and plugins/keysend.c. The json_buffer member was a tal_dup_talarr‘d copy of the command buffer; json_toks was a pointer to the params token array owned by the JSON-RPC framework. No code path consumed these members, so the change is purely a refactor. The commit message flags a lifetime concern: jsmntok_t arrays are only valid while the underlying buffer remains unchanged, and the duplicated buffer assumption (that it starts at the object) is fragile. Removing the members prevents any future code from accidentally dereferencing stale tokens.
Changed components
plugins/libplugin-pay.hplugins/pay.cplugins/keysend.cInspect captured patch +0 / −7
diff --git a/plugins/keysend.c b/plugins/keysend.c
index aed5511f..6fdc4f18 100644
--- a/plugins/keysend.c
+++ b/plugins/keysend.c
@@ -221,8 +221,6 @@ static struct command_result *json_keysend(struct command *cmd, const char *buf,
p = payment_new(cmd, cmd, NULL /* No parent */, global_hints, pay_mods);
p->local_id = &my_id;
- p->json_buffer = tal_dup_talarr(p, const char, buf);
- p->json_toks = params;
p->route_destination = tal_steal(p, destination);
p->pay_destination = p->route_destination;
p->payment_secret = NULL;
diff --git a/plugins/libplugin-pay.h b/plugins/libplugin-pay.h
index 4df7d3fc..1498f0fb 100644
--- a/plugins/libplugin-pay.h
+++ b/plugins/libplugin-pay.h
@@ -148,9 +148,6 @@ struct payment {
struct plugin *plugin;
struct node_id *local_id;
- const char *json_buffer;
- const jsmntok_t *json_toks;
-
/* The current phase we are in. */
enum payment_step step;
diff --git a/plugins/pay.c b/plugins/pay.c
index ba1353a5..acb532c3 100644
--- a/plugins/pay.c
+++ b/plugins/pay.c
@@ -1468,8 +1468,6 @@ static struct command_result *json_pay(struct command *cmd,
}
p->local_id = &my_id;
- p->json_buffer = buf;
- p->json_toks = params;
p->why = "Initial attempt";
p->constraints.cltv_budget = *maxdelay;
tal_free(maxdelay);
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.