askrene: fix use-after-free if remove_htlc_min_violations fails.
What the developer wrote
Authored by Rusty Russell
askrene: fix use-after-free if remove_htlc_min_violations fails.
It can only fail on overflow, but if it did, the fail path frees working_ctx
and returns "error_message".
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a rare programming bug in Core Lightning's 'askrene' routing plugin. If a specific internal function failed due to an overflow, the code would free a memory context and then try to use it again on the error-handling path, which is a use-after-free. The patch changes the function to use a longer-lived memory context so the error path is safe. The failure condition is described as only possible on overflow, making real-world exploitation unlikely.
Apply the patch. Review other error paths in askrene to ensure allocations intended to outlive working_ctx use the correct parent context. Consider adding static analysis or fuzzing for overflow-triggered failure paths in the routing plugin.
Security signals we found
use-after-free bug on error path
memory context mismatch between allocation and cleanup
potential dangling pointer returned to caller
overflow-triggered failure path
Evidence from the diff
In plugins/askrene/refine.c, refine_flows() iterates over flows and calls remove_htlc_min_violations() with working_ctx. If that function returns an error_message, the fail path frees working_ctx and returns error_message. However, error_message was allocated on working_ctx, so after the free, the caller receives a dangling pointer. The patch passes ctx instead of working_ctx to remove_htlc_min_violations(), ensuring error_message remains valid after working_ctx is freed. The commit message states this can only fail on overflow.
Changed components
plugins/askrene/refine.crefine_flows()remove_htlc_min_violations()Inspect captured patch +1 / −1
diff --git a/plugins/askrene/refine.c b/plugins/askrene/refine.c
index 79bc26e..64ce322 100644
--- a/plugins/askrene/refine.c
+++ b/plugins/askrene/refine.c
@@ -506,7 +506,7 @@ const char *refine_flows(const tal_t *ctx, struct route_query *rq,
/* htlc_min is not met for this flow */
tal_arr_remove(&flows_index, i);
error_message = remove_htlc_min_violations(
- working_ctx, rq, (*flows)[k]);
+ ctx, rq, (*flows)[k]);
if (error_message)
goto fail;
}
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.