splice-script: wetlog / debuglog fix
What the developer wrote
Authored by Dusty Daemon
splice-script: wetlog / debuglog fix
When using wetlog we might not also have debug log enabled.
What changed, and why it matters
This is a small bug-fix in Core Lightning's splicing plugin. The code previously always tried to write a debug log array into a JSON response, even when no debug log existed. The patch adds a check so the log array is only emitted when a debug log is actually present. The commit message frames this as a fix for a logging inconsistency when using 'wetlog' without 'debug log'. There is no direct evidence in the commit or diff of a security vulnerability.
Treat as a routine bug fix. Review whether a NULL debug_log could have caused crashes, assertion failures, or invalid JSON responses in downstream consumers, but no immediate security action is indicated by the supplied materials.
Security signals we found
NULL pointer guard added around debug log serialization
Potential malformed JSON / empty array emission prevented
No explicit security claim in commit message or diff
Evidence from the diff
In plugins/spender/splice.c, the unreserve_get_result callback unconditionally called json_array_start(response, “log”), debug_log_to_json(response, splice_cmd->debug_log), and json_array_end(response). If splice_cmd->debug_log is NULL, debug_log_to_json would presumably produce an empty or malformed log array. The patch wraps these calls in if (splice_cmd->debug_log). This prevents emitting an empty/malformed ‘log’ field. The commit title/message do not describe a security issue, only a logging fix.
Changed components
plugins/spender/splice.cunreserve_get_result functionsplice command debug log JSON responseInspect captured patch +5 / −3
diff --git a/plugins/spender/splice.c b/plugins/spender/splice.c
index 35098c0c..89705e21 100644
--- a/plugins/spender/splice.c
+++ b/plugins/spender/splice.c
@@ -75,9 +75,11 @@ static struct command_result *unreserve_get_result(struct command *cmd,
&splice_cmd->final_txid);
}
- json_array_start(response, "log");
- debug_log_to_json(response, splice_cmd->debug_log);
- json_array_end(response);
+ if (splice_cmd->debug_log) {
+ json_array_start(response, "log");
+ debug_log_to_json(response, splice_cmd->debug_log);
+ json_array_end(response);
+ }
tal_free(abort_pkg);
return command_finished(cmd, response);
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.