fuzz: fix uninitialized variable in fuzz-handle_onion_message
What the developer wrote
Authored by wqxoxo
fuzz: fix uninitialized variable in fuzz-handle_onion_message
Changelog-Fixed: fuzz: fix build with newer clang.
Fixes: #8683
What changed, and why it matters
This commit fixes a fuzz-test build issue in Core Lightning. A fuzz test is an automated testing tool, not the live Lightning node software. The change moves a variable declaration and initializes it to NULL so newer versions of the Clang compiler no longer complain about a potentially uninitialized variable when the test's error-recovery path is taken. It does not appear to fix a vulnerability in production code.
No urgent action needed for node operators. Developers should ensure fuzz targets compile cleanly with current Clang. Consider reviewing whether the cleanup path uses `daemon` safely after the change.
Security signals we found
Uninitialized local variable in fuzz harness
Compiler warning treated as error in newer Clang
No production code path affected
Fix is in tests/fuzz/ directory only
Evidence from the diff
In tests/fuzz/fuzz-handle_onion_message.c, the daemon pointer was declared after a setjmp(fuzz_env) call. If longjmp back to that point occurred, the compiler could consider daemon uninitialized when control reached the cleanup: label. The patch moves the declaration above the setjmp and initializes daemon = NULL, silencing the warning and making cleanup safe. The Changelog labels this as a build fix for newer Clang.
Changed components
tests/fuzz/fuzz-handle_onion_message.cInspect captured patch +4 / −4
diff --git a/tests/fuzz/fuzz-handle_onion_message.c b/tests/fuzz/fuzz-handle_onion_message.c
index 0bc4b308..d4a902d8 100644
--- a/tests/fuzz/fuzz-handle_onion_message.c
+++ b/tests/fuzz/fuzz-handle_onion_message.c
@@ -75,13 +75,13 @@ void init(int *argc, char ***argv)
void run(const uint8_t *data, size_t size)
{
- if (setjmp(fuzz_env) != 0)
- goto cleanup;
-
- struct daemon *daemon;
+ struct daemon *daemon = NULL;
struct peer *peer;
struct pubkey dummy_key;
+ if (setjmp(fuzz_env) != 0)
+ goto cleanup;
+
memset(&dummy_key, 'c', sizeof(dummy_key));
daemon = new_daemon(tmpctx);
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.