What the developer wrote
Authored by ziggie
routerrpc: fix payment address deep copy
using copy for a slice of size 0 will not copy anything so we need
to first initialize the slice before we do the deep copy.
What changed, and why it matters
This commit fixes a bug in LND's router RPC code where a payment address was not being properly copied before use. The original code called `copy()` on a slice that had not been created yet, so nothing was actually copied. As a result, the payment address could be left empty when it should have contained a required 32-byte value. This could cause payment probes or related routing operations to behave incorrectly, potentially leading to failed payments or unexpected routing behavior.
Treat as a bug fix with possible security implications. Review whether the missing payment address could be exploited to probe routes without proper payment constraints, or whether it could lead to privacy or payment-integrity issues. Apply the patch and consider adding regression tests that assert the payment address is preserved through probe request construction.
Security signals we found
Silent data loss: a 32-byte payment address was not copied due to uninitialized destination slice
Payment address omission could affect route probing or payment handling
Fix pattern is allocation-before-copy, a common Go deep-copy mistake
No explicit security claim in commit message or diff
Evidence from the diff
In lnrpc/routerrpc/router_server.go, the probePaymentRequest function handles optional payment addresses. The original code used copy(probeRequest.PaymentAddr, addr[:]) without first allocating the destination slice. In Go, copy to a nil or zero-length slice copies zero bytes, so the payment address was silently dropped. The same pattern occurred when copying from probeRequest.PaymentAddr to lspProbeRequest.PaymentAddr. The patch adds make([]byte, lntypes.HashSize) before each copy call to ensure the destination slice is properly allocated. This is a correctness fix for data propagation in payment probing logic.
Changed components
lnrpc/routerrpc/router_server.goprobePaymentRequest functionPaymentAddr slice handling in LSP probe request constructionInspect captured patch +5 / −0
diff --git a/lnrpc/routerrpc/router_server.go b/lnrpc/routerrpc/router_server.go
index db04526..27cd858 100644
--- a/lnrpc/routerrpc/router_server.go
+++ b/lnrpc/routerrpc/router_server.go
@@ -557,6 +557,7 @@ func (s *Server) probePaymentRequest(ctx context.Context, paymentRequest string,
// If the payment addresses is specified, then we'll also populate that
// now as well.
payReq.PaymentAddr.WhenSome(func(addr [32]byte) {
+ probeRequest.PaymentAddr = make([]byte, lntypes.HashSize)
copy(probeRequest.PaymentAddr, addr[:])
})
@@ -624,6 +625,10 @@ func (s *Server) probePaymentRequest(ctx context.Context, paymentRequest string,
// Copy the payment address if present.
if len(probeRequest.PaymentAddr) > 0 {
+ lspProbeRequest.PaymentAddr = make(
+ []byte, lntypes.HashSize,
+ )
+
copy(
lspProbeRequest.PaymentAddr,
probeRequest.PaymentAddr,
Why this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.