What the developer wrote
Authored by Elle Mouton
autopilot: fix nil map assignment
Use the `clear` call to reset a map on `reset` instead of assigning nil
to the entry.
What changed, and why it matters
This commit fixes three places in the LND (Lightning Network Daemon) code where a map was being reset by assigning it to nil. The fix uses Go's `clear()` function instead, which empties the map while keeping the underlying map object. This is a code-correctness fix that prevents potential runtime panics if the same map variable is later used after a reset callback runs, but it is not a clear-cut exploitable security vulnerability based on the diff alone.
Treat as a routine robustness fix. Review whether any callers of these reset callbacks can trigger the nil-map path in production, and include the patch in the next maintenance release. No urgent security response is indicated by the diff alone.
Security signals we found
nil map assignment replaced with clear()
defensive fix in graph traversal reset callbacks
potential runtime panic avoided in autopilot, discovery, and RPC network info paths
no explicit security framing by vendor
Evidence from the diff
The patch replaces nodes = nil, addresses = nil, a = nil, and allChans = nil with clear(nodes), clear(addresses), clear(a), and clear(allChans) respectively. These assignments occur inside reset callbacks passed to graph traversal helpers. Assigning nil to a map variable that may be shared or reused can cause a panic on subsequent map operations if the callback is invoked and then the outer code continues to use the map. Using clear() preserves the map header so later reads/writes remain safe. The change is defensive and improves robustness, but the diff does not demonstrate a reachable panic path or security boundary being crossed.
Changed components
autopilot/agent.godiscovery/bootstrapper.gorpcserver.goInspect captured patch +4 / −4
diff --git a/autopilot/agent.go b/autopilot/agent.go
index ffb3d38..cbb29f3 100644
--- a/autopilot/agent.go
+++ b/autopilot/agent.go
@@ -644,8 +644,8 @@ func (a *Agent) openChans(ctx context.Context, availableFunds btcutil.Amount,
nodes[nID] = struct{}{}
return nil
}, func() {
- nodes = nil
- addresses = nil
+ clear(nodes)
+ clear(addresses)
}); err != nil {
return fmt.Errorf("unable to get graph nodes: %w", err)
}
diff --git a/discovery/bootstrapper.go b/discovery/bootstrapper.go
index 1b6c981..43e9d5e 100644
--- a/discovery/bootstrapper.go
+++ b/discovery/bootstrapper.go
@@ -249,7 +249,7 @@ func (c *ChannelGraphBootstrapper) SampleNodeAddrs(_ context.Context,
return errFound
}, func() {
- a = nil
+ clear(a)
})
if err != nil && !errors.Is(err, errFound) {
return nil, err
diff --git a/rpcserver.go b/rpcserver.go
index 75a2472..96dee31 100644
--- a/rpcserver.go
+++ b/rpcserver.go
@@ -7284,7 +7284,7 @@ func (r *rpcServer) GetNetworkInfo(ctx context.Context,
totalNetworkCapacity = 0
minChannelSize = math.MaxInt64
maxChannelSize = 0
- allChans = nil
+ clear(allChans)
clear(seenChans)
})
if err != nil {
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.