vincenzopalazzo
/
rgb-cln
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

chaintopology: fix use-after-free which sometimes causes fatal() in clear_otx_peer 

I've only seen this under travis, so I can't verify that this fixes it,
but it's certainly a bug which could cause that issue.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Rusty Russell 2018-01-09 20:46:21 +10:30 committed by Christian Decker
parent dcb4039a96
commit 795e42d757
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lightningd/chaintopology.c
View File

@ -227,13 +227,15 @@ static void broadcast_done(struct bitcoind *bitcoind,
return;
}
/* No longer needs to be disconnected if peer dies. */
tal_del_destructor2(otx->peer, clear_otx_peer, otx);
if (otx->failed && exitstatus != 0) {
otx->failed(otx->peer, exitstatus, msg);
tal_free(otx);
} else {
/* For continual rebroadcasting, until peer freed. */
tal_steal(otx->peer, otx);
tal_del_destructor2(otx->peer, clear_otx_peer, otx);
list_add_tail(&otx->topo->outgoing_txs, &otx->list);
tal_add_destructor(otx, destroy_outgoing_tx);
}