gossip: Do not cleanup broadcast messages

Freeing the messages results in a use-after-free when the next peer
attempts to synchronize.

lightningd/gossip/gossip.c

@@ -177,19 +177,20 @@ static void wake_pkt_out(struct peer *peer)
 static struct io_plan *peer_dump_gossip(struct io_conn *conn, struct peer *peer)
 {
 	struct queued_message *next;
-	next = next_broadcast_message(
+	next = next_broadcast_message(peer->daemon->rstate->broadcasts,
-		peer->daemon->rstate->broadcasts, &peer->broadcast_index);
+				      &peer->broadcast_index);
 
 	if (!next) {
-		new_reltimer(&peer->daemon->timers, peer, time_from_sec(30), wake_pkt_out, peer);
+		new_reltimer(&peer->daemon->timers, peer, time_from_sec(30),
-		/* Going to wake up in pkt_out since we mix time based and message based wakeups */
+			     wake_pkt_out, peer);
+		/* Going to wake up in pkt_out since we mix time based and
+		 * message based wakeups */
 		return io_out_wait(conn, peer, pkt_out, peer);
 	} else {
-		struct io_plan *ret;
+		/* Do not free the message after send, queue_broadcast takes
-		ret = peer_write_message(conn, &peer->pcs, next->payload,
+		 * care of that */
-					 peer_dump_gossip);
+		return peer_write_message(conn, &peer->pcs, next->payload,
-		tal_free(next);
+					  peer_dump_gossip);
-		return ret;
 	}
 }