From 6bb8525e5d233daa9292c14dc2302669c0f49d0a Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Sun, 28 Jul 2019 16:47:44 +0930 Subject: [PATCH] gossipd: fix crash when we prune old, un-updated channel announcements. We added a random channel to the list, but we can just free it immediately (since traversal of a uintmap isn't altered by deletion). This was introduced in d1f43d993a where we explicitly call free_chan rather than relying on destructors. Fixes: #2837 Signed-off-by: Rusty Russell --- gossipd/routing.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/gossipd/routing.c b/gossipd/routing.c index 227d28bd6..01c2dd8ed 100644 --- a/gossipd/routing.c +++ b/gossipd/routing.c @@ -2476,12 +2476,10 @@ void route_prune(struct routing_state *rstate) /* Anything below this highwater mark ought to be pruned */ const s64 highwater = now - rstate->prune_timeout; struct chan **pruned = tal_arr(tmpctx, struct chan *, 0); - struct chan *chan; - struct unupdated_channel *uc; u64 idx; /* Now iterate through all channels and see if it is still alive */ - for (chan = uintmap_first(&rstate->chanmap, &idx); + for (struct chan *chan = uintmap_first(&rstate->chanmap, &idx); chan; chan = uintmap_after(&rstate->chanmap, &idx)) { /* Local-only? Don't prune. */ @@ -2507,11 +2505,12 @@ void route_prune(struct routing_state *rstate) } /* Look for channels we had an announcement for, but no update. */ - for (uc = uintmap_first(&rstate->unupdated_chanmap, &idx); + for (struct unupdated_channel *uc + = uintmap_first(&rstate->unupdated_chanmap, &idx); uc; uc = uintmap_after(&rstate->unupdated_chanmap, &idx)) { if (uc->added.ts.tv_sec < highwater) { - tal_arr_expand(&pruned, chan); + tal_free(uc); } }