Browse Source

chaintopology: fix use-after-free which sometimes causes fatal() in clear_otx_peer

I've only seen this under travis, so I can't verify that this fixes it,
but it's certainly a bug which could cause that issue.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
ppa-0.6.1
Rusty Russell 7 years ago
committed by Christian Decker
parent
commit
795e42d757
  1. 4
      lightningd/chaintopology.c

4
lightningd/chaintopology.c

@ -227,13 +227,15 @@ static void broadcast_done(struct bitcoind *bitcoind,
return; return;
} }
/* No longer needs to be disconnected if peer dies. */
tal_del_destructor2(otx->peer, clear_otx_peer, otx);
if (otx->failed && exitstatus != 0) { if (otx->failed && exitstatus != 0) {
otx->failed(otx->peer, exitstatus, msg); otx->failed(otx->peer, exitstatus, msg);
tal_free(otx); tal_free(otx);
} else { } else {
/* For continual rebroadcasting, until peer freed. */ /* For continual rebroadcasting, until peer freed. */
tal_steal(otx->peer, otx); tal_steal(otx->peer, otx);
tal_del_destructor2(otx->peer, clear_otx_peer, otx);
list_add_tail(&otx->topo->outgoing_txs, &otx->list); list_add_tail(&otx->topo->outgoing_txs, &otx->list);
tal_add_destructor(otx, destroy_outgoing_tx); tal_add_destructor(otx, destroy_outgoing_tx);
} }

Loading…
Cancel
Save