plugins/pay: fix leak on failed new payments.

Start with attaching the payment to cmd (in case of failure), then steal
onto the plugin itself.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/keysend.c

@@ -113,7 +113,6 @@ static struct command_result *json_keysend(struct command *cmd, const char *buf,
 #if DEVELOPER
 	bool *use_shadow;
 #endif
-	p = payment_new(NULL, cmd, NULL /* No parent */, pay_mods);
 	if (!param(cmd, buf, params,
 		   p_req("destination", param_node_id, &destination),
 		   p_req("msatoshi", param_msat, &msat),
@@ -130,6 +129,7 @@ static struct command_result *json_keysend(struct command *cmd, const char *buf,
 		   NULL))
 		return command_param_failed();
 
+	p = payment_new(cmd, cmd, NULL /* No parent */, pay_mods);
 	p->local_id = &my_id;
 	p->json_buffer = tal_steal(p, buf);
 	p->json_toks = params;
@@ -159,6 +159,8 @@ static struct command_result *json_keysend(struct command *cmd, const char *buf,
 #endif
 	p->label = tal_steal(p, label);
 	payment_start(p);
+	/* We're keeping this around now */
+	tal_steal(cmd->plugin, p);
 	return command_still_pending(cmd);
 }
 

plugins/pay.c

@@ -1960,8 +1960,6 @@ static struct command_result *json_paymod(struct command *cmd,
 	bool *use_shadow;
 #endif
 
-	p = payment_new(NULL, cmd, NULL /* No parent */, paymod_mods);
-
 	/* If any of the modifiers need to add params to the JSON-RPC call we
 	 * would add them to the `param()` call below, and have them be
 	 * initialized directly that way. */
@@ -1982,6 +1980,8 @@ static struct command_result *json_paymod(struct command *cmd,
 		      NULL))
 		return command_param_failed();
 
+	p = payment_new(cmd, cmd, NULL /* No parent */, paymod_mods);
+
 	b11 = bolt11_decode(cmd, b11str, plugin_feature_set(cmd->plugin),
 			    NULL, chainparams, &fail);
 	if (!b11)
@@ -2057,6 +2057,8 @@ static struct command_result *json_paymod(struct command *cmd,
 	p->label = tal_steal(p, label);
 	payment_start(p);
 	list_add_tail(&payments, &p->list);
+	/* We're keeping this around now */
+	tal_steal(cmd->plugin, p);
 
 	return command_still_pending(cmd);
 }