lightningd: check rpc names collisions with builtin commands - #9416
lightningd: check rpc names collisions with builtin commands#9416Lagrang3 wants to merge 1 commit into
Conversation
We crashed if the name collision happened to be a builtin command. ``` lightningd: FATAL SIGNAL 11 (version v26.06-241-gb35b848-modded) 0x5573cd532b2c send_backtrace common/daemon.c:38 0x5573cd532bb6 crashdump common/daemon.c:83 0x7fe1fd4ccdef ??? ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 0x5573cd4d51a4 plugin_rpcmethod_add lightningd/plugin.c:1396 0x5573cd4d5268 plugin_rpcmethods_add lightningd/plugin.c:1423 0x5573cd4d57ef plugin_parse_getmanifest_response lightningd/plugin.c:1805 0x5573cd4d68db plugin_manifest_cb lightningd/plugin.c:1827 0x5573cd4d2316 plugin_response_handle lightningd/plugin.c:692 0x5573cd4d7443 plugin_read_json lightningd/plugin.c:781 0x5573cd56fd01 next_plan ccan/ccan/io/io.c:60 0x5573cd57018c do_plan ccan/ccan/io/io.c:422 0x5573cd570245 io_ready ccan/ccan/io/io.c:439 0x5573cd571be3 io_loop ccan/ccan/io/poll.c:471 0x5573cd4a5a99 io_loop_with_timers lightningd/io_loop_with_timers.c:22 0x5573cd4d61d1 plugins_init lightningd/plugin.c:2063 0x5573cd4aad6c main lightningd/lightningd.c:1269 0x7fe1fd4b6ca7 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 0x7fe1fd4b6d64 __libc_start_main_impl ../csu/libc-start.c:360 0x5573cd47a120 ??? _start+0x20:0 0xffffffffffffffff ??? ???:0 ``` Changelog-Fixed: lightningd: checks for rpc name collisions with builtin commands before registering plugin Reported-by: Vincenzo Palazzo (Bitcoin Security Council finding 2026-08-11) Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
6268f1d to
0003922
Compare
nGoline
left a comment
There was a problem hiding this comment.
lightningd/jsonrpc.c:1347: the p == NULL branch you're now handling is also reached with no collision at all. command_add() has already inserted command->name into rpc->cmdmap when json_escape_unescape_len() fails, and this path tal_free()s the cmd_and_usage without strmap_del() and before tal_add_destructor2() is set, so the map keeps a freed key and a freed value.
That unescape rejects \uXXXX, which jsmn accepts, so any plugin with a non-ASCII character in an rpcmethod usage/description gets there (pyln avoids it only via ensure_ascii=False). Before this patch it crashed in plugin_rpcmethod_add; with the patch the node boots and the first help segfaults at lightningd/jsonrpc.c:432 in json_add_help_command on cmd->command->depr_start.
cmd->usage = json_escape_unescape_len(cmd, usage, strlen(usage));
if (!cmd->usage) {
strmap_del(&rpc->cmdmap, command->name, NULL);
tal_free(cmd);
return false;
}Verified: without it, a plugin declaring usage "arg Á" kills the node on help; with it, the plugin is rejected, the name is absent from help, and the node stays up.
lightningd/plugin.c:1402 — on that same path the new message says a builtin owns
the name when nothing does. Worth having jsonrpc_command_add() report which failure it was.
We crashed if the name collision happened to be a builtin command.
Changelog-Fixed: lightningd: checks for rpc name collisions with builtin commands before registering plugin