Skip to content

Commit d202e67

Browse files
rustyrussellrustyrussell
committed
plugins: fix %*.s typo.
And add a check for new uses creeping in, since it got cut & paste everywhere. This means "this is a valid string, but truncate it to this many characters" vs "%.*s" which means "only read this many characters of string": ``` ['lightningd-3 2025-10-23T02:31:40.890Z **BROKEN** plugin-funder: Plugin marked as important, shutting down lightningd!'] --------------------------- Captured stderr teardown --------------------------- #0 0x557da58ad1dc in printf_common(void*, char const*, __va_list_tag*) asan_interceptors.cpp.o #1 0x557da5aff814 in json_out_addv /home/runner/work/lightning/lightning/ccan/ccan/json_out/json_out.c:239:11 #2 0x557da59740ce in plugin_logv /home/runner/work/lightning/lightning/plugins/libplugin.c:1777:2 #3 0x557da5969b6f in plugin_log /home/runner/work/lightning/lightning/plugins/libplugin.c:1934:2 #4 0x557da595c4f6 in datastore_del_success /home/runner/work/lightning/lightning/plugins/funder.c:161:2 #5 0x557da598b837 in handle_rpc_reply /home/runner/work/lightning/lightning/plugins/libplugin.c:1072:10 #6 0x557da598a4b0 in rpc_conn_read_response /home/runner/work/lightning/lightning/plugins/libplugin.c:1361:3 #7 0x557da5adbea5 in next_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:60:9 #8 0x557da5ae06ff in do_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:422:8 #9 0x557da5adfb58 in io_ready /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:439:10 #10 0x557da5aec2ce in io_loop /home/runner/work/lightning/lightning/ccan/ccan/io/poll.c:455:5 #11 0x557da59757ac in plugin_main /home/runner/work/lightning/lightning/plugins/libplugin.c:2409:3 #12 0x557da594fe23 in main /home/runner/work/lightning/lightning/plugins/funder.c:1723:2 #13 0x7f6572229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #14 0x7f6572229e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #15 0x557da588b584 in _start (/home/runner/work/lightning/lightning/plugins/funder+0x10d584) (BuildId: 71ba63ab577fc6fa60573d3e8555f6db7d5c584d) 0x624000009d28 is located 0 bytes to the right of 7208-byte region [0x624000008100,0x624000009d28) allocated by thread T0 here: #0 0x557da590e7f6 in __interceptor_realloc (/home/runner/work/lightning/lightning/plugins/funder+0x1907f6) (BuildId: 71ba63ab577fc6fa60573d3e8555f6db7d5c584d) #1 0x557da5b2149b in tal_resize_ /home/runner/work/lightning/lightning/ccan/ccan/tal/tal.c:755:13 #2 0x557da59f2032 in membuf_tal_resize /home/runner/work/lightning/lightning/common/utils.c:203:2 #3 0x557da5b03934 in membuf_prepare_space_ /home/runner/work/lightning/lightning/ccan/ccan/membuf/membuf.c:45:12 #4 0x557da59d4289 in jsonrpc_io_read_ /home/runner/work/lightning/lightning/common/jsonrpc_io.c:127:2 #5 0x557da598a635 in rpc_conn_read_response /home/runner/work/lightning/lightning/plugins/libplugin.c:1366:9 #6 0x557da5adbea5 in next_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:60:9 #7 0x557da5ae06ff in do_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:422:8 #8 0x557da5adfb58 in io_ready /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:439:10 #9 0x557da5aec2ce in io_loop /home/runner/work/lightning/lightning/ccan/ccan/io/poll.c:455:5 #10 0x557da59757ac in plugin_main /home/runner/work/lightning/lightning/plugins/libplugin.c:2409:3 #11 0x557da594fe23 in main /home/runner/work/lightning/lightning/plugins/funder.c:1723:2 #12 0x7f6572229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-buffer-overflow asan_interceptors.cpp.o in printf_common(void*, char const*, __va_list_tag*) Shadow bytes around the buggy address: 0x0c487fff9350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c487fff9360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c487fff9370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c487fff9380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c487fff9390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c487fff93a0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa 0x0c487fff93b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c487fff93c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c487fff93d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c487fff93e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c487fff93f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==26122==ABORTING ``` Signed-off-by: Rusty Russell <[email protected]>
1 parent 365add0 commit d202e67

File tree

5 files changed

+17
-14
lines changed

5 files changed

+17
-14
lines changed

‎Makefile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -585,6 +585,9 @@ check-tmpctx:
585585
check-discouraged-functions:
586586
@if git grep -E "[^a-z_/](fgets|fputs|gets|scanf|sprintf)\(" -- "*.c" "*.h" ":(exclude)ccan/" ":(exclude)contrib/"; then exit 1; fi
587587

588+
check-bad-sprintf:
589+
@if git grep -n "%[*]\.s"; then exit 1; fi
590+
588591
# Don't access amount_msat and amount_sat members directly without a good reason
589592
# since it risks overflow.
590593
check-amount-access:
@@ -609,7 +612,7 @@ check-doc-examples: update-doc-examples
609612
git diff --exit-code HEAD
610613

611614
# For those without working cppcheck
612-
check-source-no-cppcheck: check-makefile check-source-bolt check-whitespace check-spelling check-python check-includes check-shellcheck check-setup_locale check-tmpctx check-discouraged-functions check-amount-access
615+
check-source-no-cppcheck: check-makefile check-source-bolt check-whitespace check-spelling check-python check-includes check-shellcheck check-setup_locale check-tmpctx check-discouraged-functions check-amount-access check-bad-sprintf
613616

614617
check-source: check-source-no-cppcheck
615618

‎plugins/funder.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ unreserve_done(struct command *aux_cmd,
8080
struct pending_open *open)
8181
{
8282
plugin_log(open->p, LOG_DBG,
83-
"`unreserveinputs` for channel %s completed. %*.s",
83+
"`unreserveinputs` for channel %s completed. %.*s",
8484
fmt_channel_id(tmpctx, &open->channel_id),
8585
json_tok_full_len(result),
8686
json_tok_full(buf, result));
@@ -159,7 +159,7 @@ datastore_del_success(struct command *cmd,
159159
{
160160
/* Cool we deleted some stuff */
161161
plugin_log(cmd->plugin, LOG_DBG,
162-
"`datastore` del succeeded: %*.s",
162+
"`datastore` del succeeded: %.*s",
163163
json_tok_full_len(result),
164164
json_tok_full(buf, result));
165165

@@ -175,7 +175,7 @@ datastore_add_fail(struct command *cmd,
175175
{
176176
/* Oops, something's broken */
177177
plugin_log(cmd->plugin, LOG_BROKEN,
178-
"%s failed: %*.s",
178+
"%s failed: %.*s",
179179
method, json_tok_full_len(error),
180180
json_tok_full(buf, error));
181181

@@ -197,7 +197,7 @@ datastore_add_success(struct command *cmd,
197197

198198
if (err)
199199
plugin_err(cmd->plugin,
200-
"`datastore` payload did not scan. %s: %*.s",
200+
"`datastore` payload did not scan. %s: %.*s",
201201
err, json_tok_full_len(result),
202202
json_tok_full(buf, result));
203203

@@ -266,7 +266,7 @@ signpsbt_done(struct command *cmd,
266266

267267
if (err)
268268
plugin_err(cmd->plugin,
269-
"`signpsbt` payload did not scan %s: %*.s",
269+
"`signpsbt` payload did not scan %s: %.*s",
270270
err, json_tok_full_len(result),
271271
json_tok_full(buf, result));
272272

@@ -594,7 +594,7 @@ listfunds_success(struct command *cmd,
594594
outputs_tok = json_get_member(buf, result, "outputs");
595595
if (!outputs_tok)
596596
plugin_err(cmd->plugin,
597-
"`listfunds` payload has no outputs token: %*.s",
597+
"`listfunds` payload has no outputs token: %.*s",
598598
json_tok_full_len(result),
599599
json_tok_full(buf, result));
600600

@@ -624,7 +624,7 @@ listfunds_success(struct command *cmd,
624624
JSON_SCAN(json_to_number, &utxo->out.n));
625625
if (err)
626626
plugin_err(cmd->plugin,
627-
"`listfunds` payload did not scan. %s: %*.s",
627+
"`listfunds` payload did not scan. %s: %.*s",
628628
err, json_tok_full_len(result),
629629
json_tok_full(buf, result));
630630

@@ -923,7 +923,7 @@ datastore_list_fail(struct command *cmd,
923923

924924
/* Oops, something's broken */
925925
plugin_log(cmd->plugin, LOG_BROKEN,
926-
"`datastore` list failed: %*.s",
926+
"`datastore` list failed: %.*s",
927927
json_tok_full_len(error),
928928
json_tok_full(buf, error));
929929

@@ -965,7 +965,7 @@ datastore_list_success(struct command *cmd,
965965
if (err)
966966
plugin_err(cmd->plugin,
967967
"`listdatastore` payload did"
968-
" not scan. %s: %*.s",
968+
" not scan. %s: %.*s",
969969
err, json_tok_full_len(result),
970970
json_tok_full(buf, result));
971971

‎plugins/spender/multifundchannel.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1450,7 +1450,7 @@ after_getfeerate(struct command *cmd,
14501450
JSON_SCAN(json_to_number, &feerate));
14511451
if (err)
14521452
mfc_fail(mfc, JSONRPC2_INVALID_PARAMS,
1453-
"Unable to parse feerate %s: %*.s",
1453+
"Unable to parse feerate %s: %.*s",
14541454
err, json_tok_full_len(result),
14551455
json_tok_full(buf, result));
14561456

‎plugins/spender/openchannel.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -554,7 +554,7 @@ static struct command_result *json_peer_sigs(struct command *cmd,
554554
JSON_SCAN_TAL(cmd, json_to_psbt, &psbt));
555555
if (err)
556556
plugin_err(cmd->plugin,
557-
"`openchannel_peer_sigs` did not scan: %s. %*.s",
557+
"`openchannel_peer_sigs` did not scan: %s. %.*s",
558558
err, json_tok_full_len(params),
559559
json_tok_full(buf, params));
560560

‎plugins/txprepare.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -522,7 +522,7 @@ static struct command_result *listfunds_done(struct command *cmd,
522522
txp->output_total = AMOUNT_SAT(0);
523523
if (!outputs_tok)
524524
plugin_err(cmd->plugin,
525-
"`listfunds` payload has no outputs token: %*.s",
525+
"`listfunds` payload has no outputs token: %.*s",
526526
json_tok_full_len(result),
527527
json_tok_full(buf, result));
528528

@@ -547,7 +547,7 @@ static struct command_result *listfunds_done(struct command *cmd,
547547
JSON_SCAN(json_to_number, &prev_out.n));
548548
if (err)
549549
plugin_err(cmd->plugin,
550-
"`listfunds` payload did not scan. %s: %*.s",
550+
"`listfunds` payload did not scan. %s: %.*s",
551551
err, json_tok_full_len(result),
552552
json_tok_full(buf, result));
553553

0 commit comments

Comments
 (0)