From 2ac775f9f4343338a0782a07d446920582f576b8 Mon Sep 17 00:00:00 2001
From: Rusty Russell <rusty@rustcorp.com.au>
Date: Thu, 8 Sep 2022 10:26:31 +0930
Subject: [PATCH] lightningd: fix crash with -O3 -flto.

It's foolish to ban passing NULL, 0 to memcpy, memset et al, but
it's been done.  At high level of optimization, GCC assumes this doesn't
happen, and yep, assumes "if (ctx)" inside tal_free() must be true.

So when a psbt is NULL, and psbt_get_bytes returns NULL, a crash ensues:

```
lightningd: FATAL SIGNAL 6 (version v0.12.0rc2-6-g47efa5d-modded)
0x5557dfc42fef send_backtrace
	common/daemon.c:33
0x5557dfc42fef crashdump
	common/daemon.c:46
0x7fe93ef5851f ???
	./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fe93efaca7c __pthread_kill_implementation
	./nptl/pthread_kill.c:44
0x7fe93efaca7c __pthread_kill_internal
	./nptl/pthread_kill.c:78
0x7fe93efaca7c __GI___pthread_kill
	./nptl/pthread_kill.c:89
0x7fe93ef58475 __GI_raise
	../sysdeps/posix/raise.c:26
0x7fe93ef3e7f2 __GI_abort
	./stdlib/abort.c:79
0x5557dfbb0c28 call_error
	ccan/ccan/tal/tal.c:93
0x5557dfbb0c34 check_bounds
	ccan/ccan/tal/tal.c:165
0x5557dfbb0c34 to_tal_hdr
	ccan/ccan/tal/tal.c:178
0x5557dfc7a1d3 tal_free
	ccan/ccan/tal/tal.c:482
0x5557dfc609d3 tal_free
	ccan/ccan/tal/tal.c:477
0x5557dfc609d3 towire_wally_psbt
	bitcoin/psbt.c:743
0x5557dfbc5dfc towire_dualopend_got_offer_reply
	openingd/dualopend_wiregen.c:358
0x5557dfbc5dfc openchannel2_hook_cb
	lightningd/dual_open_control.c:671
0x5557dfc22f4f plugin_hook_callback
	lightningd/plugin_hook.c:210
0x5557dfc1dfbe plugin_response_handle
	lightningd/plugin.c:591
0x5557dfc1dfbe plugin_read_json_one
	lightningd/plugin.c:702
0x5557dfc1dfbe plugin_read_json
	lightningd/plugin.c:747
0x5557dfc71756 next_plan
	ccan/ccan/io/io.c:59
0x5557dfc775d5 io_ready
	ccan/ccan/io/io.c:417
0x5557dfc775d5 io_loop
	ccan/ccan/io/poll.c:453
0x5557dfbdb1ce io_loop
	ccan/ccan/io/poll.c:380
0x5557dfbdb1ce io_loop_with_timers
	lightningd/io_loop_with_timers.c:22
0x5557dfbb37d1 main
	lightningd/lightningd.c:1195
0x7fe93ef3fd8f __libc_start_call_main
	../sysdeps/nptl/libc_start_call_main.h:58
0x7fe93ef3fe3f __libc_start_main_impl
	../csu/libc-start.c:392
0x5557dfbb6e84 ???
	???:0
0xffffffffffffffff ???
	???:0
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
---
 wire/towire.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/wire/towire.c b/wire/towire.c
index 6b104dd60..c4bfc6447 100644
--- a/wire/towire.c
+++ b/wire/towire.c
@@ -11,7 +11,9 @@ void towire(u8 **pptr, const void *data, size_t len)
 	size_t oldsize = tal_count(*pptr);
 
 	tal_resize(pptr, oldsize + len);
-	memcpy(*pptr + oldsize, memcheck(data, len), len);
+	/* The C standards committee has a lot to answer for :( */
+	if (len)
+		memcpy(*pptr + oldsize, memcheck(data, len), len);
 }
 
 void towire_u8(u8 **pptr, u8 v)