From d0191cb5ed5665e5b5dc5f16524614b4b780dc36 Mon Sep 17 00:00:00 2001 From: eugene Date: Fri, 30 Jul 2021 11:41:11 -0400 Subject: [PATCH 1/2] rpcserver: validate FinalCltvDelta and CltvLimit for REST Missed this check in PR #5293. --- rpcserver.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rpcserver.go b/rpcserver.go index 92d21cc1b..a15235b92 100644 --- a/rpcserver.go +++ b/rpcserver.go @@ -4339,6 +4339,14 @@ func (r *rpcServer) extractPaymentIntent(rpcPayReq *rpcPaymentRequest) (rpcPayme return payIntent, err } + // Do bounds checking with the block padding. + err = routing.ValidateCLTVLimit( + payIntent.cltvLimit, payIntent.cltvDelta, true, + ) + if err != nil { + return payIntent, err + } + return payIntent, nil } From cbbad3a674bafa9b86b08e6bec7b31a40861244b Mon Sep 17 00:00:00 2001 From: eugene Date: Wed, 11 Aug 2021 15:37:35 -0400 Subject: [PATCH 2/2] docs: update release notes for 0.14 --- docs/release-notes/release-notes-0.14.0.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/release-notes/release-notes-0.14.0.md b/docs/release-notes/release-notes-0.14.0.md index 68d087aee..337cba3be 100644 --- a/docs/release-notes/release-notes-0.14.0.md +++ b/docs/release-notes/release-notes-0.14.0.md @@ -140,6 +140,8 @@ A bug has been fixed that would cause `lnd` to [try to bootstrap using the currnet DNS seeds when in SigNet mode](https://github.com/lightningnetwork/lnd/pull/5564). +[A validation check for sane `CltvLimit` and `FinalCltvDelta` has been added for `REST`-initiated payments.](https://github.com/lightningnetwork/lnd/pull/5591) + ## Documentation The [code contribution guidelines have been updated to mention the new